Repository navigation
Read the expected System.Text.Json pin from the inventory in New-Sbom.Tests.ps1 - #123
Conversation
….Tests.ps1 The test hard-coded 8.0.5, so a Dependabot bump that correctly updates Build/Dependencies.psd1 (and therefore the SBOM) failed validation.
There was a problem hiding this comment.
🟢 Approval recommended
The one-test change correctly derives expectations from the inventory and matches the verified New-Sbom.ps1 declared-pin behavior, with no correctness or coverage concerns.
0 open findings
What changed in this PR
This PR fixes a brittle unit test in New-Sbom.Tests.ps1. The test "Should use the declared pin when a component version is fixed in the module" previously hard-coded System.Text.Json version 8.0.5 in both the version and purl assertions. Because the SBOM is generated from Build/Dependencies.psd1, any dependency bump (e.g. #120 moving to 8.0.6) would break the test even though the SBOM behaved correctly. The test now derives the expected version from the inventory itself, so the assertion tracks the manifest and only fails on real regressions in the SBOM generator's version/purl propagation.
Changes:
- Read the expected
System.Text.Jsonversion fromBuild/Dependencies.psd1instead of hard-coding it. - Assert the inventory version is non-empty, and that the SBOM
versionandpurlmatch the declared version. - Keep the existing
omadaweb:versionSource=declared-pinassertion unchanged.
| File | Description |
|---|---|
| Tests/Unit/New-Sbom.Tests.ps1 | Replaces hard-coded 8.0.5 expectations with values read from the dependency manifest, so the test survives future version bumps while still validating the SBOM carries the declared pin. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…e inventory (#124) A copy of a pinned version - such as the System.Text.Json assertion fixed in #123 - is not updated by a Dependabot bump or the lock refresh, so the next bump fails until main is edited first. The new test reports any file that names a pinned component together with its exact version, and CONTRIBUTING.md documents reading the version from the inventory. Co-authored-by: Claude <noreply@anthropic.com>
What was wrong
New-Sbom.Tests.ps1("Should use the declared pin when a component version is fixed in the module") hard-coded System.Text.Json8.0.5for bothversionandpurl. #120 bumps it to 8.0.6. That bump correctly updatesBuild/Dependencies.psd1, and therefore the SBOM, so PR Validation failed on both shells:Every future System.Text.Json bump would hit the same failure.
What changed
The test now reads the expected version from
Build/Dependencies.psd1. It still asserts that the version is set, that the purl matches it, and that the source isdeclared-pin. What it checks is unchanged: the SBOM carries the declared pin.How it was verified
Pester 6.2.0 / pwsh 7.4 on Linux:
main's inventory (8.0.5).Build/Dependencies.psd1(8.0.6).A different test in the same file, "Should record every copy", fails only on Linux, because the file uses Windows path separators. It is unrelated to this change; the Windows PR Validation legs are the real check.
Follow-up
After this merges,
mainwill be merged into #120.Generated by Claude Code