test(pip): replace manual ignore assertions with golden SBOM tests

The pip_pep621_ignore fixture was missing expected_stack_sbom.json and
expected_component_sbom.json, relying on partial manual assertions instead
of the standard SBOM_CASES golden-file pattern. Add the golden files and
switch to deep.equal comparison. Document the golden SBOM convention in
CONVENTIONS.md to prevent this gap in future implementations.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ruromero

CONVENTIONS.md

@@ -82,6 +82,7 @@ test/
 - **Test patterns**: `expect(res).to.deep.equal(...)`, `expect(() => ...).to.throw('message')`
 - **Higher-order setup**: Functions like `interceptAndRun()` for test setup/teardown
 - **Prefer real tool invocations over env var overrides**: Tests should call the actual ecosystem tools (pip, uv, poetry, mvn, npm, etc.) rather than injecting pre-recorded output via `TRUSTIFY_DA_*` environment variables. The CI environment has these tools available. Env var overrides (`TRUSTIFY_DA_PIP_REPORT`, `TRUSTIFY_DA_UV_EXPORT`, etc.) exist for users who lack the tool locally, but tests should exercise the real tool path to catch integration issues.
+- **Golden SBOM files for every test fixture**: Every provider test fixture directory must include `expected_stack_sbom.json` and `expected_component_sbom.json` golden files. Tests must use the `SBOM_CASES` pattern to do a full `deep.equal` comparison of the provider output against these golden files. Manual partial assertions (e.g. checking a single component name) are not a substitute — they may be added as supplementary tests but never as the only verification for a fixture.
 
 ## Commit Messages
 

test/providers/python_pyproject.test.js

@@ -219,21 +219,19 @@ suite('testing the python-pyproject data provider', () => {
 			expect(names).to.not.include('pysocks')
 		}).timeout(TIMEOUT)
 
-		/** Verifies exhortignore marker in PEP 621 dependencies excludes the dep. */
-		test('exhortignore marker excludes dep from component analysis', async () => {
-			let result = await pipProvider.provideComponent(path.join(pipIgnoreDir, 'pyproject.toml'))
-			let sbom = JSON.parse(result.content)
-			let names = sbom.components.map(c => c.name)
-			expect(names).to.not.include('requests')
-		}).timeout(TIMEOUT)
-
-		/** Verifies exhortignore excludes dep and its exclusive transitive deps from stack analysis. */
-		test('exhortignore marker excludes dep from stack analysis', async () => {
-			let result = await pipProvider.provideStack(path.join(pipIgnoreDir, 'pyproject.toml'))
-			let sbom = JSON.parse(result.content)
-			let names = sbom.components.map(c => c.name)
-			expect(names).to.not.include('requests')
-		}).timeout(TIMEOUT)
+		/** Verifies exhortignore marker produces expected SBOM for stack and component analysis. */
+		SBOM_CASES.forEach(({type, method, fixture}) => {
+			test(`verify exhortignore produces expected sbom for ${type} analysis with pip`, async () => {
+				let expectedSbom = fs.readFileSync(path.join(pipIgnoreDir, fixture)).toString().trim()
+				expectedSbom = JSON.stringify(JSON.parse(expectedSbom))
+				let result = await pipProvider[method](path.join(pipIgnoreDir, 'pyproject.toml'))
+				expect(result).to.deep.equal({
+					ecosystem: 'pip',
+					contentType: 'application/vnd.cyclonedx+json',
+					content: expectedSbom
+				})
+			}).timeout(TIMEOUT)
+		})
 
 		/** Verifies name canonicalization (charset_normalizer -> charset-normalizer). */
 		test('name canonicalization: charset_normalizer resolved as charset-normalizer', async () => {

test/providers/tst_manifests/pyproject/pip_pep621_ignore/expected_component_sbom.json

@@ -0,0 +1,17 @@
+{
+	"bomFormat": "CycloneDX",
+	"specVersion": "1.4",
+	"version": 1,
+	"metadata": {
+		"timestamp": "2023-10-01T00:00:00.000Z",
+		"component": {
+			"name": "test-project",
+			"version": "1.0.0",
+			"purl": "pkg:pypi/test-project@1.0.0",
+			"type": "application",
+			"bom-ref": "pkg:pypi/test-project@1.0.0"
+		}
+	},
+	"components": [],
+	"dependencies": []
+}

test/providers/tst_manifests/pyproject/pip_pep621_ignore/expected_stack_sbom.json

@@ -0,0 +1,17 @@
+{
+	"bomFormat": "CycloneDX",
+	"specVersion": "1.4",
+	"version": 1,
+	"metadata": {
+		"timestamp": "2023-10-01T00:00:00.000Z",
+		"component": {
+			"name": "test-project",
+			"version": "1.0.0",
+			"purl": "pkg:pypi/test-project@1.0.0",
+			"type": "application",
+			"bom-ref": "pkg:pypi/test-project@1.0.0"
+		}
+	},
+	"components": [],
+	"dependencies": []
+}