DataOps-platform/tests/test_data_rule_runtime_sbom.py

from __future__ import annotations

import json
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
SBOM = ROOT / "docs" / "security" / "data-rule-runtime-sbom.json"


def test_data_rule_runtime_sbom_pins_official_oss_dependencies():
    document = json.loads(SBOM.read_text(encoding="utf-8"))
    components = {
        component["name"]: component
        for component in document["components"]
    }

    assert document["bomFormat"] == "CycloneDX"
    assert document["specVersion"] == "1.5"
    assert components["polars"] == {
        "type": "library",
        "name": "polars",
        "version": "1.42.1",
        "purl": "pkg:pypi/polars@1.42.1",
        "license": "MIT",
        "officialSource": "https://github.com/pola-rs/polars",
        "purpose": "Bounded lazy/dataframe execution for governed batch rules",
    }
    assert components["minio"] == {
        "type": "library",
        "name": "minio",
        "version": "7.2.10",
        "purl": "pkg:pypi/minio@7.2.10",
        "license": "Apache-2.0",
        "officialSource": "https://github.com/minio/minio-py",
        "purpose": "Digest-bound Parquet artifact transport and metadata",
    }
    requirements = (ROOT / "requirements.txt").read_text(encoding="utf-8")
    assert "polars==1.42.1" in requirements
    assert "minio==7.2.10" in requirements