Keep testing sbom in Nuitka binary

Author: kdeldycke

changelog.md

@@ -6,7 +6,7 @@
 > This version is **not released yet** and is under active development.
 
 - **Breaking:** [mpm] Rename the global `--stats / --no-stats` flag to `--summary / --no-summary`. Scripts passing the old flag must update.
-- **Breaking:** [mpm] Move `cyclonedx-python-lib` and `spdx-tools` into a new `[sbom]` extra: `mpm sbom` now requires `pip install meta-package-manager[sbom]`. `packageurl-python` stays in the runtime install.
+- **Breaking:** [mpm] Move `cyclonedx-python-lib` and `spdx-tools` into a new `[sbom]` extra: `mpm sbom` now requires `pip install meta-package-manager[sbom]`. `packageurl-python` stays in the runtime install. The standalone binary distribution keeps shipping SBOM support: `[tool.repomatic] nuitka.extras = ["sbom"]` syncs the extra into the build venv and `[tool.nuitka] include-package = ["cyclonedx", "spdx_tools"]` forces Nuitka to bundle the `try/except`-guarded imports.
 - [asdf] Add [asdf](https://asdf-vm.com) package manager (`installed`, `outdated`, `search`, `install`, `upgrade`, `upgrade_all`, `remove`, `sync`) on Linux and macOS; requires `asdf` `>=0.16.0`.
 - [mise] Add [mise](https://mise.jdx.dev) package manager (`installed`, `outdated`, `search`, `install`, `upgrade`, `upgrade_all`, `remove`, `sync`, `cleanup`), cross-platform; requires `mise` `>=2025.5.10`.
 - [mpm] Add the `--man` (roff man page) and `--accessible` (no ANSI or Unicode, for screen readers) global options from `click-extra`, and attach an `mpm-manpages.tar.gz` asset to each release.

pyproject.toml

@@ -292,6 +292,13 @@ macos-app-icon = "docs/assets/icon.icns"
 linux-icon = "docs/assets/icon.png"
 windows-icon-from-ico = "docs/assets/icon.ico"
 include-package-data = [ "click_extra" ]
+# The cyclonedx and spdx_tools imports are guarded behind try/except blocks in
+# meta_package_manager.sbom so a default `pip install` (without the [sbom]
+# extra) still imports cleanly. Nuitka skips packages whose imports are gated
+# behind try/except even when they are installed, so force-include them.
+# Pairs with `[tool.repomatic] nuitka.extras = ["sbom"]` which syncs the
+# packages into the build venv.
+include-package = [ "cyclonedx", "spdx_tools" ]
 
 [tool.typos]
 # Correct capitalization for proper nouns.
@@ -471,6 +478,10 @@ test-matrix.remove.os = [ "windows-11-arm" ]
 test-matrix.exclude = [ { python-version = "3.15t" } ]
 # Test plan for binary testing.
 test-plan.file = "./tests/cli-test-plan.yaml"
+# Sync the [sbom] extra into the build venv so the Nuitka binary can ship
+# `mpm sbom --spdx` / `mpm sbom --cyclonedx`. Paired with `include-package`
+# in [tool.nuitka] below to defeat Nuitka's try/except import skip.
+nuitka.extras = [ "sbom" ]
 # Render the mpm Click command tree as roff `.1` files and attach them as
 # `mpm-manpages.tar.gz` to every GitHub release (handled by the `manpages` job
 # in repomatic's `_release-engine.yaml`). The `module:function` form bypasses

tests/cli-test-plan.yaml

@@ -184,14 +184,8 @@
 - cli_parameters: backup
   exit_code: 0
 
-# SBOM generation requires the [sbom] extra (cyclonedx-python-lib and
-# spdx-tools). The binary distribution mirrors a default `pip install
-# meta-package-manager` without extras, so `mpm sbom` exits with code 2 and
-# tells the user to install with `pip install meta-package-manager[sbom]`.
 - cli_parameters: sbom --spdx
-  exit_code: 2
-  stderr_contains: "SPDX SBOM generation requires the [sbom] extra"
+  exit_code: 0
 
 - cli_parameters: sbom --cyclonedx
-  exit_code: 2
-  stderr_contains: "CycloneDX SBOM generation requires the [sbom] extra"
+  exit_code: 0