diff --git a/.reviewmark.yaml b/.reviewmark.yaml index f6b6c8d..a7b16ff 100644 --- a/.reviewmark.yaml +++ b/.reviewmark.yaml @@ -6,9 +6,12 @@ # Patterns identifying all files that require review. # Processed in order; prefix a pattern with '!' to exclude. needs-review: - - "**/*.cs" # All C# source and test files - - "!**/obj/**" # Exclude build output - - "!**/bin/**" # Exclude build output + - "requirements.yaml" # Root requirements file + - "docs/reqstream/**/*.yaml" # Requirements files + - "docs/design/**/*.md" # Design documentation + - "**/*.cs" # All C# source and test files + - "!**/obj/**" # Exclude build output + - "!**/bin/**" # Exclude build output # Evidence source: review data and index.json are located in the 'reviews' branch # of this repository, accessed through the GitHub public HTTPS raw content access. @@ -22,6 +25,46 @@ evidence-source: # Each review-set groups source and tests for a coherent software unit # so that an AI-assisted review can verify consistency across the full evidence chain. reviews: + # System-level review for DemaConsulting.SpdxTool + - id: SpdxTool-System + title: Review of DemaConsulting.SpdxTool System + paths: + - "docs/reqstream/spdxtool-system.yaml" + - "docs/design/introduction.md" + - "docs/design/spdxtool-system.md" + - "src/**/Program.cs" + - "src/**/Context.cs" + - "src/**/Runner.cs" + - "src/**/AssemblyInfo.cs" + - "test/**/IntegrationTests.cs" + - "test/**/ProgramTests.cs" + - "test/**/Runner.cs" + - "test/**/AssemblyInfo.cs" + + # System-level review for DemaConsulting.SpdxTool.Targets + - id: SpdxTool-Targets-System + title: Review of DemaConsulting.SpdxTool.Targets System + paths: + - "docs/reqstream/spdxtool-targets-system.yaml" + - "docs/design/spdxtool-targets-system.md" + - "src/DemaConsulting.SpdxTool.Targets/**" + - "test/DemaConsulting.SpdxTool.Targets.Tests/**" + + # Design review + - id: SpdxTool-Design + title: Review of SpdxTool Design Documentation + paths: + - "docs/reqstream/spdxtool-system.yaml" + - "docs/reqstream/platform-requirements.yaml" + - "docs/design/**/*.md" + + # All requirements review + - id: SpdxTool-AllRequirements + title: Review of All SpdxTool Requirements + paths: + - "requirements.yaml" + - "docs/reqstream/**/*.yaml" + # Software unit reviews - id: SpdxTool-Context title: Review of SpdxTool Context Unit @@ -29,49 +72,37 @@ reviews: - "src/**/Context.cs" - "test/**/LogTests.cs" - - id: SpdxTool-Program - title: Review of SpdxTool Program Unit - paths: - - "src/**/Program.cs" - - "src/**/SelfValidation/**" - - "test/**/SelfValidationTests.cs" - - "test/**/Runner.cs" - - "test/**/AssemblyInfo.cs" - - id: SpdxTool-Commands - title: Review of SpdxTool Commands Unit + title: Review of SpdxTool Commands Subsystem paths: + - "docs/reqstream/commands/*.yaml" + - "docs/design/commands/*.md" - "src/**/Commands/**" - - "test/**/AddPackageTests.cs" - - "test/**/AddRelationshipTests.cs" - - "test/**/CommandTests.cs" - - "test/**/CopyPackageTests.cs" - - "test/**/DiagramTests.cs" - - "test/**/FindPackageTests.cs" - - "test/**/GetVersionTests.cs" - - "test/**/HashTests.cs" - - "test/**/HelpTests.cs" - - "test/**/PrintTests.cs" - - "test/**/QueryTests.cs" - - "test/**/RenameIdTests.cs" - - "test/**/RunWorkflowTests.cs" - - "test/**/SetVariableTests.cs" - - "test/**/SilentTests.cs" - - "test/**/ToMarkdownTests.cs" - - "test/**/UnknownCommandTests.cs" - - "test/**/UpdatePackageTests.cs" - - "test/**/UsageTests.cs" - - "test/**/ValidateTests.cs" - - "test/**/VersionTests.cs" - - "test/**/WildcardTests.cs" + - "test/**/Commands/**" + + - id: SpdxTool-SelfTest + title: Review of SpdxTool SelfTest Subsystem + paths: + - "docs/reqstream/self-test/self-test.yaml" + - "docs/design/self-test/self-test.md" + - "src/**/SelfTest/**" + - "test/**/SelfTest/**" - id: SpdxTool-Utility - title: Review of SpdxTool Utility Unit + title: Review of SpdxTool Utility Subsystem paths: + - "docs/reqstream/utility.yaml" + - "docs/design/utility.md" - "src/**/Spdx/**" - - "test/**/PathHelpersTests.cs" + - "src/**/Utility/**" + - "test/**/Utility/**" - - id: SpdxTool-Targets - title: Review of SpdxTool MSBuild Targets Unit + - id: SpdxTool-OTS + title: Review of SpdxTool OTS Software paths: - - "test/DemaConsulting.SpdxTool.Targets.Tests/**" + - "docs/reqstream/ots/mstest.yaml" + - "docs/reqstream/ots/reqstream.yaml" + - "docs/reqstream/ots/buildmark.yaml" + - "docs/reqstream/ots/versionmark.yaml" + - "docs/reqstream/ots/sarifmark.yaml" + - "docs/reqstream/ots/sonarmark.yaml" diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 49275d1..1f8b8ac 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -15,7 +15,7 @@ SpdxTool/ ├── src/ │ ├── DemaConsulting.SpdxTool/ # Main tool implementation │ │ ├── Commands/ # Command implementations -│ │ ├── SelfValidation/ # Self-validation logic +│ │ ├── SelfTest/ # Self-validation logic │ │ ├── Spdx/ # SPDX helper utilities │ │ ├── Utility/ # General utilities │ │ ├── Context.cs # Execution context @@ -170,7 +170,7 @@ steps: ### Self-Validation System -**Directory**: `SelfValidation/` +**Directory**: `SelfTest/` A unique feature that allows the tool to validate itself: @@ -526,7 +526,7 @@ Located in `test/DemaConsulting.SpdxTool.Tests/`: ### Adding Self-Validation -1. Create `Validate[Command].cs` in `SelfValidation/` +1. Create `Validate[Command].cs` in `SelfTest/` 2. Implement validation logic 3. Register in main `Validate.cs` orchestrator 4. Validate creates files, runs command, verifies results diff --git a/docs/design/commands/add-package.md b/docs/design/commands/add-package.md new file mode 100644 index 0000000..5901671 --- /dev/null +++ b/docs/design/commands/add-package.md @@ -0,0 +1,79 @@ +# DemaConsulting.SpdxTool add-package Command Design + +## Purpose + +The `add-package` command adds a new SPDX package to an existing SPDX document. +It supports optional relationships between the new package and other elements in +the document. If a package with the same identity already exists, the command +enhances (merges) that package rather than adding a duplicate. + +## Arguments / Inputs + +This command is only valid inside a workflow YAML file: + +```yaml +- command: add-package + inputs: + spdx: # SPDX file name (required) + package: # New package information (required) + id: # New package ID (required) + name: # New package name (required) + download: # New package download URL (required) + version: # Optional package version + filename: # Optional package filename + supplier: # Optional package supplier + originator: # Optional package originator + homepage: # Optional package homepage + copyright: # Optional package copyright + summary: # Optional package summary + description: # Optional package description + license: # Optional package license + purl: # Optional package URL (appended as external reference) + cpe23: # Optional CPE 2.3 identifier (appended as external reference) + relationships: # Optional relationships + - type: # Relationship type (e.g. DESCRIBES, CONTAINS) + element: # Related element ID + comment: # Optional comment +``` + +If invoked directly from the command-line (not in a workflow), the command raises +a `CommandUsageException` with an explanatory message. + +## Implementation + +1. The `Run(Context, YamlMappingNode, Dictionary)` override reads the `inputs` map. +2. The `spdx` input is required; its absence raises a `YamlException`. +3. The `package` sub-map is parsed by `ParsePackage`, which constructs an + `SpdxPackage` from the YAML fields. Required fields are `id`, `name`, and + `download`; all others default to `null` or `"NOASSERTION"` where appropriate. +4. Package ID must not be empty or `"SPDXRef-DOCUMENT"`; violation raises + `CommandUsageException`. +5. Optional `purl` and `cpe23` inputs are appended as `SpdxExternalReference` + entries on the package. +6. `relationships` is an optional sequence; each entry is parsed by + `AddRelationship.Parse`. +7. `AddPackageToSpdxFile` loads the document, calls `Add` (which either enhances + an existing same-identity package and renames it, or appends a deep copy), + then calls `AddRelationship.Add` for each relationship, and saves the document. + +## Error Handling + +| Condition | Exception | +| :--- | :--- | +| Invoked from command line (not workflow) | `CommandUsageException` | +| Missing `spdx` input | `YamlException` | +| Missing `package` input | `YamlException` | +| Missing package `id` | `YamlException` | +| Empty or `SPDXRef-DOCUMENT` package ID | `CommandUsageException` | +| Missing package `name` | `YamlException` | +| Missing package `download` | `YamlException` | +| Relationship parse errors | `YamlException` (propagated from `AddRelationship.Parse`) | + +## Constraints + +- Available in workflow mode only; direct CLI invocation is rejected. +- Package identity comparison uses `SpdxPackage.Same` (by name and download location). +- When enhancing an existing package, the existing package ID is renamed to the + new ID via `RenameId.Rename` so all existing references remain consistent. +- The `relationships` sequence is optional; omitting it results in no new relationships. +- Variable expansion is applied to all string inputs via `GetMapString`. diff --git a/docs/design/commands/add-relationship.md b/docs/design/commands/add-relationship.md new file mode 100644 index 0000000..f7bb27e --- /dev/null +++ b/docs/design/commands/add-relationship.md @@ -0,0 +1,101 @@ +# DemaConsulting.SpdxTool add-relationship Command Design + +## Purpose + +The `add-relationship` command adds one or more SPDX relationships between +elements in an SPDX document. Relationships can be added directly from the +command-line or from a workflow YAML file. + +## Arguments / Inputs + +### Command-line usage + +```text +spdx-tool add-relationship [comment] +``` + +- `spdx.json` — SPDX document to modify +- `id` — Source element ID +- `type` — Relationship type (e.g. `DESCRIBES`, `CONTAINS`, `BUILD_TOOL_OF`) +- `element` — Related (target) element ID +- `comment` — Optional relationship comment + +### Workflow YAML usage + +```yaml + +- command: add-relationship + + inputs: + spdx: # SPDX file name (required) + id: # Source element ID (required) + replace: false # Replace existing relationships (default: true) + relationships: + + - type: # Relationship type (required) + + element: # Related element ID (required) + comment: # Optional comment +``` + +## Implementation + +### Command-line path + +1. Requires at least 4 arguments; fewer raises `CommandUsageException`. +2. Builds a single `SpdxRelationship` from the positional arguments. +3. Calls `Add(spdxFile, relationships)` with `replace = false`. + +### Workflow path + +1. Reads `spdx`, `id`, `replace`, and `relationships` from inputs. +2. `replace` defaults to `"true"` and is parsed as a boolean. +3. Each entry in `relationships` is parsed by `Parse(command, id, node, variables)`, + + which constructs an `SpdxRelationship` using `type`, `element`, and optional + `comment` fields. + +4. Calls `Add(spdxFile, relationships, replace)`. + +### Internal helpers + +- `Add(string, SpdxRelationship[], bool)` — loads the SPDX document, delegates to + + `SpdxRelationships.Add`, and saves the result. + +- `Add(SpdxDocument, SpdxRelationship[], bool)` — wraps `SpdxRelationships.Add` + + and converts any exception to `CommandErrorException`. + +- `Parse(command, packageId, YamlSequenceNode?, variables)` — iterates nodes and + + calls the single-node overload for each. + +- `Parse(command, packageId, YamlMappingNode, variables)` — reads `type`, `element`, + + and `comment` from a mapping node. + +## Error Handling + +| Condition | Exception | +| :--- | :--- | +| Fewer than 4 CLI arguments | `CommandUsageException` | +| Missing `spdx` input (workflow) | `YamlException` | +| Missing `id` input (workflow) | `YamlException` | +| Invalid `replace` value (workflow) | `YamlException` | +| Missing `relationships` input (workflow) | `YamlException` | +| Relationship node not a mapping | `YamlException` | +| Missing relationship `type` | `YamlException` | +| Missing relationship `element` | `YamlException` | +| Error from `SpdxRelationships.Add` | `CommandErrorException` | + +## Constraints + +- The `replace` flag controls whether existing relationships of the same type from + + the same source element are replaced or supplemented. + +- Variable expansion is applied to all string inputs via `GetMapString`. +- Relationship types must be valid SPDX relationship type strings as defined by + + `SpdxRelationshipTypeExtensions.FromText`. diff --git a/docs/design/commands/commands.md b/docs/design/commands/commands.md new file mode 100644 index 0000000..1399acb --- /dev/null +++ b/docs/design/commands/commands.md @@ -0,0 +1,94 @@ +# DemaConsulting.SpdxTool Commands Subsystem Design + +## Purpose + +The Commands subsystem provides the implementations for all CLI subcommands exposed +by DemaConsulting.SpdxTool. Each subcommand corresponds to a discrete SPDX document +operation or workflow step, registered by name in the `CommandRegistry` and dispatched +by `Program`. + +## Architecture + +### Command Registry Pattern + +All commands are registered in `CommandRegistry` as `CommandEntry` instances. When +`Program` parses a command name from the CLI arguments, it looks up the corresponding +`Command` implementation in the registry and calls `Execute(Context, string[])`. + +### Abstract Base Class + +`Command` is the abstract base class for all command implementations. It defines the +`Execute(Context context, string[] args)` interface that every subcommand must implement. +Error handling uses two exception types: + +- `CommandUsageException` — thrown when arguments are invalid; triggers usage display +- `CommandErrorException` — thrown when a command fails at runtime; triggers error display + +### Individual Commands + +| Command Class | CLI Name | Purpose | +|--------------------|---------------------|---------------------------------------------------| +| `AddPackage` | `add-package` | Add a new package to an SPDX document | +| `AddRelationship` | `add-relationship` | Add a relationship between SPDX elements | +| `CopyPackage` | `copy-package` | Copy a package from one SPDX document to another | +| `Diagram` | `diagram` | Generate a Mermaid diagram from an SPDX document | +| `FindPackage` | `find-package` | Find packages in an SPDX document by criteria | +| `GetVersion` | `get-version` | Retrieve package version from an SPDX document | +| `Hash` | `hash` | Compute or verify file hashes | +| `Help` | `help` | Display usage/help information | +| `Print` | `print` | Print a message to the console (workflow step) | +| `Query` | `query` | Query external program output (workflow step) | +| `RenameId` | `rename-id` | Rename an SPDX element ID | +| `RunWorkflow` | `run-workflow` | Execute a workflow YAML file | +| `SetVariable` | `set-variable` | Set a workflow variable (workflow step) | +| `ToMarkdown` | `to-markdown` | Convert an SPDX document to Markdown | +| `UpdatePackage` | `update-package` | Update package metadata in an SPDX document | +| `Validate` | `validate` | Validate an SPDX document | + +## Data Flow + +```text +CLI arguments + │ + ▼ +CommandRegistry.Lookup(commandName) + │ + ▼ +Command.Execute(Context, args) + │ + ├─► Read SPDX JSON from file system + │ + ├─► Perform SPDX operation (via SpdxHelpers) + │ + └─► Write SPDX JSON to file system + │ + └─► Output results to Context (console/log) +``` + +## Workflow Execution + +The `RunWorkflow` command reads a YAML workflow file and iterates over its steps. +Each step specifies a command name and its arguments. Steps are dispatched back +through `CommandRegistry`, allowing any registered command to be used as a workflow +step. Variable substitution (`${{ variables.name }}`) is performed on step arguments +before dispatch, using values from the `Context` variable map. + +NuGet package workflows are resolved from the local NuGet cache before execution, +enabling versioned and distributable workflow definitions. + +## Error Handling + +- **Usage errors** (`CommandUsageException`): Display command-specific usage text and + exit with a non-zero code. +- **Runtime errors** (`CommandErrorException`): Display a descriptive error message and + exit with a non-zero code. +- **Unhandled exceptions**: Propagate to `Program`, which displays a generic error + message and exits. + +## Design Constraints + +- Commands are stateless; all mutable state is carried by the `Context` parameter. +- Commands do not reference each other directly; all cross-command calls go through + `CommandRegistry` to maintain loose coupling. +- File paths in command arguments are resolved relative to the current working directory + using `PathHelpers`. diff --git a/docs/design/commands/copy-package.md b/docs/design/commands/copy-package.md new file mode 100644 index 0000000..b02db97 --- /dev/null +++ b/docs/design/commands/copy-package.md @@ -0,0 +1,94 @@ +# DemaConsulting.SpdxTool copy-package Command Design + +## Purpose + +The `copy-package` command copies a package (and optionally its children and files) +from one SPDX document to another. It is available both from the command-line and +from a workflow YAML file. If the target package already exists in the destination, +it is enhanced (merged) rather than duplicated. + +## Arguments / Inputs + +### Command-line usage + +```text +spdx-tool copy-package [recursive] [files] +``` + +- `from.spdx.json` — Source SPDX document +- `to.spdx.json` — Destination SPDX document +- `package` — Package ID to copy +- `recursive` — Optional flag; copies child packages recursively +- `files` — Optional flag; copies associated files + +### Workflow YAML usage + +```yaml + +- command: copy-package + + inputs: + from: # Source SPDX file (required) + to: # Destination SPDX file (required) + package: # Package ID to copy (required) + recursive: true # Optional recursive copy (default: false) + files: true # Optional copy files (default: false) + relationships: # Optional relationships to add in destination + + - type: # Relationship type + + element: # Related element ID + comment: # Optional comment +``` + +## Implementation + +1. Validates that `package` is not empty and not `"SPDXRef-DOCUMENT"`. +2. Loads both source (`fromDoc`) and destination (`toDoc`) SPDX documents. +3. Calls `Copy(fromDoc, toDoc, packageId, files)` to copy or enhance the package: + - Looks up the source package by ID; raises `CommandErrorException` if not found. + - If a same-identity package exists in the destination, it is enhanced and + + renamed; otherwise a deep copy is appended with `FilesAnalyzed = false`. + + - When `files = true` and the source package has analyzed files, each file is + + also copied or enhanced in the destination. + +4. Calls `AddRelationship.Add(toDoc, relationships)` to add any new relationships. +5. If `recursive = true`, calls `CopyChildren` to recursively copy child packages + + determined by `GetChild` (based on relationship direction). + +6. Saves the destination document. + +### Helper: `GetChild` + +Determines whether a relationship implies a child package given a parent ID, based +on `RelationshipDirection` (Parent, Child, or Sibling). + +## Error Handling + +| Condition | Exception | +| :--- | :--- | +| Fewer than 3 CLI arguments | `CommandUsageException` | +| Unknown CLI option | `CommandUsageException` | +| Empty or `SPDXRef-DOCUMENT` package ID | `CommandUsageException` | +| Missing `from` input (workflow) | `YamlException` | +| Missing `to` input (workflow) | `YamlException` | +| Missing `package` input (workflow) | `YamlException` | +| Invalid `recursive` value (workflow) | `YamlException` | +| Invalid `files` value (workflow) | `YamlException` | +| Package not found in source | `CommandErrorException` | +| File referenced by package not found in source | `CommandErrorException` | + +## Constraints + +- The source document is not modified; only the destination document is saved. +- Package identity comparison uses `SpdxPackage.Same` (by name and download location). +- File identity comparison uses `SpdxFile.Same`. +- Recursive copy tracks already-copied packages in a `HashSet` to avoid + + infinite loops in cyclic relationship graphs. + +- Variable expansion is applied to all string inputs via `GetMapString`. diff --git a/docs/design/commands/diagram.md b/docs/design/commands/diagram.md new file mode 100644 index 0000000..c85a0f0 --- /dev/null +++ b/docs/design/commands/diagram.md @@ -0,0 +1,73 @@ +# DemaConsulting.SpdxTool diagram Command Design + +## Purpose + +The `diagram` command generates a Mermaid entity-relationship diagram from the +relationships in an SPDX document. Only package-to-package relationships are +rendered. Tool relationships (`BUILD_TOOL_OF`, `DEV_TOOL_OF`, `TEST_TOOL_OF`) are +excluded by default unless the `tools` option is specified. + +## Arguments / Inputs + +### Command-line usage + +```text +spdx-tool diagram [tools] +``` + +- `spdx.json` — SPDX document to read +- `mermaid.txt` — Output file for the Mermaid diagram +- `tools` — Optional flag; includes tool relationships in the diagram + +### Workflow YAML usage + +```yaml + +- command: diagram + + inputs: + spdx: # SPDX file name (required) + mermaid: # Output Mermaid file (required) + tools: true # Optional: include tools (default: false) +``` + +## Implementation + +1. Loads the SPDX document from `spdx.json`. +2. Initializes a `StringBuilder` with `erDiagram` as the opening line. +3. Filters relationships: + - Excludes tool relationships unless `tools = true`. + - Retains only relationships where both `Id` and `RelatedSpdxElement` resolve + + to `SpdxPackage` elements in the document. + +4. For each retained relationship, determines the direction (Parent, Child, Sibling) + + and writes a Mermaid edge of the form: + + ```text + "from.Name / from.Version" ||--|| "to.Name / to.Version" : "TYPE" + ``` + +5. Writes the resulting diagram string to the output file via `File.WriteAllText`. + +## Error Handling + +| Condition | Exception | +| :--- | :--- | +| Fewer than 2 CLI arguments | `CommandUsageException` | +| Unknown CLI option | `CommandUsageException` | +| Invalid `tools` value (workflow) | `YamlException` | +| Missing `spdx` input (workflow) | `YamlException` | +| Missing `mermaid` input (workflow) | `YamlException` | +| Relationship direction is unknown | `InvalidDataException` (internal guard) | + +## Constraints + +- Only package-to-package relationships appear in the diagram; file or snippet + + relationships are silently skipped. + +- Package labels use the format `"Name / Version"`. +- The output file is overwritten unconditionally. +- Variable expansion is applied to all string inputs via `GetMapString`. diff --git a/docs/design/commands/find-package.md b/docs/design/commands/find-package.md new file mode 100644 index 0000000..3bb98ad --- /dev/null +++ b/docs/design/commands/find-package.md @@ -0,0 +1,79 @@ +# DemaConsulting.SpdxTool find-package Command Design + +## Purpose + +The `find-package` command searches an SPDX document for a package matching +specified criteria and returns the package's SPDX element ID. Criteria support +wildcard patterns for flexible matching. The command is available from the +command-line and from workflow YAML files. + +## Arguments / Inputs + +### Command-line usage + +```text +spdx-tool find-package [criteria] +``` + +Criteria are key=value pairs: + +- `id=` — Match by SPDX element ID +- `name=` — Match by package name +- `version=` — Match by package version +- `filename=` — Match by package file name +- `download=` — Match by download location + +### Workflow YAML usage + +```yaml + +- command: find-package + + inputs: + output: # Output variable to store the package ID (required) + spdx: # SPDX file name (required) + id: # Optional package ID criterion + name: # Optional package name criterion + version: # Optional package version criterion + filename: # Optional package filename criterion + download: # Optional download location criterion +``` + +## Implementation + +1. Loads the SPDX document from `spdx.json`. +2. `ParseCriteria` populates a `Dictionary` from the inputs. + - CLI path: splits each `key=value` argument. + - Workflow path: reads named fields from the YAML map. +3. `FindPackageByCriteria` iterates over `doc.Packages` and calls `IsPackageMatch` + + for each package. + +4. `IsPackageMatch` evaluates each criterion against the corresponding package + + field using `Wildcard.IsMatch`. + +5. Exactly one match must exist; zero or multiple matches raise `CommandErrorException`. +6. CLI path: writes the package ID to the console via `context.WriteLine`. +7. Workflow path: stores the package ID in `variables[output]`. + +## Error Handling + +| Condition | Exception | +| :--- | :--- | +| Fewer than 2 CLI arguments | `CommandUsageException` | +| Invalid `key=value` format in CLI criterion | `CommandUsageException` | +| Missing `output` input (workflow) | `YamlException` | +| Missing `spdx` input (workflow) | `YamlException` | +| No package matching criteria | `CommandErrorException` | +| Multiple packages matching criteria | `CommandErrorException` | + +## Constraints + +- All criteria are optional; with no criteria all packages match (multiple match + + error if more than one package exists). + +- Criterion values support wildcard patterns (`*`, `?