Add some helper tooling for dev and docs

Also, reformat with black and fix a few ruff findings.

.github/workflows/docs.yml

@@ -24,5 +24,5 @@ jobs:
           path: .cache
           restore-keys: |
             mkdocs-material-
-      - run: pip install mkdocs-material[imaging]
+      - run: pip install -r requirements/docs-requirements.txt
       - run: mkdocs gh-deploy --force

.github/workflows/test.yml

@@ -0,0 +1,25 @@
+name: CI
+
+on:
+  # Triggers the workflow on push or pull request events but only for the "main" branch
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+jobs:
+  tox:
+    name: Run Tox
+    steps:
+    - uses: actions/checkout@v2
+    - name: Run all envs
+      uses: fedora-python/tox-github-action@main
+      with:
+        tox_env: ${{ matrix.tox_env }}
+    strategy:
+      matrix:
+        tox_env: [black, ruff, schema]
+    runs-on: ubuntu-latest

.gitignore

@@ -1 +1,3 @@
 .cache
+*.egg-info/
+.tox

pyproject.toml

@@ -0,0 +1,9 @@
+[tool.black]
+line-length = 100
+
+[tool.ruff]
+line-length = 100
+
+[tool.ruff.lint]
+# https://beta.ruff.rs/docs/rules/
+select = ["F", "E", "W", "I", "N"]

requirements/dev-requirements.in

@@ -0,0 +1,3 @@
+black
+check-jsonschema
+ruff

requirements/docs-requirements.in

@@ -0,0 +1 @@
+mkdocs-material[imaging]

sbom/examples/container_image/from_catalog.py

@@ -1,5 +1,5 @@
-import json
 import itertools
+import json
 import sys
 
 import requests

sbom/examples/rpm/from-koji.py

@@ -1,12 +1,13 @@
 import hashlib
 import json
-import koji
 import os
 import re
 import subprocess
 import sys
 from tempfile import TemporaryDirectory
 
+import koji
+
 # Script requires these RPMs: brewkoji, rpmdevtools, rpm-build
 # Run with: ./from-koji.py brew <NVR>
 
@@ -95,14 +96,14 @@ def run_syft(builddir):
     relationships.extend(syft_rels)
 
 
-def mock_openssl_midstream(sfn, sourceN, sname, sver):
+def mock_openssl_midstream(sfn, source, sname, sver):
     # Model a midstream repository for this.
     ext = re.sub(r".*-hobbled\.", "", sfn)
     url = f"https://openssl.org/source/openssl-{sver}.{ext}"
     # Hard-code example value for 3.0.7
     digest = "83049d042a260e696f62406ac5c08bf706fd84383f945cf21bd61e9ed95c396e"
     upackage = {
-        "SPDXID": f"SPDXRef-{sourceN}-origin",
+        "SPDXID": f"SPDXRef-{source}-origin",
         "name": sname,
         "versionInfo": sver,
         "downloadLocation": url,
@@ -117,17 +118,19 @@ def mock_openssl_midstream(sfn, sourceN, sname, sver):
             {
                 "referenceCategory": "PACKAGE-MANAGER",
                 "referenceType": "purl",
-                "referenceLocator": f"pkg:generic/{sname}@{sver}?download_url={url}&checksum=sha256:{digest}",
+                "referenceLocator": (
+                    f"pkg:generic/{sname}@{sver}?download_url={url}&checksum=sha256:{digest}",
+                ),
             }
         ],
     }
 
     pkgs_by_arch.setdefault(arch, []).append(upackage)
     relationships.append(
         {
-            "spdxElementId": f"SPDXRef-{sourceN}",
+            "spdxElementId": f"SPDXRef-{source}",
             "relationshipType": "GENERATED_FROM",
-            "relatedSpdxElement": f"SPDXRef-{sourceN}-origin",
+            "relatedSpdxElement": f"SPDXRef-{source}-origin",
         }
     )
 
@@ -198,7 +201,7 @@ def handle_srpm(filename, name):
             if not m:
                 continue
 
-            (sourceN, url, _, sfn) = m.groups()
+            (source, url, _, sfn) = m.groups()
 
             # Parse filename
             tarball_match = tarball_re.match(sfn)
@@ -209,7 +212,7 @@ def handle_srpm(filename, name):
 
             # Special case to fix up example for openssl
             if sname == "openssl":
-                url = mock_openssl_midstream(sfn, sourceN, sname, sver)
+                url = mock_openssl_midstream(sfn, source, sname, sver)
 
             # Calculate checksum
             sha256 = hashlib.sha256()
@@ -223,7 +226,7 @@ def handle_srpm(filename, name):
             if url is None or ":" not in url:
                 url = "NOASSERTION"
 
-            sref = f"SPDXRef-{sourceN}"
+            sref = f"SPDXRef-{source}"
             digest = sha256.hexdigest()
             spackage = {
                 "SPDXID": sref,
@@ -309,7 +312,10 @@ def handle_srpm(filename, name):
             {
                 "referenceCategory": "PACKAGE-MANAGER",
                 "referenceType": "purl",
-                "referenceLocator": f"pkg:rpm/redhat/{name}@{version}-{release}?arch={arch}&checksum=sha256:{digest}",
+                "referenceLocator": (
+                    f"pkg:rpm/redhat/{name}@{version}-{release}?"
+                    f"arch={arch}&checksum=sha256:{digest}",
+                ),
             }
         ],
         "checksums": [

tox.ini

@@ -0,0 +1,19 @@
+[tox]
+envlist = black, ruff, schema
+
+[testenv:black]
+deps = -r requirements/dev-requirements.txt
+commands = black --check .
+
+[testenv:ruff]
+deps = -r requirements/dev-requirements.txt
+commands = ruff check .
+
+[testenv:schema]
+deps = -r requirements/dev-requirements.txt
+allowlist_externals = bash
+commands =
+    bash -c 'for example in {tox_root}/sbom/examples/*/*.json; do \
+        echo "$example"; \
+        check-jsonschema --schemafile sbom/spdx-2.3-schema.json "$example"; \
+    done'