test(pip): call pip directly instead of using env var overrides

Remove TRUSTIFY_DA_PIP_REPORT setup/teardown from pip tests and let them
invoke pip directly. Pin fixture pyproject.toml versions to get
deterministic output, add --quiet flag to suppress non-JSON stdout, and
update expected SBOMs with real resolved versions. Add testing convention
to CONVENTIONS.md and ignore *.egg-info build artifacts.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ruromero

.gitignore

@@ -10,3 +10,4 @@ build
 target
 .npmrc
 src/providers/*.wasm
+*.egg-info

CONVENTIONS.md

@@ -0,0 +1,98 @@
+# Coding Conventions
+
+<!-- This file documents project-specific coding standards for exhort-javascript-api. -->
+
+## Language and Framework
+
+- **Primary Language**: JavaScript (ES modules, `"type": "module"` in package.json)
+- **TypeScript**: Configuration present but code is primarily JavaScript with JSDoc
+- **Node.js**: Requires Node >= 20.0.0, npm >= 11.5.1
+- **CLI**: `yargs` for command-line argument parsing
+- **Parsing Libraries**: `fast-xml-parser`, `fast-toml`, `smol-toml`, `tree-sitter-requirements`
+
+## Code Style
+
+- **Linter**: ESLint with recommended config + editorconfig + import plugins
+- **Indentation**: Tabs (4 spaces for YAML/Markdown)
+- **Line endings**: LF
+- **Max line length**: 100 (120 for Markdown)
+- **Charset**: UTF-8, final newline, trim trailing whitespace
+- **Import ordering** (ESLint enforced): builtin, external, internal, parent, sibling, index — alphabetical within groups
+- **Strict equality**: `eqeqeq: ["warn", "always", {"null": "never"}]`
+- **Curly braces**: Required (`curly: "warn"`)
+- **No throw literals**: `no-throw-literal: "warn"`
+- **No Prettier** — ESLint + EditorConfig handle formatting
+
+## Naming Conventions
+
+- **Classes**: PascalCase with underscore-separated language names (`Java_maven`, `Base_java`, `Javascript_npm`)
+- **Files**: snake_case for providers (`base_java.js`, `javascript_npm.js`, `python_pip.js`)
+- **Test files**: `*.test.js` suffix (`analysis.test.js`, `provider.test.js`)
+- **Functions/Methods**: camelCase (`provideComponent()`, `provideStack()`, `validateLockFile()`)
+- **Variables**: camelCase (`manifestPath`, `backendUrl`)
+- **Constants**: UPPER_SNAKE_CASE (`ecosystem_maven`, `DEFAULT_WORKSPACE_DISCOVERY_IGNORE`)
+- **Private class fields**: `#` prefix (`#manifest`, `#cmd`, `#ecosystem`)
+- **Protected methods**: `_` prefix (`_lockFileName()`, `_cmdName()`, `_listCmdArgs()`)
+
+## File Organization
+
+```
+src/
+├── index.js                    # Main export
+├── cli.js                      # CLI entry point
+├── analysis.js                 # API request handling
+├── provider.js                 # Provider matching logic
+├── workspace.js                # Workspace discovery
+├── tools.js                    # Utilities
+├── sbom.js                     # SBOM handling
+├── cyclone_dx_sbom.js          # CycloneDX SBOM generation
+├── providers/                  # Ecosystem providers
+│   ├── base_java.js
+│   ├── base_javascript.js
+│   ├── java_maven.js
+│   ├── javascript_npm.js
+│   ├── python_pip.js
+│   ├── rust_cargo.js
+│   └── processors/            # Specialized processors
+├── license/                    # License detection
+└── oci_image/                  # OCI image analysis
+
+test/
+├── analysis.test.js
+├── provider.test.js
+├── tools.test.js
+└── providers/                  # Provider-specific tests
+```
+
+## Error Handling
+
+- **Throw Error objects**: `throw new Error("message")`, `throw new TypeError("message")`
+- **No custom error classes** — uses built-in `Error` and `TypeError`
+- **HTTP errors**: Check `resp.status`, throw with status code and response text
+- **Async errors**: Bubble up naturally via async/await (no blanket try-catch)
+- **Validation errors**: Thrown early with descriptive context (manifest type, lock file)
+
+## Testing Conventions
+
+- **Framework**: Mocha with TDD UI (`suite()` / `test()`)
+- **Assertions**: Chai with `expect()` syntax
+- **Mocking**: Sinon for stubs; MSW (Mock Service Worker) for HTTP mocking
+- **Module mocking**: `esmock` with experimental loader
+- **Coverage**: C8 with 82% line coverage requirement
+- **Test patterns**: `expect(res).to.deep.equal(...)`, `expect(() => ...).to.throw('message')`
+- **Higher-order setup**: Functions like `interceptAndRun()` for test setup/teardown
+- **Prefer real tool invocations over env var overrides**: Tests should call the actual ecosystem tools (pip, uv, poetry, mvn, npm, etc.) rather than injecting pre-recorded output via `TRUSTIFY_DA_*` environment variables. The CI environment has these tools available. Env var overrides (`TRUSTIFY_DA_PIP_REPORT`, `TRUSTIFY_DA_UV_EXPORT`, etc.) exist for users who lack the tool locally, but tests should exercise the real tool path to catch integration issues.
+
+## Commit Messages
+
+- Likely Conventional Commits format
+- DCO (Developer Certificate of Origin) required
+- Semantic versioning (`0.3.0` in package.json)
+
+## Dependencies
+
+- **Package manager**: npm with `package-lock.json`
+- **Module system**: ES modules with explicit `.js` extensions in relative imports
+- **Import convention**: `import fs from 'node:fs'` (node: protocol for built-ins)
+- **Environment variables**: Prefixed with `TRUSTIFY_DA_` (e.g., `TRUSTIFY_DA_MVN_PATH`, `TRUSTIFY_DA_TOKEN`, `TRUSTIFY_DA_DEBUG`)
+- **Multi-ecosystem support**: npm, pnpm, yarn, Maven, Gradle, pip, cargo, Go modules, Docker/Podman