`) via `Wildcard.IsMatch`. +- The `version` and `filename` criteria only match packages that have those fields set. +- Variable expansion is applied to all string inputs via `GetMapString`. diff --git a/docs/design/commands/get-version.md b/docs/design/commands/get-version.md new file mode 100644 index 0000000..1f98b79 --- /dev/null +++ b/docs/design/commands/get-version.md @@ -0,0 +1,63 @@ +# DemaConsulting.SpdxTool get-version Command Design + +## Purpose + +The `get-version` command retrieves the version string of a package in an SPDX +document, matched by criteria. It is available from the command-line and from +workflow YAML files. + +## Arguments / Inputs + +### Command-line usage + +```text +spdx-tool get-version [criteria] +``` + +Criteria are key=value pairs (same as `find-package`): + +- `id=`, `name=`, `version=`, `filename=`, + + `download=` + +### Workflow YAML usage + +```yaml + +- command: get-version + + inputs: + output: # Output variable to store the version (required) + spdx: # SPDX file name (required) + id: # Optional package ID criterion + name: # Optional package name criterion + version: # Optional package version criterion + filename: # Optional package filename criterion + download: # Optional download location criterion +``` + +## Implementation + +1. Delegates criteria parsing to `FindPackage.ParseCriteria`. +2. Calls `FindPackage.FindPackageByCriteria` to locate the matching package. +3. Reads the `Version` property from the returned package. +4. CLI path: writes the version (or empty string if null) to the console. +5. Workflow path: stores the version in `variables[output]`. + +The `output` field is read in the workflow path _after_ finding the package to +allow the `spdx` and criterion inputs to be validated first. + +## Error Handling + +| Condition | Exception | +| :--- | :--- | +| Fewer than 2 CLI arguments | `CommandUsageException` | +| Missing `spdx` input (workflow) | `YamlException` | +| Missing `output` input (workflow) | `YamlException` | +| Package not found or multiple matches | `CommandErrorException` (from `FindPackage`) | + +## Constraints + +- The version is returned as an empty string when the package has no version set. +- All `FindPackage` constraints apply (wildcard matching, etc.). +- Variable expansion is applied to all string inputs via `GetMapString`. diff --git a/docs/design/commands/hash.md b/docs/design/commands/hash.md new file mode 100644 index 0000000..a03a969 --- /dev/null +++ b/docs/design/commands/hash.md @@ -0,0 +1,76 @@ +# DemaConsulting.SpdxTool hash Command Design + +## Purpose + +The `hash` command generates or verifies SHA-256 hash files. It is available from +the command-line and from workflow YAML files. + +## Arguments / Inputs + +### Command-line usage + +```text +spdx-tool hash generate sha256 +spdx-tool hash verify sha256 +``` + +- `generate` — Computes the SHA-256 hash of `` and writes it to `.sha256`. +- `verify` — Reads the expected hash from `.sha256`, recomputes, and compares. + +### Workflow YAML usage + +```yaml + +- command: hash + + inputs: + operation: generate | verify # Required + algorithm: sha256 # Required (currently only sha256 supported) + file: # Required: file to hash or verify +``` + +## Implementation + +1. Reads `operation`, `algorithm`, and `file` inputs. +2. Validates `algorithm`; only `"sha256"` is currently accepted. +3. Dispatches to `GenerateSha256` or `VerifySha256` based on `operation`. + +### `GenerateSha256(file)` + +1. Calls `CalculateSha256(file)` to compute the digest. +2. Writes the hex digest to `file + ".sha256"`. + +### `VerifySha256(context, file)` + +1. Checks that `file.sha256` exists; raises `CommandErrorException` if not. +2. Reads the stored digest (trimmed). +3. Calls `CalculateSha256(file)` to recompute. +4. Compares digests; raises `CommandErrorException` on mismatch. +5. Writes a success message to the context on match. + +### `CalculateSha256(file)` + +1. Verifies the file exists; raises `CommandErrorException` if not. +2. Opens a `FileStream` and uses `SHA256.ComputeHash` to compute the digest. +3. Returns the lowercase hex string. + +## Error Handling + +| Condition | Exception | +| :--- | :--- | +| Not exactly 3 CLI arguments | `CommandUsageException` | +| Missing `operation` input (workflow) | `YamlException` | +| Missing `algorithm` input (workflow) | `YamlException` | +| Missing `file` input (workflow) | `YamlException` | +| Unsupported algorithm | `CommandUsageException` | +| Unknown operation | `CommandUsageException` | +| File not found | `CommandErrorException` | +| Hash file not found (verify) | `CommandErrorException` | +| Hash mismatch | `CommandErrorException` | +| I/O error computing hash | `CommandErrorException` | + +## Constraints + +- Currently only `sha256` is supported as an algorithm. +- The hash file is always `.sha256` (appended, not replaced). +- Variable expansion is applied to all string inputs via `GetMapString`. diff --git a/docs/design/commands/help.md b/docs/design/commands/help.md new file mode 100644 index 0000000..23f4a98 --- /dev/null +++ b/docs/design/commands/help.md @@ -0,0 +1,46 @@ +# DemaConsulting.SpdxTool help Command Design + +## Purpose + +The `help` command displays extended help information about a specific command. +It is available from the command-line and from workflow YAML files. + +## Arguments / Inputs + +### Command-line usage + +```text +spdx-tool help +``` + +- `command` — Name of the command to display help for. + +### Workflow YAML usage + +```yaml +- command: help + inputs: + about: # Command to display help for (required) +``` + +## Implementation + +1. Reads the command name from the single CLI argument or the `about` input. +2. Looks up the command in `CommandsRegistry.Commands`. +3. If found, iterates over `entry.Details` and writes each line to the context. +4. If not found, raises `CommandUsageException`. + +## Error Handling + +| Condition | Exception | +| :--- | :--- | +| Not exactly 1 CLI argument | `CommandUsageException` | +| Missing `about` input (workflow) | `YamlException` | +| Unknown command name | `CommandUsageException` | + +## Constraints + +- The command name must exactly match the registered command name (case-sensitive). +- Help text is taken directly from the `CommandEntry.Details` array defined by + each command's `Entry` static field. +- Variable expansion is applied to string inputs via `GetMapString`. diff --git a/docs/design/commands/print.md b/docs/design/commands/print.md new file mode 100644 index 0000000..c931861 --- /dev/null +++ b/docs/design/commands/print.md @@ -0,0 +1,51 @@ +# DemaConsulting.SpdxTool print Command Design + +## Purpose + +The `print` command outputs one or more lines of text to the console. Variable +expansion is applied to each line so workflow variable values can be embedded in +the output. It is available from the command-line and from workflow YAML files. + +## Arguments / Inputs + +### Command-line usage + +```text +spdx-tool print [text] ... +``` + +Each positional argument is printed as a separate line. + +### Workflow YAML usage + +```yaml +- command: print + inputs: + text: + - Some text to print + - The value of variable is ${{ variable }} +``` + +The `text` input is a YAML sequence; each entry is printed as a line. +Variable expansion (`${{ variable }}`) is applied to each entry. + +## Implementation + +1. CLI path: iterates `args` and calls `context.WriteLine` for each argument. +2. Workflow path: reads the `text` sequence from `inputs`. Iterates each sequence + index using `GetSequenceString` (which applies variable expansion) and calls + `context.WriteLine`. + +## Error Handling + +| Condition | Exception | +| :--- | :--- | +| Missing `text` input (workflow) | `YamlException` | + +No error is raised if `text` is an empty sequence (nothing is printed). + +## Constraints + +- Variable expansion uses the standard `${{ variable }}` syntax via `GetSequenceString`. +- CLI path accepts zero or more arguments (zero arguments prints nothing). +- The `text` sequence in workflow mode is required; the key must be present. diff --git a/docs/design/commands/query.md b/docs/design/commands/query.md new file mode 100644 index 0000000..694bf55 --- /dev/null +++ b/docs/design/commands/query.md @@ -0,0 +1,65 @@ +# DemaConsulting.SpdxTool query Command Design + +## Purpose + +The `query` command executes an external program, captures its combined stdout and +stderr output, and extracts a value by matching lines against a regular expression +with a named capture group `value`. The captured value is written to the console +or stored in a workflow variable. + +## Arguments / Inputs + +### Command-line usage + +```text +spdx-tool query [args] +``` + +- `pattern` — Regular expression with a `(?...)` capture group. +- `program` — External program to execute. +- `args` — Zero or more arguments passed to the program. + +### Workflow YAML usage + +```yaml +- command: query + inputs: + output: # Output variable (required) + pattern: # Regex with 'value' capture group (required) + program: # Program to execute (required) + arguments: # Optional argument list + - + - +``` + +## Implementation + +1. Validates that `pattern` contains a `value` capture group; raises + `CommandUsageException` if not. +2. Constructs a `ProcessStartInfo` with `RedirectStandardOutput`, `RedirectStandardError`, + and `UseShellExecute = false`. +3. Starts the process; raises `CommandErrorException` if it cannot start. +4. Reads combined stdout + stderr, waits for exit. +5. Splits output into lines, trims each, and applies the regex. The first non-empty + `value` capture group match is returned. +6. CLI path: writes the result to console. +7. Workflow path: stores the result in `variables[output]`. + +## Error Handling + +| Condition | Exception | +| :--- | :--- | +| Fewer than 2 CLI arguments | `CommandUsageException` | +| Missing `output` input (workflow) | `YamlException` | +| Missing `pattern` input (workflow) | `YamlException` | +| Missing `program` input (workflow) | `YamlException` | +| Pattern missing `value` capture group | `CommandUsageException` | +| Program cannot be started | `CommandErrorException` | +| Pattern not found in program output | `CommandErrorException` | + +## Constraints + +- The regex is compiled with a 100 ms timeout per match to prevent ReDoS. +- Arguments in workflow mode undergo variable expansion. +- The match is performed per-line (not across multiple lines). +- Only the first matching `value` capture is used. diff --git a/docs/design/commands/rename-id.md b/docs/design/commands/rename-id.md new file mode 100644 index 0000000..8f3b80c --- /dev/null +++ b/docs/design/commands/rename-id.md @@ -0,0 +1,57 @@ +# DemaConsulting.SpdxTool rename-id Command Design + +## Purpose + +The `rename-id` command renames an SPDX element ID throughout an SPDX document, +updating all packages, files, snippets, relationships, and describes entries that +reference the old ID. It is available from the command-line and from workflow YAML +files. + +## Arguments / Inputs + +### Command-line usage + +```text +spdx-tool rename-id +``` + +### Workflow YAML usage + +```yaml +- command: rename-id + inputs: + spdx: # SPDX file name (required) + old: # Old element ID (required) + new: # New element ID (required) +``` + +## Implementation + +1. Reads `spdx`, `old`, and `new` from inputs. +2. Validates `old` and `new` IDs: + - Neither may be empty or `"SPDXRef-DOCUMENT"`. + - They must differ. + - `new` must not already be in use by another element. +3. Iterates all packages, files, snippets, relationships, and document describes + arrays, replacing every occurrence of `old` with `new` using `UpdateId`. +4. If `old == new`, returns without modification (no-op). + +## Error Handling + +| Condition | Exception | +| :--- | :--- | +| Not exactly 3 CLI arguments | `CommandUsageException` | +| Missing `spdx` input (workflow) | `YamlException` | +| Missing `new` input (workflow) | `YamlException` | +| Missing `old` input (workflow) | `YamlException` | +| Empty or `SPDXRef-DOCUMENT` old ID | `CommandUsageException` | +| Empty or `SPDXRef-DOCUMENT` new ID | `CommandUsageException` | +| New ID already in use | `CommandErrorException` | + +## Constraints + +- Renaming `old` to itself is silently treated as a no-op. +- The new ID must not collide with any existing package, file, or snippet ID. +- References in `HasFiles`, `RelatedSpdxElement`, and `Describes` arrays are all + updated so that referential integrity is maintained. +- Variable expansion is applied to all string inputs via `GetMapString`. diff --git a/docs/design/commands/run-workflow.md b/docs/design/commands/run-workflow.md new file mode 100644 index 0000000..a0c757a --- /dev/null +++ b/docs/design/commands/run-workflow.md @@ -0,0 +1,94 @@ +# DemaConsulting.SpdxTool run-workflow Command Design + +## Purpose + +The `run-workflow` command executes a multi-step SPDX workflow defined in a YAML +file, a URL, or a NuGet package. It supports parameterized workflows, integrity +verification, and output extraction. It is available from the command-line and +from workflow YAML files (workflows can be nested). + +## Arguments / Inputs + +### Command-line usage + +```text +spdx-tool run-workflow [parameter=value] [--verbose] +``` + +- `workflow.yaml` or `http://...` — Workflow file path or HTTP URL. +- `parameter=value` — Optional parameters passed to the workflow. +- `--verbose` — Print workflow outputs after execution. + +### Workflow YAML usage + +```yaml + +- command: run-workflow + + inputs: + file: # Optional local workflow file + url: # Optional workflow URL + nuget: # Optional NuGet package (requires file) + integrity: # Optional SHA-256 integrity check + parameters: # Optional parameter overrides + name: + outputs: # Optional output extraction + name: +``` + +## Implementation + +### CLI path + +1. Requires at least one argument (workflow path or URL). +2. Parses `--verbose` flag and `key=value` parameters. +3. Dispatches to `RunUrl` for HTTP paths or `RunFile` for local paths. +4. Optionally prints outputs if `--verbose`. + +### Workflow path + +1. Reads `file`, `url`, `nuget`, `integrity`, `parameters`, and `outputs`. +2. If `nuget` is specified, resolves the workflow file path from the local NuGet + + cache via `NuGetCache.EnsureCachedAsync`; `url` must not also be set; `file` + must specify the relative path within the package. + +3. Uses `PathHelpers.SafePathCombine` to prevent path traversal. +4. Dispatches to `RunFile` or `RunUrl`. +5. After execution, reads requested outputs from the returned variables map. + +### `RunBytes` + +1. Optionally verifies SHA-256 integrity against the provided hash. +2. Parses the YAML document. +3. Processes `parameters` section into local variables with expansion. +4. Validates that provided parameters are declared by the workflow. +5. Executes each `steps` entry by dispatching to `CommandsRegistry`. +6. Returns the resulting variables map as outputs. + +## Error Handling + +| Condition | Exception | +| :--- | :--- | +| No arguments (CLI) | `CommandUsageException` | +| Invalid `key=value` argument (CLI) | `CommandUsageException` | +| Both `file` and `url` specified | `YamlException` | +| Neither `file` nor `url` specified | `YamlException` | +| Both `nuget` and `url` specified | `YamlException` | +| `nuget` without `file` | `YamlException` | +| `nuget` value not `PackageName:version` format | `YamlException` | +| File not found | `CommandUsageException` | +| HTTP error fetching URL | `CommandErrorException` | +| Integrity check failure | `CommandErrorException` | +| Invalid YAML structure | `CommandErrorException` | +| Missing `steps` in workflow | `CommandErrorException` | +| Unknown command in step | `CommandUsageException` | +| Undeclared parameter | `CommandErrorException` | +| Requested output not produced | `CommandUsageException` | + +## Constraints + +- Workflows may be nested (a workflow step can call `run-workflow`). +- Each nested workflow has its own isolated variables scope. +- NuGet package resolution is synchronous (blocking) using `GetAwaiter().GetResult()`. +- Variable expansion is applied to step inputs via the standard `Expand` helper. diff --git a/docs/design/commands/set-variable.md b/docs/design/commands/set-variable.md new file mode 100644 index 0000000..64abb3e --- /dev/null +++ b/docs/design/commands/set-variable.md @@ -0,0 +1,41 @@ +# DemaConsulting.SpdxTool set-variable Command Design + +## Purpose + +The `set-variable` command sets a workflow variable to a specified value. It is +only valid inside a workflow YAML file; direct command-line invocation is rejected. + +## Arguments / Inputs + +This command is only valid inside a workflow YAML file: + +```yaml +- command: set-variable + inputs: + value: # New value (required) + output: # Variable name to set (required) +``` + +- `value` — The new value to assign; supports variable expansion. +- `output` — Name of the variable in the workflow's variables map to set. + +## Implementation + +1. Reads `value` and `output` from the `inputs` map. +2. Applies variable expansion to `value` via `GetMapString`. +3. Assigns `variables[output] = value`. + +## Error Handling + +| Condition | Exception | +| :--- | :--- | +| Invoked from command line (not workflow) | `CommandUsageException` | +| Missing `value` input | `YamlException` | +| Missing `output` input | `YamlException` | + +## Constraints + +- Available in workflow mode only; direct CLI invocation raises `CommandUsageException`. +- Variable expansion is applied to `value` before assignment, so the value can + reference other variables already set in the workflow. +- The `output` variable name is not expanded; it is used literally as the key. diff --git a/docs/design/commands/to-markdown.md b/docs/design/commands/to-markdown.md new file mode 100644 index 0000000..e40f1e1 --- /dev/null +++ b/docs/design/commands/to-markdown.md @@ -0,0 +1,80 @@ +# DemaConsulting.SpdxTool to-markdown Command Design + +## Purpose + +The `to-markdown` command generates a Markdown summary of an SPDX document. The +summary includes document metadata, root packages, non-root packages, and tool +packages, each in a formatted table. It is available from the command-line and +from workflow YAML files. + +## Arguments / Inputs + +### Command-line usage + +```text +spdx-tool to-markdown [title] [depth] +``` + +- `spdx.json` — SPDX document to summarize. +- `out.md` — Output Markdown file. +- `title` — Optional section title (default: `"SPDX Document"`). +- `depth` — Optional heading depth (integer ≥ 1, default: `2`). + +### Workflow YAML usage + +```yaml + +- command: to-markdown + + inputs: + spdx: # SPDX file name (required) + markdown: # Output Markdown file (required) + title: # Optional title (default: "SPDX Document") + depth: <depth> # Optional heading depth (default: 2) +``` + +## Implementation + +1. Loads the SPDX document. +2. Constructs the Markdown in a `StringBuilder`: + - A document summary table (file name, name, file/package/relationship counts, + + creation info). + + - Root packages table (packages returned by `doc.GetRootPackages()`). + - Non-root, non-tool packages table. + - Tools table (packages involved in `BUILD_TOOL_OF`, `DEV_TOOL_OF`, + + or `TEST_TOOL_OF` relationships). + +3. Writes the result to the output file via `File.WriteAllText`. + +### License helper + +`License(package)` returns `ConcludedLicense` if non-empty and not `"NOASSERTION"`, +then `DeclaredLicense`, then `"NOASSERTION"` as a fallback. + +## Error Handling + +| Condition | Exception | +| :--- | :--- | +| Fewer than 2 CLI arguments | `CommandUsageException` | +| Empty or whitespace `title` argument (CLI) | `CommandUsageException` | +| Invalid or non-positive `depth` argument (CLI) | `CommandUsageException` | +| Missing `spdx` input (workflow) | `YamlException` | +| Missing `markdown` input (workflow) | `YamlException` | +| Empty or whitespace `title` input (workflow) | `YamlException` | +| Invalid or non-positive `depth` input (workflow) | `YamlException` | + +## Constraints + +- The output file is overwritten unconditionally. +- Heading depth controls the number of `#` characters in section headers + + (`depth = 2` → `##`, `depth = 3` → `###`, etc.). + +- Sub-section headings use one extra `#` relative to the document heading + + (i.e. `depth + 1`). + +- Variable expansion is applied to all string inputs via `GetMapString`. diff --git a/docs/design/commands/update-package.md b/docs/design/commands/update-package.md new file mode 100644 index 0000000..5bec94f --- /dev/null +++ b/docs/design/commands/update-package.md @@ -0,0 +1,73 @@ +# DemaConsulting.SpdxTool update-package Command Design + +## Purpose + +The `update-package` command updates the metadata of an existing package in an +SPDX document. It is only valid inside a workflow YAML file; direct command-line +invocation is rejected. + +## Arguments / Inputs + +This command is only valid inside a workflow YAML file: + +```yaml + +- command: update-package + + inputs: + spdx: <spdx.json> # SPDX file name (required) + package: # Package identification and updates + id: <id> # Package ID to update (required) + name: <name> # Optional new name + download: <download-url> # Optional new download URL + version: <version> # Optional new version + filename: <filename> # Optional new filename + supplier: <supplier> # Optional new supplier + originator: <originator> # Optional new originator + homepage: <homepage> # Optional new homepage + copyright: <copyright> # Optional new copyright text + summary: <summary> # Optional new summary + description: <description> # Optional new description + license: <license> # Optional new license (sets both concluded and declared) +``` + +## Implementation + +1. Reads `spdx` and `package` inputs. +2. Reads `id` from the `package` sub-map. +3. `ParseUpdates` reads each optional field from the map into an + + `updates` dictionary, skipping absent keys. + +4. `UpdatePackageInSpdxFile` loads the document, finds the package by ID + + (raises `CommandErrorException` if not found), applies each update by + setting the corresponding property, and saves the document. + +### Supported update keys + +`name`, `download`, `version`, `filename`, `supplier`, `originator`, `homepage`, +`copyright`, `summary`, `description`, `license`. +Any other key raises `CommandErrorException`. + +When `license` is updated, both `ConcludedLicense` and `DeclaredLicense` are set. + +## Error Handling + +| Condition | Exception | +| :--- | :--- | +| Invoked from command line (not workflow) | `CommandUsageException` | +| Missing `spdx` input | `YamlException` | +| Missing `package` input | `YamlException` | +| Missing `package.id` input | `YamlException` | +| Package ID not found in document | `CommandErrorException` | +| Invalid update key | `CommandErrorException` | + +## Constraints + +- Available in workflow mode only; direct CLI invocation raises `CommandUsageException`. +- Only the fields present in the `package` map are updated; absent fields leave + + the existing values unchanged. + +- Variable expansion is applied to all string inputs via `GetMapString`. diff --git a/docs/design/commands/validate.md b/docs/design/commands/validate.md new file mode 100644 index 0000000..ba0defd --- /dev/null +++ b/docs/design/commands/validate.md @@ -0,0 +1,56 @@ +# DemaConsulting.SpdxTool validate Command Design + +## Purpose + +The `validate` command validates an SPDX document for specification conformance +issues. It optionally checks for NTIA (National Telecommunications and Information +Administration) minimum elements compliance. It is available from the command-line +and from workflow YAML files. + +## Arguments / Inputs + +### Command-line usage + +```text +spdx-tool validate <spdx.json> [ntia] +``` + +- `spdx.json` — SPDX document to validate. +- `ntia` — Optional flag; enables NTIA minimum elements checking. + +### Workflow YAML usage + +```yaml +- command: validate + inputs: + spdx: <spdx.json> # SPDX file name (required) + ntia: true # Optional NTIA check (default: false) +``` + +## Implementation + +1. Reads `spdx` and optionally `ntia` from inputs. +2. Loads the SPDX document. +3. Calls `doc.Validate(issues, ntia)` from the SPDX model to collect issues. +4. If no issues are found, returns silently. +5. If issues are found: + - Each issue is written as a warning via `context.WriteWarning`. + - A blank line is written. + - A `CommandErrorException` is raised with the count of issues. + +## Error Handling + +| Condition | Exception | +| :--- | :--- | +| No arguments (CLI) | `CommandUsageException` | +| Missing `spdx` input (workflow) | `YamlException` | +| SPDX document has validation issues | `CommandErrorException` | + +## Constraints + +- The `ntia` flag is detected in CLI mode by searching for the string `"ntia"` in + the arguments after the first (case-sensitive). +- In workflow mode, `ntia` is case-insensitively compared to `"true"`. +- All validation issues are reported as warnings before the error is raised, so the + caller can inspect the full list of problems. +- Variable expansion is applied to all string inputs via `GetMapString`. diff --git a/docs/design/introduction.md b/docs/design/introduction.md new file mode 100644 index 0000000..6b5ad2e --- /dev/null +++ b/docs/design/introduction.md @@ -0,0 +1,151 @@ +# DemaConsulting.SpdxTool Design Introduction + +## Purpose + +This document introduces the design of two related but independent systems in this +repository: + +- **DemaConsulting.SpdxTool** — a .NET tool for creating, validating, and + manipulating SPDX (Software Package Data Exchange) documents. +- **DemaConsulting.SpdxTool.Targets** — an MSBuild