Add "fail" compliance action, fixes #4388

[zilosz]

Description

Fixes #4388

Adds a fail compliance action for missing package names and versions. When configured, Syft will throw an error and abort the SBOM generation process instead of continuing.

In addition to existing actions, the missing-name and missing-version config options under compliance now accept fail (with alias error).

Type of change

• New feature (non-breaking change which adds functionality)

Checklist

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections

[kzantow]

Based on the discussions we've had about this one, I think we should update the python cataloger to fix the bug where it's not returning packages without versions, so these can be later handled by the compliance rules. If we update this PR with that one known issue, I think it solves the problem raised in the issue #4388, and we can have follow-on issues for any other catalogers we might find that didn't properly get updated for compliance handling.

There was further discussion about packages without names, but I think this is still an "it depends on the cataloger" decision: if we can give the user enough information to determine where this completely blank package came from where we were actually expecting a package name, we should probably return it, which for JSON might require a future go version with stdlib's JSON v2 to return file and line numbers. Other things like a blank line in requrements.txt probably shouldn't qualify for this as an example. For these other changes, they should probably be follow-ons also, not part of this PR.

Let me know if any of that is unclear; I think the python change mostly solves your use case, as I understood it.

[zilosz]

For now, I've just modified the requirements.txt parser to emit packages with missing versions, since that's what the original issue focused on. I did notice that other Python parsers such as parse_setup.go also explicitly handle missing versions instead of emitting full packages, so perhaps I could fix that in another PR. I also think it would be a good idea to fix other catalogers through separate issues.

[oss-housekeeper]

Warning

Changes github configuration or dependencies — this requires manual review from @anchore/tools

No action from the PR author is needed.

Guarded files touched in this PR:

• .github/actions/bootstrap/action.yaml (sha: 6e8aa90ef8af3e0af7d5cbca143566ad486fe601)

This review disposition can be dismissed after manual review.

[zilosz]

I worked on this PR for the first time in a while and ended up polluting the commit history. Cleaner PR is now #5231

[zilosz]

Closing now.