src/providers/python_pip_pyproject.js

@@ -47,7 +47,7 @@ export default class Python_pip_pyproject extends Base_pyproject {
 			pipBin = getCustomPath('pip', opts)
 		}
 		return invokeCommand(pipBin, [
-			'install', '--dry-run', '--ignore-installed', '--report', '-', '.'
+			'install', '--dry-run', '--ignore-installed', '--quiet', '--report', '-', '.'
 		], { cwd: manifestDir }).toString()
 	}
 

test/providers/python_pyproject.test.js

@@ -10,7 +10,7 @@ import Python_uv from '../../src/providers/python_uv.js'
 
 let clock
 
-const TIMEOUT = process.env.GITHUB_ACTIONS ? 30000 : 10000
+const TIMEOUT = process.env.GITHUB_ACTIONS ? 30000 : 15000
 
 const uvProvider = new Python_uv()
 const poetryProvider = new Python_poetry()
@@ -180,21 +180,6 @@ suite('testing the python-pyproject data provider', () => {
 	suite('pip projects (via pip --dry-run --report)', () => {
 		const pipFixtureDir = `${MANIFESTS}/pip_pep621`
 		const pipIgnoreDir = `${MANIFESTS}/pip_pep621_ignore`
-		let savedEnv
-
-		setup(() => {
-			savedEnv = process.env.TRUSTIFY_DA_PIP_REPORT
-			let report = fs.readFileSync(path.join(pipFixtureDir, 'pip_report.json'), 'utf-8')
-			process.env.TRUSTIFY_DA_PIP_REPORT = Buffer.from(report).toString('base64')
-		})
-
-		teardown(() => {
-			if (savedEnv === undefined) {
-				delete process.env.TRUSTIFY_DA_PIP_REPORT
-			} else {
-				process.env.TRUSTIFY_DA_PIP_REPORT = savedEnv
-			}
-		})
 
