fix: resolve unification conflict in repo violations

Switches violation reporting to a set-based structure to handle
duplicate PURLs across multiple SBOM sources.

fixes coderabbit review:
#1696 (comment)

Author: cmarulas

policy/lib/sbom/maven_test.rego

@@ -20,13 +20,13 @@ test_cyclonedx_maven_extraction if {
 
 	result := sbom.packages with sbom.cyclonedx_sboms as [_cyclonedx_sbom(mock_components)]
 
-	lib.assert_equal(expected, result)
+	lib.assertions.assert_equal(expected, result)
 }
 
 test_cyclonedx_ignores_non_maven if {
 	mock_components := [{"name": "react", "purl": "pkg:npm/react@18.2.0"}]
 
-	lib.assert_empty(sbom.packages) with sbom.cyclonedx_sboms as [_cyclonedx_sbom(mock_components)]
+	lib.assertions.assert_empty(sbom.packages) with sbom.cyclonedx_sboms as [_cyclonedx_sbom(mock_components)]
 }
 
 test_cyclonedx_empty_repo_url if {
@@ -44,7 +44,7 @@ test_cyclonedx_empty_repo_url if {
 
 	result := sbom.packages with sbom.cyclonedx_sboms as [_cyclonedx_sbom(mock_components)]
 
-	lib.assert_equal(expected, result)
+	lib.assertions.assert_equal(expected, result)
 }
 
 test_spdx_maven_extraction if {
@@ -65,7 +65,7 @@ test_spdx_maven_extraction if {
 
 	result := sbom.packages with sbom.spdx_sboms as [_spdx_sbom(mock_packages)]
 
-	lib.assert_equal(expected, result)
+	lib.assertions.assert_equal(expected, result)
 }
 
 test_combined_sources if {
@@ -100,7 +100,7 @@ test_combined_sources if {
 	result := sbom.packages with sbom.cyclonedx_sboms as [_cyclonedx_sbom(mock_cdx)]
 		with sbom.spdx_sboms as [_spdx_sbom(mock_spdx)]
 
-	lib.assert_equal(expected, result)
+	lib.assertions.assert_equal(expected, result)
 }
 
 test_cyclonedx_multiple_repo_capture if {
@@ -128,7 +128,7 @@ test_cyclonedx_multiple_repo_capture if {
 
 	result := sbom.packages with sbom.cyclonedx_sboms as [_cyclonedx_sbom(mock_components)]
 
-	lib.assert_equal(expected, result)
+	lib.assertions.assert_equal(expected, result)
 }
 
 _cyclonedx_sbom(components) := {"components": components}

policy/release/maven_repos/maven_repos.rego

@@ -17,6 +17,7 @@ import future.keywords.if
 import future.keywords.in
 
 import data.lib
+import data.lib.rule_data
 import data.lib.sbom
 
 # METADATA
@@ -50,30 +51,33 @@ deny contains result if {
 #    failure_msg: '%s'
 #    effective_on: 2026-05-10T00:00:00Z
 deny contains result if {
-	some purl, msg in _repo_url_errors
-	base := lib.result_helper(rego.metadata.chain(), [msg])
-	result := object.union(base, {"term": purl})
+	some err in _repo_url_errors
+	base := lib.result_helper(rego.metadata.chain(), [err.msg])
+	result := object.union(base, {"term": err.purl})
 }
 
-_repo_url_errors[pkg.purl] := msg if {
+_repo_url_errors contains err if {
 	some pkg in sbom.packages
 	source := _get_effective_url(pkg.repository_url)
 	not _url_is_permitted(source)
-	msg := sprintf("Package %q (source: %q) is not in the permitted list", [pkg.purl, source])
+	err := {
+		"purl": pkg.purl,
+		"msg": sprintf("Package %q (source: %q) is not in the permitted list", [pkg.purl, source]),
+	}
 }
 
 _get_effective_url(url) := url if {
 	url != ""
 } else := "https://repo.maven.apache.org/maven2/"
 
 _url_is_permitted(url) if {
-	permitted := lib.rule_data("allowed_maven_repositories")
+	permitted := rule_data.get("allowed_maven_repositories")
 	url in permitted
 }
 
 _rule_data_errors contains key if {
 	key := "allowed_maven_repositories"
-	data_list := lib.rule_data(key)
+	data_list := rule_data.get(key)
 	_is_invalid_data(data_list)
 }
 

policy/release/maven_repos/maven_repos_test.rego

@@ -17,7 +17,7 @@ test_cyclonedx_permitted if {
 		"externalRefs": [{"type": "distribution", "url": "https://repo.maven.apache.org/maven2/"}],
 	}]}
 
-	lib.assert_empty(maven_repos.deny) with data.rule_data as mock_data
+	lib.assertions.assert_empty(maven_repos.deny) with data.rule_data as mock_data
 		with sbom.cyclonedx_sboms as [cdx_input]
 }
 
