chore(tests): add delta SBOM validation

Add a pytest to validate delta SBOM generation from base and target
SBOMs.
Verify only extra packages and their relationships appear in the delta.

Add GitHub Actions workflow step to run `debsbom delta` on SPDX and
CycloneDX SBOMs.
Collect coverage for both SPDX and CDX delta runs.

Signed-off-by: Badrikesh Prusty <badrikesh.prusty@siemens.com>

Author: baprusty

.github/actions/pytest/action.yml

@@ -52,6 +52,14 @@ runs:
       export COVERAGE_FILE=".coverage.smoke-export.${{ inputs.artifact-identifier }}"
       coverage run $(which debsbom) -v export sbom-rp.spdx.json
 
+  - name: smoke test delta
+    shell: bash
+    run: |
+      export COVERAGE_FILE=".coverage.delta.spdx.${{ inputs.artifact-identifier }}"
+      coverage run $(which debsbom) -v delta --validate tests/data/delta-base.spdx.json tests/data/delta-target.spdx.json
+      export COVERAGE_FILE=".coverage.delta.cdx.${{ inputs.artifact-identifier }}"
+      coverage run $(which debsbom) -v delta --validate tests/data/delta-base.cdx.json tests/data/delta-target.cdx.json
+
   - name: upload smoke test SBOMs
     uses: actions/upload-artifact@v4
     with: