Add yocto PURL injection for SPDX 2.2 and SPDX 3

[vpetersson]

Summary

• Adds automatic pkg:yocto/<name>@<version> PURL injection for Yocto SBOMs where PURLs are missing (older Yocto <5.0 doesn't generate them natively)
• Supports both SPDX 2.2 (externalRefs) and SPDX 3 (packageUrl) formats
• Injection runs before augmentation/enrichment so downstream enrichment can leverage the PURLs
• Idempotent: preserves existing yocto PURLs and leaves non-yocto PURLs untouched

Test plan

• Unit tests for PURL generation (TestGenerateYoctoPurl)
• Unit tests for SPDX 2.2 detection and injection (TestHasYoctoPurlSpdx22, TestInjectYoctoPurlsSpdx22)
• Unit tests for SPDX 3 injection (TestInjectYoctoPurlsSpdx3)
• Integration tests verifying injection is called during both pipeline paths
• Full test suite passes (1740 passed)
• Lint and format checks pass

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds Yocto-specific Package URL (PURL) injection so older Yocto-generated SPDX SBOMs (missing PURLs) can be augmented/enriched downstream with consistent pkg:yocto/<name>@<version> identifiers, supporting both SPDX 2.2 and SPDX 3.

Changes:

• Introduces Yocto PURL generation plus SPDX 2.2 (externalRefs) and SPDX 3 (packageUrl) injection helpers.
• Calls PURL injection early in the Yocto pipeline (both SPDX 2.2 archive flow and SPDX 3 single-file flow).
• Adds unit and pipeline integration tests covering generation, detection, injection, and pipeline invocation.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
sbomify_action/_yocto/purl.py	New Yocto PURL generator and SPDX 2.2/SPDX 3 injection routines that rewrite SBOM JSON in-place when injecting.
sbomify_action/_yocto/pipeline.py	Invokes injection before augmentation/enrichment in both pipeline paths.
sbomify_action/_yocto/__init__.py	Exports new PURL utilities from the Yocto package.
tests/test_yocto_purl.py	Adds unit tests for PURL generation and SPDX 2.2/SPDX 3 injection behavior.
tests/test_yocto_pipeline.py	Adds tests asserting injection is called in both SPDX 2.2 and SPDX 3 pipeline paths.

Comments suppressed due to low confidence (1)

tests/test_yocto_purl.py:13

• The imported names in this from sbomify_action._yocto.purl import (...) block are not ordered consistently; if Ruff/isort is run on tests, this can fail lint. Sort the imported names in a stable order.

from sbomify_action._yocto.purl import (
    _has_yocto_purl_spdx22,
    generate_yocto_purl,
    inject_yocto_purls_spdx3,
    inject_yocto_purls_spdx22,
)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.