[FScholPer]

Fixes multiple issues with bazel resolution

Frank Scholter Peres frank.scholter_peres@mercedes-benz.com, Mercedes-Benz Tech Innovation GmbH
Provider Information

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved issues affect license overrides, fallback metadata, and component checksums.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Explicit license override ignored by score-module defaulting · New

What changed in this PR

This PR fixes Bazel resolution and enriches generated SBOM metadata for SCORE modules.

Changes:

• Resolves module versions using source.json.
• Adds SCORE metadata, licenses, PURLs, and download locations.
• Preserves default exclusions alongside custom patterns.

File	Reviewed changes
tests/​test_sbom_generator.py	Adds lockfile resolution regression coverage.
internal/​generator/​spdx_formatter.py	Adds SCORE GitHub download locations.
internal/​generator/​sbom_generator.py	Updates module resolution, metadata, licenses, and checksums.
defs.bzl	Combines default and custom exclusion patterns.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Three unresolved moderate issues remain in internal/generator/sbom_generator.py.

Review effort: Lite
Findings: None

Resolved since last review (1)

• Explicit license override ignored by score-module defaulting

[umaucher]

Validated locally against the real registry-pinned score_baselibs@0.2.13 (combined with persistency#430), rebuilding //:product_sbom and //:build_tools_sbom:

• version: unknown → 0.2.13
• license: NOASSERTION → Apache-2.0
• checksum now populated

No regressions.