targets extension that integrates + SPDX document decoration into the standard `dotnet pack` build workflow. + +This document serves as the entry point for design documentation supporting formal +code review, compliance evidence, and maintenance activities. + +## Scope + +This design documentation covers both systems and all their constituent subsystems +and units. It applies to all source code under `src/`. Third-party (OTS) components +are referenced but not designed in detail. + +## Software Structure + +### DemaConsulting.SpdxTool (System) + +```text +DemaConsulting.SpdxTool (System) +├── Commands (Subsystem) +│ ├── AddPackage.cs (Unit) +│ ├── AddRelationship.cs (Unit) +│ ├── Command.cs (Unit) +│ ├── CommandEntry.cs (Unit) +│ ├── CommandErrorException.cs (Unit) +│ ├── CommandRegistry.cs (Unit) +│ ├── CommandUsageException.cs (Unit) +│ ├── CopyPackage.cs (Unit) +│ ├── Diagram.cs (Unit) +│ ├── FindPackage.cs (Unit) +│ ├── GetVersion.cs (Unit) +│ ├── Hash.cs (Unit) +│ ├── Help.cs (Unit) +│ ├── Print.cs (Unit) +│ ├── Query.cs (Unit) +│ ├── RenameId.cs (Unit) +│ ├── RunWorkflow.cs (Unit) +│ ├── SetVariable.cs (Unit) +│ ├── ToMarkdown.cs (Unit) +│ ├── UpdatePackage.cs (Unit) +│ └── Validate.cs (Unit) +├── SelfTest (Subsystem) +│ ├── Validate.cs (Unit) +│ ├── ValidateAddPackage.cs (Unit) +│ ├── ValidateAddRelationship.cs (Unit) +│ ├── ValidateBasic.cs (Unit) +│ ├── ValidateCopyPackage.cs (Unit) +│ ├── ValidateDiagram.cs (Unit) +│ ├── ValidateFindPackage.cs (Unit) +│ ├── ValidateGetVersion.cs (Unit) +│ ├── ValidateHash.cs (Unit) +│ ├── ValidateNtia.cs (Unit) +│ ├── ValidateQuery.cs (Unit) +│ ├── ValidateRenameId.cs (Unit) +│ ├── ValidateRunNuGetWorkflow.cs (Unit) +│ ├── ValidateToMarkdown.cs (Unit) +│ └── ValidateUpdatePackage.cs (Unit) +├── Utility (Subsystem) +│ ├── RelationshipDirection.cs (Unit) +│ ├── SpdxHelpers.cs (Unit) +│ ├── PathHelpers.cs (Unit) +│ └── Wildcard.cs (Unit) +├── Context.cs (Unit) +└── Program.cs (Unit) +``` + +### DemaConsulting.SpdxTool.Targets (System) + +```text +DemaConsulting.SpdxTool.Targets (System) +├── build/DemaConsulting.SpdxTool.Targets.targets (Unit) +└── buildMultiTargeting/DemaConsulting.SpdxTool.Targets.targets (Unit) +``` + +## Folder Layout + +```text +src/DemaConsulting.SpdxTool/ +├── Commands/ +│ ├── AddPackage.cs — add-package command implementation +│ ├── AddRelationship.cs — add-relationship command implementation +│ ├── Command.cs — abstract base class for all commands +│ ├── CommandEntry.cs — command entry/dispatch logic +│ ├── CommandErrorException.cs — exception for command errors +│ ├── CommandRegistry.cs — registry of all available commands +│ ├── CommandUsageException.cs — exception for command usage errors +│ ├── CopyPackage.cs — copy-package command implementation +│ ├── Diagram.cs — diagram command implementation +│ ├── FindPackage.cs — find-package command implementation +│ ├── GetVersion.cs — get-version command implementation +│ ├── Hash.cs — hash command implementation +│ ├── Help.cs — help command implementation +│ ├── Print.cs — print command implementation +│ ├── Query.cs — query command implementation +│ ├── RenameId.cs — rename-id command implementation +│ ├── RunWorkflow.cs — run-workflow command implementation +│ ├── SetVariable.cs — set-variable command implementation +│ ├── ToMarkdown.cs — to-markdown command implementation +│ ├── UpdatePackage.cs — update-package command implementation +│ └── Validate.cs — validate command implementation +├── SelfTest/ +│ ├── Validate.cs — self-test orchestrator +│ ├── ValidateAddPackage.cs — validates add-package command +│ ├── ValidateAddRelationship.cs — validates add-relationship command +│ ├── ValidateBasic.cs — validates basic tool functionality +│ ├── ValidateCopyPackage.cs — validates copy-package command +│ ├── ValidateDiagram.cs — validates diagram command +│ ├── ValidateFindPackage.cs — validates find-package command +│ ├── ValidateGetVersion.cs — validates get-version command +│ ├── ValidateHash.cs — validates hash command +│ ├── ValidateNtia.cs — validates NTIA validation command +│ ├── ValidateQuery.cs — validates query command +│ ├── ValidateRenameId.cs — validates rename-id command +│ ├── ValidateRunNuGetWorkflow.cs — validates NuGet workflow execution +│ ├── ValidateToMarkdown.cs — validates to-markdown command +│ └── ValidateUpdatePackage.cs — validates update-package command +├── Spdx/ +│ ├── RelationshipDirection.cs — SPDX relationship direction enumeration +│ └── SpdxHelpers.cs — SPDX document utility helpers +├── Utility/ +│ ├── PathHelpers.cs — file path utility helpers +│ └── Wildcard.cs — wildcard pattern matching +├── Context.cs — execution context (output, logging) +└── Program.cs — tool entry point and CLI parsing + +src/DemaConsulting.SpdxTool.Targets/ +├── build/ +│ └── DemaConsulting.SpdxTool.Targets.targets — single-TFM MSBuild targets +└── buildMultiTargeting/ + └── DemaConsulting.SpdxTool.Targets.targets — multi-TFM MSBuild targets +``` + +## Per-Unit Design Documentation + +Per-unit design documentation is maintained for Commands and SelfTest subsystem units: + +- `docs/design/commands/<command>.md` — design doc for each command unit +- `docs/design/self-test/<unit>.md` — design doc for each SelfTest unit + +Per-unit requirements are maintained alongside the design docs: + +- `docs/reqstream/commands/<command>.yaml` — requirements for each command unit +- `docs/reqstream/self-test/<unit>.yaml` — requirements for each SelfTest unit diff --git a/docs/design/self-test/self-test.md b/docs/design/self-test/self-test.md new file mode 100644 index 0000000..a279c6c --- /dev/null +++ b/docs/design/self-test/self-test.md @@ -0,0 +1,87 @@ +# DemaConsulting.SpdxTool SelfTest Subsystem Design + +## Purpose + +The SelfTest subsystem implements the `--validate` self-test suite for +DemaConsulting.SpdxTool. It exercises every command against embedded SPDX fixtures +to verify that the tool is functioning correctly after installation or deployment, +without requiring external tools or network access. + +## Architecture + +### Orchestrator + +`Validate.cs` is the entry point for self-validation. When `Program` detects the +`--validate` flag, it calls `Validate.Run(Context)` instead of dispatching to a +command. `Validate.Run` creates a temporary working directory, copies embedded SPDX +fixture files into it, and then invokes each `Validate*` step class in sequence. + +### Validation Steps + +Each `Validate*.cs` class tests one or more commands by invoking them through the +`CommandRegistry` against the fixture files. Results are collected as pass/fail entries +and reported to the `Context` output stream. + +| Step Class | Commands Exercised | +|-----------------------------|------------------------------| +| `ValidateBasic` | version, help, silent, log | +| `ValidateAddPackage` | add-package, run-workflow | +| `ValidateAddRelationship` | add-relationship | +| `ValidateCopyPackage` | copy-package | +| `ValidateDiagram` | diagram | +| `ValidateFindPackage` | find-package | +| `ValidateGetVersion` | get-version | +| `ValidateHash` | hash | +| `ValidateNtia` | validate (NTIA check) | +| `ValidateQuery` | query | +| `ValidateRenameId` | rename-id | +| `ValidateRunNuGetWorkflow` | run-workflow (NuGet) | +| `ValidateToMarkdown` | to-markdown | +| `ValidateUpdatePackage` | update-package | + +## Result Reporting + +Self-validation results are reported in three ways: + +1. **Console output**: Pass/fail status for each test is written to the `Context` + output stream, with optional depth control (`--depth`) to show hierarchical detail. +2. **TRX output**: When the `--result` flag specifies a `.trx` file path, results are + written in Visual Studio TRX format for integration with CI/CD test reporting tools. +3. **JUnit XML output**: When the `--result` flag specifies a `.xml` file path, results + are written in JUnit XML format for integration with CI/CD systems that consume + JUnit reports. + +## Data Flow + +```text +Program.cs detects --validate flag + │ + ▼ +Validate.Run(Context) + │ + ├─► Create temporary working directory + │ + ├─► Copy embedded SPDX fixture files + │ + ├─► For each Validate* step: + │ │ + │ ├─► Invoke command(s) via CommandRegistry + │ │ + │ └─► Record pass/fail result + │ + └─► Report results + ├─► Console (with optional depth) + ├─► TRX file (if --result *.trx) + └─► JUnit XML file (if --result *.xml) +``` + +## Design Constraints + +- Most self-validation steps run entirely in-process; however, `ValidateQuery` spawns + `dotnet` as an external process and requires `dotnet` on the system `PATH`, and + `ValidateRunNuGetWorkflow` may restore a NuGet package on a cache miss (requiring + network access to NuGet feeds). +- Fixture files are embedded as resources to ensure they are always available. +- The temporary working directory is cleaned up after validation completes. +- Self-validation bypasses normal command dispatch; the `--validate` flag is processed + before command name lookup in `Program`. diff --git a/docs/design/self-test/validate-add-package.md b/docs/design/self-test/validate-add-package.md new file mode 100644 index 0000000..0af8bcf --- /dev/null +++ b/docs/design/self-test/validate-add-package.md @@ -0,0 +1,47 @@ +# DemaConsulting.SpdxTool ValidateAddPackage SelfTest Design + +## Purpose + +`ValidateAddPackage.cs` exercises the `add-package` command end-to-end within the +SelfTest subsystem. It verifies that a package can be added to an SPDX document +via a workflow file, and that the resulting document contains the expected content. + +## Test: `SpdxTool_AddPackage` + +### Setup + +1. Creates a `validate.tmp` working directory. +2. Writes a minimal SPDX JSON document (`test.spdx.json`) containing one package + + (`SPDXRef-Package-1`). + +3. Writes a workflow YAML (`workflow.yaml`) that executes the `add-package` command + + to add `SPDXRef-Package-2` with a `BUILD_TOOL_OF` relationship to `SPDXRef-Package-1`, + including a `purl` external reference. + +### Execution + +Calls `Validate.RunSpdxTool("validate.tmp", ["--silent", "run-workflow", "workflow.yaml"])`. + +### Verification + +Reads the modified SPDX document and verifies: + +- Exactly two packages exist with IDs `SPDXRef-Package-1` and `SPDXRef-Package-2`. +- A `BUILD_TOOL_OF` relationship exists from `SPDXRef-Package-2` to `SPDXRef-Package-1`. + +### Teardown + +Deletes the `validate.tmp` directory. + +## Error Handling + +- Returns `false` if `RunSpdxTool` returns a non-zero exit code. +- Returns `false` if the document structure does not match expectations. +- The result is recorded in the `TestResults` collection as `Passed` or `Failed`. + +## Constraints + +- The test is self-contained; all fixture data is embedded as string literals. +- The temporary directory is always deleted in a `finally` block. diff --git a/docs/design/self-test/validate-add-relationship.md b/docs/design/self-test/validate-add-relationship.md new file mode 100644 index 0000000..6307b96 --- /dev/null +++ b/docs/design/self-test/validate-add-relationship.md @@ -0,0 +1,43 @@ +# DemaConsulting.SpdxTool ValidateAddRelationship SelfTest Design + +## Purpose + +`ValidateAddRelationship.cs` exercises the `add-relationship` command end-to-end +within the SelfTest subsystem. It verifies that a relationship can be added between +existing SPDX elements, both via command-line and via workflow, and that the resulting +document contains the expected relationship entries. + +## Test: `SpdxTool_AddRelationship` + +### Setup + +1. Creates a `validate.tmp` working directory. +2. Writes a minimal SPDX JSON document containing two packages. +3. Writes a workflow YAML that executes `add-relationship` to add a relationship + + between the two packages. + +### Execution + +Calls `Validate.RunSpdxTool("validate.tmp", [...])` with the appropriate arguments. + +### Verification + +Reads the modified SPDX document and verifies: + +- The expected relationship exists with the correct type and element IDs. + +### Teardown + +Deletes the `validate.tmp` directory. + +## Error Handling + +- Returns `false` if `RunSpdxTool` returns a non-zero exit code. +- Returns `false` if the document structure does not match expectations. +- The result is recorded in the `TestResults` collection as `Passed` or `Failed`. + +## Constraints + +- The test is self-contained; all fixture data is embedded as string literals. +- The temporary directory is always deleted in a `finally` block. diff --git a/docs/design/self-test/validate-basic.md b/docs/design/self-test/validate-basic.md new file mode 100644 index 0000000..6ecc6f1 --- /dev/null +++ b/docs/design/self-test/validate-basic.md @@ -0,0 +1,48 @@ +# DemaConsulting.SpdxTool ValidateBasic SelfTest Design + +## Purpose + +`ValidateBasic.cs` exercises basic tool functionality within the SelfTest subsystem. +It verifies that the tool handles valid and invalid SPDX documents correctly using +the `validate` command. + +## Test: `SpdxTool_Basic` + +### Sub-tests + +The test runs two sub-tests: + +**DoValidateValid**: Verifies that a well-formed SPDX document passes validation +without errors (exit code 0). + +**DoValidateInvalid**: Verifies that a malformed SPDX document fails validation +(non-zero exit code). + +### Setup + +1. Creates a `validate.tmp` working directory. +2. Writes SPDX fixture files (valid and invalid variants). + +### Execution + +Calls `Validate.RunSpdxTool("validate.tmp", ["--silent", "validate", ...])` for +each sub-test. + +### Verification + +- Valid document: exit code must be 0. +- Invalid document: exit code must be non-zero. + +### Teardown + +Deletes the `validate.tmp` directory. + +## Error Handling + +- Returns `false` if either sub-test produces an unexpected exit code. +- The result is recorded in the `TestResults` collection as `Passed` or `Failed`. + +## Constraints + +- The test exercises the `validate` command (not the `--validate` self-test flag). +- The temporary directory is always deleted in a `finally` block. diff --git a/docs/design/self-test/validate-copy-package.md b/docs/design/self-test/validate-copy-package.md new file mode 100644 index 0000000..9295818 --- /dev/null +++ b/docs/design/self-test/validate-copy-package.md @@ -0,0 +1,42 @@ +# DemaConsulting.SpdxTool ValidateCopyPackage SelfTest Design + +## Purpose + +`ValidateCopyPackage.cs` exercises the `copy-package` command end-to-end within +the SelfTest subsystem. It verifies that a package can be copied from one SPDX +document to another, with the destination document updated correctly. + +## Test: `SpdxTool_CopyPackage` + +### Setup + +1. Creates a `validate.tmp` working directory. +2. Writes two SPDX JSON documents: a source document containing the package to + + copy, and a destination document to receive the copy. + +3. Writes a workflow YAML that executes the `copy-package` command. + +### Execution + +Calls `Validate.RunSpdxTool("validate.tmp", ["--silent", "run-workflow", "workflow.yaml"])`. + +### Verification + +Reads the destination SPDX document and verifies that the copied package is present +with the expected ID and metadata. + +### Teardown + +Deletes the `validate.tmp` directory. + +## Error Handling + +- Returns `false` if `RunSpdxTool` returns a non-zero exit code. +- Returns `false` if the destination document does not contain the expected package. +- The result is recorded in the `TestResults` collection as `Passed` or `Failed`. + +## Constraints + +- The test is self-contained; all fixture data is embedded as string literals. +- The temporary directory is always deleted in a `finally` block. diff --git a/docs/design/self-test/validate-diagram.md b/docs/design/self-test/validate-diagram.md new file mode 100644 index 0000000..2374e92 --- /dev/null +++ b/docs/design/self-test/validate-diagram.md @@ -0,0 +1,41 @@ +# DemaConsulting.SpdxTool ValidateDiagram SelfTest Design + +## Purpose + +`ValidateDiagram.cs` exercises the `diagram` command end-to-end within the SelfTest +subsystem. It verifies that a Mermaid diagram can be generated from an SPDX document +and that the output file is created with expected content. + +## Test: `SpdxTool_Diagram` + +### Setup + +1. Creates a `validate.tmp` working directory. +2. Writes an SPDX JSON document containing packages with relationships suitable + + for diagram generation. + +### Execution + +Calls `Validate.RunSpdxTool("validate.tmp", ["--silent", "diagram", ...])` or via +a workflow YAML. + +### Verification + +- Checks that the output Mermaid file exists and is non-empty. +- Verifies that the file contains `erDiagram` as expected. + +### Teardown + +Deletes the `validate.tmp` directory. + +## Error Handling + +- Returns `false` if `RunSpdxTool` returns a non-zero exit code. +- Returns `false` if the output file does not exist or lacks expected content. +- The result is recorded in the `TestResults` collection as `Passed` or `Failed`. + +## Constraints + +- The test is self-contained; all fixture data is embedded as string literals. +- The temporary directory is always deleted in a `finally` block. diff --git a/docs/design/self-test/validate-find-package.md b/docs/design/self-test/validate-find-package.md new file mode 100644 index 0000000..787de15 --- /dev/null +++ b/docs/design/self-test/validate-find-package.md @@ -0,0 +1,39 @@ +# DemaConsulting.SpdxTool ValidateFindPackage SelfTest Design + +## Purpose + +`ValidateFindPackage.cs` exercises the `find-package` command end-to-end within +the SelfTest subsystem. It verifies that a package can be located in an SPDX +document by criteria and that its ID is returned correctly. + +## Test: `SpdxTool_FindPackage` + +### Setup + +1. Creates a `validate.tmp` working directory. +2. Writes an SPDX JSON document containing one or more packages. +3. Writes a workflow YAML that executes `find-package` with specific criteria. + +### Execution + +Calls `Validate.RunSpdxTool("validate.tmp", ["--silent", "run-workflow", "workflow.yaml"])`. + +### Verification + +Verifies that the workflow completed successfully and the found package ID matches +the expected value. + +### Teardown + +Deletes the `validate.tmp` directory. + +## Error Handling + +- Returns `false` if `RunSpdxTool` returns a non-zero exit code. +- Returns `false` if the found package ID does not match expectations. +- The result is recorded in the `TestResults` collection as `Passed` or `Failed`. + +## Constraints + +- The test is self-contained; all fixture data is embedded as string literals. +- The temporary directory is always deleted in a `finally` block. diff --git a/docs/design/self-test/validate-get-version.md b/docs/design/self-test/validate-get-version.md new file mode 100644 index 0000000..d52b15d --- /dev/null +++ b/docs/design/self-test/validate-get-version.md @@ -0,0 +1,39 @@ +# DemaConsulting.SpdxTool ValidateGetVersion SelfTest Design + +## Purpose + +`ValidateGetVersion.cs` exercises the `get-version` command end-to-end within +the SelfTest subsystem. It verifies that a package version can be retrieved from +an SPDX document by criteria. + +## Test: `SpdxTool_GetVersion` + +### Setup + +1. Creates a `validate.tmp` working directory. +2. Writes an SPDX JSON document containing a package with a known version. +3. Writes a workflow YAML that executes `get-version` to retrieve the version. + +### Execution + +Calls `Validate.RunSpdxTool("validate.tmp", ["--silent", "run-workflow", "workflow.yaml"])`. + +### Verification + +Verifies that the workflow completed successfully and the extracted version matches +the known expected value. + +### Teardown + +Deletes the `validate.tmp` directory. + +## Error Handling + +- Returns `false` if `RunSpdxTool` returns a non-zero exit code. +- Returns `false` if the extracted version does not match expectations. +- The result is recorded in the `TestResults` collection as `Passed` or `Failed`. + +## Constraints + +- The test is self-contained; all fixture data is embedded as string literals. +- The temporary directory is always deleted in a `finally` block. diff --git a/docs/design/self-test/validate-hash.md b/docs/design/self-test/validate-hash.md new file mode 100644 index 0000000..e17d0b4 --- /dev/null +++ b/docs/design/self-test/validate-hash.md @@ -0,0 +1,39 @@ +# DemaConsulting.SpdxTool ValidateHash SelfTest Design + +## Purpose + +`ValidateHash.cs` exercises the `hash` command end-to-end within the SelfTest +subsystem. It verifies that a SHA-256 hash can be generated for a file and then +successfully verified. + +## Test: `SpdxTool_Hash` + +### Setup + +1. Creates a `validate.tmp` working directory. +2. Writes a test file to hash. + +### Execution + +1. Calls `Validate.RunSpdxTool("validate.tmp", ["--silent", "hash", "generate", "sha256", "<file>"])`. +2. Calls `Validate.RunSpdxTool("validate.tmp", ["--silent", "hash", "verify", "sha256", "<file>"])`. + +### Verification + +- Both invocations must return exit code 0. +- The `.sha256` hash file must exist after generate. + +### Teardown + +Deletes the `validate.tmp` directory. + +## Error Handling + +- Returns `false` if either `RunSpdxTool` call returns a non-zero exit code. +- Returns `false` if the hash file is not created. +- The result is recorded in the `TestResults` collection as `Passed` or `Failed`. + +## Constraints + +- The test is self-contained; all fixture data is embedded as string literals. +- The temporary directory is always deleted in a `finally` block. diff --git a/docs/design/self-test/validate-ntia.md b/docs/design/self-test/validate-ntia.md new file mode 100644 index 0000000..75fa668 --- /dev/null +++ b/docs/design/self-test/validate-ntia.md @@ -0,0 +1,38 @@ +# DemaConsulting.SpdxTool ValidateNtia SelfTest Design + +## Purpose + +`ValidateNtia.cs` exercises the NTIA minimum elements validation within the +SelfTest subsystem. It verifies that the `validate` command correctly identifies +NTIA compliance or non-compliance in SPDX documents. + +## Test: `SpdxTool_Ntia` + +### Setup + +1. Creates a `validate.tmp` working directory. +2. Writes SPDX JSON documents — one NTIA-compliant and one non-compliant. + +### Execution + +1. Calls `Validate.RunSpdxTool("validate.tmp", ["--silent", "validate", "<compliant.spdx.json>", "ntia"])`. +2. Calls `Validate.RunSpdxTool("validate.tmp", ["--silent", "validate", "<noncompliant.spdx.json>", "ntia"])`. + +### Verification + +- Compliant document: exit code must be 0. +- Non-compliant document: exit code must be non-zero. + +### Teardown + +Deletes the `validate.tmp` directory. + +## Error Handling + +- Returns `false` if either sub-test produces an unexpected exit code. +- The result is recorded in the `TestResults` collection as `Passed` or `Failed`. + +## Constraints + +- The test is self-contained; all fixture data is embedded as string literals. +- The temporary directory is always deleted in a `finally` block. diff --git a/docs/design/self-test/validate-query.md b/docs/design/self-test/validate-query.md new file mode 100644 index 0000000..e5a3470 --- /dev/null +++ b/docs/design/self-test/validate-query.md @@ -0,0 +1,40 @@ +# DemaConsulting.SpdxTool ValidateQuery SelfTest Design + +## Purpose + +`ValidateQuery.cs` exercises the `query` command end-to-end within the SelfTest +subsystem. It verifies that an external program can be queried and a value extracted +from its output using a regular expression pattern. + +## Test: `SpdxTool_Query` + +### Setup + +1. Creates a `validate.tmp` working directory. +2. Writes a workflow YAML that executes `query` against a known program + + (e.g., `dotnet --version`) to extract a version string. + +### Execution + +Calls `Validate.RunSpdxTool("validate.tmp", ["--silent", "run-workflow", "workflow.yaml"])`. + +### Verification + +- The workflow must complete with exit code 0. +- The extracted value must match the expected pattern. + +### Teardown + +Deletes the `validate.tmp` directory. + +## Error Handling + +- Returns `false` if `RunSpdxTool` returns a non-zero exit code. +- Returns `false` if the extracted value does not match expectations. +- The result is recorded in the `TestResults` collection as `Passed` or `Failed`. + +## Constraints + +- The test requires `dotnet` to be available on the system PATH. +- The temporary directory is always deleted in a `finally` block. diff --git a/docs/design/self-test/validate-rename-id.md b/docs/design/self-test/validate-rename-id.md new file mode 100644 index 0000000..7675dbf --- /dev/null +++ b/docs/design/self-test/validate-rename-id.md @@ -0,0 +1,40 @@ +# DemaConsulting.SpdxTool ValidateRenameId SelfTest Design + +## Purpose + +`ValidateRenameId.cs` exercises the `rename-id` command end-to-end within the +SelfTest subsystem. It verifies that an SPDX element ID can be renamed throughout +an SPDX document, with all references updated correctly. + +## Test: `SpdxTool_RenameId` + +### Setup + +1. Creates a `validate.tmp` working directory. +2. Writes an SPDX JSON document containing a package whose ID will be renamed. + +### Execution + +Calls `Validate.RunSpdxTool("validate.tmp", ["--silent", "rename-id", "<spdx.json>", "<old-id>", "<new-id>"])`. + +### Verification + +Reads the modified SPDX document and verifies: + +- The package now has the new ID. +- All relationship references have been updated to use the new ID. + +### Teardown + +Deletes the `validate.tmp` directory. + +## Error Handling + +- Returns `false` if `RunSpdxTool` returns a non-zero exit code. +- Returns `false` if the document does not reflect the rename. +- The result is recorded in the `TestResults` collection as `Passed` or `Failed`. + +## Constraints + +- The test is self-contained; all fixture data is embedded as string literals. +- The temporary directory is always deleted in a `finally` block. diff --git a/docs/design/self-test/validate-run-nuget-workflow.md b/docs/design/self-test/validate-run-nuget-workflow.md new file mode 100644 index 0000000..b404b28 --- /dev/null +++ b/docs/design/self-test/validate-run-nuget-workflow.md @@ -0,0 +1,44 @@ +# DemaConsulting.SpdxTool ValidateRunNuGetWorkflow SelfTest Design + +## Purpose + +`ValidateRunNuGetWorkflow.cs` exercises the `run-workflow` command's NuGet package +support within the SelfTest subsystem. It verifies that a workflow file can be +resolved from a NuGet package in the local NuGet cache and executed successfully. + +## Test: `SpdxTool_RunNuGetWorkflow` + +### Setup + +1. Creates a `validate.tmp` working directory. +2. Writes an SPDX JSON document as a target for the NuGet workflow. +3. Writes a workflow YAML that uses the `nuget:` input to reference a known + + NuGet package and a workflow file within it. + +### Execution + +Calls `Validate.RunSpdxTool("validate.tmp", ["--silent", "run-workflow", "workflow.yaml"])`. + +### Verification + +- The workflow must complete with exit code 0. +- The SPDX document must be updated as expected by the NuGet workflow. + +### Teardown + +Deletes the `validate.tmp` directory. + +## Error Handling + +- Returns `false` if `RunSpdxTool` returns a non-zero exit code. +- Returns `false` if the SPDX document is not updated as expected. +- The result is recorded in the `TestResults` collection as `Passed` or `Failed`. + +## Constraints + +- Requires internet or NuGet cache access to download/restore the NuGet package. +- The temporary directory is always deleted in a `finally` block. +- `PathHelpers.SafePathCombine` is used to prevent path traversal when resolving + + the workflow file within the NuGet package. diff --git a/docs/design/self-test/validate-to-markdown.md b/docs/design/self-test/validate-to-markdown.md new file mode 100644 index 0000000..4c90fdd --- /dev/null +++ b/docs/design/self-test/validate-to-markdown.md @@ -0,0 +1,38 @@ +# DemaConsulting.SpdxTool ValidateToMarkdown SelfTest Design + +## Purpose + +`ValidateToMarkdown.cs` exercises the `to-markdown` command end-to-end within the +SelfTest subsystem. It verifies that an SPDX document can be converted to a +Markdown summary file. + +## Test: `SpdxTool_ToMarkdown` + +### Setup + +1. Creates a `validate.tmp` working directory. +2. Writes an SPDX JSON document containing packages and metadata. + +### Execution + +Calls `Validate.RunSpdxTool("validate.tmp", ["--silent", "to-markdown", "<spdx.json>", "<out.md>"])`. + +### Verification + +- The workflow must complete with exit code 0. +- The output Markdown file must exist and contain expected table headers and content. + +### Teardown + +Deletes the `validate.tmp` directory. + +## Error Handling + +- Returns `false` if `RunSpdxTool` returns a non-zero exit code. +- Returns `false` if the Markdown output does not match expectations. +- The result is recorded in the `TestResults` collection as `Passed` or `Failed`. + +## Constraints + +- The test is self-contained; all fixture data is embedded as string literals. +- The temporary directory is always deleted in a `finally` block. diff --git a/docs/design/self-test/validate-update-package.md b/docs/design/self-test/validate-update-package.md new file mode 100644 index 0000000..72ad842 --- /dev/null +++ b/docs/design/self-test/validate-update-package.md @@ -0,0 +1,41 @@ +# DemaConsulting.SpdxTool ValidateUpdatePackage SelfTest Design + +## Purpose + +`ValidateUpdatePackage.cs` exercises the `update-package` command end-to-end within +the SelfTest subsystem. It verifies that package metadata fields can be updated in +an SPDX document via a workflow file. + +## Test: `SpdxTool_UpdatePackage` + +### Setup + +1. Creates a `validate.tmp` working directory. +2. Writes an SPDX JSON document containing a package with initial metadata. +3. Writes a workflow YAML that executes the `update-package` command to change + + one or more fields (e.g., version, supplier). + +### Execution + +Calls `Validate.RunSpdxTool("validate.tmp", ["--silent", "run-workflow", "workflow.yaml"])`. + +### Verification + +Reads the modified SPDX document and verifies that the updated fields match the +new values specified in the workflow. + +### Teardown + +Deletes the `validate.tmp` directory. + +## Error Handling + +- Returns `false` if `RunSpdxTool` returns a non-zero exit code. +- Returns `false` if the updated package fields do not match expectations. +- The result is recorded in the `TestResults` collection as `Passed` or `Failed`. + +## Constraints + +- The test is self-contained; all fixture data is embedded as string literals. +- The temporary directory is always deleted in a `finally` block. diff --git a/docs/design/self-test/validate.md b/docs/design/self-test/validate.md new file mode 100644 index 0000000..c8458c2 --- /dev/null +++ b/docs/design/self-test/validate.md @@ -0,0 +1,66 @@ +# DemaConsulting.SpdxTool SelfTest Orchestrator Design + +## Purpose + +`Validate.cs` is the entry point for the SelfTest subsystem. When the `Program` +class detects the `--validate` flag, it calls `Validate.Run(Context)` instead of +dispatching to a normal command. The orchestrator collects pass/fail results from +each individual validation step and writes a summary report. + +## Architecture + +`Validate.Run` performs the following work: + +1. Writes a system information header (version, OS, .NET runtime, timestamp). +2. Creates a `TestResults` object to collect results. +3. Invokes each `Validate*` step class in order: + - `ValidateAddPackage`, `ValidateAddRelationship`, `ValidateBasic`, + + `ValidateCopyPackage`, `ValidateDiagram`, `ValidateFindPackage`, + `ValidateGetVersion`, `ValidateHash`, `ValidateNtia`, `ValidateQuery`, + `ValidateRenameId`, `ValidateRunNuGetWorkflow`, `ValidateToMarkdown`, + `ValidateUpdatePackage`. + +4. Computes totals (total, passed, failed) and writes to the console. +5. If `Context.Errors == 0`, writes "Validation Passed". +6. If `Context.ValidationFile` is set, calls `WriteResultsFile`. + +## Result File Writing + +`WriteResultsFile` detects the file extension: + +- `.trx` → serializes with `TrxSerializer.Serialize`. +- `.xml` → serializes with `JUnitSerializer.Serialize` (JUnit format). +- Other → writes an error to the context. + +## Helper Methods + +- `RunSpdxTool(string[] args)` — creates a `Context`, runs `Program.Run`, returns + + the exit code. Used by all `Validate*` step classes. + +- `RunSpdxTool(string workingFolder, string[] args)` — temporarily changes the + + current directory before calling `RunSpdxTool(args)`. + +## Error Handling + +- Individual step failures are captured in `TestResult` entries with + + `TestOutcome.Failed`; they do not terminate the orchestrator. + +- Unsupported result file extensions result in a context error message. + +## Constraints + +- Self-validation is entirely in-process; no external tools or network access are + + required (other than the NuGet workflow test). + +- Each step uses a `validate.tmp` temporary directory, created and deleted within + + the step. + +- The orchestrator does not throw exceptions on individual step failures; it + + continues executing all steps. diff --git a/docs/design/spdxtool-system.md b/docs/design/spdxtool-system.md new file mode 100644 index 0000000..6fd7306 --- /dev/null +++ b/docs/design/spdxtool-system.md @@ -0,0 +1,104 @@ +# DemaConsulting.SpdxTool System Design + +## System Overview + +DemaConsulting.SpdxTool is one of two systems in this repository. It is a .NET tool +distributed as a NuGet package that exposes a command-line interface for creating, +validating, and manipulating SPDX documents. The companion system, +`DemaConsulting.SpdxTool.Targets`, integrates SPDX decoration into the `dotnet pack` +workflow via MSBuild targets. + +## System Architecture + +The system follows a command-pattern architecture where a central registry dispatches +CLI subcommands to dedicated command classes. Global flags are processed by `Program` +before dispatch, with `--validate` redirecting execution to the SelfTest subsystem +rather than a regular command. + +### Major Components + +- **Program** — parses the CLI arguments, initializes a `Context`, and dispatches to + `CommandRegistry`. +- **Context** — carries the runtime execution state: console/log output streams, the + silent flag, and the mutable variables map used by workflow commands. +- **CommandRegistry** — maintains the map of command names to `Command` implementations + and performs command lookup and dispatch. +- **Commands subsystem** — contains one `Command`-derived class per supported CLI + subcommand (e.g., `AddPackage`, `RunWorkflow`, `Validate`). +- **SelfTest subsystem** — contains the `--validate` self-test suite that exercises + all commands against embedded SPDX fixtures. +- **Spdx unit group** — provides SPDX-domain helpers (`SpdxHelpers`) and the + `RelationshipDirection` enumeration consumed throughout the commands. +- **Utility unit group** — provides cross-cutting helpers: `PathHelpers` for file path + resolution and `Wildcard` for glob pattern matching. +- **Targets subsystem** — MSBuild `.targets` files that invoke `spdx-tool run-workflow` + during `dotnet pack`. + +## External Interfaces + +### Command-Line Interface + +The tool is invoked as `spdx-tool <command> [options]` where `<command>` is one of the +registered command names. Global flags (`--silent`, `--log`, `--validate`, etc.) are +parsed by `Program` before command dispatch. The `--validate` flag bypasses command +dispatch and runs the self-validation suite instead. + +### File System + +Commands read and write SPDX JSON documents from/to paths supplied as command arguments. +Workflow files are YAML files that specify a sequence of command invocations. NuGet +package-based workflows are resolved from the local NuGet cache. + +### NuGet + +The `run-workflow` command supports workflow files embedded in NuGet packages. It +resolves the package from the local NuGet cache using the package ID and version +supplied in the workflow step. + +### MSBuild Integration + +`DemaConsulting.SpdxTool.Targets` injects a `DecorateNuGetSbom` target into the build +pipeline. This target runs after `dotnet pack` and conditionally invokes +`spdx-tool run-workflow` with a user-supplied workflow file path. + +## Data Flow + +```text +CLI Input + │ + ▼ +Program.cs ──────────────────────────────────────┐ + │ parse global flags + command name │ + ▼ │ +Context.cs (output, log, variables) │ + │ │ --validate flag + ▼ ▼ +CommandRegistry ──► Command.Execute() SelfTest.Validate.Run() + │ │ + ▼ ▼ + SPDX document I/O SelfTest.* + (read/write JSON) (exercise each command) +``` + +## Design Constraints + +- **Cross-platform**: The tool must run on Windows, Linux, and macOS using .NET 8, 9, + and 10. All file I/O uses `Path` APIs to maintain portability. +- **No global state**: All mutable state is encapsulated in `Context` and passed + explicitly; commands are stateless. +- **Workflow isolation**: Each workflow step executes in the same `Context` instance, + allowing variables set in one step to be consumed in subsequent steps. +- **Self-contained validation**: The `--validate` flag runs the entire command suite + using only in-process calls. The `ValidateQuery` step spawns `dotnet` as an external + process, and `ValidateRunNuGetWorkflow` may restore a NuGet package on a cache miss + (requiring network access). All other steps are fully in-process. + +## Integration Patterns + +- **Command pattern**: Each CLI subcommand is a self-contained `Command` class with + `Execute(Context, string[])` semantics, registered by name in `CommandRegistry`. +- **Variable substitution**: Workflow YAML supports `${{ variables.name }}` tokens that + are replaced at runtime from the `Context` variable map. +- **Source-filter evidence**: ReqStream source filters (`windows@`, `ubuntu@`, `net8.0@`) + restrict test evidence to specific CI/CD matrix legs, ensuring platform requirements + are validated on the correct runtime environment. diff --git a/docs/design/spdxtool-targets-system.md b/docs/design/spdxtool-targets-system.md new file mode 100644 index 0000000..4b5f44b --- /dev/null +++ b/docs/design/spdxtool-targets-system.md @@ -0,0 +1,75 @@ +# DemaConsulting.SpdxTool.Targets System Design + +## Purpose + +`DemaConsulting.SpdxTool.Targets` is a separate MSBuild targets NuGet package that +integrates SPDX document decoration into the standard `dotnet pack` build workflow. +It allows projects to automatically decorate their NuGet-generated SBOMs during the +pack process without manual intervention. + +## Architecture + +### Build Target Integration + +The subsystem consists of two MSBuild `.targets` files: + +- `build/DemaConsulting.SpdxTool.Targets.targets` — injected for single-TFM projects +- `buildMultiTargeting/DemaConsulting.SpdxTool.Targets.targets` — injected for + multi-TFM projects + +Both files define the `DecorateNuGetSbom` target, which runs after the `Pack` target +in the MSBuild pipeline. + +### Workflow Invocation + +The `DecorateNuGetSbom` target conditionally invokes `spdx-tool run-workflow` with +a user-supplied workflow file. The workflow file path is specified via the +`SpdxToolWorkflow` MSBuild property. The `spdx-tool` global tool must be installed +and available on the system `PATH`. + +### Configuration Properties + +| MSBuild Property | Default | Description | +|----------------------|---------|------------------------------------------------------| +| `DecorateSBOM` | `false` | Set to `true` to enable SBOM decoration during pack | +| `GenerateSBOM` | `true` | When `false`, skips decoration (no SBOM to decorate) | +| `SpdxToolWorkflow` | — | Path to the workflow YAML file for decoration | + +## Conditional Execution + +The `DecorateNuGetSbom` target is skipped when: + +- `DecorateSBOM` is not set to `true` (opt-in required) +- `GenerateSBOM` is `false` (no SBOM generated to decorate) +- `SpdxToolWorkflow` path does not exist (build error reported) + +## Data Flow + +```text +dotnet pack + │ + ▼ +Pack target completes (NuGet .nupkg + embedded SBOM generated) + │ + ▼ +DecorateNuGetSbom target + │ + ├─► Check DecorateSBOM == true (skip if false) + │ + ├─► Check GenerateSBOM == true (skip if false) + │ + ├─► Check SpdxToolWorkflow exists (error if missing) + │ + └─► Execute: spdx-tool run-workflow <SpdxToolWorkflow> + │ + └─► Workflow modifies the SPDX JSON embedded in .nupkg +``` + +## Design Constraints + +- The Targets subsystem has no direct dependency on the SpdxTool source code; it + invokes `spdx-tool` as an external process via MSBuild `Exec` task. +- SBOM decoration is opt-in (`DecorateSBOM` must be explicitly set to `true`). +- The subsystem gracefully skips decoration when prerequisites are not met, rather + than failing silently or producing incomplete output. +- Multi-TFM projects use a separate targets file to handle the outer build correctly. diff --git a/docs/design/utility.md b/docs/design/utility.md new file mode 100644 index 0000000..be5ab93 --- /dev/null +++ b/docs/design/utility.md @@ -0,0 +1,44 @@ +# DemaConsulting.SpdxTool Utility Subsystem Design + +## Purpose + +The Utility subsystem provides cross-cutting helper units used throughout the +DemaConsulting.SpdxTool system. It encompasses the `Utility` and `Spdx` namespaces, +which offer path-safety utilities, wildcard pattern matching, SPDX-domain helpers, +and SPDX relationship direction support. + +## Units + +### PathHelpers + +`PathHelpers` provides safe file path operations that prevent path-traversal attacks. +The `SafePathCombine` method validates that a relative path contains no `..` components +or absolute path roots before combining it with a base path, throwing `ArgumentException` +when unsafe components are detected. + +### Wildcard + +`Wildcard` provides glob-style pattern matching for file names and paths. It converts +wildcard patterns (using `*` and `?`) into regular expressions and performs +case-insensitive matching. Used by commands that accept file patterns (e.g., +`find-package`) to filter SPDX document contents. + +### SpdxHelpers + +`SpdxHelpers` provides SPDX-domain utility methods consumed across the Commands +subsystem, including relationship traversal helpers and package attribute manipulation. + +### RelationshipDirection + +`RelationshipDirection` is an enumeration expressing the traversal direction of an +SPDX relationship query: `Forward`, `Reverse`, or `Both`. Consumed by query and +find operations in the Commands subsystem. + +## Design Constraints + +- All utilities are stateless; no instance members are required. +- `PathHelpers.SafePathCombine` must reject any path component that is `..` or is + an absolute path root, to prevent directory traversal vulnerabilities. +- `Wildcard` pattern matching is case-insensitive to ensure consistent cross-platform + behavior on both case-sensitive (Linux) and case-insensitive (Windows, macOS) + file systems. diff --git a/docs/reqstream/commands/add-package.yaml b/docs/reqstream/commands/add-package.yaml new file mode 100644 index 0000000..8cb4450 --- /dev/null +++ b/docs/reqstream/commands/add-package.yaml @@ -0,0 +1,17 @@ +# DemaConsulting.SpdxTool add-package Command Requirements +# +# This file contains requirements for the add-package command. +# It is included by the root requirements.yaml file. +--- +sections: + - title: add-package Command + requirements: + - id: SpdxTool-Pkg-AddPackage + title: The tool shall add packages to SPDX documents using the add-package command. + tags: + - spdx + justification: | + Users need to incrementally build SPDX documents by adding new packages + that represent software components, libraries, or dependencies. + tests: + - SpdxTool_AddPackage diff --git a/docs/reqstream/commands/add-relationship.yaml b/docs/reqstream/commands/add-relationship.yaml new file mode 100644 index 0000000..eb172cf --- /dev/null +++ b/docs/reqstream/commands/add-relationship.yaml @@ -0,0 +1,18 @@ +# DemaConsulting.SpdxTool add-relationship Command Requirements +# +# This file contains requirements for the add-relationship command. +# It is included by the root requirements.yaml file. +--- +sections: + - title: add-relationship Command + requirements: + - id: SpdxTool-Rel-AddRelationship + title: The tool shall add relationships to SPDX documents using the add-relationship command. + tags: + - spdx + justification: | + SPDX documents describe relationships between packages, files, and other + elements. Users need to define these relationships to accurately represent + dependency graphs and component hierarchies. + tests: + - SpdxTool_AddRelationship diff --git a/docs/reqstream/commands/copy-package.yaml b/docs/reqstream/commands/copy-package.yaml new file mode 100644 index 0000000..fdceb76 --- /dev/null +++ b/docs/reqstream/commands/copy-package.yaml @@ -0,0 +1,17 @@ +# DemaConsulting.SpdxTool copy-package Command Requirements +# +# This file contains requirements for the copy-package command. +# It is included by the root requirements.yaml file. +--- +sections: + - title: copy-package Command + requirements: + - id: SpdxTool-Pkg-CopyPackage + title: The tool shall copy packages between SPDX documents using the copy-package command. + tags: + - spdx + justification: | + Users need to reuse package information across multiple SPDX documents + to avoid duplication and ensure consistency of package metadata. + tests: + - SpdxTool_CopyPackage diff --git a/docs/reqstream/commands/diagram.yaml b/docs/reqstream/commands/diagram.yaml new file mode 100644 index 0000000..16ba664 --- /dev/null +++ b/docs/reqstream/commands/diagram.yaml @@ -0,0 +1,18 @@ +# DemaConsulting.SpdxTool diagram Command Requirements +# +# This file contains requirements for the diagram command. +# It is included by the root requirements.yaml file. +--- +sections: + - title: diagram Command + requirements: + - id: SpdxTool-Xfm-Diagram + title: The tool shall generate Mermaid diagrams from SPDX documents using the diagram command. + tags: + - spdx + justification: | + Visual representations of SPDX relationships and package hierarchies + help users understand complex dependency graphs. Mermaid is a popular + text-based diagramming language. + tests: + - SpdxTool_Diagram diff --git a/docs/reqstream/commands/find-package.yaml b/docs/reqstream/commands/find-package.yaml new file mode 100644 index 0000000..be00e7e --- /dev/null +++ b/docs/reqstream/commands/find-package.yaml @@ -0,0 +1,17 @@ +# DemaConsulting.SpdxTool find-package Command Requirements +# +# This file contains requirements for the find-package command. +# It is included by the root requirements.yaml file. +--- +sections: + - title: find-package Command + requirements: + - id: SpdxTool-Pkg-FindPackage + title: The tool shall find packages in SPDX documents using the find-package command. + tags: + - spdx + justification: | + Users need to locate specific packages within SPDX documents based on + criteria such as name, version, or other attributes to query or modify them. + tests: + - SpdxTool_FindPackage diff --git a/docs/reqstream/commands/get-version.yaml b/docs/reqstream/commands/get-version.yaml new file mode 100644 index 0000000..d39fe73 --- /dev/null +++ b/docs/reqstream/commands/get-version.yaml @@ -0,0 +1,17 @@ +# DemaConsulting.SpdxTool get-version Command Requirements +# +# This file contains requirements for the get-version command. +# It is included by the root requirements.yaml file. +--- +sections: + - title: get-version Command + requirements: + - id: SpdxTool-Pkg-GetVersion + title: The tool shall retrieve package versions from SPDX documents using the get-version command. + tags: + - spdx + justification: | + Users need to extract version information from packages for reporting, + dependency management, and compatibility checking. + tests: + - SpdxTool_GetVersion diff --git a/docs/reqstream/commands/hash.yaml b/docs/reqstream/commands/hash.yaml new file mode 100644 index 0000000..2f4a375 --- /dev/null +++ b/docs/reqstream/commands/hash.yaml @@ -0,0 +1,18 @@ +# DemaConsulting.SpdxTool hash Command Requirements +# +# This file contains requirements for the hash command. +# It is included by the root requirements.yaml file. +--- +sections: + - title: hash Command + requirements: + - id: SpdxTool-Hsh-Hash + title: The tool shall compute and verify file hashes using the hash command. + tags: + - spdx + justification: | + SPDX documents often include file hashes for integrity verification. + Users need to compute hashes using various algorithms and verify that + files match expected hash values. + tests: + - SpdxTool_Hash diff --git a/docs/reqstream/commands/help.yaml b/docs/reqstream/commands/help.yaml new file mode 100644 index 0000000..69f8635 --- /dev/null +++ b/docs/reqstream/commands/help.yaml @@ -0,0 +1,20 @@ +# DemaConsulting.SpdxTool help Command Requirements +# +# This file contains requirements for the help command. +# It is included by the root requirements.yaml file. +--- +sections: + - title: help Command + requirements: + - id: SpdxTool-Cmd-HelpCommand + title: The help command shall display extended usage information for a specified command. + tags: + - cli + justification: | + Users need access to detailed usage information for each command to + understand arguments, options, and workflow YAML syntax without consulting + external documentation. + tests: + - Help_NoArguments_ReportsError + - Help_UnknownCommand_ReportsError + - Help_RunWorkflowCommand_DisplaysHelp diff --git a/docs/reqstream/commands/print.yaml b/docs/reqstream/commands/print.yaml new file mode 100644 index 0000000..85d5cae --- /dev/null +++ b/docs/reqstream/commands/print.yaml @@ -0,0 +1,17 @@ +# DemaConsulting.SpdxTool print Command Requirements +# +# This file contains requirements for the print command. +# It is included by the root requirements.yaml file. +--- +sections: + - title: print Command + requirements: + - id: SpdxTool-Wkf-Print + title: The tool shall support printing text within workflows using the print command. + tags: + - workflow + justification: | + Users need to output informational messages during workflow execution + for debugging, progress tracking, and user feedback. + tests: + - Print_InWorkflow_PrintsText diff --git a/docs/reqstream/commands/query.yaml b/docs/reqstream/commands/query.yaml new file mode 100644 index 0000000..fb1b22c --- /dev/null +++ b/docs/reqstream/commands/query.yaml @@ -0,0 +1,17 @@ +# DemaConsulting.SpdxTool query Command Requirements +# +# This file contains requirements for the query command. +# It is included by the root requirements.yaml file. +--- +sections: + - title: query Command + requirements: + - id: SpdxTool-Wkf-Query + title: The tool shall support querying external program output using the query command. + tags: + - workflow + justification: | + Workflows often need to extract information from external tools or + commands to incorporate into SPDX documents or workflow logic. + tests: + - SpdxTool_Query diff --git a/docs/reqstream/commands/rename-id.yaml b/docs/reqstream/commands/rename-id.yaml new file mode 100644 index 0000000..90a5afc --- /dev/null +++ b/docs/reqstream/commands/rename-id.yaml @@ -0,0 +1,18 @@ +# DemaConsulting.SpdxTool rename-id Command Requirements +# +# This file contains requirements for the rename-id command. +# It is included by the root requirements.yaml