test(sca): pip install-discovery + requirements-detection coverage

Add tests for the pip requirements detection and install-directory discovery that
shipped in v3.40.0, plus a go.mod tidy.

Author: 0x73746F66

cmd/scan.go

@@ -2048,6 +2048,9 @@ func runLocalScan(
 	// Write any requested file outputs.
 	if outCfg.cdxFile != "" {
 		outBOM := cdx.BuildFromLocalScan(localResults, "1.7", scanCtx, seedBOM)
+		// Carry the dependency tree into the file output too, so `-o file.cdx.json`
+		// is as complete as the canonical .vulnetix/sbom.cdx.json.
+		outBOM.Dependencies = cdx.BuildDependencies(manifestGroups, cdx.ExportCompRefs(outBOM))
 		if err := writeBOMToFile(outBOM, outCfg.cdxFile); err != nil {
 			fmt.Fprintf(os.Stderr, "  warning: could not write CDX to %s: %v\n", outCfg.cdxFile, err)
 		}

go.mod

@@ -3,6 +3,7 @@ module github.com/vulnetix/cli/v3
 go 1.25.0
 
 require (
+	github.com/BurntSushi/toml v1.6.0
 	github.com/Masterminds/semver/v3 v3.5.0
 	github.com/Vulnetix/vdb-cyclonedx v0.2.0
 	github.com/alecthomas/chroma/v2 v2.26.1
@@ -27,7 +28,6 @@ require (
 
 require (
 	dario.cat/mergo v1.0.2 // indirect
-	github.com/BurntSushi/toml v1.6.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/ProtonMail/go-crypto v1.4.1 // indirect
 	github.com/agnivade/levenshtein v1.2.1 // indirect

internal/scan/pip_detect_test.go

@@ -0,0 +1,103 @@
+package scan
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func writePyTestFile(t *testing.T, path, body string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, []byte(body), 0o644); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// TestDetectManifest_RequirementsVariations covers non-standard requirements
+// filenames (matched by name pattern → confident) and arbitrary names matched by
+// content (versioned/hashed → confident; bare names → tentative).
+func TestDetectManifest_RequirementsVariations(t *testing.T) {
+	dir := t.TempDir()
+	cases := []struct {
+		rel, body, wantConf string
+	}{
+		{"requirements-dev.txt", "irrelevant content\n", ConfidenceConfident}, // name pattern wins, no read
+		{"requirements/base.in", "irrelevant content\n", ConfidenceConfident}, // parent dir = requirements/
+		{"constraints.txt", "irrelevant\n", ConfidenceConfident},
+		{"app.pip", "irrelevant\n", ConfidenceConfident},                            // .pip extension
+		{"deps.list", "flask==2.3.0\n    --hash=sha256:abc\n", ConfidenceConfident}, // content: versioned + hash
+		{"names.lst", "flask\nrequests\nnumpy\n", ConfidenceTentative},              // content: bare names
+	}
+	for _, c := range cases {
+		full := filepath.Join(dir, c.rel)
+		writePyTestFile(t, full, c.body)
+		info, ok := DetectManifest(full)
+		if !ok {
+			t.Errorf("%s: not detected", c.rel)
+			continue
+		}
+		if info.Type != "requirements.txt" {
+			t.Errorf("%s: type = %q, want requirements.txt", c.rel, info.Type)
+		}
+		if info.Ecosystem != "pypi" {
+			t.Errorf("%s: ecosystem = %q, want pypi", c.rel, info.Ecosystem)
+		}
+		if info.Confidence != c.wantConf {
+			t.Errorf("%s: confidence = %q, want %q", c.rel, info.Confidence, c.wantConf)
+		}
+	}
+}
+
+func TestDetectManifest_NotRequirements(t *testing.T) {
+	dir := t.TempDir()
+	cases := []struct{ rel, body string }{
+		{"notes.txt", "This is prose with spaces.\nMore prose here.\n"}, // spaces → not requirements
+		{"paths.txt", "src/foo.py\nsrc/bar.py\n"},                       // path separators
+		{"readme.md", "flask\nrequests\n"},                              // .md not a sniff candidate
+		{"data.txt", "key = value\nother = thing\n"},                    // assignment, not requirements
+	}
+	for _, c := range cases {
+		full := filepath.Join(dir, c.rel)
+		writePyTestFile(t, full, c.body)
+		if info, ok := DetectManifest(full); ok {
+			t.Errorf("%s: unexpectedly detected as %s (conf=%s)", c.rel, info.Type, info.Confidence)
+		}
+	}
+}
+
+func TestDetectManifest_OversizedNotSniffed(t *testing.T) {
+	dir := t.TempDir()
+	full := filepath.Join(dir, "big.txt")
+	var b strings.Builder
+	for b.Len() < 300*1024 {
+		b.WriteString("flask\n")
+	}
+	writePyTestFile(t, full, b.String())
+	if _, ok := DetectManifest(full); ok {
+		t.Error("a >256KB .txt must not be content-sniffed as requirements")
+	}
+}
+
+func TestDetectManifest_PylockExact(t *testing.T) {
+	info, ok := DetectManifest("pylock.toml")
+	if !ok {
+		t.Fatal("pylock.toml not detected")
+	}
+	if info.Type != "pylock.toml" || info.Ecosystem != "pypi" || !info.IsLock {
+		t.Fatalf("pylock.toml: %+v", info)
+	}
+}
+
+// Exact requirements.txt / requirements.in keep confident confidence.
+func TestDetectManifest_ExactRequirementsConfident(t *testing.T) {
+	for _, name := range []string{"requirements.txt", "requirements.in"} {
+		info, ok := DetectManifest(name)
+		if !ok || info.Confidence != ConfidenceConfident {
+			t.Errorf("%s: ok=%v confidence=%q, want confident", name, ok, info.Confidence)
+		}
+	}
+}

