create isoccur for top level package when artifact is found (#2137)

Signed-off-by: pxp928 <[email protected]>

Author: pxp928

internal/testing/testdata/testdata.go

@@ -1127,6 +1127,16 @@ var (
 	}
 
 	CdxIngestionPredicates = assembler.IngestPredicates{
+		IsOccurrence: []assembler.IsOccurrenceIngest{
+			{
+				Pkg: cdxTopLevelPack,
+				Artifact: &model.ArtifactInputSpec{
+					Algorithm: "sha256",
+					Digest:    "6ad5b696af3ca05a048bd29bf0f623040462638cb0b29c8d702cbb2805687388",
+				},
+				IsOccurrence: isOccurrenceJustifyTopPkg,
+			},
+		},
 		IsDependency: CdxDeps,
 		HasSBOM:      CdxHasSBOM,
 	}

pkg/ingestor/parser/cyclonedx/parser_cyclonedx.go

@@ -387,6 +387,8 @@ func (c *cyclonedxParser) GetPredicates(ctx context.Context) *assembler.IngestPr
 					logger.Infof("CDX artifact was not parsable: %v", err)
 				} else {
 					topLevelArts = append(topLevelArts, artInput)
+					// append to packageArtifacts so that isOccurrence is created
+					c.packageArtifacts[c.cdxBom.Metadata.Component.BOMRef] = append(c.packageArtifacts[c.cdxBom.Metadata.Component.BOMRef], artInput)
 					logger.Infof("getArtInput %v", artInput)
 				}
 			}