file. +--- +sections: + - title: rename-id Command + requirements: + - id: SpdxTool-Man-RenameId + title: The tool shall rename SPDX element IDs using the rename-id command. + tags: + - spdx + justification: | + Users need to modify element IDs to resolve conflicts, follow naming + conventions, or reorganize SPDX documents while maintaining referential + integrity. + tests: + - SpdxTool_RenameId diff --git a/docs/reqstream/commands/run-workflow.yaml b/docs/reqstream/commands/run-workflow.yaml new file mode 100644 index 0000000..28231d6 --- /dev/null +++ b/docs/reqstream/commands/run-workflow.yaml @@ -0,0 +1,33 @@ +# DemaConsulting.SpdxTool run-workflow Command Requirements +# +# This file contains requirements for the run-workflow command, covering +# workflow execution and NuGet-based workflow support. +# It is included by the root requirements.yaml file. +--- +sections: + - title: run-workflow Command + requirements: + - id: SpdxTool-Wkf-RunWorkflow + title: The tool shall execute workflow files using the run-workflow command. + tags: + - workflow + justification: | + Complex SPDX document operations often require multiple steps. Workflows + enable users to define and automate multi-step processes in a declarative + YAML format. + tests: + - SpdxTool_AddPackage + - SpdxTool_AddRelationship + - SpdxTool_CopyPackage + - SpdxTool_UpdatePackage + + - id: SpdxTool-Wkf-NuGetWorkflow + title: The tool shall support running workflow files from NuGet packages using the run-workflow command. + tags: + - workflow + justification: | + Users need to reference workflow files stored in NuGet packages so that + workflows can be versioned, distributed, and cached locally rather than + downloaded on every run. + tests: + - SpdxTool_RunNuGetWorkflow diff --git a/docs/reqstream/commands/set-variable.yaml b/docs/reqstream/commands/set-variable.yaml new file mode 100644 index 0000000..ec19d0d --- /dev/null +++ b/docs/reqstream/commands/set-variable.yaml @@ -0,0 +1,17 @@ +# DemaConsulting.SpdxTool set-variable Command Requirements +# +# This file contains requirements for the set-variable command. +# It is included by the root requirements.yaml file. +--- +sections: + - title: set-variable Command + requirements: + - id: SpdxTool-Wkf-SetVariable + title: The tool shall support setting variables within workflows using the set-variable command. + tags: + - workflow + justification: | + Workflows need to pass data between steps and parameterize operations. + Variables enable dynamic workflow execution based on computed or input values. + tests: + - SetVariable_InWorkflow_SetsVariable diff --git a/docs/reqstream/commands/to-markdown.yaml b/docs/reqstream/commands/to-markdown.yaml new file mode 100644 index 0000000..2b9ba7e --- /dev/null +++ b/docs/reqstream/commands/to-markdown.yaml @@ -0,0 +1,18 @@ +# DemaConsulting.SpdxTool to-markdown Command Requirements +# +# This file contains requirements for the to-markdown command. +# It is included by the root requirements.yaml file. +--- +sections: + - title: to-markdown Command + requirements: + - id: SpdxTool-Xfm-ToMarkdown + title: The tool shall convert SPDX documents to Markdown format using the to-markdown command. + tags: + - spdx + justification: | + Users need human-readable representations of SPDX documents for + documentation, reporting, and review purposes. Markdown is a widely + supported format for documentation. + tests: + - SpdxTool_ToMarkdown diff --git a/docs/reqstream/commands/update-package.yaml b/docs/reqstream/commands/update-package.yaml new file mode 100644 index 0000000..bdb2bec --- /dev/null +++ b/docs/reqstream/commands/update-package.yaml @@ -0,0 +1,17 @@ +# DemaConsulting.SpdxTool update-package Command Requirements +# +# This file contains requirements for the update-package command. +# It is included by the root requirements.yaml file. +--- +sections: + - title: update-package Command + requirements: + - id: SpdxTool-Pkg-UpdatePackage + title: The tool shall update existing packages in SPDX documents using the update-package command. + tags: + - spdx + justification: | + Users need to modify package metadata as software components evolve, + such as updating versions, licenses, or other attributes. + tests: + - SpdxTool_UpdatePackage diff --git a/docs/reqstream/commands/validate.yaml b/docs/reqstream/commands/validate.yaml new file mode 100644 index 0000000..7fb6844 --- /dev/null +++ b/docs/reqstream/commands/validate.yaml @@ -0,0 +1,29 @@ +# DemaConsulting.SpdxTool validate Command Requirements +# +# This file contains requirements for the validate command, covering +# SPDX document validation and NTIA minimum elements checking. +# It is included by the root requirements.yaml file. +--- +sections: + - title: validate Command + requirements: + - id: SpdxTool-Val-Validate + title: The tool shall validate SPDX documents using the validate command. + tags: + - spdx + justification: | + Users need to verify that SPDX documents conform to the SPDX specification + before using them in downstream processes or sharing them with others. + tests: + - SpdxTool_Validate + + - id: SpdxTool-Val-NtiaMinimum + title: The tool shall validate SPDX documents against NTIA minimum elements requirements. + tags: + - spdx + justification: | + The NTIA (National Telecommunications and Information Administration) has + defined minimum elements for SBOM. Users need to verify compliance with + these requirements for regulatory and industry standards. + tests: + - SpdxTool_Ntia diff --git a/docs/reqstream/ots/buildmark.yaml b/docs/reqstream/ots/buildmark.yaml new file mode 100644 index 0000000..164ed75 --- /dev/null +++ b/docs/reqstream/ots/buildmark.yaml @@ -0,0 +1,19 @@ +# DemaConsulting.SpdxTool BuildMark OTS Requirements +# +# This file contains requirements for the BuildMark OTS component used by SpdxTool. +# It is included by the root requirements.yaml file. +--- +sections: + - title: SpdxTool Requirements + sections: + - title: BuildMark + requirements: + - id: SpdxTool-OTS-BuildMark + title: BuildMark shall generate build-notes documentation from GitHub Actions metadata. + tags: + - ots + justification: | + DemaConsulting.BuildMark queries the GitHub API to capture workflow run details and + renders them as a markdown build-notes document included in the release artifacts. + tests: + - BuildMark_MarkdownReportGeneration diff --git a/docs/reqstream/ots/mstest.yaml b/docs/reqstream/ots/mstest.yaml new file mode 100644 index 0000000..39c7b54 --- /dev/null +++ b/docs/reqstream/ots/mstest.yaml @@ -0,0 +1,22 @@ +# DemaConsulting.SpdxTool MSTest OTS Requirements +# +# This file contains requirements for the MSTest OTS component used by SpdxTool. +# It is included by the root requirements.yaml file. +--- +sections: + - title: SpdxTool Requirements + sections: + - title: MSTest + requirements: + - id: SpdxTool-OTS-MSTest + title: MSTest shall execute unit tests and report results. + tags: + - ots + justification: | + MSTest (MSTest.TestFramework and MSTest.TestAdapter) is the unit-testing framework + used by the project. It discovers and runs all test methods and writes TRX result + files that feed into coverage reporting and requirements traceability. + tests: + - Version_ShortFlag_DisplaysVersion + - Version_LongFlag_DisplaysVersion + - Usage_ShortHelpFlag_DisplaysUsage diff --git a/docs/reqstream/ots/reqstream.yaml b/docs/reqstream/ots/reqstream.yaml new file mode 100644 index 0000000..44b6046 --- /dev/null +++ b/docs/reqstream/ots/reqstream.yaml @@ -0,0 +1,20 @@ +# DemaConsulting.SpdxTool ReqStream OTS Requirements +# +# This file contains requirements for the ReqStream OTS component used by SpdxTool. +# It is included by the root requirements.yaml file. +--- +sections: + - title: SpdxTool Requirements + sections: + - title: ReqStream + requirements: + - id: SpdxTool-OTS-ReqStream + title: ReqStream shall enforce that every requirement is linked to passing test evidence. + tags: + - ots + justification: | + DemaConsulting.ReqStream processes requirements.yaml and the TRX test-result files to + produce a requirements report, justifications document, and traceability matrix. When + run with --enforce, it exits with a non-zero code if any requirement lacks test evidence. + tests: + - ReqStream_EnforcementMode diff --git a/docs/reqstream/ots/sarifmark.yaml b/docs/reqstream/ots/sarifmark.yaml new file mode 100644 index 0000000..9bf4c80 --- /dev/null +++ b/docs/reqstream/ots/sarifmark.yaml @@ -0,0 +1,20 @@ +# DemaConsulting.SpdxTool SarifMark OTS Requirements +# +# This file contains requirements for the SarifMark OTS component used by SpdxTool. +# It is included by the root requirements.yaml file. +--- +sections: + - title: SpdxTool Requirements + sections: + - title: SarifMark + requirements: + - id: SpdxTool-OTS-SarifMark + title: SarifMark shall convert CodeQL SARIF results into a markdown report. + tags: + - ots + justification: | + DemaConsulting.SarifMark reads the SARIF output produced by CodeQL code scanning and + renders it as a human-readable markdown document included in the release artifacts. + tests: + - SarifMark_SarifReading + - SarifMark_MarkdownReportGeneration diff --git a/docs/reqstream/ots/sonarmark.yaml b/docs/reqstream/ots/sonarmark.yaml new file mode 100644 index 0000000..68ee652 --- /dev/null +++ b/docs/reqstream/ots/sonarmark.yaml @@ -0,0 +1,22 @@ +# DemaConsulting.SpdxTool SonarMark OTS Requirements +# +# This file contains requirements for the SonarMark OTS component used by SpdxTool. +# It is included by the root requirements.yaml file. +--- +sections: + - title: SpdxTool Requirements + sections: + - title: SonarMark + requirements: + - id: SpdxTool-OTS-SonarMark + title: SonarMark shall generate a SonarCloud quality report. + tags: + - ots + justification: | + DemaConsulting.SonarMark retrieves quality-gate and metrics data from SonarCloud and + renders it as a markdown document included in the release artifacts. + tests: + - SonarMark_QualityGateRetrieval + - SonarMark_IssuesRetrieval + - SonarMark_HotSpotsRetrieval + - SonarMark_MarkdownReportGeneration diff --git a/docs/reqstream/ots/versionmark.yaml b/docs/reqstream/ots/versionmark.yaml new file mode 100644 index 0000000..91a8233 --- /dev/null +++ b/docs/reqstream/ots/versionmark.yaml @@ -0,0 +1,20 @@ +# DemaConsulting.SpdxTool VersionMark OTS Requirements +# +# This file contains requirements for the VersionMark OTS component used by SpdxTool. +# It is included by the root requirements.yaml file. +--- +sections: + - title: SpdxTool Requirements + sections: + - title: VersionMark + requirements: + - id: SpdxTool-OTS-VersionMark + title: VersionMark shall publish captured tool-version information. + tags: + - ots + justification: | + DemaConsulting.VersionMark reads version metadata for each dotnet tool used in the + pipeline and writes a versions markdown document included in the release artifacts. + tests: + - VersionMark_CapturesVersions + - VersionMark_GeneratesMarkdownReport diff --git a/docs/reqstream/platform-requirements.yaml b/docs/reqstream/platform-requirements.yaml new file mode 100644 index 0000000..cd35689 --- /dev/null +++ b/docs/reqstream/platform-requirements.yaml @@ -0,0 +1,96 @@ +# DemaConsulting.SpdxTool Platform Requirements +# +# This file contains platform support requirements for the SpdxTool system, +# covering Windows, Linux, macOS, and .NET runtime version support. +# It is included by the root requirements.yaml file. +--- +sections: + - title: SpdxTool Requirements + sections: + - title: Platform Support + requirements: + - id: SpdxTool-Plt-Windows + title: The tool shall run successfully on Windows platforms. + tags: + - platform + - msbuild + justification: | + Windows is a widely used operating system for development. The tool + (both the dotnet-tool and the MSBuild targets package) must function + correctly on Windows to support a broad user base. + tests: + - windows@SpdxTool_Validate + - windows@SingleTfmProject_DecorateSbomTrue_DecoratesSbom + - windows@MultiTfmProject_DecorateSbomTrue_DecoratesSbom + - windows@SingleTfmProject_DecorateSbomFalse_SkipsDecoration + - windows@SingleTfmProject_GenerateSbomFalse_SkipsEntirely + - windows@SingleTfmProject_MissingWorkflow_ReportsError + + - id: SpdxTool-Plt-Linux + title: The tool shall run successfully on Linux platforms. + tags: + - platform + - msbuild + justification: | + Linux is a widely used operating system for development and deployment, + especially in CI/CD environments. The tool (both the dotnet-tool and + the MSBuild targets package) must function correctly on Linux to support + a broad user base. + tests: + - ubuntu@SpdxTool_Validate + - ubuntu@SingleTfmProject_DecorateSbomTrue_DecoratesSbom + - ubuntu@MultiTfmProject_DecorateSbomTrue_DecoratesSbom + - ubuntu@SingleTfmProject_DecorateSbomFalse_SkipsDecoration + - ubuntu@SingleTfmProject_GenerateSbomFalse_SkipsEntirely + - ubuntu@SingleTfmProject_MissingWorkflow_ReportsError + + - id: SpdxTool-Plt-MacOS + title: The tool shall run successfully on macOS platforms. + tags: + - platform + - msbuild + justification: | + macOS is a widely used operating system for development, especially + among software engineers and developers. The tool (both the dotnet-tool + and the MSBuild targets package) must function correctly on macOS to + support a broad user base. + tests: + - macos@SpdxTool_Validate + - macos@SingleTfmProject_DecorateSbomTrue_DecoratesSbom + - macos@MultiTfmProject_DecorateSbomTrue_DecoratesSbom + - macos@SingleTfmProject_DecorateSbomFalse_SkipsDecoration + - macos@SingleTfmProject_GenerateSbomFalse_SkipsEntirely + - macos@SingleTfmProject_MissingWorkflow_ReportsError + + - id: SpdxTool-Plt-Net8 + title: The tool shall run successfully on .NET 8.x. + tags: + - platform + justification: | + .NET 8.x is a long-term support (LTS) release of .NET. The tool must + support this version to provide stability and compatibility for users + who require LTS support. + tests: + - dotnet8.x@SpdxTool_Validate + + - id: SpdxTool-Plt-Net9 + title: The tool shall run successfully on .NET 9.x. + tags: + - platform + justification: | + .NET 9.x is a current release of .NET. The tool must support this + version to enable users to take advantage of the latest .NET features + and improvements. + tests: + - dotnet9.x@SpdxTool_Validate + + - id: SpdxTool-Plt-Net10 + title: The tool shall run successfully on .NET 10.x. + tags: + - platform + justification: | + .NET 10.x represents forward compatibility. The tool should support + future .NET releases to ensure users can upgrade their runtime without + losing tool functionality. + tests: + - dotnet10.x@SpdxTool_Validate diff --git a/docs/reqstream/self-test/self-test.yaml b/docs/reqstream/self-test/self-test.yaml new file mode 100644 index 0000000..e6b6b28 --- /dev/null +++ b/docs/reqstream/self-test/self-test.yaml @@ -0,0 +1,52 @@ +# DemaConsulting.SpdxTool Self-Test Requirements +# +# This file contains requirements for the SpdxTool self-test subsystem, +# covering the --validate flag, depth control, and result output formats. +# It is included by the root requirements.yaml file. +--- +sections: + - title: SpdxTool Requirements + sections: + - title: Self-Validation + requirements: + - id: SpdxTool-Cmd-Validate + title: The tool shall perform self-validation when invoked with the --validate flag. + tags: + - cli + justification: | + Self-validation ensures that the tool functions correctly after installation + or deployment. This is critical for CI/CD pipelines and quality assurance. + tests: + - SelfTest_ValidateFlag_Succeeds + + - id: SpdxTool-Cmd-Depth + title: The tool shall support depth control for self-validation output. + tags: + - cli + justification: | + Users may want to see detailed hierarchical results during self-validation + to understand which specific tests passed or failed at different depths. + tests: + - SelfTest_ValidateFlagWithDepth_ShowsDepth + + - id: SpdxTool-Cmd-ResultsTrx + title: The tool shall write self-validation results as TRX when the --result flag uses a .trx extension. + tags: + - cli + justification: | + CI/CD systems and test reporting tools often require test results in + standardized formats like TRX. This enables integration with existing + test infrastructure. + tests: + - SelfTest_ValidateFlagWithResults_GeneratesTrxFile + + - id: SpdxTool-Cmd-ResultsJUnit + title: The tool shall write self-validation results as JUnit XML when the --result flag uses .xml extension. + tags: + - cli + justification: | + Many CI/CD systems and test reporting tools support JUnit XML format. + Auto-detecting the format from the file extension allows users to generate + JUnit output without requiring a separate flag. + tests: + - SelfTest_ValidateFlagWithResults_GeneratesJUnitFile diff --git a/docs/reqstream/self-test/validate-add-package.yaml b/docs/reqstream/self-test/validate-add-package.yaml new file mode 100644 index 0000000..41f4c01 --- /dev/null +++ b/docs/reqstream/self-test/validate-add-package.yaml @@ -0,0 +1,18 @@ +# DemaConsulting.SpdxTool SelfTest ValidateAddPackage Requirements +# +# This file contains requirements for the ValidateAddPackage self-test step. +# It is included by the root requirements.yaml file. +--- +sections: + - title: SelfTest ValidateAddPackage + requirements: + - id: SpdxTool-ST-AddPackage + title: The SelfTest shall exercise the add-package command. + tags: + - self-test + justification: | + Self-validation of the add-package command ensures it correctly adds + packages and relationships to SPDX documents after installation or + deployment. + tests: + - SpdxTool_AddPackage diff --git a/docs/reqstream/self-test/validate-add-relationship.yaml b/docs/reqstream/self-test/validate-add-relationship.yaml new file mode 100644 index 0000000..4b00214 --- /dev/null +++ b/docs/reqstream/self-test/validate-add-relationship.yaml @@ -0,0 +1,17 @@ +# DemaConsulting.SpdxTool SelfTest ValidateAddRelationship Requirements +# +# This file contains requirements for the ValidateAddRelationship self-test step. +# It is included by the root requirements.yaml file. +--- +sections: + - title: SelfTest ValidateAddRelationship + requirements: + - id: SpdxTool-ST-AddRelationship + title: The SelfTest shall exercise the add-relationship command. + tags: + - self-test + justification: | + Self-validation of the add-relationship command ensures it correctly adds + relationships between SPDX elements after installation or deployment. + tests: + - SpdxTool_AddRelationship diff --git a/docs/reqstream/self-test/validate-basic.yaml b/docs/reqstream/self-test/validate-basic.yaml new file mode 100644 index 0000000..337ab8e --- /dev/null +++ b/docs/reqstream/self-test/validate-basic.yaml @@ -0,0 +1,18 @@ +# DemaConsulting.SpdxTool SelfTest ValidateBasic Requirements +# +# This file contains requirements for the ValidateBasic self-test step. +# It is included by the root requirements.yaml file. +--- +sections: + - title: SelfTest ValidateBasic + requirements: + - id: SpdxTool-ST-Basic + title: The SelfTest shall exercise the basic commands (version, help, silent, log). + tags: + - self-test + justification: | + Self-validation of basic tool functionality ensures the core CLI features + (version reporting, help display, silent mode, logging) work correctly + after installation or deployment. + tests: + - SpdxTool_Basic diff --git a/docs/reqstream/self-test/validate-copy-package.yaml b/docs/reqstream/self-test/validate-copy-package.yaml new file mode 100644 index 0000000..14abaa4 --- /dev/null +++ b/docs/reqstream/self-test/validate-copy-package.yaml @@ -0,0 +1,17 @@ +# DemaConsulting.SpdxTool SelfTest ValidateCopyPackage Requirements +# +# This file contains requirements for the ValidateCopyPackage self-test step. +# It is included by the root requirements.yaml file. +--- +sections: + - title: SelfTest ValidateCopyPackage + requirements: + - id: SpdxTool-ST-CopyPackage + title: The SelfTest shall exercise the copy-package command. + tags: + - self-test + justification: | + Self-validation of the copy-package command ensures it correctly copies + packages between SPDX documents after installation or deployment. + tests: + - SpdxTool_CopyPackage diff --git a/docs/reqstream/self-test/validate-diagram.yaml b/docs/reqstream/self-test/validate-diagram.yaml new file mode 100644 index 0000000..0ab348f --- /dev/null +++ b/docs/reqstream/self-test/validate-diagram.yaml @@ -0,0 +1,17 @@ +# DemaConsulting.SpdxTool SelfTest ValidateDiagram Requirements +# +# This file contains requirements for the ValidateDiagram self-test step. +# It is included by the root requirements.yaml file. +--- +sections: + - title: SelfTest ValidateDiagram + requirements: + - id: SpdxTool-ST-Diagram + title: The SelfTest shall exercise the diagram command. + tags: + - self-test + justification: | + Self-validation of the diagram command ensures it correctly generates + Mermaid diagrams from SPDX documents after installation or deployment. + tests: + - SpdxTool_Diagram diff --git a/docs/reqstream/self-test/validate-find-package.yaml b/docs/reqstream/self-test/validate-find-package.yaml new file mode 100644 index 0000000..dd21ba3 --- /dev/null +++ b/docs/reqstream/self-test/validate-find-package.yaml @@ -0,0 +1,17 @@ +# DemaConsulting.SpdxTool SelfTest ValidateFindPackage Requirements +# +# This file contains requirements for the ValidateFindPackage self-test step. +# It is included by the root requirements.yaml file. +--- +sections: + - title: SelfTest ValidateFindPackage + requirements: + - id: SpdxTool-ST-FindPackage + title: The SelfTest shall exercise the find-package command. + tags: + - self-test + justification: | + Self-validation of the find-package command ensures it correctly locates + packages in SPDX documents by criteria after installation or deployment. + tests: + - SpdxTool_FindPackage diff --git a/docs/reqstream/self-test/validate-get-version.yaml b/docs/reqstream/self-test/validate-get-version.yaml new file mode 100644 index 0000000..69c0220 --- /dev/null +++ b/docs/reqstream/self-test/validate-get-version.yaml @@ -0,0 +1,17 @@ +# DemaConsulting.SpdxTool SelfTest ValidateGetVersion Requirements +# +# This file contains requirements for the ValidateGetVersion self-test step. +# It is included by the root requirements.yaml file. +--- +sections: + - title: SelfTest ValidateGetVersion + requirements: + - id: SpdxTool-ST-GetVersion + title: The SelfTest shall exercise the get-version command. + tags: + - self-test + justification: | + Self-validation of the get-version command ensures it correctly retrieves + package versions from SPDX documents after installation or deployment. + tests: + - SpdxTool_GetVersion diff --git a/docs/reqstream/self-test/validate-hash.yaml b/docs/reqstream/self-test/validate-hash.yaml new file mode 100644 index 0000000..0e4685a --- /dev/null +++ b/docs/reqstream/self-test/validate-hash.yaml @@ -0,0 +1,17 @@ +# DemaConsulting.SpdxTool SelfTest ValidateHash Requirements +# +# This file contains requirements for the ValidateHash self-test step. +# It is included by the root requirements.yaml file. +--- +sections: + - title: SelfTest ValidateHash + requirements: + - id: SpdxTool-ST-Hash + title: The SelfTest shall exercise the hash command. + tags: + - self-test + justification: | + Self-validation of the hash command ensures it correctly generates and + verifies SHA-256 file hashes after installation or deployment. + tests: + - SpdxTool_Hash diff --git a/docs/reqstream/self-test/validate-ntia.yaml b/docs/reqstream/self-test/validate-ntia.yaml new file mode 100644 index 0000000..ed7508c --- /dev/null +++ b/docs/reqstream/self-test/validate-ntia.yaml @@ -0,0 +1,18 @@ +# DemaConsulting.SpdxTool SelfTest ValidateNtia Requirements +# +# This file contains requirements for the ValidateNtia self-test step. +# It is included by the root requirements.yaml file. +--- +sections: + - title: SelfTest ValidateNtia + requirements: + - id: SpdxTool-ST-Ntia + title: The SelfTest shall exercise the NTIA minimum elements validation. + tags: + - self-test + justification: | + Self-validation of NTIA minimum elements checking ensures the validate + command correctly identifies NTIA-compliant and non-compliant SPDX + documents after installation or deployment. + tests: + - SpdxTool_Ntia diff --git a/docs/reqstream/self-test/validate-query.yaml b/docs/reqstream/self-test/validate-query.yaml new file mode 100644 index 0000000..a0bcf79 --- /dev/null +++ b/docs/reqstream/self-test/validate-query.yaml @@ -0,0 +1,18 @@ +# DemaConsulting.SpdxTool SelfTest ValidateQuery Requirements +# +# This file contains requirements for the ValidateQuery self-test step. +# It is included by the root requirements.yaml file. +--- +sections: + - title: SelfTest ValidateQuery + requirements: + - id: SpdxTool-ST-Query + title: The SelfTest shall exercise the query command. + tags: + - self-test + justification: | + Self-validation of the query command ensures it correctly executes + external programs and extracts values from their output after installation + or deployment. + tests: + - SpdxTool_Query diff --git a/docs/reqstream/self-test/validate-rename-id.yaml b/docs/reqstream/self-test/validate-rename-id.yaml new file mode 100644 index 0000000..cfc2424 --- /dev/null +++ b/docs/reqstream/self-test/validate-rename-id.yaml @@ -0,0 +1,18 @@ +# DemaConsulting.SpdxTool SelfTest ValidateRenameId Requirements +# +# This file contains requirements for the ValidateRenameId self-test step. +# It is included by the root requirements.yaml file. +--- +sections: + - title: SelfTest ValidateRenameId + requirements: + - id: SpdxTool-ST-RenameId + title: The SelfTest shall exercise the rename-id command. + tags: + - self-test + justification: | + Self-validation of the rename-id command ensures it correctly renames + SPDX element IDs and updates all references throughout a document after + installation or deployment. + tests: + - SpdxTool_RenameId diff --git a/docs/reqstream/self-test/validate-run-nuget-workflow.yaml b/docs/reqstream/self-test/validate-run-nuget-workflow.yaml new file mode 100644 index 0000000..01e88e1 --- /dev/null +++ b/docs/reqstream/self-test/validate-run-nuget-workflow.yaml @@ -0,0 +1,18 @@ +# DemaConsulting.SpdxTool SelfTest ValidateRunNuGetWorkflow Requirements +# +# This file contains requirements for the ValidateRunNuGetWorkflow self-test step. +# It is included by the root requirements.yaml file. +--- +sections: + - title: SelfTest ValidateRunNuGetWorkflow + requirements: + - id: SpdxTool-ST-RunNuGetWorkflow + title: The SelfTest shall exercise the run-workflow command with NuGet packages. + tags: + - self-test + justification: | + Self-validation of NuGet workflow execution ensures the run-workflow command + correctly resolves workflow files from NuGet packages and executes them + after installation or deployment. + tests: + - SpdxTool_RunNuGetWorkflow diff --git a/docs/reqstream/self-test/validate-to-markdown.yaml b/docs/reqstream/self-test/validate-to-markdown.yaml new file mode 100644 index 0000000..629e4b2 --- /dev/null +++ b/docs/reqstream/self-test/validate-to-markdown.yaml @@ -0,0 +1,17 @@ +# DemaConsulting.SpdxTool SelfTest ValidateToMarkdown Requirements +# +# This file contains requirements for the ValidateToMarkdown self-test step. +# It is included by the root requirements.yaml file. +--- +sections: + - title: SelfTest ValidateToMarkdown + requirements: + - id: SpdxTool-ST-ToMarkdown + title: The SelfTest shall exercise the to-markdown command. + tags: + - self-test + justification: | + Self-validation of the to-markdown command ensures it correctly generates + Markdown summaries of SPDX documents after installation or deployment. + tests: + - SpdxTool_ToMarkdown diff --git a/docs/reqstream/self-test/validate-update-package.yaml b/docs/reqstream/self-test/validate-update-package.yaml new file mode 100644 index 0000000..fb474f1 --- /dev/null +++ b/docs/reqstream/self-test/validate-update-package.yaml @@ -0,0 +1,17 @@ +# DemaConsulting.SpdxTool SelfTest ValidateUpdatePackage Requirements +# +# This file contains requirements for the ValidateUpdatePackage self-test step. +# It is included by the root requirements.yaml file. +--- +sections: + - title: SelfTest ValidateUpdatePackage + requirements: + - id: SpdxTool-ST-UpdatePackage + title: The SelfTest shall exercise the update-package command. + tags: + - self-test + justification: | + Self-validation of the update-package command ensures it correctly updates + package metadata in SPDX documents after installation or deployment. + tests: + - SpdxTool_UpdatePackage diff --git a/docs/reqstream/self-test/validate.yaml b/docs/reqstream/self-test/validate.yaml new file mode 100644 index 0000000..06dd46a --- /dev/null +++ b/docs/reqstream/self-test/validate.yaml @@ -0,0 +1,18 @@ +# DemaConsulting.SpdxTool SelfTest Orchestrator Requirements +# +# This file contains requirements for the SelfTest orchestrator (Validate.cs). +# It is included by the root requirements.yaml file. +--- +sections: + - title: SelfTest Orchestrator + requirements: + - id: SpdxTool-ST-Orchestrate + title: The SelfTest orchestrator shall execute all validation steps and collect results. + tags: + - self-test + justification: | + The orchestrator is responsible for running all individual self-test steps + in sequence, collecting pass/fail results, and reporting a summary. This + ensures complete coverage of all commands during self-validation. + tests: + - SelfTest_ValidateFlag_Succeeds diff --git a/docs/reqstream/spdxtool-system.yaml b/docs/reqstream/spdxtool-system.yaml new file mode 100644 index 0000000..883c4a1 --- /dev/null +++ b/docs/reqstream/spdxtool-system.yaml @@ -0,0 +1,63 @@ +# DemaConsulting.SpdxTool System Requirements +# +# This file contains system-level requirements for the DemaConsulting.SpdxTool system, +# covering the command-line interface. It is included by the root requirements.yaml file. +--- +sections: + - title: SpdxTool Requirements + sections: + - title: Command-Line Interface + requirements: + - id: SpdxTool-Cmd-Version + title: The tool shall display version information when invoked with the -v or --version flag. + tags: + - cli + justification: | + Users need to check the version of the tool they are using for compatibility + and troubleshooting purposes. + tests: + - Version_ShortFlag_DisplaysVersion + - Version_LongFlag_DisplaysVersion + + - id: SpdxTool-Cmd-Help + title: The tool shall display usage information when invoked with the -h, -?, or --help flag. + tags: + - cli + justification: | + Users need quick access to help documentation to understand how to use the + tool effectively. + tests: + - Usage_ShortHelpFlag_DisplaysUsage + - Usage_LongHelpFlag_DisplaysUsage + + - id: SpdxTool-Cmd-InvalidArgs + title: The tool shall display an error and usage information when invoked without arguments. + tags: + - cli + justification: | + When users invoke the tool without any arguments, they should receive + guidance on proper usage rather than encountering undefined behavior. + tests: + - Usage_NoArguments_DisplaysError + + - id: SpdxTool-Cmd-Silent + title: The tool shall silence console output when invoked with the -s or --silent flag. + tags: + - cli + justification: | + In automated scripts and CI/CD pipelines, users may want to suppress + console output to reduce log noise. + tests: + - Silent_ShortFlag_SuppressesOutput + - Silent_LongFlag_SuppressesOutput + + - id: SpdxTool-Cmd-Log + title: The tool shall write output to a log file when invoked with the -l or --log flag. + tags: + - cli + justification: | + Users need the ability to capture tool output to files for auditing, + debugging, and record-keeping purposes. + tests: + - Log_ShortFlag_WritesOutputToFile + - Log_LongFlag_WritesOutputToFile diff --git a/docs/reqstream/spdxtool-targets-system.yaml b/docs/reqstream/spdxtool-targets-system.yaml new file mode 100644 index 0000000..70ea8d9 --- /dev/null +++ b/docs/reqstream/spdxtool-targets-system.yaml @@ -0,0 +1,59 @@ +# DemaConsulting.SpdxTool.Targets System Requirements +# +# This file contains system-level requirements for the DemaConsulting.SpdxTool.Targets +# system, covering SBOM decoration and skip behaviors. +# It is included by the root requirements.yaml file. +--- +sections: + - title: SpdxTool Requirements + sections: + - title: MSBuild Targets Integration + requirements: + - id: SpdxTool-Tgt-DecorateSbom + title: The MSBuild targets package shall decorate SBOMs during dotnet pack. + tags: + - msbuild + - sbom + justification: | + Users need SBOM decoration integrated into their standard build process + without manual intervention. Automatic decoration during pack ensures + SBOMs are consistently enhanced for both single-TFM and multi-TFM projects. + tests: + - SingleTfmProject_DecorateSbomTrue_DecoratesSbom + - MultiTfmProject_DecorateSbomTrue_DecoratesSbom + + - id: SpdxTool-Tgt-SkipDecorate + title: The MSBuild targets package shall skip SBOM decoration when DecorateSBOM is false. + tags: + - msbuild + - sbom + justification: | + Users must be able to opt-out of SBOM decoration for projects where it is + not needed or desired. The default behavior respects user choice by not + decorating unless explicitly enabled. + tests: + - SingleTfmProject_DecorateSbomFalse_SkipsDecoration + + - id: SpdxTool-Tgt-SkipGenerateSbom + title: The MSBuild targets package shall skip SBOM decoration when GenerateSBOM is false. + tags: + - msbuild + - sbom + justification: | + SBOM decoration depends on SBOM generation being enabled. When no SBOM + is generated, decoration should be skipped entirely to avoid errors and + unnecessary processing. + tests: + - SingleTfmProject_GenerateSbomFalse_SkipsEntirely + + - id: SpdxTool-Tgt-MissingWorkflowError + title: The MSBuild targets package shall report a clear error when the workflow file is missing. + tags: + - msbuild + - sbom + justification: | + When users enable SBOM decoration but the required workflow file is not + present, they need a clear error message to understand the problem and + take corrective action. + tests: + - SingleTfmProject_MissingWorkflow_ReportsError diff --git a/docs/reqstream/utility.yaml b/docs/reqstream/utility.yaml new file mode 100644 index 0000000..d7e35fc --- /dev/null +++ b/docs/reqstream/utility.yaml @@ -0,0 +1,50 @@ +# DemaConsulting.SpdxTool Utility Subsystem Requirements +# +# This file contains requirements for the DemaConsulting.SpdxTool Utility subsystem, +# covering path safety and wildcard pattern matching. +# It is included by the root requirements.yaml file. +--- +sections: + - title: SpdxTool Requirements + sections: + - title: Utility + requirements: + - id: SpdxTool-Util-SafePath + title: The PathHelpers unit shall reject path components containing traversal sequences or absolute paths. + tags: + - utility + - security + justification: | + Commands that accept user-supplied file paths must prevent directory + traversal attacks. SafePathCombine ensures that combined paths remain + within the intended base directory. + tests: + - PathHelpers_SafePathCombine_PathTraversalWithDoubleDots_ThrowsArgumentException + - PathHelpers_SafePathCombine_DoubleDotsInMiddle_ThrowsArgumentException + - PathHelpers_SafePathCombine_AbsolutePath_ThrowsArgumentException + + - id: SpdxTool-Util-ValidPath + title: The PathHelpers unit shall correctly combine valid relative paths with a base path. + tags: + - utility + justification: | + Commands that resolve file paths need a reliable utility for combining + base and relative paths in a safe manner. + tests: + - PathHelpers_SafePathCombine_ValidPaths_CombinesCorrectly + - PathHelpers_SafePathCombine_CurrentDirectoryReference_CombinesCorrectly + - PathHelpers_SafePathCombine_NestedPaths_CombinesCorrectly + - PathHelpers_SafePathCombine_EmptyRelativePath_ReturnsBasePath + + - id: SpdxTool-Util-Wildcard + title: The Wildcard unit shall match strings against glob-style wildcard patterns case-insensitively. + tags: + - utility + justification: | + Commands that filter SPDX content by name require wildcard matching that + is consistent across case-sensitive (Linux) and case-insensitive (Windows, + macOS) file systems. + tests: + - Wildcard_ExactMatch_ReturnsTrue + - Wildcard_AsteriskPattern_MatchesMultipleChars + - Wildcard_QuestionMarkPattern_MatchesSingleChar diff --git a/requirements.yaml b/requirements.yaml index 5885e41..1237829 100644 --- a/requirements.yaml +++ b/requirements.yaml @@ -28,508 +28,46 @@ # dotnet10.x@TestName - proves the self-validation test ran with .NET 10.x runtime # --- -sections: - - title: SpdxTool Requirements - sections: - - title: Command-Line Interface - requirements: - - id: SpdxTool-Cmd-Version - title: The tool shall display version information when invoked with the -v or --version flag. - tags: - - cli - justification: | - Users need to check the version of the tool they are using for compatibility - and troubleshooting purposes. - tests: - - Version_ShortFlag_DisplaysVersion - - Version_LongFlag_DisplaysVersion - - - id: SpdxTool-Cmd-Help - title: The tool shall display usage information when invoked with the -h, -?, or --help flag. - tags: - - cli - justification: | - Users need quick access to help documentation to understand how to use the - tool effectively. - tests: - - Usage_ShortHelpFlag_DisplaysUsage - - Usage_LongHelpFlag_DisplaysUsage - - - id: SpdxTool-Cmd-InvalidArgs - title: The tool shall display an error and usage information when invoked without arguments. - tags: - - cli - justification: | - When users invoke the tool without any arguments, they should receive - guidance on proper usage rather than encountering undefined behavior. - tests: - - Usage_NoArguments_DisplaysError - - - id: SpdxTool-Cmd-Silent - title: The tool shall silence console output when invoked with the -s or --silent flag. - tags: - - cli - justification: | - In automated scripts and CI/CD pipelines, users may want to suppress - console output to reduce log noise. - tests: - - Silent_ShortFlag_SuppressesOutput - - Silent_LongFlag_SuppressesOutput - - - id: SpdxTool-Cmd-Log - title: The tool shall write output to a log file when invoked with the -l or --log flag. - tags: - - cli - justification: | - Users need the ability to capture tool output to files for auditing, - debugging, and record-keeping purposes. - tests: - - Log_ShortFlag_WritesOutputToFile - - Log_LongFlag_WritesOutputToFile - - - id: SpdxTool-Cmd-Validate - title: The tool shall perform self-validation when invoked with the --validate flag. - tags: - - cli - justification: | - Self-validation ensures that the tool functions correctly after installation - or deployment. This is critical for CI/CD pipelines and quality assurance. - tests: - - SelfValidation_ValidateFlag_Succeeds - - - id: SpdxTool-Cmd-Depth - title: The tool shall support depth control for self-validation output. - tags: - - cli - justification: | - Users may want to see detailed hierarchical results during self-validation - to understand which specific tests passed or failed at different depths. - tests: - - SelfValidation_ValidateFlagWithDepth_ShowsDepth - - - id: SpdxTool-Cmd-ResultsTrx - title: The tool shall write self-validation results as TRX when the --result flag uses a .trx extension. - tags: - - cli - justification: | - CI/CD systems and test reporting tools often require test results in - standardized formats like TRX. This enables integration with existing - test infrastructure. - tests: - - SelfValidation_ValidateFlagWithResults_GeneratesTrxFile - - - id: SpdxTool-Cmd-ResultsJUnit - title: The tool shall write self-validation results as JUnit XML when the --result flag uses .xml extension. - tags: - - cli - justification: | - Many CI/CD systems and test reporting tools support JUnit XML format. - Auto-detecting the format from the file extension allows users to generate - JUnit output without requiring a separate flag. - tests: - - SelfValidation_ValidateFlagWithResults_GeneratesJUnitFile - - - title: SPDX Document Validation - requirements: - - id: SpdxTool-Val-Validate - title: The tool shall validate SPDX documents using the validate command. - tags: - - spdx - justification: | - Users need to verify that SPDX documents conform to the SPDX specification - before using them in downstream processes or sharing them with others. - tests: - - SpdxTool_Validate - - - id: SpdxTool-Val-NtiaMinimum - title: The tool shall validate SPDX documents against NTIA minimum elements requirements. - tags: - - spdx - justification: | - The NTIA (National Telecommunications and Information Administration) has - defined minimum elements for SBOM. Users need to verify compliance with - these requirements for regulatory and industry standards. - tests: - - SpdxTool_Ntia - - - title: SPDX Package Management - requirements: - - id: SpdxTool-Pkg-AddPackage - title: The tool shall add packages to SPDX documents using the add-package command. - tags: - - spdx - justification: | - Users need to incrementally build SPDX documents by adding new packages - that represent software components, libraries, or dependencies. - tests: - - SpdxTool_AddPackage - - - id: SpdxTool-Pkg-CopyPackage - title: The tool shall copy packages between SPDX documents using the copy-package command. - tags: - - spdx - justification: | - Users need to reuse package information across multiple SPDX documents - to avoid duplication and ensure consistency of package metadata. - tests: - - SpdxTool_CopyPackage - - - id: SpdxTool-Pkg-UpdatePackage - title: The tool shall update existing packages in SPDX documents using the update-package command. - tags: - - spdx - justification: | - Users need to modify package metadata as software components evolve, - such as updating versions, licenses, or other attributes. - tests: - - SpdxTool_UpdatePackage - - - id: SpdxTool-Pkg-FindPackage - title: The tool shall find packages in SPDX documents using the find-package command. - tags: - - spdx - justification: | - Users need to locate specific packages within SPDX documents based on - criteria such as name, version, or other attributes to query or modify them. - tests: - - SpdxTool_FindPackage - - - id: SpdxTool-Pkg-GetVersion - title: The tool shall retrieve package versions from SPDX documents using the get-version command. - tags: - - spdx - justification: | - Users need to extract version information from packages for reporting, - dependency management, and compatibility checking. - tests: - - SpdxTool_GetVersion - - - title: SPDX Relationship Management - requirements: - - id: SpdxTool-Rel-AddRelationship - title: The tool shall add relationships to SPDX documents using the add-relationship command. - tags: - - spdx - justification: | - SPDX documents describe relationships between packages, files, and other - elements. Users need to define these relationships to accurately represent - dependency graphs and component hierarchies. - tests: - - SpdxTool_AddRelationship - - - title: SPDX Document Transformation - requirements: - - id: SpdxTool-Xfm-ToMarkdown - title: The tool shall convert SPDX documents to Markdown format using the to-markdown command. - tags: - - spdx - justification: | - Users need human-readable representations of SPDX documents for - documentation, reporting, and review purposes. Markdown is a widely - supported format for documentation. - tests: - - SpdxTool_ToMarkdown - - - id: SpdxTool-Xfm-Diagram - title: The tool shall generate Mermaid diagrams from SPDX documents using the diagram command. - tags: - - spdx - justification: | - Visual representations of SPDX relationships and package hierarchies - help users understand complex dependency graphs. Mermaid is a popular - text-based diagramming language. - tests: - - SpdxTool_Diagram - - - title: SPDX Document Manipulation - requirements: - - id: SpdxTool-Man-RenameId - title: The tool shall rename SPDX element IDs using the rename-id command. - tags: - - spdx - justification: | - Users need to modify element IDs to resolve conflicts, follow naming - conventions, or reorganize SPDX documents while maintaining referential - integrity. - tests: - - SpdxTool_RenameId - - - title: File Hashing - requirements: - - id: SpdxTool-Hsh-Hash - title: The tool shall compute and verify file hashes using the hash command. - tags: - - spdx - justification: | - SPDX documents often include file hashes for integrity verification. - Users need to compute hashes using various algorithms and verify that - files match expected hash values. - tests: - - SpdxTool_Hash - - - title: Workflow Support - requirements: - - id: SpdxTool-Wkf-RunWorkflow - title: The tool shall execute workflow files using the run-workflow command. - tags: - - workflow - justification: | - Complex SPDX document operations often require multiple steps. Workflows - enable users to define and automate multi-step processes in a declarative - YAML format. - tests: - - SpdxTool_AddPackage - - SpdxTool_AddRelationship - - SpdxTool_CopyPackage - - SpdxTool_UpdatePackage - - - id: SpdxTool-Wkf-SetVariable - title: The tool shall support setting variables within workflows using the set-variable command. - tags: - - workflow - justification: | - Workflows need to pass data between steps and parameterize operations. - Variables enable dynamic workflow execution based on computed or input values. - tests: - - SpdxTool_AddPackage - - - id: SpdxTool-Wkf-Print - title: The tool shall support printing text within workflows using the print command. - tags: - - workflow - justification: | - Users need to output informational messages during workflow execution - for debugging, progress tracking, and user feedback. - tests: - - SpdxTool_AddPackage - - - id: SpdxTool-Wkf-Query - title: The tool shall support querying external program output using the query command. - tags: - - workflow - justification: | - Workflows often need to extract information from external tools or - commands to incorporate into SPDX documents or workflow logic. - tests: - - SpdxTool_Query - - - id: SpdxTool-Wkf-NuGetWorkflow - title: The tool shall support running workflow files from NuGet packages using the run-workflow command. - tags: - - workflow - justification: | - Users need to reference workflow files stored in NuGet packages so that - workflows can be versioned, distributed, and cached locally rather than - downloaded on every run. - tests: - - SpdxTool_RunNuGetWorkflow - - - title: Platform Support - requirements: - - id: SpdxTool-Plt-Windows - title: The tool shall run successfully on Windows platforms. - tags: - - platform - - msbuild - justification: | - Windows is a widely used operating system for development. The tool - (both the dotnet-tool and the MSBuild targets package) must function - correctly on Windows to support a broad user base. - tests: - - windows@SpdxTool_Validate - - windows@SingleTfmProject_DecorateSbomTrue_DecoratesSbom - - windows@MultiTfmProject_DecorateSbomTrue_DecoratesSbom - - windows@SingleTfmProject_DecorateSbomFalse_SkipsDecoration - - windows@SingleTfmProject_GenerateSbomFalse_SkipsEntirely - - windows@SingleTfmProject_MissingWorkflow_ReportsError - - - id: SpdxTool-Plt-Linux - title: The tool shall run successfully on Linux platforms. - tags: - - platform - - msbuild - justification: | - Linux is a widely used operating system for development and deployment, - especially in CI/CD environments. The tool (both the dotnet-tool and - the MSBuild targets package) must function correctly on Linux to support - a broad user base. - tests: - - ubuntu@SpdxTool_Validate - - ubuntu@SingleTfmProject_DecorateSbomTrue_DecoratesSbom - - ubuntu@MultiTfmProject_DecorateSbomTrue_DecoratesSbom - - ubuntu@SingleTfmProject_DecorateSbomFalse_SkipsDecoration - - ubuntu@SingleTfmProject_GenerateSbomFalse_SkipsEntirely - - ubuntu@SingleTfmProject_MissingWorkflow_ReportsError - - - id: SpdxTool-Plt-MacOS - title: The tool shall run successfully on macOS platforms. - tags: - - platform - - msbuild - justification: | - macOS is a widely used operating system for development, especially - among software engineers and developers. The tool (both the dotnet-tool - and the MSBuild targets package) must function correctly on macOS to - support a broad user base. - tests: - - macos@SpdxTool_Validate - - macos@SingleTfmProject_DecorateSbomTrue_DecoratesSbom - - macos@MultiTfmProject_DecorateSbomTrue_DecoratesSbom - - macos@SingleTfmProject_DecorateSbomFalse_SkipsDecoration - - macos@SingleTfmProject_GenerateSbomFalse_SkipsEntirely - - macos@SingleTfmProject_MissingWorkflow_ReportsError - - - id: SpdxTool-Plt-Net8 - title: The tool shall run successfully on .NET 8.x. - tags: - - platform - justification: | - .NET 8.x is a long-term support (LTS) release of .NET. The tool must - support this version to provide stability and compatibility for users - who require LTS support. - tests: - - dotnet8.x@SpdxTool_Validate - - - id: SpdxTool-Plt-Net9 - title: The tool shall run successfully on .NET 9.x. - tags: - - platform - justification: | - .NET 9.x is a current release of .NET. The tool must support this - version to enable users to take advantage of the latest .NET features - and improvements. - tests: - - dotnet9.x@SpdxTool_Validate - - - id: SpdxTool-Plt-Net10 - title: The tool shall run successfully on .NET 10.x. - tags: - - platform - justification: | - .NET 10.x represents forward compatibility. The tool should support - future .NET releases to ensure users can upgrade their runtime without - losing tool functionality. - tests: - - dotnet10.x@SpdxTool_Validate - - - title: OTS Software - requirements: - - id: SpdxTool-OTS-MSTest - title: MSTest shall execute unit tests and report results. - tags: - - ots - justification: | - MSTest (MSTest.TestFramework and MSTest.TestAdapter) is the unit-testing framework - used by the project. It discovers and runs all test methods and writes TRX result - files that feed into coverage reporting and requirements traceability. - tests: - - Version_ShortFlag_DisplaysVersion - - Version_LongFlag_DisplaysVersion - - Usage_ShortHelpFlag_DisplaysUsage - - - id: SpdxTool-OTS-ReqStream - title: ReqStream shall enforce that every requirement is linked to passing test evidence. - tags: - - ots - justification: | - DemaConsulting.ReqStream processes requirements.yaml and the TRX test-result files to - produce a requirements report, justifications document, and traceability matrix. When - run with --enforce, it exits with a non-zero code if any requirement lacks test evidence. - tests: - - ReqStream_EnforcementMode - - - id: SpdxTool-OTS-BuildMark - title: BuildMark shall generate build-notes documentation from GitHub Actions metadata. - tags: - - ots - justification: | - DemaConsulting.BuildMark queries the GitHub API to capture workflow run details and - renders them as a markdown build-notes document included in the release artifacts. - tests: - - BuildMark_MarkdownReportGeneration - - - id: SpdxTool-OTS-VersionMark - title: VersionMark shall publish captured tool-version information. - tags: - - ots - justification: | - DemaConsulting.VersionMark reads version