fix(release): attach and verify generated SBOM assets

scripts/verify-sbom.test.tsadded+34-0

Changes to scripts/verify-sbom.test.ts

		@@ -0,0 +1,34 @@
	1	+import { expect, test } from 'bun:test'
	2	+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
	3	+import { tmpdir } from 'node:os'
	4	+import { join } from 'node:path'
	5	+import { releaseSboms, verifySbomFiles } from './verify-sbom'
	6	+
	7	+const documents = {
	8	+ 'craft-sbom.json': { bomFormat: 'CycloneDX', specVersion: '1.5', metadata: { component: { name: 'craft', version: 'v0.0.93' } } },
	9	+ 'full-sbom.cyclonedx.json': { bomFormat: 'CycloneDX', specVersion: '1.6', components: [{ name: 'dependency', version: '1.0.0' }] },
	10	+ 'full-sbom.spdx.json': { spdxVersion: 'SPDX-2.3', SPDXID: 'SPDXRef-DOCUMENT', packages: [{ name: 'dependency' }] },
	11	+}
	12	+
	13	+test('requires all three valid documents from the matching release', () => {
	14	+ const directory = mkdtempSync(join(tmpdir(), 'craft-sbom-'))
	15	+ try {
	16	+ for (const [name, value] of Object.entries(documents)) writeFileSync(join(directory, name), JSON.stringify(value))
	17	+ expect(() => verifySbomFiles(directory, 'v0.0.93')).not.toThrow()
	18	+ expect(() => verifySbomFiles(directory, 'v0.0.94')).toThrow('release identity')
	19	+ for (const name of releaseSboms) {
	20	+ rmSync(join(directory, name))
	21	+ expect(() => verifySbomFiles(directory, 'v0.0.93')).toThrow()
	22	+ writeFileSync(join(directory, name), '{')
	23	+ expect(() => verifySbomFiles(directory, 'v0.0.93')).toThrow()
	24	+ writeFileSync(join(directory, name), '{}')
	25	+ expect(() => verifySbomFiles(directory, 'v0.0.93')).toThrow()
	26	+ writeFileSync(join(directory, name), JSON.stringify(documents[name]))
	27	+ }
	28	+ writeFileSync(join(directory, 'full-sbom.cyclonedx.json'), JSON.stringify({ bomFormat: 'CycloneDX', specVersion: '1.6', components: [] }))
	29	+ expect(() => verifySbomFiles(directory, 'v0.0.93')).toThrow('dependency components')
	30	+ }
	31	+ finally {
	32	+ rmSync(directory, { recursive: true, force: true })
	33	+ }
	34	+})