consolidation

func BuildPackageRegistry ¶

func BuildPackageRegistry(consolidated sdk.ConsolidatedGraph) *sdk.PackageRegistry

BuildPackageRegistry seeds a PURL-keyed package registry from a consolidated graph. Each dependency node contributes one registry package (deduplicated by PURL); detection-time license facts stashed on the node by SBOM-backed detectors are lifted into the registry package. Matchers later enrich these packages in place. Dependency nodes are linked to their package via PackageRef.

func ConsolidateGraphs ¶

func ConsolidateGraphs(results []sdk.DetectionResult) (sdk.ConsolidatedGraph, error)

ConsolidateGraphs merges resolved subproject graph containers while preserving manifest roots.

func ManifestDedupPriority ¶

func ManifestDedupPriority(origin sdk.DetectorOrigin) int

ManifestDedupPriority returns the precedence rank used when multiple detectors resolve the same manifest. Lower values win.

Priority order: 0. External detectors 1. Core detectors (Bomly-native implementations) 2. Bundled third-party detectors (e.g. Syft fallback)

func NormalizeManifestPath ¶ added in v0.20.2

func NormalizeManifestPath(subproject sdk.Subproject, manifestPath string) string

NormalizeManifestPath renders a detector-reported manifest path the way the consolidated manifests carry it: relative to the subproject's execution target in slash form. Warnings that name a file go through this so an absolute path inside a temporary clone directory never reaches output.