sbom-tools 0.2.0

Semantic SBOM diff and analysis tool
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175

name: Bindings

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions: read-all

jobs:
  constant-parity:
    name: Binding Constant Parity
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Check wrapper constants match sbom_tools.h
        run: ./scripts/check-binding-constants.sh

  dagger-rust-sdk:
    name: Dagger CI (workspace check + staticlib + FFI tests + Go bindings)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install Rust
        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # master
        with:
          toolchain: stable
      - name: Cache Rust
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - name: Run Dagger Rust SDK pipeline
        run: ./scripts/run-dagger-ci.sh

  rust-ffi:
    name: Rust FFI
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install Rust
        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # master
        with:
          toolchain: stable
      - name: Cache
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - name: Build FFI library
        run: bash ./scripts/build-bindings-mvp.sh
      - name: Test FFI ABI
        run: cargo test --locked --features ffi --test ffi_bindings

      - name: Test ABI snapshot contracts
        run: cargo test --locked --features ffi --test ffi_schema_snapshots

      - name: Test FFI conformance (bidirectional ABI)
        run: cargo test --locked --features ffi --test conformance_ffi

      - name: Test FFI regression (PR #113 + multi-format)
        run: cargo test --locked --features ffi --test ffi_regression

  go-bindings:
    name: Go Bindings (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install Rust
        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # master
        with:
          toolchain: stable
      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: '1.22'
      - name: Cache Rust
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - name: Build Rust library
        run: bash ./scripts/build-bindings-mvp.sh
      - name: Test Go wrapper
        working-directory: bindings/go
        run: go test ./...
      - name: Test Go dedup helpers
        run: ./scripts/test-bindings-dedup.sh go

  python-bindings:
    name: Python Bindings (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install Rust
        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # master
        with:
          toolchain: stable
      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.12'
      - name: Cache Rust
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - name: Build Rust library
        run: cargo build -p sbom-tools-ffi --release
      - name: Create Python environment
        working-directory: bindings/python
        run: python -m venv .venv
      - name: Install Python binding
        working-directory: bindings/python
        run: >-
          python -c "import os, pathlib, subprocess;
          executable = pathlib.Path('.venv') / ('Scripts/python.exe' if os.name == 'nt' else 'bin/python');
          subprocess.check_call([str(executable), '-m', 'pip', 'install', '-e', '.[test]'])"
      - name: Test Python wrapper
        working-directory: bindings/python
        run: >-
          python -c "import os, pathlib, subprocess;
          executable = pathlib.Path('.venv') / ('Scripts/python.exe' if os.name == 'nt' else 'bin/python');
          subprocess.check_call([str(executable), '-m', 'pytest', '-q'])"

  swift-bindings:
    name: Swift Bindings
    runs-on: macos-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install Rust
        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # master
        with:
          toolchain: stable
      - name: Build Rust library
        run: bash ./scripts/build-bindings-mvp.sh
      - name: Build and test Swift wrapper
        working-directory: bindings/swift
        run: swift test
      - name: Test Swift dedup helpers
        run: ./scripts/test-bindings-dedup.sh swift

  nodejs-bindings:
    name: Node.js Bindings (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install Rust
        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # master
        with:
          toolchain: stable
      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          cache: npm
          cache-dependency-path: bindings/nodejs/package-lock.json
      - name: Cache Rust
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
      - name: Install Node.js dependencies
        working-directory: bindings/nodejs
        run: npm ci
      - name: Build Rust library
        run: cargo build -p sbom-tools-ffi --release
      - name: Build and test Node.js wrapper
        working-directory: bindings/nodejs
        run: npm test