internal/scan/pip_installed_test.go

@@ -0,0 +1,167 @@
+package scan
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// makePyVenv creates a minimal project venv with the given name→version
+// distributions as *.dist-info directories, and isolates the venv-discovery env.
+func makePyVenv(t *testing.T, root string, dists map[string]string) {
+	t.Helper()
+	t.Setenv("VIRTUAL_ENV", "")
+	t.Setenv("CONDA_PREFIX", "")
+	t.Setenv("UV_PROJECT_ENVIRONMENT", "")
+	sp := filepath.Join(root, ".venv", "lib", "python3.13", "site-packages")
+	if err := os.MkdirAll(sp, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	writePyTestFile(t, filepath.Join(root, ".venv", "pyvenv.cfg"), "home = /usr\nversion_info = 3.13.0\n")
+	for name, ver := range dists {
+		di := filepath.Join(sp, name+"-"+ver+".dist-info")
+		if err := os.MkdirAll(di, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		writePyTestFile(t, filepath.Join(di, "METADATA"), "Name: "+name+"\nVersion: "+ver+"\n")
+	}
+}
+
+func TestRequirementsFullyLocked(t *testing.T) {
+	cases := []struct {
+		name string
+		pkgs []ScopedPackage
+		want bool
+	}{
+		{"exact pin", []ScopedPackage{{Name: "a", Version: "1.0", VersionSpec: "==1.0"}}, true},
+		{"hashed", []ScopedPackage{{Name: "a", Checksums: []PackageChecksum{{Alg: "SHA-256", Value: "x"}}}}, true},
+		{"range", []ScopedPackage{{Name: "a", Version: "1.0", VersionSpec: ">=1.0"}}, false},
+		{"bare name", []ScopedPackage{{Name: "a"}}, false},
+		{"empty", nil, false},
+		{"mixed unpinned", []ScopedPackage{{Name: "a", Version: "1.0", VersionSpec: "==1.0"}, {Name: "b"}}, false},
+	}
+	for _, c := range cases {
+		if got := RequirementsFullyLocked(c.pkgs); got != c.want {
+			t.Errorf("%s: RequirementsFullyLocked = %v, want %v", c.name, got, c.want)
+		}
+	}
+}
+
+func TestPyLockfilePresent(t *testing.T) {
+	dir := t.TempDir()
+	if PyLockfilePresent(dir) {
+		t.Error("empty dir reports a lock")
+	}
+	writePyTestFile(t, filepath.Join(dir, "uv.lock"), "version = 1\n")
+	if !PyLockfilePresent(dir) {
+		t.Error("uv.lock present but not detected")
+	}
+}
+
+func TestReadInstalledPythonPackages(t *testing.T) {
+	dir := t.TempDir()
+	for _, n := range []string{
+		"attrs-25.3.0.dist-info",
+		"jsonschema_specifications-2025.4.1.dist-info",
+		"foo-1.0.egg-info",
+	} {
+		if err := os.MkdirAll(filepath.Join(dir, n), 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	m, err := readInstalledPythonPackages(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if m["attrs"].Version != "25.3.0" {
+		t.Errorf("attrs = %+v", m["attrs"])
+	}
+	if m["jsonschema_specifications"].Version != "2025.4.1" {
+		t.Errorf("jsonschema_specifications = %+v", m["jsonschema_specifications"])
+	}
+	if m["foo"].Version != "1.0" {
+		t.Errorf("foo (egg-info) = %+v", m["foo"])
+	}
+}
+
+// Confident requirements file resolved from a project venv: declared packages
+// are manifest provenance, venv-only packages are installed transitives.
+func TestResolvePython_VenvResolvesWithProvenance(t *testing.T) {
+	root := t.TempDir()
