SBOM: validate --max-depth, and say when a closure skipped every edge - #178
Merged
villelaitila merged 1 commit intoAug 21, 2026
Merged
Conversation
Follow-ups to the transitive closure, split out because 1.11.0 released before they landed. --max-depth accepted 0 and negative values and silently behaved as 1, which contradicts its own meaning: a cap below the shallowest level excludes every component the walk could emit, so it is refused rather than rounded up. Both public entry points validate it, and the CLI reports the flag as typed. The existing requirement that it accompany --transitive-externals had no test and now has one. An edge whose deptype the converter does not recognise was skipped silently, so a model whose closure the converter could not read produced the same document as one with no closure at all. When a document follows no package-to-package edge while such edges were skipped, one line naming those deptypes goes to stderr. Deliberately not one line per edge: code-level edges between externals are the ordinary case the allow-list exists to skip, and reporting those would fire on nearly every model and train readers to ignore the message. docs/data-formats.md catches up with the behaviour already released: the depth a component publishes agrees with the dependency graph of the same document, including across inlined internal elements; the recognised deptypes are listed, so "inert" is qualified as "holds no edges the converter recognises"; and the lower bound on --max-depth is stated.
Softagram Impact Report for pull/178 (head commit: e6b28ca)TL;DR Arch. Impact: -3 | Changed code files: 2 | Directly impacted code files: 1⭐ Change Overview
⭐ Details of Dependency Changes (diagram)
🤖 AGENTS - machine-readable impact data (2 files changed, 1 impacted, +6/-0 deps)Change overviewHead Added dependencies (6)
Removed dependencies (0)None. Impacted files (1)Unchanged files that directly depend on files changed in this PR - check them for behavioral impact. Grouped by changed file:
Complete data
[] 📄 Full report
Impact Report explained. Give feedback on this report to support@softagram.com |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-ups to #176, split out because 1.11.0 released before they landed. #176 carried the three correctness fixes (closure tests retargeted onto the deptypes that actually carry data, depth agreeing with the dependency graph, the finding guard made to discriminate); these three did not make it in.
--max-depthaccepted 0 and negative values and silently behaved as 1, contradicting its own meaning — a cap below the shallowest level excludes every component the walk could emit, so it is now refused rather than rounded up. Both public entry points validate it, and the CLI reports the flag as typed. The existing requirement that it accompany--transitive-externalshad no test; removing that guard previously survived the whole suite.An unrecognised deptype was skipped silently, so a model whose closure the converter could not read produced the same document as one with no closure at all. When a document follows no package-to-package edge while such edges were skipped, one line naming those deptypes goes to stderr.
Deliberately not one line per edge: code-level edges between externals are the ordinary case the allow-list exists to skip, so per-edge reporting would fire on nearly every model and train readers to ignore it.
docs/data-formats.mdcatches up with behaviour already released in 1.11.0: the depth a component publishes agrees with the dependency graph of the same document, including across inlined internal elements; the recognised deptypes are listed, so "inert" is qualified as "holds no edges the converter recognises"; and the lower bound on--max-depthis stated.Verification
311 passed. Each new test was checked by mutation — breaking the implementation deliberately to confirm the test notices:
--max-depthbound--max-depthrequires-closure guard