Fix: Exclude SPDX files outside BuildDropPath from files section

Copilot · pragnya17 · Copilot · commit 6c9f0187059d · 2025-07-24T18:47:50.000Z
Co-authored-by: pragnya17 &lt;59893188+pragnya17@users.noreply.github.com&gt;
diff --git a/src/Microsoft.Sbom.Api/Executors/FileInfoWriter.cs b/src/Microsoft.Sbom.Api/Executors/FileInfoWriter.cs
@@ -76,7 +76,12 @@ private async Task Generate(IList<ISbomConfig> filesArraySupportingSboms, Intern
                     config.Recorder.RecordSPDXFileId(fileId);
                 }
 
-                await result.Writer.WriteAsync((generationResult?.Document, config.JsonSerializer));
+                // Only include files in the files section if they are within the BuildDropPath
+                // Files outside the BuildDropPath should only be processed as external document references
+                if (!sbomFile.IsOutsideDropPath)
+                {
+                    await result.Writer.WriteAsync((generationResult?.Document, config.JsonSerializer));
+                }
             }
         }
         catch (Exception e)

Original file line number	Diff line number	Diff line change
`@@ -76,7 +76,12 @@ private async Task Generate(IList<ISbomConfig> filesArraySupportingSboms, Intern`
`76`	`76`	`config.Recorder.RecordSPDXFileId(fileId);`
`77`	`77`	`}`
`78`	`78`
`79`		`- await result.Writer.WriteAsync((generationResult?.Document, config.JsonSerializer));`
	`79`	`+ // Only include files in the files section if they are within the BuildDropPath`
	`80`	`+ // Files outside the BuildDropPath should only be processed as external document references`
	`81`	`+ if (!sbomFile.IsOutsideDropPath)`
	`82`	`+ {`
	`83`	`+ await result.Writer.WriteAsync((generationResult?.Document, config.JsonSerializer));`
	`84`	`+ }`
`80`	`85`	`}`
`81`	`86`	`}`
`82`	`87`	`catch (Exception e)`