Merge branch 'main' into perf-optimize-nested-components-8794458850882209436

Author: saquibsaifee

.github/workflows/zizmor.yml

@@ -32,7 +32,7 @@ jobs:
           persist-credentials: false
       - name: Run zizmor 🌈
         # see https://github.com/zizmorcore/zizmor-action
-        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054  # v0.6.2
+        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99  # v0.6.3
         with:
           # advanced-security: false => emit findings as workflow-command annotations (::error file=…) rather than
           # uploading a SARIF report to GitHub's Security tab.

cyclonedx/model/bom.py

@@ -708,9 +708,10 @@ def get_component_by_purl(self, purl: Optional['PackageURL']) -> Optional[Compon
         .. deprecated:: next
         """
         if purl:
-            found = [x for x in self.components if x.purl == purl]
-            if len(found) == 1:
-                return found[0]
+            gen = (x for x in self.components if x.purl == purl)
+            first = next(gen, None)
+            if first and next(gen, None) is None:
+                return first
 
         return None
 
@@ -742,9 +743,9 @@ def has_component(self, component: Component) -> bool:
 
     def _get_all_components(self) -> Generator[Component, None, None]:
         if self.metadata.component:
-            yield from self.metadata.component.get_all_nested_components(include_self=True)
+            yield from self.metadata.component.iter_all_nested_components(include_self=True)
         for c in self.components:
-            yield from c.get_all_nested_components(include_self=True)
+            yield from c.iter_all_nested_components(include_self=True)
 
     def get_vulnerabilities_for_bom_ref(self, bom_ref: BomRef) -> 'SortedSet[Vulnerability]':
         """
@@ -855,8 +856,8 @@ def validate(self) -> bool:
         elem: Union[BomMetaData, Component, Service]
         for elem in chain(  # type:ignore[assignment]
             [self.metadata],
-            self.metadata.component.get_all_nested_components(include_self=True) if self.metadata.component else [],
-            chain.from_iterable(c.get_all_nested_components(include_self=True) for c in self.components),
+            self.metadata.component.iter_all_nested_components(include_self=True) if self.metadata.component else [],
+            chain.from_iterable(c.iter_all_nested_components(include_self=True) for c in self.components),
             self.services
         ):
             if len(elem.licenses) > 1 and any(isinstance(li, LicenseExpression) for li in elem.licenses):

cyclonedx/model/component.py

@@ -17,7 +17,7 @@
 
 import re
 import sys
-from collections.abc import Iterable
+from collections.abc import Iterable, Iterator
 from enum import Enum
 from typing import Any, Optional, Union
 from warnings import warn
@@ -1684,19 +1684,29 @@ def tags(self) -> 'SortedSet[str]':
     def tags(self, tags: Iterable[str]) -> None:
         self._tags = SortedSet(tags)
 
-    def get_all_nested_components(self, include_self: bool = False) -> set['Component']:
-        components = set()
-        if include_self:
-            components.add(self)
+    def iter_all_nested_components(self, include_self: bool = False) -> Iterator['Component']:
+        """
+        Iterate over this component and all its nested components (assemblies), recursively.
+
+        Components are deduplicated by object identity — NOT by equality.
+        This never calls the (costly) ``Component.__hash__``/``__eq__``,
+        which makes it dramatically faster than :func:`get_all_nested_components`
+        for large component trees. Safe against cyclic component graphs.
 
-        stack = list(self.components)
+        Order of iteration is not guaranteed.
+        """
+        seen: dict[int, 'Component'] = {}
+        stack: list['Component'] = [self] if include_self else list(self.components)
         while stack:
             current = stack.pop()
-            if current not in components:
-                components.add(current)
+            current_id = id(current)
+            if current_id not in seen:
+                seen[current_id] = current
                 stack.extend(current.components)
+        return iter(seen.values())
 
-        return components
+    def get_all_nested_components(self, include_self: bool = False) -> set['Component']:
+        return set(self.iter_all_nested_components(include_self=include_self))
 
     def get_pypi_url(self) -> str:
         if self.version:

tests/_data/snapshots/README.md

@@ -1,6 +1,31 @@
-# TEST FIXTURES
+# Test fixtures
 
-## RE-CREATION
+## Model fixtures
+
+Serialization and deserialization tests share BOM factories from
+[`tests/_data/models.py`](../models.py). To cover a model change:
+
+1. Add a descriptively named factory that starts with `get_bom_` and returns a
+   `Bom`. The function is discovered automatically; its name also becomes the
+   snapshot filename prefix.
+2. Populate every field relevant to the change so the JSON and XML output
+   tests exercise the complete model. Name a fixture ending in `_invalid` only
+   when serialization is expected to fail.
+3. Register a factory in `all_get_bom_funct_with_incomplete_deps` when its
+   dependency graph is intentionally incomplete. Otherwise, include the
+   complete dependency graph in the returned BOM.
+4. Re-create the snapshots, review the changed files, then run the tests again
+   without snapshot re-creation enabled.
+5. For version-specific fixtures, prefix the name with the target schema version
+   tag (e.g. `get_bom_v1_5_*`). The test runner uses `is_valid_for_schema_version()`
+   to ensure such models are only evaluated against applicable schema versions.
+
+The output tests serialize each discovered model for the applicable schema
+versions, validate the generated JSON and XML, and compare it with the stored
+snapshots. The deserialization tests also use these fixtures for round-trip
+coverage.
+
+## Re-creation
 
 Some assets here can be (re-)created automatically, by setting the env var `CDX_TEST_RECREATE_SNAPSHOTS=1`.  
 It might also help to set `PYTHONHASHSEED=0`!  
@@ -10,4 +35,6 @@ As a shortcut just run:
 CDX_TEST_RECREATE_SNAPSHOTS=1 poetry run tox -e py
 ```
 
-The files will be written as is, which might not be human-readable. feel free to reformat the files manually.
+Only commit snapshots that belong to the model change. Snapshot tests compare
+the serialized text with the stored fixture using exact string equality, so do
+not reformat snapshots manually.

tests/test_model_component.py

@@ -112,6 +112,7 @@ def test_empty_basic_component(self) -> None:
         self.assertIsNone(c.release_notes)
         self.assertEqual(len(c.components), 0)
         self.assertEqual(len(c.get_all_nested_components(include_self=True)), 1)
+        self.assertEqual(len(list(c.iter_all_nested_components(include_self=True))), 1)
 
     def test_multiple_basic_components(self) -> None:
         c1 = Component(name='test-component')
@@ -312,6 +313,8 @@ def test_nested_components_1(self) -> None:
         self.assertEqual(1, len(comp_b.components))
         self.assertEqual(2, len(comp_b.get_all_nested_components(include_self=True)))
         self.assertEqual(1, len(comp_b.get_all_nested_components(include_self=False)))
+        self.assertEqual(2, len(list(comp_b.iter_all_nested_components(include_self=True))))
+        self.assertEqual(1, len(list(comp_b.iter_all_nested_components(include_self=False))))
 
     def test_nested_components_2(self) -> None:
         comp_a = Component(name='comp_a')
@@ -323,6 +326,8 @@ def test_nested_components_2(self) -> None:
         self.assertEqual(2, len(comp_b.components))
         self.assertEqual(3, len(comp_b.get_all_nested_components(include_self=True)))
         self.assertEqual(2, len(comp_b.get_all_nested_components(include_self=False)))
+        self.assertEqual(3, len(list(comp_b.iter_all_nested_components(include_self=True))))
+        self.assertEqual(2, len(list(comp_b.iter_all_nested_components(include_self=False))))
 
 
 class TestModelDiff(TestCase):