dennisdoomen / packageguard / 32579286261

81%

Build Type

push

github

Committed by web-flow

Commit Message

Fix missing using directive for ValidationResult (#226)

AnalyzeCommandSettingsSpecs.cs referenced Spectre.Console.ValidationResult
but only imported Spectre.Console.Cli, which doesn't contain that type
(ValidationResult lives in the Spectre.Console namespace itself).



Fix schema-validation issues in generated CycloneDX and SPDX documents

Both issues surfaced from running the generated files through the
official CycloneDX 1.6 and SPDX 2.3 JSON schemas:

- CycloneDX: the tool component used a 'vendor' string property, which
  CycloneDX 1.6 removed from the component schema in favor of
  'manufacturer' (an organizationalEntity object with a 'name' field).
- SPDX: creationInfo.created and every annotation's annotationDate used
  .NET's default DateTimeOffset round-trip format
  (2026-08-17T19:12:46.6595686+00:00), which isn't valid per SPDX 2.3 -
  it requires strict 'YYYY-MM-DDThh:mm:ssZ': no fractional seconds and
  a literal 'Z' instead of a numeric offset.

Verified against a real generated SBOM: both fields now match the
required formats, and added regression tests for each so a future
regression fails the build instead of only showing up in downstream
SBOM validators (dependency-track, sbom-utility, etc.).



Re-trigger CI

The previous run's build/test/analyze job failed only on a transient
Coveralls 503 rate-limit, and a separate test-results reporting job
got stuck in-progress and wouldn't respond to cancellation. Empty
commit to get a clean workflow run.



Address InspectCode findings introduced by the SBOM feature

- Remove SbomComponent.Ecosystem: computed but never read after
  construction (ecosystem is already encoded in each component's purl
  and separately tracked per-ecosystem on SbomModel.EcosystemGraphIsAccurate).
- SpdxSbomWriter: use a format specifier in the interpolated severity
  string instead of ToString("0.0"), and target-typed new() where the
  type is already evident from the surrounding List<SpdxRelationship>.
- SbomEn... (continued)

Coverage Stats

1691 of 2426 branches covered (69.7%)

Branch coverage included in aggregate %.

559 of 602 new or added lines in 22 files covered. (92.86%)

2 existing lines in 1 file now uncovered.

5294 of 6489 relevant lines covered (81.58%)

1895.8 hits per line