feat(plc): ingest CODESYS projects from a git repo (SAST + SBOM) (#171)

compliance-agent/src/pipeline/plc/sbom.rs

@@ -11,10 +11,46 @@
 //! CVEs).
 
 use std::collections::BTreeSet;
-use std::path::Path;
+use std::path::{Path, PathBuf};
 
 use compliance_core::models::SbomEntry;
 
+/// Collect the control-application SBOM from every `.projectarchive` reachable for
+/// a target: the ingested artifact file itself (an uploaded archive), plus any
+/// `*.projectarchive` committed inside the working tree — e.g. a git repo or an
+/// extracted source archive that ships the archive alongside its PLCopen XML / ST
+/// exports. Deduplicated by (name, version).
+pub fn collect_sbom(artifact_file: &Path, working_path: &Path, repo_id: &str) -> Vec<SbomEntry> {
+    let mut archives: Vec<PathBuf> = Vec::new();
+    if artifact_file.is_file() {
+        archives.push(artifact_file.to_path_buf());
+    }
+    for entry in walkdir::WalkDir::new(working_path)
+        .max_depth(8)
+        .into_iter()
+        .filter_map(|e| e.ok())
+    {
+        let p = entry.path();
+        if entry.file_type().is_file()
+            && p.extension()
+                .and_then(|x| x.to_str())
+                .is_some_and(|x| x.eq_ignore_ascii_case("projectarchive"))
+        {
+            archives.push(p.to_path_buf());
+        }
+    }
+    let mut seen: BTreeSet<(String, String)> = BTreeSet::new();
+    let mut out = Vec::new();
+    for a in archives {
+        for e in projectarchive_sbom(&a, repo_id) {
+            if seen.insert((e.name.clone(), e.version.clone())) {
+                out.push(e);
+            }
+        }
+    }
+    out
+}
+
 /// Extract CODESYS library + runtime components from a `.projectarchive` (a zip).
 /// Best-effort: returns empty if the file is not a readable zip (e.g. a bare
 /// `.st`/`.xml` project, which carries no library manifest).
@@ -114,7 +150,12 @@ mod tests {
     /// device descriptor.
     fn synthetic_archive(dir: &Path) -> std::path::PathBuf {
         let path = dir.join("App.projectarchive");
-        let file = std::fs::File::create(&path).expect("create");
+        write_synthetic_archive(&path);
+        path
+    }
+
+    fn write_synthetic_archive(path: &Path) {
+        let file = std::fs::File::create(path).expect("create");
         let mut zip = zip::ZipWriter::new(file);
         let opts: zip::write::SimpleFileOptions = Default::default();
         let names = [
@@ -131,7 +172,6 @@ mod tests {
             zip.write_all(b"x").expect("write");
         }
         zip.finish().expect("finish");
-        path
     }
 
     #[test]
@@ -179,6 +219,28 @@ mod tests {
         let _ = std::fs::remove_dir_all(&tmp);
     }
 
+    #[test]
+    fn collect_sbom_finds_a_projectarchive_committed_in_a_git_tree() {
+        let tmp = std::env::temp_dir().join(format!("cs-plc-collect-{}", uuid::Uuid::new_v4()));
+        let src = tmp.join("clone/src");
+        std::fs::create_dir_all(&src).expect("mkdir");
+        // Simulate a git clone that commits the archive alongside its exports.
+        write_synthetic_archive(&src.join("PumpStation.projectarchive"));
+
+        // The artifact "file" is a git URL (not a real file), so the SBOM must
+        // come from walking the cloned tree.
+        let entries = collect_sbom(Path::new("https://git.example/plc.git"), &tmp, "t");
+        let names: std::collections::HashSet<&str> =
+            entries.iter().map(|e| e.name.as_str()).collect();
+        assert!(
+            names.contains("Standard"),
+            "found libs in the committed archive"
+        );
+        assert!(names.contains("CODESYS Control for Linux ARM SL"));
+
+        let _ = std::fs::remove_dir_all(&tmp);
+    }
+
     #[test]
     fn non_zip_file_yields_no_sbom() {
         let tmp = std::env::temp_dir().join(format!("cs-plc-sbom-st-{}", uuid::Uuid::new_v4()));