 		/** Verifies stack and component SBOM output matches expected pip fixtures. */
 		SBOM_CASES.forEach(({type, method, fixture}) => {

test/providers/tst_manifests/pyproject/pip_pep621/expected_component_sbom.json

@@ -15,21 +15,21 @@
 	"components": [
 		{
 			"name": "requests",
-			"version": "2.33.1",
-			"purl": "pkg:pypi/requests@2.33.1",
+			"version": "2.32.3",
+			"purl": "pkg:pypi/requests@2.32.3",
 			"type": "library",
-			"bom-ref": "pkg:pypi/requests@2.33.1"
+			"bom-ref": "pkg:pypi/requests@2.32.3"
 		}
 	],
 	"dependencies": [
 		{
 			"ref": "pkg:pypi/test-project@1.0.0",
 			"dependsOn": [
-				"pkg:pypi/requests@2.33.1"
+				"pkg:pypi/requests@2.32.3"
 			]
 		},
 		{
-			"ref": "pkg:pypi/requests@2.33.1",
+			"ref": "pkg:pypi/requests@2.32.3",
 			"dependsOn": []
 		}
 	]

test/providers/tst_manifests/pyproject/pip_pep621/expected_stack_sbom.json

@@ -15,17 +15,17 @@
 	"components": [
 		{
 			"name": "requests",
-			"version": "2.33.1",
-			"purl": "pkg:pypi/requests@2.33.1",
+			"version": "2.32.3",
+			"purl": "pkg:pypi/requests@2.32.3",
 			"type": "library",
-			"bom-ref": "pkg:pypi/requests@2.33.1"
+			"bom-ref": "pkg:pypi/requests@2.32.3"
 		},
 		{
 			"name": "certifi",
-			"version": "2026.2.2",
-			"purl": "pkg:pypi/certifi@2026.2.2",
+			"version": "2026.2.25",
+			"purl": "pkg:pypi/certifi@2026.2.25",
 			"type": "library",
-			"bom-ref": "pkg:pypi/certifi@2026.2.2"
+			"bom-ref": "pkg:pypi/certifi@2026.2.25"
 		},
 		{
 			"name": "charset-normalizer",
@@ -53,20 +53,20 @@
 		{
 			"ref": "pkg:pypi/test-project@1.0.0",
 			"dependsOn": [
-				"pkg:pypi/requests@2.33.1"
+				"pkg:pypi/requests@2.32.3"
 			]
 		},
 		{
-			"ref": "pkg:pypi/requests@2.33.1",
+			"ref": "pkg:pypi/requests@2.32.3",
 			"dependsOn": [
-				"pkg:pypi/certifi@2026.2.2",
+				"pkg:pypi/certifi@2026.2.25",
 				"pkg:pypi/charset-normalizer@3.4.7",
 				"pkg:pypi/idna@3.11",
 				"pkg:pypi/urllib3@2.6.3"
 			]
 		},
 		{
-			"ref": "pkg:pypi/certifi@2026.2.2",
+			"ref": "pkg:pypi/certifi@2026.2.25",
 			"dependsOn": []
 		},
 		{

test/providers/tst_manifests/pyproject/pip_pep621/pip_report.json

@@ -3,5 +3,5 @@ name = "test-project"
 version = "1.0.0"
 requires-python = ">=3.12"
 dependencies = [
-    "requests[socks]>=2.32",
+    "requests[socks]==2.32.3",
 ]

test/providers/tst_manifests/pyproject/pip_pep621/pyproject.toml

@@ -3,5 +3,5 @@ name = "test-project"
 version = "1.0.0"
 requires-python = ">=3.12"
 dependencies = [
-    "requests>=2.32", #exhortignore
+    "requests==2.32.3", #exhortignore
 ]