@@ -31,7 +31,7 @@ test_spdx_permitted if {
 		}],
 	}]}
 
-	lib.assert_empty(maven_repos.deny) with data.rule_data as mock_data
+	lib.assertions.assert_empty(maven_repos.deny) with data.rule_data as mock_data
 		with sbom.spdx_sboms as [spdx_input]
 }
 
@@ -42,7 +42,7 @@ test_default_maven_central_pass if {
 		"externalRefs": [],
 	}]}
 
-	lib.assert_empty(maven_repos.deny) with data.rule_data as mock_data
+	lib.assertions.assert_empty(maven_repos.deny) with data.rule_data as mock_data
 		with sbom.cyclonedx_sboms as [cdx_input]
 }
 
@@ -67,7 +67,7 @@ test_default_cdx_fail if {
 		"term": "pkg:maven/org.base/no-url@1.0",
 	}}
 
-	lib.assert_equal(maven_repos.deny, expected) with data.rule_data as restricted_data
+	lib.assertions.assert_equal(maven_repos.deny, expected) with data.rule_data as restricted_data
 		with sbom.cyclonedx_sboms as [mock_cdx]
 }
 
@@ -90,7 +90,7 @@ test_missing_rule_data if {
 		"effective_on": "2022-01-01T00:00:00Z",
 		"msg": "Policy data is missing the required \"allowed_maven_repositories\" list",
 	}}
-	lib.assert_equal(maven_repos.deny, expected) with data.rule_data as {}
+	lib.assertions.assert_equal(maven_repos.deny, expected) with data.rule_data as {}
 }
 
 test_get_effective_url_provided if {
@@ -152,3 +152,65 @@ test_spdx_multiple_refs_behavior if {
 	urls := {p.repository_url | some p in pkg_list}
 	urls == {"https://primary.repo.com", "https://mirror.repo.com"}
 }
+
+test_repo_url_errors_collision_from_mixed_sources if {
+	mock_cdx := {"components": [{
+		"name": "shared-lib",
+		"purl": "pkg:maven/org.example/shared@1.0",
+		"externalRefs": [{"type": "distribution", "url": "https://untrusted-cdx.com"}],
+	}]}
+
+	mock_spdx := {"packages": [{
+		"name": "shared-lib",
+		"purl": "pkg:maven/org.example/shared@1.0",
+		"externalRefs": [{"referenceType": "repository", "referenceLocator": "https://untrusted-spdx.com"}],
+	}]}
+
+	expected := {
+		{
+			"code": "release.maven_repos.deny_unpermitted_urls",
+			"effective_on": "2026-05-10T00:00:00Z",
+			"msg": "Package \"pkg:maven/org.example/shared@1.0\" (source: \"https://untrusted-cdx.com\") is not in the permitted list",
+			"term": "pkg:maven/org.example/shared@1.0",
+		},
+		{
+			"code": "release.maven_repos.deny_unpermitted_urls",
+			"effective_on": "2026-05-10T00:00:00Z",
+			"msg": "Package \"pkg:maven/org.example/shared@1.0\" (source: \"https://untrusted-spdx.com\") is not in the permitted list",
+			"term": "pkg:maven/org.example/shared@1.0",
+		},
+	}
+
+	result := maven_repos.deny with sbom.cyclonedx_sboms as [mock_cdx]
+		with sbom.spdx_sboms as [mock_spdx]
+		with data.rule_data as mock_data
+
+	lib.assertions.assert_equal(expected, result)
+}
+
+test_repo_url_errors_mixed_permitted_and_unpermitted if {
+	mock_cdx := {"components": [{
+		"name": "shared-lib",
+		"purl": "pkg:maven/org.example/shared@1.0",
+		"externalRefs": [{"type": "distribution", "url": "https://repo.maven.apache.org/maven2/"}],
+	}]}
+
+	mock_spdx := {"packages": [{
+		"name": "shared-lib",
+		"purl": "pkg:maven/org.example/shared@1.0",
+		"externalRefs": [{"referenceType": "repository", "referenceLocator": "https://untrusted-spdx.com"}],
+	}]}
+
+	expected := {{
+		"code": "release.maven_repos.deny_unpermitted_urls",
+		"effective_on": "2026-05-10T00:00:00Z",
+		"msg": "Package \"pkg:maven/org.example/shared@1.0\" (source: \"https://untrusted-spdx.com\") is not in the permitted list",
+		"term": "pkg:maven/org.example/shared@1.0",
+	}}
+
+	result := maven_repos.deny with sbom.cyclonedx_sboms as [mock_cdx]
+		with sbom.spdx_sboms as [mock_spdx]
+		with data.rule_data as mock_data
+
+	lib.assertions.assert_equal(expected, result)
+}