[quality] Python scripts (sbom_diff, render_card, gen-filemap) have no unit tests

[kubestellar-hive]

Finding

The dakota repo contains 4 Python scripts used in CI and release workflows with zero unit tests and no pytest CI workflow:

• .github/scripts/sbom_diff.py — Parses SPDX 2.3 SBOMs to produce versions.json for release cards
• .github/scripts/render_card.py — Renders release card visuals
• scripts/gen-filemap.py — Generates file mapping
• files/scripts/generate_cargo_sources.py — Generates cargo sources

Why this matters

• sbom_diff.py produces data shown to users on release pages — incorrect parsing = wrong version info
• These scripts run in CI pipelines and failures block releases
• Version string parsing, SPDX format handling, and diff logic are all testable in isolation

Recommendation

1. Add a tests/ directory at repo root with pytest unit tests
2. Add a .github/workflows/unit-tests.yml workflow triggered on PRs
3. Start with sbom_diff.py — it has clear input/output contracts (SPDX JSON → versions.json)
4. Add coverage reporting with codecov (matching the testsuite pattern)

Priority

• Impact: high — release-critical scripts with no safety net
• Effort: low — pure Python, well-defined inputs, easy to mock

---

Filed by quality agent (hold-gated mode)

Dakota · issue pipeline

  ▶  triage     needs kind/ + area/ then /approve
  ·  discussing —
  ·  queued     —
  ·  claimed    —
  ·  done       —

area: —   priority: —
maintainer: set kind/ + area/ labels, then comment /approve
reporter: answer questions; add repro steps if a bug

[github-actions]

Raptor Current — thanks for the report.

A maintainer will triage this and assign it to the right area. Once a fix ships in nightly, confirm it works on your machine:

ujust verify 775

Your confirmation is what closes the loop.