Add integration test for sbom generation - #8
Merged
masc2023 merged 2 commits intoAug 6, 2026
Merged
Conversation
Lukasz-Juranek
marked this pull request as ready for review
August 5, 2026 15:19
Lukasz-Juranek
requested review from
AlexanderLanin and
masc2023
as code owners
August 5, 2026 15:19
There was a problem hiding this comment.
Pull request overview
Adds a nested “dummy project” Bazel module under examples/ and wires it into CI to provide an end-to-end integration test that exercises the public sbom() macro against a real C++ + Rust build.
Changes:
- Introduces
examples/dummy_projectas a separate Bazel module containing minimal C++/Rust binaries and an SBOM validationpy_test. - Updates documentation to describe the new two-layer testing strategy (unit + integration).
- Extends CI (
tests.yml) with anintegration_testjob that runsbazel test //...inside the dummy project module.
Reviewed changes
Copilot reviewed 17 out of 18 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| tools/BUILD.bazel | Documents why the nested dummy module is excluded from the root workspace copyright checker. |
| README.md | Explains unit vs. end-to-end integration testing and adds the dummy project test to the test matrix. |
| examples/dummy_project/sbom_test.py | Adds Python assertions validating generated SPDX/CycloneDX SBOM outputs. |
| examples/dummy_project/BUILD.bazel | Defines the sbom() invocation for C++/Rust targets and a py_test that validates outputs. |
| examples/dummy_project/MODULE.bazel | Declares the dummy project as a separate Bazel module and pins its deps/toolchains. |
| examples/dummy_project/.bazelrc | Sets registries and Java settings for the dummy module. |
| examples/dummy_project/.bazelversion | Pins Bazel version for the dummy module. |
| examples/dummy_project/cpp/BUILD.bazel | Adds C++ library/binary/test for the dummy build. |
| examples/dummy_project/cpp/main.cpp | Minimal C++ app that exercises the dummy library. |
| examples/dummy_project/cpp/greeter.h | Declares dummy greeting API. |
| examples/dummy_project/cpp/greeter.cpp | Implements dummy greeting using nlohmann::json. |
| examples/dummy_project/cpp/greeter_test.cpp | Adds a simple runtime test for the dummy C++ greeting. |
| examples/dummy_project/rust/BUILD.bazel | Adds Rust library/binary/test for the dummy build. |
| examples/dummy_project/rust/src/main.rs | Minimal Rust app exercising the dummy library. |
| examples/dummy_project/rust/src/lib.rs | Dummy Rust library using external crates to ensure Rust dep traversal. |
| .github/workflows/tests.yml | Adds CI job to run the dummy-project integration test. |
| .bazelignore | Excludes the nested dummy Bazel module from the root workspace. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+26
to
+27
| SPDX_PATH = pathlib.Path("dummy_sbom.spdx.json") | ||
| CDX_PATH = pathlib.Path("dummy_sbom.cdx.json") |
Comment on lines
+219
to
+222
| `auto_cdxgen` and `auto_crates_cache` are off, so the test needs no npm and | ||
| reaches no network at build time; it covers the aspect, the rule and the module | ||
| extension — the parts no fixture can cover — rather than full license | ||
| enrichment. |
Comment on lines
+29
to
+32
| # auto_cdxgen needs npm + @cyclonedx/cdxgen on the build machine, and | ||
| # auto_crates_cache reaches out to dash-license-scan and crates.io at build | ||
| # time. Both are left off so the smoke test stays hermetic and offline; a | ||
| # real project should enable them to get full C++ and Rust license data. |
Comment on lines
+51
to
+55
| py_test( | ||
| name = "sbom_test", | ||
| srcs = ["sbom_test.py"], | ||
| data = [":dummy_sbom"], | ||
| ) |
Contributor
Author
There was a problem hiding this comment.
false positive dependency is handled properly
masc2023
approved these changes
Aug 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
Here is example sbom contents generated by tooling:
Sunshine - SBOM visualization tool.pdf
dummy_sbom.cdx.json
dummy_sbom.spdx.json
Faliure detection checked in Lukasz-Juranek#2