metadata for each dotnet tool used in the - pipeline and writes a versions markdown document included in the release artifacts. - tests: - - VersionMark_CapturesVersions - - VersionMark_GeneratesMarkdownReport - - - id: SpdxTool-OTS-SarifMark - title: SarifMark shall convert CodeQL SARIF results into a markdown report. - tags: - - ots - justification: | - DemaConsulting.SarifMark reads the SARIF output produced by CodeQL code scanning and - renders it as a human-readable markdown document included in the release artifacts. - tests: - - SarifMark_SarifReading - - SarifMark_MarkdownReportGeneration - - - id: SpdxTool-OTS-SonarMark - title: SonarMark shall generate a SonarCloud quality report. - tags: - - ots - justification: | - DemaConsulting.SonarMark retrieves quality-gate and metrics data from SonarCloud and - renders it as a markdown document included in the release artifacts. - tests: - - SonarMark_QualityGateRetrieval - - SonarMark_IssuesRetrieval - - SonarMark_HotSpotsRetrieval - - SonarMark_MarkdownReportGeneration - - - title: MSBuild Targets Integration - requirements: - - id: SpdxTool-Tgt-DecorateSbom - title: The MSBuild targets package shall decorate SBOMs during dotnet pack. - tags: - - msbuild - - sbom - justification: | - Users need SBOM decoration integrated into their standard build process - without manual intervention. Automatic decoration during pack ensures - SBOMs are consistently enhanced for both single-TFM and multi-TFM projects. - tests: - - SingleTfmProject_DecorateSbomTrue_DecoratesSbom - - MultiTfmProject_DecorateSbomTrue_DecoratesSbom - - - id: SpdxTool-Tgt-SkipDecorate - title: The MSBuild targets package shall skip SBOM decoration when DecorateSBOM is false. - tags: - - msbuild - - sbom - justification: | - Users must be able to opt-out of SBOM decoration for projects where it is - not needed or desired. The default behavior respects user choice by not - decorating unless explicitly enabled. - tests: - - SingleTfmProject_DecorateSbomFalse_SkipsDecoration - - - id: SpdxTool-Tgt-SkipGenerateSbom - title: The MSBuild targets package shall skip SBOM decoration when GenerateSBOM is false. - tags: - - msbuild - - sbom - justification: | - SBOM decoration depends on SBOM generation being enabled. When no SBOM - is generated, decoration should be skipped entirely to avoid errors and - unnecessary processing. - tests: - - SingleTfmProject_GenerateSbomFalse_SkipsEntirely - - - id: SpdxTool-Tgt-MissingWorkflowError - title: The MSBuild targets package shall report a clear error when the workflow file is missing. - tags: - - msbuild - - sbom - justification: | - When users enable SBOM decoration but the required workflow file is not - present, they need a clear error message to understand the problem and - take corrective action. - tests: - - SingleTfmProject_MissingWorkflow_ReportsError +includes: + - docs/reqstream/spdxtool-system.yaml + - docs/reqstream/self-test/self-test.yaml + - docs/reqstream/self-test/validate.yaml + - docs/reqstream/self-test/validate-basic.yaml + - docs/reqstream/self-test/validate-add-package.yaml + - docs/reqstream/self-test/validate-add-relationship.yaml + - docs/reqstream/self-test/validate-copy-package.yaml + - docs/reqstream/self-test/validate-diagram.yaml + - docs/reqstream/self-test/validate-find-package.yaml + - docs/reqstream/self-test/validate-get-version.yaml + - docs/reqstream/self-test/validate-hash.yaml + - docs/reqstream/self-test/validate-ntia.yaml + - docs/reqstream/self-test/validate-query.yaml + - docs/reqstream/self-test/validate-rename-id.yaml + - docs/reqstream/self-test/validate-run-nuget-workflow.yaml + - docs/reqstream/self-test/validate-to-markdown.yaml + - docs/reqstream/self-test/validate-update-package.yaml + - docs/reqstream/commands/add-package.yaml + - docs/reqstream/commands/add-relationship.yaml + - docs/reqstream/commands/copy-package.yaml + - docs/reqstream/commands/diagram.yaml + - docs/reqstream/commands/find-package.yaml + - docs/reqstream/commands/get-version.yaml + - docs/reqstream/commands/hash.yaml + - docs/reqstream/commands/help.yaml + - docs/reqstream/commands/print.yaml + - docs/reqstream/commands/query.yaml + - docs/reqstream/commands/rename-id.yaml + - docs/reqstream/commands/run-workflow.yaml + - docs/reqstream/commands/set-variable.yaml + - docs/reqstream/commands/to-markdown.yaml + - docs/reqstream/commands/update-package.yaml + - docs/reqstream/commands/validate.yaml + - docs/reqstream/utility.yaml + - docs/reqstream/platform-requirements.yaml + - docs/reqstream/spdxtool-targets-system.yaml + - docs/reqstream/ots/mstest.yaml + - docs/reqstream/ots/reqstream.yaml + - docs/reqstream/ots/buildmark.yaml + - docs/reqstream/ots/versionmark.yaml + - docs/reqstream/ots/sarifmark.yaml + - docs/reqstream/ots/sonarmark.yaml diff --git a/src/DemaConsulting.SpdxTool/Program.cs b/src/DemaConsulting.SpdxTool/Program.cs index 4982295..2fdf2a3 100644 --- a/src/DemaConsulting.SpdxTool/Program.cs +++ b/src/DemaConsulting.SpdxTool/Program.cs @@ -20,7 +20,7 @@ using System.Reflection; using DemaConsulting.SpdxTool.Commands; -using Validate = DemaConsulting.SpdxTool.SelfValidation.Validate; +using Validate = DemaConsulting.SpdxTool.SelfTest.Validate; namespace DemaConsulting.SpdxTool; diff --git a/src/DemaConsulting.SpdxTool/SelfValidation/Validate.cs b/src/DemaConsulting.SpdxTool/SelfTest/Validate.cs similarity index 99% rename from src/DemaConsulting.SpdxTool/SelfValidation/Validate.cs rename to src/DemaConsulting.SpdxTool/SelfTest/Validate.cs index 5cedd15..920c46f 100644 --- a/src/DemaConsulting.SpdxTool/SelfValidation/Validate.cs +++ b/src/DemaConsulting.SpdxTool/SelfTest/Validate.cs @@ -22,7 +22,7 @@ using DemaConsulting.TestResults; using DemaConsulting.TestResults.IO; -namespace DemaConsulting.SpdxTool.SelfValidation; +namespace DemaConsulting.SpdxTool.SelfTest; /// <summary> /// Self-validation class diff --git a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateAddPackage.cs b/src/DemaConsulting.SpdxTool/SelfTest/ValidateAddPackage.cs similarity index 97% rename from src/DemaConsulting.SpdxTool/SelfValidation/ValidateAddPackage.cs rename to src/DemaConsulting.SpdxTool/SelfTest/ValidateAddPackage.cs index 23be7b3..08f51a4 100644 --- a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateAddPackage.cs +++ b/src/DemaConsulting.SpdxTool/SelfTest/ValidateAddPackage.cs @@ -22,7 +22,7 @@ using DemaConsulting.SpdxModel.IO; using DemaConsulting.TestResults; -namespace DemaConsulting.SpdxTool.SelfValidation; +namespace DemaConsulting.SpdxTool.SelfTest; /// <summary> /// Self-validation of AddPackage @@ -52,7 +52,7 @@ public static void Run(Context context, TestResults.TestResults results) new TestResult { Name = "SpdxTool_AddPackage", - ClassName = "DemaConsulting.SpdxTool.SelfValidation.ValidateAddPackage", + ClassName = "DemaConsulting.SpdxTool.SelfTest.ValidateAddPackage", ComputerName = Environment.MachineName, StartTime = DateTime.Now, Outcome = passed ? TestOutcome.Passed : TestOutcome.Failed diff --git a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateAddRelationship.cs b/src/DemaConsulting.SpdxTool/SelfTest/ValidateAddRelationship.cs similarity index 97% rename from src/DemaConsulting.SpdxTool/SelfValidation/ValidateAddRelationship.cs rename to src/DemaConsulting.SpdxTool/SelfTest/ValidateAddRelationship.cs index b0e4734..85fd8cd 100644 --- a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateAddRelationship.cs +++ b/src/DemaConsulting.SpdxTool/SelfTest/ValidateAddRelationship.cs @@ -22,7 +22,7 @@ using DemaConsulting.SpdxModel.IO; using DemaConsulting.TestResults; -namespace DemaConsulting.SpdxTool.SelfValidation; +namespace DemaConsulting.SpdxTool.SelfTest; /// <summary> /// Self-validation of AddRelationship @@ -52,7 +52,7 @@ public static void Run(Context context, TestResults.TestResults results) new TestResult { Name = "SpdxTool_AddRelationship", - ClassName = "DemaConsulting.SpdxTool.SelfValidation.ValidateAddRelationship", + ClassName = "DemaConsulting.SpdxTool.SelfTest.ValidateAddRelationship", ComputerName = Environment.MachineName, StartTime = DateTime.Now, Outcome = passed ? TestOutcome.Passed : TestOutcome.Failed diff --git a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateBasic.cs b/src/DemaConsulting.SpdxTool/SelfTest/ValidateBasic.cs similarity index 97% rename from src/DemaConsulting.SpdxTool/SelfValidation/ValidateBasic.cs rename to src/DemaConsulting.SpdxTool/SelfTest/ValidateBasic.cs index e217014..1537cdd 100644 --- a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateBasic.cs +++ b/src/DemaConsulting.SpdxTool/SelfTest/ValidateBasic.cs @@ -20,7 +20,7 @@ using DemaConsulting.TestResults; -namespace DemaConsulting.SpdxTool.SelfValidation; +namespace DemaConsulting.SpdxTool.SelfTest; /// <summary> /// Self-validation of basic SPDX validation @@ -52,7 +52,7 @@ public static void Run(Context context, TestResults.TestResults results) new TestResult { Name = "SpdxTool_Validate", - ClassName = "DemaConsulting.SpdxTool.SelfValidation.ValidateBasic", + ClassName = "DemaConsulting.SpdxTool.SelfTest.ValidateBasic", ComputerName = Environment.MachineName, StartTime = DateTime.Now, Outcome = passed ? TestOutcome.Passed : TestOutcome.Failed diff --git a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateCopyPackage.cs b/src/DemaConsulting.SpdxTool/SelfTest/ValidateCopyPackage.cs similarity index 98% rename from src/DemaConsulting.SpdxTool/SelfValidation/ValidateCopyPackage.cs rename to src/DemaConsulting.SpdxTool/SelfTest/ValidateCopyPackage.cs index e634f5a..7b3644e 100644 --- a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateCopyPackage.cs +++ b/src/DemaConsulting.SpdxTool/SelfTest/ValidateCopyPackage.cs @@ -22,7 +22,7 @@ using DemaConsulting.SpdxModel.IO; using DemaConsulting.TestResults; -namespace DemaConsulting.SpdxTool.SelfValidation; +namespace DemaConsulting.SpdxTool.SelfTest; /// <summary> /// Self-validation of CopyPackage @@ -52,7 +52,7 @@ public static void Run(Context context, TestResults.TestResults results) new TestResult { Name = "SpdxTool_CopyPackage", - ClassName = "DemaConsulting.SpdxTool.SelfValidation.ValidateCopyPackage", + ClassName = "DemaConsulting.SpdxTool.SelfTest.ValidateCopyPackage", ComputerName = Environment.MachineName, StartTime = DateTime.Now, Outcome = passed ? TestOutcome.Passed : TestOutcome.Failed diff --git a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateDiagram.cs b/src/DemaConsulting.SpdxTool/SelfTest/ValidateDiagram.cs similarity index 97% rename from src/DemaConsulting.SpdxTool/SelfValidation/ValidateDiagram.cs rename to src/DemaConsulting.SpdxTool/SelfTest/ValidateDiagram.cs index df20d9f..6fd4002 100644 --- a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateDiagram.cs +++ b/src/DemaConsulting.SpdxTool/SelfTest/ValidateDiagram.cs @@ -20,7 +20,7 @@ using DemaConsulting.TestResults; -namespace DemaConsulting.SpdxTool.SelfValidation; +namespace DemaConsulting.SpdxTool.SelfTest; /// <summary> /// Self-validation of Diagram command @@ -52,7 +52,7 @@ public static void Run(Context context, TestResults.TestResults results) new TestResult { Name = "SpdxTool_Diagram", - ClassName = "DemaConsulting.SpdxTool.SelfValidation.ValidateDiagram", + ClassName = "DemaConsulting.SpdxTool.SelfTest.ValidateDiagram", ComputerName = Environment.MachineName, StartTime = DateTime.Now, Outcome = passed ? TestOutcome.Passed : TestOutcome.Failed diff --git a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateFindPackage.cs b/src/DemaConsulting.SpdxTool/SelfTest/ValidateFindPackage.cs similarity index 97% rename from src/DemaConsulting.SpdxTool/SelfValidation/ValidateFindPackage.cs rename to src/DemaConsulting.SpdxTool/SelfTest/ValidateFindPackage.cs index 425873b..7243946 100644 --- a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateFindPackage.cs +++ b/src/DemaConsulting.SpdxTool/SelfTest/ValidateFindPackage.cs @@ -20,7 +20,7 @@ using DemaConsulting.TestResults; -namespace DemaConsulting.SpdxTool.SelfValidation; +namespace DemaConsulting.SpdxTool.SelfTest; /// <summary> /// Self-validation of FindPackage @@ -50,7 +50,7 @@ public static void Run(Context context, TestResults.TestResults results) new TestResult { Name = "SpdxTool_FindPackage", - ClassName = "DemaConsulting.SpdxTool.SelfValidation.ValidateFindPackage", + ClassName = "DemaConsulting.SpdxTool.SelfTest.ValidateFindPackage", ComputerName = Environment.MachineName, StartTime = DateTime.Now, Outcome = passed ? TestOutcome.Passed : TestOutcome.Failed diff --git a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateGetVersion.cs b/src/DemaConsulting.SpdxTool/SelfTest/ValidateGetVersion.cs similarity index 97% rename from src/DemaConsulting.SpdxTool/SelfValidation/ValidateGetVersion.cs rename to src/DemaConsulting.SpdxTool/SelfTest/ValidateGetVersion.cs index 974acd1..c3f4a60 100644 --- a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateGetVersion.cs +++ b/src/DemaConsulting.SpdxTool/SelfTest/ValidateGetVersion.cs @@ -20,7 +20,7 @@ using DemaConsulting.TestResults; -namespace DemaConsulting.SpdxTool.SelfValidation; +namespace DemaConsulting.SpdxTool.SelfTest; /// <summary> /// Self-validation of GetVersion @@ -50,7 +50,7 @@ public static void Run(Context context, TestResults.TestResults results) new TestResult { Name = "SpdxTool_GetVersion", - ClassName = "DemaConsulting.SpdxTool.SelfValidation.ValidateGetVersion", + ClassName = "DemaConsulting.SpdxTool.SelfTest.ValidateGetVersion", ComputerName = Environment.MachineName, StartTime = DateTime.Now, Outcome = passed ? TestOutcome.Passed : TestOutcome.Failed diff --git a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateHash.cs b/src/DemaConsulting.SpdxTool/SelfTest/ValidateHash.cs similarity index 97% rename from src/DemaConsulting.SpdxTool/SelfValidation/ValidateHash.cs rename to src/DemaConsulting.SpdxTool/SelfTest/ValidateHash.cs index e13a46c..a8d6745 100644 --- a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateHash.cs +++ b/src/DemaConsulting.SpdxTool/SelfTest/ValidateHash.cs @@ -20,7 +20,7 @@ using DemaConsulting.TestResults; -namespace DemaConsulting.SpdxTool.SelfValidation; +namespace DemaConsulting.SpdxTool.SelfTest; /// <summary> /// Self-validation of Hash command @@ -52,7 +52,7 @@ public static void Run(Context context, TestResults.TestResults results) new TestResult { Name = "SpdxTool_Hash", - ClassName = "DemaConsulting.SpdxTool.SelfValidation.ValidateHash", + ClassName = "DemaConsulting.SpdxTool.SelfTest.ValidateHash", ComputerName = Environment.MachineName, StartTime = DateTime.Now, Outcome = passed ? TestOutcome.Passed : TestOutcome.Failed diff --git a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateNtia.cs b/src/DemaConsulting.SpdxTool/SelfTest/ValidateNtia.cs similarity index 98% rename from src/DemaConsulting.SpdxTool/SelfValidation/ValidateNtia.cs rename to src/DemaConsulting.SpdxTool/SelfTest/ValidateNtia.cs index 97ab0da..3175845 100644 --- a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateNtia.cs +++ b/src/DemaConsulting.SpdxTool/SelfTest/ValidateNtia.cs @@ -20,7 +20,7 @@ using DemaConsulting.TestResults; -namespace DemaConsulting.SpdxTool.SelfValidation; +namespace DemaConsulting.SpdxTool.SelfTest; /// <summary> /// Self-validation of NTIA validation @@ -50,7 +50,7 @@ public static void Run(Context context, TestResults.TestResults results) new TestResult { Name = "SpdxTool_Ntia", - ClassName = "DemaConsulting.SpdxTool.SelfValidation.ValidateNtia", + ClassName = "DemaConsulting.SpdxTool.SelfTest.ValidateNtia", ComputerName = Environment.MachineName, StartTime = DateTime.Now, Outcome = passed ? TestOutcome.Passed : TestOutcome.Failed diff --git a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateQuery.cs b/src/DemaConsulting.SpdxTool/SelfTest/ValidateQuery.cs similarity index 96% rename from src/DemaConsulting.SpdxTool/SelfValidation/ValidateQuery.cs rename to src/DemaConsulting.SpdxTool/SelfTest/ValidateQuery.cs index 2ca06e6..68c66c5 100644 --- a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateQuery.cs +++ b/src/DemaConsulting.SpdxTool/SelfTest/ValidateQuery.cs @@ -21,7 +21,7 @@ using System.Text.RegularExpressions; using DemaConsulting.TestResults; -namespace DemaConsulting.SpdxTool.SelfValidation; +namespace DemaConsulting.SpdxTool.SelfTest; /// <summary> /// Self-validation of GetVersion @@ -58,7 +58,7 @@ public static void Run(Context context, TestResults.TestResults results) new TestResult { Name = "SpdxTool_Query", - ClassName = "DemaConsulting.SpdxTool.SelfValidation.ValidateQuery", + ClassName = "DemaConsulting.SpdxTool.SelfTest.ValidateQuery", ComputerName = Environment.MachineName, StartTime = DateTime.Now, Outcome = passed ? TestOutcome.Passed : TestOutcome.Failed diff --git a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateRenameId.cs b/src/DemaConsulting.SpdxTool/SelfTest/ValidateRenameId.cs similarity index 97% rename from src/DemaConsulting.SpdxTool/SelfValidation/ValidateRenameId.cs rename to src/DemaConsulting.SpdxTool/SelfTest/ValidateRenameId.cs index 85f0205..79f41d0 100644 --- a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateRenameId.cs +++ b/src/DemaConsulting.SpdxTool/SelfTest/ValidateRenameId.cs @@ -21,7 +21,7 @@ using DemaConsulting.SpdxModel.IO; using DemaConsulting.TestResults; -namespace DemaConsulting.SpdxTool.SelfValidation; +namespace DemaConsulting.SpdxTool.SelfTest; /// <summary> /// Self-validation of RenameId @@ -51,7 +51,7 @@ public static void Run(Context context, TestResults.TestResults results) new TestResult { Name = "SpdxTool_RenameId", - ClassName = "DemaConsulting.SpdxTool.SelfValidation.ValidateRenameId", + ClassName = "DemaConsulting.SpdxTool.SelfTest.ValidateRenameId", ComputerName = Environment.MachineName, StartTime = DateTime.Now, Outcome = passed ? TestOutcome.Passed : TestOutcome.Failed diff --git a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateRunNuGetWorkflow.cs b/src/DemaConsulting.SpdxTool/SelfTest/ValidateRunNuGetWorkflow.cs similarity index 96% rename from src/DemaConsulting.SpdxTool/SelfValidation/ValidateRunNuGetWorkflow.cs rename to src/DemaConsulting.SpdxTool/SelfTest/ValidateRunNuGetWorkflow.cs index 030389c..2d99dd4 100644 --- a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateRunNuGetWorkflow.cs +++ b/src/DemaConsulting.SpdxTool/SelfTest/ValidateRunNuGetWorkflow.cs @@ -20,7 +20,7 @@ using DemaConsulting.TestResults; -namespace DemaConsulting.SpdxTool.SelfValidation; +namespace DemaConsulting.SpdxTool.SelfTest; /// <summary> /// Self-validation of RunWorkflow with NuGet package @@ -50,7 +50,7 @@ public static void Run(Context context, TestResults.TestResults results) new TestResult { Name = "SpdxTool_RunNuGetWorkflow", - ClassName = "DemaConsulting.SpdxTool.SelfValidation.ValidateRunNuGetWorkflow", + ClassName = "DemaConsulting.SpdxTool.SelfTest.ValidateRunNuGetWorkflow", ComputerName = Environment.MachineName, StartTime = DateTime.Now, Outcome = passed ? TestOutcome.Passed : TestOutcome.Failed diff --git a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateToMarkdown.cs b/src/DemaConsulting.SpdxTool/SelfTest/ValidateToMarkdown.cs similarity index 97% rename from src/DemaConsulting.SpdxTool/SelfValidation/ValidateToMarkdown.cs rename to src/DemaConsulting.SpdxTool/SelfTest/ValidateToMarkdown.cs index bbdac6e..dabc3e4 100644 --- a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateToMarkdown.cs +++ b/src/DemaConsulting.SpdxTool/SelfTest/ValidateToMarkdown.cs @@ -20,7 +20,7 @@ using DemaConsulting.TestResults; -namespace DemaConsulting.SpdxTool.SelfValidation; +namespace DemaConsulting.SpdxTool.SelfTest; /// <summary> /// Self-validation of ToMarkdown command @@ -52,7 +52,7 @@ public static void Run(Context context, TestResults.TestResults results) new TestResult { Name = "SpdxTool_ToMarkdown", - ClassName = "DemaConsulting.SpdxTool.SelfValidation.ValidateToMarkdown", + ClassName = "DemaConsulting.SpdxTool.SelfTest.ValidateToMarkdown", ComputerName = Environment.MachineName, StartTime = DateTime.Now, Outcome = passed ? TestOutcome.Passed : TestOutcome.Failed diff --git a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateUpdatePackage.cs b/src/DemaConsulting.SpdxTool/SelfTest/ValidateUpdatePackage.cs similarity index 97% rename from src/DemaConsulting.SpdxTool/SelfValidation/ValidateUpdatePackage.cs rename to src/DemaConsulting.SpdxTool/SelfTest/ValidateUpdatePackage.cs index 99a15f6..2b63260 100644 --- a/src/DemaConsulting.SpdxTool/SelfValidation/ValidateUpdatePackage.cs +++ b/src/DemaConsulting.SpdxTool/SelfTest/ValidateUpdatePackage.cs @@ -21,7 +21,7 @@ using DemaConsulting.SpdxModel.IO; using DemaConsulting.TestResults; -namespace DemaConsulting.SpdxTool.SelfValidation; +namespace DemaConsulting.SpdxTool.SelfTest; /// <summary> /// Self-validation of UpdatePackage @@ -51,7 +51,7 @@ public static void Run(Context context, TestResults.TestResults results) new TestResult { Name = "SpdxTool_UpdatePackage", - ClassName = "DemaConsulting.SpdxTool.SelfValidation.ValidateUpdatePackage", + ClassName = "DemaConsulting.SpdxTool.SelfTest.ValidateUpdatePackage", ComputerName = Environment.MachineName, StartTime = DateTime.Now, Outcome = passed ? TestOutcome.Passed : TestOutcome.Failed diff --git a/test/DemaConsulting.SpdxTool.Tests/AddPackageTests.cs b/test/DemaConsulting.SpdxTool.Tests/Commands/AddPackageTests.cs similarity index 100% rename from test/DemaConsulting.SpdxTool.Tests/AddPackageTests.cs rename to test/DemaConsulting.SpdxTool.Tests/Commands/AddPackageTests.cs diff --git a/test/DemaConsulting.SpdxTool.Tests/AddRelationshipTests.cs b/test/DemaConsulting.SpdxTool.Tests/Commands/AddRelationshipTests.cs similarity index 100% rename from test/DemaConsulting.SpdxTool.Tests/AddRelationshipTests.cs rename to test/DemaConsulting.SpdxTool.Tests/Commands/AddRelationshipTests.cs diff --git a/test/DemaConsulting.SpdxTool.Tests/CommandTests.cs b/test/DemaConsulting.SpdxTool.Tests/Commands/CommandTests.cs similarity index 100% rename from test/DemaConsulting.SpdxTool.Tests/CommandTests.cs rename to test/DemaConsulting.SpdxTool.Tests/Commands/CommandTests.cs diff --git a/test/DemaConsulting.SpdxTool.Tests/CopyPackageTests.cs b/test/DemaConsulting.SpdxTool.Tests/Commands/CopyPackageTests.cs similarity index 100% rename from test/DemaConsulting.SpdxTool.Tests/CopyPackageTests.cs rename to test/DemaConsulting.SpdxTool.Tests/Commands/CopyPackageTests.cs diff --git a/test/DemaConsulting.SpdxTool.Tests/DiagramTests.cs b/test/DemaConsulting.SpdxTool.Tests/Commands/DiagramTests.cs similarity index 100% rename from test/DemaConsulting.SpdxTool.Tests/DiagramTests.cs rename to test/DemaConsulting.SpdxTool.Tests/Commands/DiagramTests.cs diff --git a/test/DemaConsulting.SpdxTool.Tests/FindPackageTests.cs b/test/DemaConsulting.SpdxTool.Tests/Commands/FindPackageTests.cs similarity index 100% rename from test/DemaConsulting.SpdxTool.Tests/FindPackageTests.cs rename to test/DemaConsulting.SpdxTool.Tests/Commands/FindPackageTests.cs diff --git a/test/DemaConsulting.SpdxTool.Tests/GetVersionTests.cs b/test/DemaConsulting.SpdxTool.Tests/Commands/GetVersionTests.cs similarity index 100% rename from test/DemaConsulting.SpdxTool.Tests/GetVersionTests.cs rename to test/DemaConsulting.SpdxTool.Tests/Commands/GetVersionTests.cs diff --git a/test/DemaConsulting.SpdxTool.Tests/HashTests.cs b/test/DemaConsulting.SpdxTool.Tests/Commands/HashTests.cs similarity index 100% rename from test/DemaConsulting.SpdxTool.Tests/HashTests.cs rename to test/DemaConsulting.SpdxTool.Tests/Commands/HashTests.cs diff --git a/test/DemaConsulting.SpdxTool.Tests/HelpTests.cs b/test/DemaConsulting.SpdxTool.Tests/Commands/HelpTests.cs similarity index 100% rename from test/DemaConsulting.SpdxTool.Tests/HelpTests.cs rename to test/DemaConsulting.SpdxTool.Tests/Commands/HelpTests.cs diff --git a/test/DemaConsulting.SpdxTool.Tests/PrintTests.cs b/test/DemaConsulting.SpdxTool.Tests/Commands/PrintTests.cs similarity index 100% rename from test/DemaConsulting.SpdxTool.Tests/PrintTests.cs rename to test/DemaConsulting.SpdxTool.Tests/Commands/PrintTests.cs diff --git a/test/DemaConsulting.SpdxTool.Tests/QueryTests.cs b/test/DemaConsulting.SpdxTool.Tests/Commands/QueryTests.cs similarity index 100% rename from test/DemaConsulting.SpdxTool.Tests/QueryTests.cs rename to test/DemaConsulting.SpdxTool.Tests/Commands/QueryTests.cs diff --git a/test/DemaConsulting.SpdxTool.Tests/RenameIdTests.cs b/test/DemaConsulting.SpdxTool.Tests/Commands/RenameIdTests.cs similarity index 100% rename from test/DemaConsulting.SpdxTool.Tests/RenameIdTests.cs rename to test/DemaConsulting.SpdxTool.Tests/Commands/RenameIdTests.cs diff --git a/test/DemaConsulting.SpdxTool.Tests/RunWorkflowTests.cs b/test/DemaConsulting.SpdxTool.Tests/Commands/RunWorkflowTests.cs similarity index 100% rename from test/DemaConsulting.SpdxTool.Tests/RunWorkflowTests.cs rename to test/DemaConsulting.SpdxTool.Tests/Commands/RunWorkflowTests.cs diff --git a/test/DemaConsulting.SpdxTool.Tests/SetVariableTests.cs b/test/DemaConsulting.SpdxTool.Tests/Commands/SetVariableTests.cs similarity index 100% rename from test/DemaConsulting.SpdxTool.Tests/SetVariableTests.cs rename to test/DemaConsulting.SpdxTool.Tests/Commands/SetVariableTests.cs diff --git a/test/DemaConsulting.SpdxTool.Tests/ToMarkdownTests.cs b/test/DemaConsulting.SpdxTool.Tests/Commands/ToMarkdownTests.cs similarity index 100% rename from test/DemaConsulting.SpdxTool.Tests/ToMarkdownTests.cs rename to test/DemaConsulting.SpdxTool.Tests/Commands/ToMarkdownTests.cs diff --git a/test/DemaConsulting.SpdxTool.Tests/UnknownCommandTests.cs b/test/DemaConsulting.SpdxTool.Tests/Commands/UnknownCommandTests.cs similarity index 100% rename from test/DemaConsulting.SpdxTool.Tests/UnknownCommandTests.cs rename to test/DemaConsulting.SpdxTool.Tests/Commands/UnknownCommandTests.cs diff --git a/test/DemaConsulting.SpdxTool.Tests/UpdatePackageTests.cs b/test/DemaConsulting.SpdxTool.Tests/Commands/UpdatePackageTests.cs similarity index 100% rename from test/DemaConsulting.SpdxTool.Tests/UpdatePackageTests.cs rename to test/DemaConsulting.SpdxTool.Tests/Commands/UpdatePackageTests.cs diff --git a/test/DemaConsulting.SpdxTool.Tests/ValidateTests.cs b/test/DemaConsulting.SpdxTool.Tests/Commands/ValidateTests.cs similarity index 100% rename from test/DemaConsulting.SpdxTool.Tests/ValidateTests.cs rename to test/DemaConsulting.SpdxTool.Tests/Commands/ValidateTests.cs diff --git a/test/DemaConsulting.SpdxTool.Tests/SelfValidationTests.cs b/test/DemaConsulting.SpdxTool.Tests/IntegrationTests.cs similarity index 94% rename from test/DemaConsulting.SpdxTool.Tests/SelfValidationTests.cs rename to test/DemaConsulting.SpdxTool.Tests/IntegrationTests.cs index 78e0352..b139ae8 100644 --- a/test/DemaConsulting.SpdxTool.Tests/SelfValidationTests.cs +++ b/test/DemaConsulting.SpdxTool.Tests/IntegrationTests.cs @@ -21,16 +21,16 @@ namespace DemaConsulting.SpdxTool.Tests; /// <summary> -/// Tests for the self-validation feature. +/// Integration tests for the self-validation feature. /// </summary> [TestClass] -public class SelfValidationTests +public class IntegrationTests { /// <summary> /// Test that the validate flag succeeds on self-validation /// </summary> [TestMethod] - public void SelfValidation_ValidateFlag_Succeeds() + public void SelfTest_ValidateFlag_Succeeds() { // Act: Run the command var exitCode = Runner.Run( @@ -48,7 +48,7 @@ public void SelfValidation_ValidateFlag_Succeeds() /// Test that the validate flag with depth shows depth in output /// </summary> [TestMethod] - public void SelfValidation_ValidateFlagWithDepth_ShowsDepth() + public void SelfTest_ValidateFlagWithDepth_ShowsDepth() { // Act: Run the command var exitCode = Runner.Run( @@ -69,7 +69,7 @@ public void SelfValidation_ValidateFlagWithDepth_ShowsDepth() /// Test that the validate flag with results generates a TRX file /// </summary> [TestMethod] - public void SelfValidation_ValidateFlagWithResults_GeneratesTrxFile() + public void SelfTest_ValidateFlagWithResults_GeneratesTrxFile() { const string resultFile = "results.trx"; @@ -124,7 +124,7 @@ public void SelfValidation_ValidateFlagWithResults_GeneratesTrxFile() /// Test that the validate flag with results generates a JUnit file /// </summary> [TestMethod] - public void SelfValidation_ValidateFlagWithResults_GeneratesJUnitFile() + public void SelfTest_ValidateFlagWithResults_GeneratesJUnitFile() { const string resultFile = "results.xml"; diff --git a/test/DemaConsulting.SpdxTool.Tests/ProgramTests.cs b/test/DemaConsulting.SpdxTool.Tests/ProgramTests.cs new file mode 100644 index 0000000..ee2c7d1 --- /dev/null +++ b/test/DemaConsulting.SpdxTool.Tests/ProgramTests.cs @@ -0,0 +1,134 @@ +// Copyright (c) 2024 DEMA Consulting +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. + +using System.Text.RegularExpressions; + +namespace DemaConsulting.SpdxTool.Tests; + +/// <summary> +/// Unit tests for the Program class. +/// </summary> +[TestClass] +public partial class ProgramTests +{ + /// <summary> + /// Regular expression to match a semantic version string. + /// </summary> + [GeneratedRegex(@"\d+\.