[nicu1989]

Pass selected Cargo.toml files to the metadata collector.
Check crate identity before using the declared license.
Fall back to exact-version API data for confirmed crates.io sources.
Record license sources and unresolved reasons.
Rate-limit API requests and retry temporary failures.

Closes: #26

[Copilot]

🟡 Changes recommended

Unresolved identity, compatibility, annotation-preservation, and HTTP error-handling issues can lose metadata or abort collection.

5 open issues

• Preserve legacy crate repositories during dependency selection · New
• Recover normalized Cargo versions from repository suffixes · New
• Preserve crate metadata alongside generated repository entries · New
• Retry truncated HTTP responses without aborting cache generation · New
• Preserve Cargo.lock metadata when using deps JSON · New

What changed in this PR

Adds manifest-first Rust license collection to the Bazel SBOM pipeline, addressing issue #26.

Changes:

• Passes repository-associated manifests as declared action inputs.
• Validates crate identity and records license origins or unresolved reasons.
• Adds restricted exact-version API fallback, rate limiting, retries, and regression tests.

File	Description
tests/​test_sbom_generator.py	Tests repository-cache license precedence.
tests/​test_generate_crates_metadata_cache.py	Tests manifest collection and API handling.
scripts/​generate_crates_metadata_cache.py	Implements manifest-first metadata collection.
README.md	Documents collection behavior and limitations.
internal/​rules.bzl	Passes manifests and dependency data to collection.
internal/​providers.bzl	Adds manifest propagation data.
internal/​generator/​sbom_generator.py	Prefers repository-specific cache entries.
internal/​aspect.bzl	Collects and propagates crate manifests.
defs.bzl	Updates collection option documentation.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Named-hub repository parsing can abort collection, and connection resets bypass the intended retries.

2 open issues

• Fix hub prefix parsing for canonical crate repository names · New
• Retry license fetches after connection reset errors · New

5 resolved since last review

• Recover normalized Cargo versions from repository suffixes
• Preserve legacy crate repositories during dependency selection
• Preserve Cargo.lock metadata when using deps JSON
• Retry truncated HTTP responses without aborting cache generation
• Preserve crate metadata alongside generated repository entries

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Identical crate versions across hubs overwrite repository records, losing checksums and disabling valid license fallback.

1 open issue

• Prevent same-version crates from overwriting repository records · New

2 resolved since last review

• Fix hub prefix parsing for canonical crate repository names
• Retry license fetches after connection reset errors

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Default repository exclusions omit newly supported crate hubs from generated SBOMs.

1 open issue

• Default repository filtering prevents hub parsing and SBOM entries · New

1 resolved since last review

• Prevent same-version crates from overwriting repository records

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Downstream deduplication can combine a fork’s checksum with another source’s license.

1 open issue

• Preserve repository identity when deduplicating crate components · New

1 resolved since last review

• Default repository filtering prevents hub parsing and SBOM entries

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Metadata collection omits edge-only crate dependencies that the SBOM generator includes, leaving available licenses and checksums unused.

1 open issue

• Collect metadata for crates used only as dependency edge destinations · New

1 resolved since last review

• Preserve repository identity when deduplicating crate components

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The repository-conflict check incorrectly aborts mixed-language SBOM generation when PyPI and Cargo packages share a name and version.

1 open issue

• Avoid cross-ecosystem package collisions during SBOM deduplication · New

1 resolved since last review

• Collect metadata for crates used only as dependency edge destinations

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Mixed Cargo and module lockfile inputs can still discard crate checksums and disable valid license API fallback.

No open issues 🎉

1 resolved since last review

• Avoid cross-ecosystem package collisions during SBOM deduplication

_{Review effort: Balanced}