fix: resolve unification conflict in repo violations

Switches violation reporting to a set-based structure to handle
duplicate PURLs across multiple SBOM sources.

fixes coderabbit review:
#1696 (comment)

Author: cmarulas

policy/release/maven_repos/maven_repos.rego

@@ -49,17 +49,21 @@ deny contains result if {
 #    short_name: deny_unpermitted_urls
 #    failure_msg: '%s'
 #    effective_on: 2026-05-10T00:00:00Z
+
 deny contains result if {
-	some purl, msg in _repo_url_errors
-	base := lib.result_helper(rego.metadata.chain(), [msg])
-	result := object.union(base, {"term": purl})
+	some err in _repo_url_errors
+	base := lib.result_helper(rego.metadata.chain(), [err.msg])
+	result := object.union(base, {"term": err.purl})
 }
 
-_repo_url_errors[pkg.purl] := msg if {
+_repo_url_errors contains err if {
 	some pkg in sbom.packages
 	source := _get_effective_url(pkg.repository_url)
 	not _url_is_permitted(source)
-	msg := sprintf("Package %q (source: %q) is not in the permitted list", [pkg.purl, source])
+	err := {
+		"purl": pkg.purl,
+		"msg": sprintf("Package %q (source: %q) is not in the permitted list", [pkg.purl, source]),
+	}
 }
 
 _get_effective_url(url) := url if {

policy/release/maven_repos/maven_repos_test.rego

@@ -152,3 +152,65 @@ test_spdx_multiple_refs_behavior if {
 	urls := {p.repository_url | some p in pkg_list}
 	urls == {"https://primary.repo.com", "https://mirror.repo.com"}
 }
+
+test_repo_url_errors_collision_from_mixed_sources if {
+	mock_cdx := {"components": [{
+		"name": "shared-lib",
+		"purl": "pkg:maven/org.example/shared@1.0",
+		"externalRefs": [{"type": "distribution", "url": "https://untrusted-cdx.com"}],
+	}]}
+
+	mock_spdx := {"packages": [{
+		"name": "shared-lib",
+		"purl": "pkg:maven/org.example/shared@1.0",
+		"externalRefs": [{"referenceType": "repository", "referenceLocator": "https://untrusted-spdx.com"}],
+	}]}
+
+	expected := {
+		{
+			"code": "release.maven_repos.deny_unpermitted_urls",
+			"effective_on": "2026-05-10T00:00:00Z",
+			"msg": "Package \"pkg:maven/org.example/shared@1.0\" (source: \"https://untrusted-cdx.com\") is not in the permitted list",
+			"term": "pkg:maven/org.example/shared@1.0",
+		},
+		{
+			"code": "release.maven_repos.deny_unpermitted_urls",
+			"effective_on": "2026-05-10T00:00:00Z",
+			"msg": "Package \"pkg:maven/org.example/shared@1.0\" (source: \"https://untrusted-spdx.com\") is not in the permitted list",
+			"term": "pkg:maven/org.example/shared@1.0",
+		},
+	}
+
+	result := maven_repos.deny with sbom.cyclonedx_sboms as [mock_cdx]
+		with sbom.spdx_sboms as [mock_spdx]
+		with data.rule_data as mock_data
+
+	lib.assert_equal(expected, result)
+}
+
+test_repo_url_errors_mixed_permitted_and_unpermitted if {
+	mock_cdx := {"components": [{
+		"name": "shared-lib",
+		"purl": "pkg:maven/org.example/shared@1.0",
+		"externalRefs": [{"type": "distribution", "url": "https://repo.maven.apache.org/maven2/"}],
+	}]}
+
+	mock_spdx := {"packages": [{
+		"name": "shared-lib",
+		"purl": "pkg:maven/org.example/shared@1.0",
+		"externalRefs": [{"referenceType": "repository", "referenceLocator": "https://untrusted-spdx.com"}],
+	}]}
+
+	expected := {{
+		"code": "release.maven_repos.deny_unpermitted_urls",
+		"effective_on": "2026-05-10T00:00:00Z",
+		"msg": "Package \"pkg:maven/org.example/shared@1.0\" (source: \"https://untrusted-spdx.com\") is not in the permitted list",
+		"term": "pkg:maven/org.example/shared@1.0",
+	}}
+
+	result := maven_repos.deny with sbom.cyclonedx_sboms as [mock_cdx]
+		with sbom.spdx_sboms as [mock_spdx]
+		with data.rule_data as mock_data
+
+	lib.assert_equal(expected, result)
+}