+	writePyTestFile(t, filepath.Join(root, "requirements.txt"), "flask\n")
+	makePyVenv(t, root, map[string]string{"flask": "2.3.0", "werkzeug": "2.3.0"})
+
+	declared := []ScopedPackage{{Name: "flask", Ecosystem: "pypi", Scope: ScopeProduction, IsDirect: true}}
+	got, err := ResolvePythonRequirementsFromSitePackages(
+		filepath.Join(root, "requirements.txt"), "requirements.txt", declared, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	flask, ok := findPkg(got, "flask")
+	if !ok {
+		t.Fatal("flask missing")
+	}
+	if flask.Version != "2.3.0" || !flask.IsDirect || flask.SourceType != SourceTypeManifest || flask.InstalledPath != "" {
+		t.Errorf("flask provenance wrong: %+v", flask)
+	}
+	wk, ok := findPkg(got, "werkzeug")
+	if !ok {
+		t.Fatal("werkzeug (transitive) missing")
+	}
+	if wk.IsDirect || wk.SourceType != SourceTypeInstalled || wk.InstalledPath == "" {
+		t.Errorf("werkzeug provenance wrong: %+v", wk)
+	}
+}
+
+// A confident file with a declared dep absent from the env is a fatal error with
+// the build-or-lock remediation.
+func TestResolvePython_ConfidentMissingErrors(t *testing.T) {
+	root := t.TempDir()
+	writePyTestFile(t, filepath.Join(root, "requirements.txt"), "flask>=2.0\n")
+	makePyVenv(t, root, map[string]string{"requests": "2.0"}) // flask NOT installed
+
+	declared := []ScopedPackage{{Name: "flask", VersionSpec: ">=2.0", Ecosystem: "pypi"}}
+	_, err := ResolvePythonRequirementsFromSitePackages(
+		filepath.Join(root, "requirements.txt"), "requirements.txt", declared, true)
+	if err == nil {
+		t.Fatal("expected error for a missing confident dependency")
+	}
+	for _, want := range []string{"build the app", "generate a lock file", "flask"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("error missing %q: %v", want, err)
+		}
+	}
+}
+
+// A tentative file is confirmed when ANY declared name is installed (user choice).
+func TestResolvePython_TentativeAnyMatchConfirms(t *testing.T) {
+	root := t.TempDir()
+	writePyTestFile(t, filepath.Join(root, "names.lst"), "flask\nnotapkg\n")
+	makePyVenv(t, root, map[string]string{"flask": "2.3.0"})
+
+	declared := []ScopedPackage{{Name: "flask"}, {Name: "notapkg"}}
+	got, err := ResolvePythonRequirementsFromSitePackages(
+		filepath.Join(root, "names.lst"), "names.lst", declared, false)
+	if err != nil {
+		t.Fatalf("tentative file with 1 installed match should resolve: %v", err)
+	}
+	if _, ok := findPkg(got, "flask"); !ok {
+		t.Error("flask should be resolved")
+	}
+}
+
+// A tentative file with no installed matches is disregarded (resolver errors so
+// the caller drops it).
+func TestResolvePython_TentativeNoMatchDropped(t *testing.T) {
+	root := t.TempDir()
+	writePyTestFile(t, filepath.Join(root, "names.lst"), "alpha\nbeta\n")
+	makePyVenv(t, root, map[string]string{"flask": "2.3.0"})
+
+	declared := []ScopedPackage{{Name: "alpha"}, {Name: "beta"}}
+	if _, err := ResolvePythonRequirementsFromSitePackages(
+		filepath.Join(root, "names.lst"), "names.lst", declared, false); err == nil {
+		t.Fatal("tentative file with no installed match should error (be dropped)")
+	}
+}