[Supply Chain] Generate an SBOM and automate dependency-license review

[KeyffMS]

Completed state

SightAdapt now generates its SBOM, dependency summary and license-evidence report from the complete application and test restore graphs plus exact publish-component evidence. The dependency policy is a reviewed decision/override layer, not a handwritten inventory.

Implemented inventory

• every NuGet package in both project.assets.json libraries collections is inventoried;
• every package dependency edge in both targets graphs is retained;
• direct and transitive dependencies are distinguished;
• application, test, build, restore-only and shipped scopes are distinguished;
• [Legal/.NET] Generate exact-version THIRD-PARTY-NOTICES for self-contained builds #83 component coverage is the authority for packages embedded in SightAdapt.exe or shipped as loose binaries;
• the pinned SDK and maintained GitHub Actions are included as build inputs;
• every final packaged file except the SBOM's own final bytes is recorded with SHA-256.

License evidence

For every NuGet package the report retains:

• exact package identity and SHA-512;
• exact .nuspec SHA-256;
• declared license expression, packaged license file or license URL;
• packaged-license SHA-256 when applicable;
• repository URL/commit and author information when supplied;
• concluded license, decision source and approval result.

Unknown, denied, review-required or evidence-incomplete packages fail CI. release/dependency-policy.json schema 2 defines allow/deny/review rules, custom LicenseRef records and selected version-specific overrides.

Verified result

GitHub Actions run 30541728349 generated a passing inventory for 0.5.0.50-alpha:

Metric	Result
Components	25
Transitive components	16
Restore-graph edges	17
Shipped packages/components	4
Application-graph packages	6
Test-graph packages	16
SPDX packages	25
Packaged files	16
SPDX relationships	58

License conclusions:

• 21 × MIT;
• 3 × LicenseRef-Microsoft-DotNet-Distribution;
• 1 × LicenseRef-Microsoft-Windows-SDK-Reference-Terms.

SPDX root relationships are scope-aware:

• shipped packages use SightAdapt DEPENDS_ON package;
• test-only packages use package TEST_DEPENDENCY_OF SightAdapt;
• SDK, Actions, restore-only and application-build packages use package BUILD_DEPENDENCY_OF SightAdapt;
• package-to-package restore edges remain DEPENDS_ON.

Findings corrected during implementation

• Microsoft.AspNetCore.App.Runtime.win-x64/8.0.29 declares MIT and is treated as application-build/restore-only, not shipped;
• transitive System.Reflection.Metadata/1.6.0 uses legacy license-URL metadata and has a version-specific reviewed MIT conclusion;
• build/test dependencies are no longer misrepresented as runtime dependencies of SightAdapt.

Negative validation

CI injects a deliberately transitive Unknown.Transitive/1.0.0 package with exact package/nuspec evidence but no license metadata. It is rejected specifically because no license can be resolved. Existing incomplete, stale and unmapped package tests also remain active.

Acceptance criteria

• Generate SPDX 2.3 JSON for every release candidate.
• Include application, complete NuGet graphs, runtime packs, embedded components and loose native files.
• Record component identity, version, supplier, license, source and checksums.
• Run automated license review in CI.
• Define allow, deny and explicit-review policies.
• Fail when a component has no resolved license or triggers policy review.
• Publish the SBOM with the release artifact.
• Generate DEPENDENCIES.md from the same inventory.
• Retain LICENSE-REPORT.json and the compliance report with each build.
• Preserve direct/transitive graph edges and correct SPDX scope semantics.

Implementation

PR #142, merged as 8024e46e1919e5c92e851f5e245e40518a409c02.

The final archive SHA-256 recorded by the compliance report is 7B178A42167B80F606D137A1AEEF734972A71363BB5166F4B0169761F34DFDBF.

Re-review triggers

Reopen or update the policy when a package, version, restore graph, build Action, SDK/runtime, publish composition, declared license, custom term or license-review rule changes.