add python and java collector and two modes

[FScholPer]

Add more collectors and a qualification and product mode

Frank Scholter Peres frank.scholter_peres@mercedes-benz.com, Mercedes-Benz Tech Innovation GmbH
Provider Information

[Copilot]

Pull request overview

Adds Python and Java/JAR collection capabilities to the SBOM Bazel rule, supporting both “product” and “tool qualification” SBOM use cases by ingesting pip-compile lockfiles and declared Java artifacts.

Changes:

• Introduces a Python metadata cache generator (generate_python_metadata_cache.py) and wires it into the Bazel rule via --python-cache.
• Adds Java file component collection (name/checksum/size) to the SBOM generator.
• Updates documentation and adds tests + Bazel test targets for the new collectors.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tests/test_sbom_generator.py	Adds unit test coverage for Java file component collection.
tests/test_generate_python_metadata_cache.py	Adds tests for parsing pip-compile lockfiles and DASH summary parsing.
tests/BUILD	Registers the new Python metadata cache tests as a Bazel pytest target.
scripts/generate_python_metadata_cache.py	New script to parse Python lockfiles and optionally enrich licenses via DASH.
scripts/BUILD.bazel	Exports/builds the new Python metadata cache generator as a Bazel target.
README.md	Documents SBOM “product vs tool” modes and new parameters (python_lockfiles, java_files, auto_python_cache).
internal/rules.bzl	Adds new rule attrs and build actions to generate and pass the Python metadata cache + java file inputs.
internal/generator/sbom_generator.py	Loads python-cache output, collects Java file components, and integrates them into SBOM outputs.
defs.bzl	Extends the public macro interface to accept python/java inputs and auto_python_cache.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.

Suppressed comments (3)

internal/generator/sbom_generator.py:516

• This line is a no-op and makes it look like the component list is being rebuilt, but it does nothing. Replace it with an explanatory comment (or remove it) to avoid confusion.

    components.extend([])

scripts/generate_python_metadata_cache.py:120

• The temporary UV cache directory created for the DASH scan is never removed. In long-running environments (or repeated local runs) this can leak many temp directories. Clean up cache_dir before every return path.

    except (OSError, subprocess.TimeoutExpired) as error:
        print(f"WARNING: DASH Python license scan unavailable: {error}")
        return False
    if result.returncode < 0:
        print(f"WARNING: DASH Python license scan was terminated: {result.returncode}")

internal/generator/sbom_generator.py:490

• --python-cache JSON is assumed to be a dict; if a user accidentally points it at a non-dict JSON value (e.g., a list), python_cache.values() will raise at runtime. Validate the loaded JSON shape before using it.

        try:
            with open(args.python_cache, encoding="utf-8") as f:
                python_cache = json.load(f)
        except (OSError, json.JSONDecodeError):
            python_cache = {}

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.

Suppressed comments (5)

internal/rules.bzl:199

• The Python metadata action always declares requires-network, but the script can still generate version/hash metadata offline (only DASH enrichment needs network). Consider plumbing a rule attribute (e.g. python_skip_dash) to pass --skip-dash, and only set requires-network when DASH enrichment is enabled; otherwise offline builds must disable auto_python_cache and lose Python components entirely.

            mnemonic = "PythonMetadataGenerate",
            progress_message = "Generating Python metadata cache for %s" % ctx.attr.name,
            execution_requirements = {"requires-network": ""},
            use_default_shell_env = True,
        )

internal/generator/sbom_generator.py:516

• components.extend([]) is a no-op and makes it look like there is intended logic missing. If the intent is just to preserve the previously-seeded python/java components, the line can be removed or replaced with a clarifying comment.

    # Build component list with metadata
    components.extend([])

scripts/generate_python_metadata_cache.py:88

• run_dash_license_scan() creates a temp directory via tempfile.mkdtemp() and never deletes it, which can leak many dash-license-scan-* directories over repeated runs (CI / Bazel actions). Register cleanup (or use TemporaryDirectory) so the cache dir is removed on process exit.

    cache_dir = tempfile.mkdtemp(prefix="dash-license-scan-")
    env = os.environ.copy()
    env["UV_CACHE_DIR"] = cache_dir
    env["UV_TOOL_DIR"] = cache_dir
    command = [

internal/generator/sbom_generator.py:490

• If loading --python-cache fails, the generator silently drops all Python components. Emitting a warning (including the path) makes missing Python metadata diagnosable without having to diff outputs.

    if args.python_cache:
        try:
            with open(args.python_cache, encoding="utf-8") as f:
                python_cache = json.load(f)
        except (OSError, json.JSONDecodeError):
            python_cache = {}

tests/test_sbom_generator.py:109

• There are end-to-end main() integration tests in this file, but none exercise the new --python-cache path (verified: no references to python-cache/python_cache). Adding an integration test that supplies a small cache JSON and asserts those components appear in the generated SPDX/CycloneDX outputs would prevent regressions in the new collector pipeline.

from internal.generator.sbom_generator import (
    collect_java_file_components,
    deduplicate_components,
    filter_repos,
    main,
    mark_missing_cpp_descriptions,
    parse_module_bazel_files,
    parse_module_lockfiles,
    resolve_component,
)