Add PHP Analyzer Plugin and Composer Lock Data Handling

- Implemented the PhpAnalyzerPlugin to analyze PHP projects.
- Created ComposerLockData class to represent data from composer.lock files.
- Developed ComposerLockReader to load and parse composer.lock files asynchronously.
- Introduced ComposerPackage class to encapsulate package details.
- Added PhpPackage class to represent PHP packages with metadata and evidence.
- Implemented PhpPackageCollector to gather packages from ComposerLockData.
- Created PhpLanguageAnalyzer to perform analysis and emit results.
- Added capability signals for known PHP frameworks and CMS.
- Developed unit tests for the PHP language analyzer and its components.
- Included sample composer.lock and expected output for testing.
- Updated project files for the new PHP analyzer library and tests.

src/Graph/__Tests/StellaOps.Graph.Indexer.Tests/GraphAnalyticsEngineTests.cs

@@ -0,0 +1,27 @@
+using System.Linq;
+using StellaOps.Graph.Indexer.Analytics;
+
+namespace StellaOps.Graph.Indexer.Tests;
+
+public sealed class GraphAnalyticsEngineTests
+{
+    [Fact]
+    public void Compute_IsDeterministic_ForLinearGraph()
+    {
+        var snapshot = GraphAnalyticsTestData.CreateLinearSnapshot();
+        var engine = new GraphAnalyticsEngine(new GraphAnalyticsOptions { MaxPropagationIterations = 5, BetweennessSampleSize = 8 });
+
+        var first = engine.Compute(snapshot);
+        var second = engine.Compute(snapshot);
+
+        Assert.Equal(first.Clusters, second.Clusters);
+        Assert.Equal(first.CentralityScores, second.CentralityScores);
+
+        var mainCluster = first.Clusters.First(c => c.NodeId == snapshot.Nodes[0]["id"]!.GetValue<string>()).ClusterId;
+        Assert.All(first.Clusters.Where(c => c.NodeId != snapshot.Nodes[^1]["id"]!.GetValue<string>()), c => Assert.Equal(mainCluster, c.ClusterId));
+
+        var centralNode = first.CentralityScores.OrderByDescending(c => c.Betweenness).First();
+        Assert.True(centralNode.Betweenness > 0);
+        Assert.True(centralNode.Degree >= 2);
+    }
+}

src/Graph/__Tests/StellaOps.Graph.Indexer.Tests/GraphAnalyticsPipelineTests.cs

@@ -0,0 +1,32 @@
+using System.Collections.Immutable;
+using Microsoft.Extensions.Logging.Abstractions;
+using StellaOps.Graph.Indexer.Analytics;
+
+namespace StellaOps.Graph.Indexer.Tests;
+
+public sealed class GraphAnalyticsPipelineTests
+{
+    [Fact]
+    public async Task RunAsync_WritesClustersAndCentrality()
+    {
+        var snapshot = GraphAnalyticsTestData.CreateLinearSnapshot();
+
+        var provider = new InMemoryGraphSnapshotProvider();
+        provider.Enqueue(snapshot);
+
+        using var metrics = new GraphAnalyticsMetrics();
+        var writer = new InMemoryGraphAnalyticsWriter();
+        var pipeline = new GraphAnalyticsPipeline(
+            new GraphAnalyticsEngine(new GraphAnalyticsOptions()),
+            provider,
+            writer,
+            metrics,
+            NullLogger<GraphAnalyticsPipeline>.Instance);
+
+        await pipeline.RunAsync(new GraphAnalyticsRunContext(false), CancellationToken.None);
+
+        Assert.Single(writer.ClusterWrites);
+        Assert.Single(writer.CentralityWrites);
+        Assert.Equal(snapshot.Nodes.Length, writer.ClusterWrites.Single().Assignments.Length);
+    }
+}

src/Graph/__Tests/StellaOps.Graph.Indexer.Tests/GraphAnalyticsTestData.cs

@@ -0,0 +1,78 @@
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Text.Json.Nodes;
+using StellaOps.Graph.Indexer.Analytics;
+using StellaOps.Graph.Indexer.Schema;
+
+namespace StellaOps.Graph.Indexer.Tests;
+
+internal static class GraphAnalyticsTestData
+{
+    public static GraphAnalyticsSnapshot CreateLinearSnapshot()
+    {
+        var tenant = "tenant-a";
+        var provenance = new GraphProvenanceSpec("test", DateTimeOffset.UtcNow, "sbom-1", 1);
+
+        var nodeA = GraphDocumentFactory.CreateNode(new GraphNodeSpec(
+            tenant,
+            "component",
+            new Dictionary<string, string> { { "purl", "pkg:npm/a@1.0.0" } },
+            new JsonObject { ["purl"] = "pkg:npm/a@1.0.0" },
+            provenance,
+            DateTimeOffset.UtcNow,
+            null));
+
+        var nodeB = GraphDocumentFactory.CreateNode(new GraphNodeSpec(
+            tenant,
+            "component",
+            new Dictionary<string, string> { { "purl", "pkg:npm/b@1.0.0" } },
+            new JsonObject { ["purl"] = "pkg:npm/b@1.0.0" },
+            provenance,
+            DateTimeOffset.UtcNow,
+            null));
+
+        var nodeC = GraphDocumentFactory.CreateNode(new GraphNodeSpec(
+            tenant,
+            "component",
+            new Dictionary<string, string> { { "purl", "pkg:npm/c@1.0.0" } },
+            new JsonObject { ["purl"] = "pkg:npm/c@1.0.0" },
+            provenance,
+            DateTimeOffset.UtcNow,
+            null));
+
+        var nodeD = GraphDocumentFactory.CreateNode(new GraphNodeSpec(
+            tenant,
+            "component",
+            new Dictionary<string, string> { { "purl", "pkg:npm/d@1.0.0" } },
+            new JsonObject { ["purl"] = "pkg:npm/d@1.0.0" },
+            provenance,
+            DateTimeOffset.UtcNow,
+            null));
+
+        var edgeAB = CreateDependsOnEdge(tenant, nodeA["id"]!.GetValue<string>(), nodeB["id"]!.GetValue<string>(), provenance);
+        var edgeBC = CreateDependsOnEdge(tenant, nodeB["id"]!.GetValue<string>(), nodeC["id"]!.GetValue<string>(), provenance);
+
+        return new GraphAnalyticsSnapshot(
+            tenant,
+            "snapshot-1",
+            DateTimeOffset.UtcNow,
+            ImmutableArray.Create(nodeA, nodeB, nodeC, nodeD),
+            ImmutableArray.Create(edgeAB, edgeBC));
+    }
+
+    private static JsonObject CreateDependsOnEdge(string tenant, string sourceNodeId, string dependencyNodeId, GraphProvenanceSpec provenance)
+    {
+        return GraphDocumentFactory.CreateEdge(new GraphEdgeSpec(
+            tenant,
+            "DEPENDS_ON",
+            new Dictionary<string, string>
+            {
+                { "component_node_id", sourceNodeId },
+                { "dependency_node_id", dependencyNodeId }
+            },
+            new JsonObject(),
+            provenance,
+            DateTimeOffset.UtcNow,
+            null));
+    }
+}

src/Graph/__Tests/StellaOps.Graph.Indexer.Tests/GraphChangeStreamProcessorTests.cs

@@ -0,0 +1,110 @@
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Text.Json.Nodes;
+using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.Extensions.Options;
+using StellaOps.Graph.Indexer.Incremental;
+using StellaOps.Graph.Indexer.Ingestion.Sbom;
+
+namespace StellaOps.Graph.Indexer.Tests;
+
+public sealed class GraphChangeStreamProcessorTests
+{
+    [Fact]
+    public async Task ApplyStreamAsync_SkipsDuplicates_AndRetries()
+    {
+        var tenant = "tenant-a";
+        var nodes = ImmutableArray.Create(new JsonObject { ["id"] = "gn:tenant-a:component:a", ["kind"] = "component" });
+        var edges = ImmutableArray<JsonObject>.Empty;
+
+        var events = new List<GraphChangeEvent>
+        {
+            new(tenant, "snap-1", "seq-1", nodes, edges, false),
+            new(tenant, "snap-1", "seq-1", nodes, edges, false), // duplicate
+            new(tenant, "snap-1", "seq-2", nodes, edges, false)
+        };
+
+        var changeSource = new FakeChangeSource(events);
+        var backfillSource = new FakeChangeSource(Array.Empty<GraphChangeEvent>());
+        var store = new InMemoryIdempotencyStore();
+        var writer = new FlakyWriter(failFirst: true);
+        using var metrics = new GraphBackfillMetrics();
+
+        var options = Options.Create(new GraphChangeStreamOptions
+        {
+            MaxRetryAttempts = 3,
+            RetryBackoff = TimeSpan.FromMilliseconds(10)
+        });
+
+        var processor = new GraphChangeStreamProcessor(
+            changeSource,
+            backfillSource,
+            writer,
+            store,
+            options,
+            metrics,
+            NullLogger<GraphChangeStreamProcessor>.Instance);
+
+        await processor.ApplyStreamAsync(isBackfill: false, CancellationToken.None);
+
+        Assert.Equal(2, writer.BatchCount); // duplicate skipped
+        Assert.True(writer.SucceededAfterRetry);
+    }
+
+    private sealed class FakeChangeSource : IGraphChangeEventSource, IGraphBackfillSource
+    {
+        private readonly IReadOnlyList<GraphChangeEvent> _events;
+
+        public FakeChangeSource(IReadOnlyList<GraphChangeEvent> events)
+        {
+            _events = events;
+        }
+
+        public IAsyncEnumerable<GraphChangeEvent> ReadAsync(CancellationToken cancellationToken)
+        {
+            return EmitAsync(cancellationToken);
+        }
+
+        public IAsyncEnumerable<GraphChangeEvent> ReadBackfillAsync(CancellationToken cancellationToken)
+        {
+            return EmitAsync(cancellationToken);
+        }
+
+        private async IAsyncEnumerable<GraphChangeEvent> EmitAsync([System.Runtime.CompilerServices.EnumeratorCancellation] CancellationToken cancellationToken)
+        {
+            foreach (var change in _events)
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                yield return change;
+                await Task.Yield();
+            }
+        }
+    }
+
+    private sealed class FlakyWriter : IGraphDocumentWriter
+    {
+        private readonly bool _failFirst;
+        private int _attempts;
+
+        public FlakyWriter(bool failFirst)
+        {
+            _failFirst = failFirst;
+        }
+
+        public int BatchCount { get; private set; }
+        public bool SucceededAfterRetry => _attempts > 1 && BatchCount > 0;
+
+        public Task WriteAsync(GraphBuildBatch batch, CancellationToken cancellationToken)
+        {
+            _attempts++;
+            if (_failFirst && _attempts == 1)
+            {
+                throw new InvalidOperationException("simulated failure");
+            }
+
+            BatchCount++;
+            return Task.CompletedTask;
+        }
+    }
+}

src/Graph/__Tests/StellaOps.Graph.Indexer.Tests/StellaOps.Graph.Indexer.Tests.csproj

@@ -9,5 +9,8 @@
 
   <ItemGroup>
     <ProjectReference Include="../../StellaOps.Graph.Indexer/StellaOps.Graph.Indexer.csproj" />
+    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
   </ItemGroup>
 </Project>