Files

Docs CI / lint-and-preview (push) Has been cancelled

Details

Add unit tests for SBOM ingestion and transformation

- Implement `SbomIngestServiceCollectionExtensionsTests` to verify the SBOM ingestion pipeline exports snapshots correctly.
- Create `SbomIngestTransformerTests` to ensure the transformation produces expected nodes and edges, including deduplication of license nodes and normalization of timestamps.
- Add `SbomSnapshotExporterTests` to test the export functionality for manifest, adjacency, nodes, and edges.
- Introduce `VexOverlayTransformerTests` to validate the transformation of VEX nodes and edges.
- Set up project file for the test project with necessary dependencies and configurations.
- Include JSON fixture files for testing purposes.

2025-11-04 07:49:39 +02:00

1.7 KiB

Raw Blame History

StellaOps Graph

Graph module (upcoming) will power graph-indexed queries for SBOM relationships, lineage, and blast-radius analysis.

Responsibilities

Model SBOM and advisory entities as a navigable graph.
Provide APIs for dependency impact, provenance chains, and reachability analysis.
Integrate with Scheduler/Policy for graph-driven re-evaluation.
Expose tooling for offline explorers.
Maintain Graph Index Canonical Schema with deterministic identities, fixtures, and attribute dictionary.

Domain highlights (Epic 5)

Nodes: artifacts/images, SBOM components, packages/versions, files/paths, licences, advisories, VEX statements, provenance attestations, policy versions.
Edges: depends_on, contains, built_from, declared_in, affected_by, vex_exempts, governs_with, produced_by, each timestamped and tenant-scoped.
Overlays: policy verdict overlays, VEX consensus, runtime telemetry, and export-ready snapshots with diff support.
Queries: reachability (impact(graph, advisory)), blast radius (reverseDepends(component)), provenance timeline, saved query library with semantic zoom for Console.

Key components

Planned services documented in implementation plan (to be delivered).

Integrations & dependencies

SBOM Service / Cartographer for data ingestion.
Policy & CLI for query surfaces.

Operational notes

Pending — see implementation plan for staged milestones.

Backlog references

DOCS-GRAPH-24-003 (architecture index) and SCHED-MODELS-21-001 tasks.

Epic alignment

Epic 5 – SBOM Graph Explorer: deliver graph indexer, API, Console explorer, saved queries, overlays, and exports.

1.7 KiB Raw Blame History Unescape Escape