\d+\.\d+.*")] + private static partial Regex VersionRegex(); + + /// <summary> + /// Test that Program.Version is a valid version string. + /// </summary> + [TestMethod] + public void Program_Version_IsValidVersionString() + { + // Act + var version = Program.Version; + + // Assert + Assert.IsNotNull(version); + Assert.IsFalse(string.IsNullOrWhiteSpace(version)); + Assert.MatchesRegex(VersionRegex(), version); + } + + /// <summary> + /// Test that Program.Run with version context writes version to output. + /// </summary> + [TestMethod] + public void Program_Run_VersionContext_WritesVersion() + { + // Arrange + using var context = Context.Create(["-v"]); + + // Act: capture console output + var originalOut = Console.Out; + using var writer = new StringWriter(); + Console.SetOut(writer); + try + { + Program.Run(context); + } + finally + { + Console.SetOut(originalOut); + } + + // Assert + Assert.AreEqual(0, context.ExitCode); + Assert.MatchesRegex(VersionRegex(), writer.ToString()); + } + + /// <summary> + /// Test that Program.Run with help context writes usage to output. + /// </summary> + [TestMethod] + public void Program_Run_HelpContext_WritesUsage() + { + // Arrange + using var context = Context.Create(["--help"]); + + // Act: capture console output + var originalOut = Console.Out; + using var writer = new StringWriter(); + Console.SetOut(writer); + try + { + Program.Run(context); + } + finally + { + Console.SetOut(originalOut); + } + + // Assert + Assert.AreEqual(0, context.ExitCode); + Assert.Contains("Usage: spdx-tool", writer.ToString()); + } + + /// <summary> + /// Test that Program.Run with no arguments writes error and usage. + /// </summary> + [TestMethod] + public void Program_Run_NoArguments_WritesErrorAndUsage() + { + // Arrange + using var context = Context.Create([]); + + // Act: capture console output + var originalOut = Console.Out; + using var writer = new StringWriter(); + Console.SetOut(writer); + try + { + Program.Run(context); + } + finally + { + Console.SetOut(originalOut); + } + + // Assert + Assert.AreEqual(1, context.ExitCode); + var output = writer.ToString(); + Assert.Contains("Error: Missing arguments", output); + Assert.Contains("Usage: spdx-tool", output); + } +} diff --git a/test/DemaConsulting.SpdxTool.Tests/SelfTest/SelfTestTests.cs b/test/DemaConsulting.SpdxTool.Tests/SelfTest/SelfTestTests.cs new file mode 100644 index 0000000..3a2ac1f --- /dev/null +++ b/test/DemaConsulting.SpdxTool.Tests/SelfTest/SelfTestTests.cs @@ -0,0 +1,118 @@ +// Copyright (c) 2024 DEMA Consulting +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. + +using DemaConsulting.SpdxTool.SelfTest; + +namespace DemaConsulting.SpdxTool.Tests; + +/// <summary> +/// Tests for the SelfTest subsystem. +/// </summary> +[TestClass] +public class SelfTestTests +{ + /// <summary> + /// Test that Validate.Run succeeds with a --validate context + /// </summary> + [TestMethod] + public void SelfTest_Validate_Succeeds() + { + // Arrange: create context with --validate flag + using var context = Context.Create(["--validate"]); + + // Act: run the self-test subsystem directly + Validate.Run(context); + + // Assert: no errors + Assert.AreEqual(0, context.ExitCode); + } + + /// <summary> + /// Test that Validate.Run succeeds with depth control + /// </summary> + [TestMethod] + public void SelfTest_ValidateWithDepth_Succeeds() + { + // Arrange: create context with --validate --depth flags + using var context = Context.Create(["--validate", "--depth", "2"]); + + // Act: run the self-test subsystem directly + Validate.Run(context); + + // Assert: no errors + Assert.AreEqual(0, context.ExitCode); + } + + /// <summary> + /// Test that Validate.Run generates a TRX result file + /// </summary> + [TestMethod] + public void SelfTest_ValidateWithTrxResult_GeneratesTrxFile() + { + var resultFile = Path.Join(Path.GetTempPath(), $"spdxtool-st-{Guid.NewGuid():N}.trx"); + + try + { + // Arrange: create context with --validate --result flags + using var context = Context.Create(["--validate", "--result", resultFile]); + + // Act: run the self-test subsystem directly + Validate.Run(context); + + // Assert: file created and contains expected content + Assert.AreEqual(0, context.ExitCode); + Assert.IsTrue(File.Exists(resultFile)); + var results = File.ReadAllText(resultFile).Replace("\r\n", "\n"); + Assert.Contains("DemaConsulting.SpdxTool Validation Results -", results); + } + finally + { + File.Delete(resultFile); + } + } + + /// <summary> + /// Test that Validate.Run generates a JUnit XML result file + /// </summary> + [TestMethod] + public void SelfTest_ValidateWithJUnitResult_GeneratesJUnitFile() + { + var resultFile = Path.Join(Path.GetTempPath(), $"spdxtool-st-{Guid.NewGuid():N}.xml"); + + try + { + // Arrange: create context with --validate --result flags + using var context = Context.Create(["--validate", "--result", resultFile]); + + // Act: run the self-test subsystem directly + Validate.Run(context); + + // Assert: file created and contains expected content + Assert.AreEqual(0, context.ExitCode); + Assert.IsTrue(File.Exists(resultFile)); + var results = File.ReadAllText(resultFile); + Assert.Contains("DemaConsulting.SpdxTool Validation Results -", results); + } + finally + { + File.Delete(resultFile); + } + } +} diff --git a/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateAddPackageTests.cs b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateAddPackageTests.cs new file mode 100644 index 0000000..3628439 --- /dev/null +++ b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateAddPackageTests.cs @@ -0,0 +1,48 @@ +// Copyright (c) 2024 DEMA Consulting +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. + +using DemaConsulting.SpdxTool.SelfTest; +using DemaConsulting.TestResults; + +namespace DemaConsulting.SpdxTool.Tests; +/// <summary> +/// Unit tests for the ValidateAddPackage self-validation unit. +/// </summary> +[TestClass] +public class ValidateAddPackageTests +{ + /// <summary> + /// Test that ValidateAddPackage validation passes. + /// </summary> + [TestMethod] + public void SpdxTool_AddPackage() + { + // Arrange + using var context = Context.Create(["--validate"]); + var results = new DemaConsulting.TestResults.TestResults(); + + // Act + ValidateAddPackage.Run(context, results); + + // Assert + Assert.AreEqual(1, results.Results.Count); + Assert.AreEqual(TestOutcome.Passed, results.Results[0].Outcome); + } +} diff --git a/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateAddRelationshipTests.cs b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateAddRelationshipTests.cs new file mode 100644 index 0000000..808e3cb --- /dev/null +++ b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateAddRelationshipTests.cs @@ -0,0 +1,48 @@ +// Copyright (c) 2024 DEMA Consulting +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. + +using DemaConsulting.SpdxTool.SelfTest; +using DemaConsulting.TestResults; + +namespace DemaConsulting.SpdxTool.Tests; +/// <summary> +/// Unit tests for the ValidateAddRelationship self-validation unit. +/// </summary> +[TestClass] +public class ValidateAddRelationshipTests +{ + /// <summary> + /// Test that ValidateAddRelationship validation passes. + /// </summary> + [TestMethod] + public void SpdxTool_AddRelationship() + { + // Arrange + using var context = Context.Create(["--validate"]); + var results = new DemaConsulting.TestResults.TestResults(); + + // Act + ValidateAddRelationship.Run(context, results); + + // Assert + Assert.AreEqual(1, results.Results.Count); + Assert.AreEqual(TestOutcome.Passed, results.Results[0].Outcome); + } +} diff --git a/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateBasicTests.cs b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateBasicTests.cs new file mode 100644 index 0000000..d064336 --- /dev/null +++ b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateBasicTests.cs @@ -0,0 +1,48 @@ +// Copyright (c) 2024 DEMA Consulting +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. + +using DemaConsulting.SpdxTool.SelfTest; +using DemaConsulting.TestResults; + +namespace DemaConsulting.SpdxTool.Tests; +/// <summary> +/// Unit tests for the ValidateBasic self-validation unit. +/// </summary> +[TestClass] +public class ValidateBasicTests +{ + /// <summary> + /// Test that ValidateBasic validation passes. + /// </summary> + [TestMethod] + public void SpdxTool_Basic() + { + // Arrange + using var context = Context.Create(["--validate"]); + var results = new DemaConsulting.TestResults.TestResults(); + + // Act + ValidateBasic.Run(context, results); + + // Assert + Assert.AreEqual(1, results.Results.Count); + Assert.AreEqual(TestOutcome.Passed, results.Results[0].Outcome); + } +} diff --git a/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateCopyPackageTests.cs b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateCopyPackageTests.cs new file mode 100644 index 0000000..46609c0 --- /dev/null +++ b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateCopyPackageTests.cs @@ -0,0 +1,48 @@ +// Copyright (c) 2024 DEMA Consulting +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. + +using DemaConsulting.SpdxTool.SelfTest; +using DemaConsulting.TestResults; + +namespace DemaConsulting.SpdxTool.Tests; +/// <summary> +/// Unit tests for the ValidateCopyPackage self-validation unit. +/// </summary> +[TestClass] +public class ValidateCopyPackageTests +{ + /// <summary> + /// Test that ValidateCopyPackage validation passes. + /// </summary> + [TestMethod] + public void SpdxTool_CopyPackage() + { + // Arrange + using var context = Context.Create(["--validate"]); + var results = new DemaConsulting.TestResults.TestResults(); + + // Act + ValidateCopyPackage.Run(context, results); + + // Assert + Assert.AreEqual(1, results.Results.Count); + Assert.AreEqual(TestOutcome.Passed, results.Results[0].Outcome); + } +} diff --git a/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateDiagramTests.cs b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateDiagramTests.cs new file mode 100644 index 0000000..3458312 --- /dev/null +++ b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateDiagramTests.cs @@ -0,0 +1,48 @@ +// Copyright (c) 2024 DEMA Consulting +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. + +using DemaConsulting.SpdxTool.SelfTest; +using DemaConsulting.TestResults; + +namespace DemaConsulting.SpdxTool.Tests; +/// <summary> +/// Unit tests for the ValidateDiagram self-validation unit. +/// </summary> +[TestClass] +public class ValidateDiagramTests +{ + /// <summary> + /// Test that ValidateDiagram validation passes. + /// </summary> + [TestMethod] + public void SpdxTool_Diagram() + { + // Arrange + using var context = Context.Create(["--validate"]); + var results = new DemaConsulting.TestResults.TestResults(); + + // Act + ValidateDiagram.Run(context, results); + + // Assert + Assert.AreEqual(1, results.Results.Count); + Assert.AreEqual(TestOutcome.Passed, results.Results[0].Outcome); + } +} diff --git a/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateFindPackageTests.cs b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateFindPackageTests.cs new file mode 100644 index 0000000..9654a4a --- /dev/null +++ b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateFindPackageTests.cs @@ -0,0 +1,48 @@ +// Copyright (c) 2024 DEMA Consulting +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. + +using DemaConsulting.SpdxTool.SelfTest; +using DemaConsulting.TestResults; + +namespace DemaConsulting.SpdxTool.Tests; +/// <summary> +/// Unit tests for the ValidateFindPackage self-validation unit. +/// </summary> +[TestClass] +public class ValidateFindPackageTests +{ + /// <summary> + /// Test that ValidateFindPackage validation passes. + /// </summary> + [TestMethod] + public void SpdxTool_FindPackage() + { + // Arrange + using var context = Context.Create(["--validate"]); + var results = new DemaConsulting.TestResults.TestResults(); + + // Act + ValidateFindPackage.Run(context, results); + + // Assert + Assert.AreEqual(1, results.Results.Count); + Assert.AreEqual(TestOutcome.Passed, results.Results[0].Outcome); + } +} diff --git a/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateGetVersionTests.cs b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateGetVersionTests.cs new file mode 100644 index 0000000..dbf1939 --- /dev/null +++ b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateGetVersionTests.cs @@ -0,0 +1,48 @@ +// Copyright (c) 2024 DEMA Consulting +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. + +using DemaConsulting.SpdxTool.SelfTest; +using DemaConsulting.TestResults; + +namespace DemaConsulting.SpdxTool.Tests; +/// <summary> +/// Unit tests for the ValidateGetVersion self-validation unit. +/// </summary> +[TestClass] +public class ValidateGetVersionTests +{ + /// <summary> + /// Test that ValidateGetVersion validation passes. + /// </summary> + [TestMethod] + public void SpdxTool_GetVersion() + { + // Arrange + using var context = Context.Create(["--validate"]); + var results = new DemaConsulting.TestResults.TestResults(); + + // Act + ValidateGetVersion.Run(context, results); + + // Assert + Assert.AreEqual(1, results.Results.Count); + Assert.AreEqual(TestOutcome.Passed, results.Results[0].Outcome); + } +} diff --git a/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateHashTests.cs b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateHashTests.cs new file mode 100644 index 0000000..40580b8 --- /dev/null +++ b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateHashTests.cs @@ -0,0 +1,48 @@ +// Copyright (c) 2024 DEMA Consulting +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. + +using DemaConsulting.SpdxTool.SelfTest; +using DemaConsulting.TestResults; + +namespace DemaConsulting.SpdxTool.Tests; +/// <summary> +/// Unit tests for the ValidateHash self-validation unit. +/// </summary> +[TestClass] +public class ValidateHashTests +{ + /// <summary> + /// Test that ValidateHash validation passes. + /// </summary> + [TestMethod] + public void SpdxTool_Hash() + { + // Arrange + using var context = Context.Create(["--validate"]); + var results = new DemaConsulting.TestResults.TestResults(); + + // Act + ValidateHash.Run(context, results); + + // Assert + Assert.AreEqual(1, results.Results.Count); + Assert.AreEqual(TestOutcome.Passed, results.Results[0].Outcome); + } +} diff --git a/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateNtiaTests.cs b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateNtiaTests.cs new file mode 100644 index 0000000..101f24e --- /dev/null +++ b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateNtiaTests.cs @@ -0,0 +1,48 @@ +// Copyright (c) 2024 DEMA Consulting +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. + +using DemaConsulting.SpdxTool.SelfTest; +using DemaConsulting.TestResults; + +namespace DemaConsulting.SpdxTool.Tests; +/// <summary> +/// Unit tests for the ValidateNtia self-validation unit. +/// </summary> +[TestClass] +public class ValidateNtiaTests +{ + /// <summary> + /// Test that ValidateNtia validation passes. + /// </summary> + [TestMethod] + public void SpdxTool_Ntia() + { + // Arrange + using var context = Context.Create(["--validate"]); + var results = new DemaConsulting.TestResults.TestResults(); + + // Act + ValidateNtia.Run(context, results); + + // Assert + Assert.AreEqual(1, results.Results.Count); + Assert.AreEqual(TestOutcome.Passed, results.Results[0].Outcome); + } +} diff --git a/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateQueryTests.cs b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateQueryTests.cs new file mode 100644 index 0000000..173ec01 --- /dev/null +++ b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateQueryTests.cs @@ -0,0 +1,48 @@ +// Copyright (c) 2024 DEMA Consulting +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. + +using DemaConsulting.SpdxTool.SelfTest; +using DemaConsulting.TestResults; + +namespace DemaConsulting.SpdxTool.Tests; +/// <summary> +/// Unit tests for the ValidateQuery self-validation unit. +/// </summary> +[TestClass] +public class ValidateQueryTests +{ + /// <summary> + /// Test that ValidateQuery validation passes. + /// </summary> + [TestMethod] + public void SpdxTool_Query() + { + // Arrange + using var context = Context.Create(["--validate"]); + var results = new DemaConsulting.TestResults.TestResults(); + + // Act + ValidateQuery.Run(context, results); + + // Assert + Assert.AreEqual(1, results.Results.Count); + Assert.AreEqual(TestOutcome.Passed, results.Results[0].Outcome); + } +} diff --git a/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateRenameIdTests.cs b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateRenameIdTests.cs new file mode 100644 index 0000000..3b7d557 --- /dev/null +++ b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateRenameIdTests.cs @@ -0,0 +1,48 @@ +// Copyright (c) 2024 DEMA Consulting +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. + +using DemaConsulting.SpdxTool.SelfTest; +using DemaConsulting.TestResults; + +namespace DemaConsulting.SpdxTool.Tests; +/// <summary> +/// Unit tests for the ValidateRenameId self-validation unit. +/// </summary> +[TestClass] +public class ValidateRenameIdTests +{ + /// <summary> + /// Test that ValidateRenameId validation passes. + /// </summary> + [TestMethod] + public void SpdxTool_RenameId() + { + // Arrange + using var context = Context.Create(["--validate"]); + var results = new DemaConsulting.TestResults.TestResults(); + + // Act + ValidateRenameId.Run(context, results); + + // Assert + Assert.AreEqual(1, results.Results.Count); + Assert.AreEqual(TestOutcome.Passed, results.Results[0].Outcome); + } +} diff --git a/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateRunNuGetWorkflowTests.cs b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateRunNuGetWorkflowTests.cs new file mode 100644 index 0000000..ede376e --- /dev/null +++ b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateRunNuGetWorkflowTests.cs @@ -0,0 +1,48 @@ +// Copyright (c) 2024 DEMA Consulting +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. + +using DemaConsulting.SpdxTool.SelfTest; +using DemaConsulting.TestResults; + +namespace DemaConsulting.SpdxTool.Tests; +/// <summary> +/// Unit tests for the ValidateRunNuGetWorkflow self-validation unit. +/// </summary> +[TestClass] +public class ValidateRunNuGetWorkflowTests +{ + /// <summary> + /// Test that ValidateRunNuGetWorkflow validation passes. + /// </summary> + [TestMethod] + public void SpdxTool_RunNuGetWorkflow() + { + // Arrange + using var context = Context.Create(["--validate"]); + var results = new DemaConsulting.TestResults.TestResults(); + + // Act + ValidateRunNuGetWorkflow.Run(context, results); + + // Assert + Assert.AreEqual(1, results.Results.Count); + Assert.AreEqual(TestOutcome.Passed, results.Results[0].Outcome); + } +} diff --git a/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateToMarkdownTests.cs b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateToMarkdownTests.cs new file mode 100644 index 0000000..bb67e4c --- /dev/null +++ b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateToMarkdownTests.cs @@ -0,0 +1,48 @@ +// Copyright (c) 2024 DEMA Consulting +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. + +using DemaConsulting.SpdxTool.SelfTest; +using DemaConsulting.TestResults; + +namespace DemaConsulting.SpdxTool.Tests; +/// <summary> +/// Unit tests for the ValidateToMarkdown self-validation unit. +/// </summary> +[TestClass] +public class ValidateToMarkdownTests +{ + /// <summary> + /// Test that ValidateToMarkdown validation passes. + /// </summary> + [TestMethod] + public void SpdxTool_ToMarkdown() + { + // Arrange + using var context = Context.Create(["--validate"]); + var results = new DemaConsulting.TestResults.TestResults(); + + // Act + ValidateToMarkdown.Run(context, results); + + // Assert + Assert.AreEqual(1, results.Results.Count); + Assert.AreEqual(TestOutcome.Passed, results.Results[0].Outcome); + } +} diff --git a/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateUpdatePackageTests.cs b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateUpdatePackageTests.cs new file mode 100644 index 0000000..b0e2e8e --- /dev/null +++ b/test/DemaConsulting.SpdxTool.Tests/SelfTest/ValidateUpdatePackageTests.cs @@ -0,0 +1,48 @@ +// Copyright (c) 2024 DEMA Consulting +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to deal +// in the Software without restriction, including without limitation the rights +// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +// copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +// SOFTWARE. + +using DemaConsulting.SpdxTool.SelfTest; +using DemaConsulting.TestResults; + +namespace DemaConsulting.SpdxTool.Tests; +/// <summary> +/// Unit tests for the ValidateUpdatePackage self-validation unit. +/// </summary> +[TestClass] +public class ValidateUpdatePackageTests +{ + /// <summary> + /// Test that ValidateUpdatePackage validation passes. + /// </summary> + [TestMethod] + public void SpdxTool_UpdatePackage() + { + // Arrange + using var context = Context.Create(["--validate"]); + var results = new DemaConsulting.TestResults.TestResults(); + + // Act + ValidateUpdatePackage.Run(context, results); + + // Assert + Assert.AreEqual(1, results.Results.Count); + Assert.AreEqual(TestOutcome.Passed, results.Results[0].Outcome); + } +} diff --git a/test/DemaConsulting.SpdxTool.Tests/PathHelpersTests.cs b/test/DemaConsulting.SpdxTool.Tests/Utility/PathHelpersTests.cs similarity index 100% rename from test/DemaConsulting.SpdxTool.Tests/PathHelpersTests.cs rename to test/DemaConsulting.SpdxTool.Tests/Utility/PathHelpersTests.cs diff --git a/test/DemaConsulting.SpdxTool.Tests/WildcardTests.cs b/test/DemaConsulting.SpdxTool.Tests/Utility/WildcardTests.cs similarity index 100% rename from test/DemaConsulting.SpdxTool.Tests/WildcardTests.cs rename to test/DemaConsulting.SpdxTool.Tests/Utility/WildcardTests.cs