[kocaemre]

Pull Request Description

What

• Keep the upstream SBOM package at the resolved source version when purl.upstream is unset; purl.version continues to identify the built wheel.
• Add a regression validating both SPDX package versions and purls without an explicit upstream override.

Why

Closes #1376. A locally versioned wheel must not make the GENERATED_FROM source reference point to a non-existent upstream release.

Verification

• RED: uvx --from hatch hatch run test:test tests/test_sbom.py::test_generate_sbom_upstream_uses_source_version_without_upstream_override -q --no-cov --tb=short — 1 failed as expected (upstream.versionInfo: 0.5.5+local.1 instead of 0.5.5).
• GREEN: uvx --from hatch hatch run test:test tests/test_sbom.py tests/test_packagesettings.py -q --no-cov --tb=short — 108 passed.
• uvx --from hatch hatch run mypy:check src/fromager/sbom.py — 77 source, 51 test, 7 e2e files checked without errors (repo wrapper checks all three).
• uvx --from hatch hatch run lint:check and git diff --check — passed.
• Full suite and end-to-end build not run (repo guide recommends file-scoped tests for small fixes).

AI assistance: Hermes Agent prepared this focused change and its regression; local checks above were run. Commit is DCO signed-off.

• PR follows CONTRIBUTING.md guidelines

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: python-wheel-build/fromager/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7f22ed18-5ede-4640-9a05-fa363ce8b16e

📥 Commits

Reviewing files that changed from the base of the PR and between 7b20afb and d5e5b73.

📒 Files selected for processing: 1

• src/fromager/packagesettings/_models.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The fallback upstream PURL now uses the supplied source version instead of the per-package version override. An explicit upstream PURL is still used as-is. Documentation describes the derived PURL and its omitted repository_url qualifier. A new test checks that the local version applies to the wheel while the upstream entry retains the source version, and validates the generated SPDX document.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to d5e5b

The generated SBOM preserves the distinct wheel and source versions and links the wheel to the upstream package. No material merge risk is evident.

Pre-merge checks: 6

Check name	Status	Explanation
Title check		The title clearly and concisely describes the primary SBOM change: preserving the source version in the upstream entry.
Description check		The description directly explains the SBOM versioning fix, regression test, rationale, and verification results.
Linked Issues check		The pull request addresses issue #1376 and matches its stated requirement for preserving the upstream source version.
Out of Scope Changes check		The changes are focused on SBOM generation, related documentation, and regression coverage. No unrelated changes are identified.
Linked Issues check		Issue #1376 requires the fallback upstream SBOM entry to retain the resolved source version when purl.upstream is unset. _build_upstream_purl now uses the resolved version for the fallback and p…
Out of Scope Changes check		The changes are limited to fallback upstream purl construction, its documentation, and a focused SBOM regression test. These changes directly support issue #1376. No unrelated change is shown in the s…

Full details: Linked Issues check

Explanation

Issue #1376 requires the fallback upstream SBOM entry to retain the resolved source version when purl.upstream is unset. _build_upstream_purl now uses the resolved version for the fallback and preserves explicit PurlConfig.upstream values. The regression test verifies the wheel version and purl use 0.5.5+local.1, while the upstream SPDX version and purl use 0.5.5.

Full details: Out of Scope Changes check

Explanation

The changes are limited to fallback upstream purl construction, its documentation, and a focused SBOM regression test. These changes directly support issue #1376. No unrelated change is shown in the supplied pull request evidence.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mprpic]

Couple minor comments:

• The doc string in PurlConfig.upstream in src/fromager/packagesettings/_models.py is now outdated after this change.
• Nit: the repo conventions ask that you use Co-Authored-By as commit trailer, not AI-Assisted-By.

Otherwise, lgtm!

[rd4398]

This looks good to me as well and I agree with @mprpic 's comment above

[kocaemre]

Thanks @mprpic and @rd4398. Updated PurlConfig.upstream to explain that the fallback retains the source version even when the downstream wheel has a local version override; replaced the nonstandard AI trailer with the documented Co-Authored-By trailer and kept Emre K DCO sign-off. RED: the pre-edit upstream-docstring consistency assertion failed with upstream docstring omits resolved source version; GREEN: the same assertion passed. uvx --from hatch hatch run test:test tests/test_sbom.py tests/test_packagesettings.py -q --no-cov --tb=short — 108 passed; uvx --from hatch hatch run lint:check and git diff --check origin/main..HEAD passed. New head: d5e5b738aa21f4e504867dcdeb1e67c41bacf292. Ready for re-review.

[rd4398]

This looks good! Thanks for your contribution

[mergify]

This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again.