Integ

.codex/skills/regression-suite/SKILL.md

@@ -0,0 +1,26 @@
+# Regression Suite
+
+Use this skill after implementation changes in this repository.
+
+## Required Checks
+
+- After every implementation change, run targeted regression at minimum:
+  `.\.venv\Scripts\python.exe scripts\dev\run_regression_suite.py --mode targeted`
+- Before staging or committing, run full or pre-stage regression:
+  `.\.venv\Scripts\python.exe scripts\dev\run_regression_suite.py --mode full`
+  or
+  `.\.venv\Scripts\python.exe scripts\dev\run_regression_suite.py --mode pre-stage`
+- Use pytest through the runner. Do not rely only on `unittest discover`.
+- Never hide test failures. Report the exact command, exit status, and failing check.
+- Never stage or commit unless the user explicitly asks.
+
+## Decision Guidance
+
+- Small localized fix: run targeted mode.
+- Controller, output, formatter, schema, or validation fix: run targeted mode and make sure output-contract tests are included.
+- Broad model, service, schema, or cross-path change: run full mode.
+- Before commit or staging: run pre-stage mode.
+
+## Manual Smoke Reminder
+
+Real Hugging Face generation remains optional and manual because the automated regression suite is offline and deterministic. Mention this residual integration risk in final responses when relevant.

.gitignore

@@ -10,6 +10,7 @@ __pycache__/
 .env
 venv/
 .venv/
+.venv-*/
 env/
 dist/
 build/

CONTRIBUTING.md

@@ -80,7 +80,7 @@ import json
 import logging
 
 # Third-party
-import requests
+from cyclonedx.model.bom import Bom
 from huggingface_hub import HfApi
 
 # Local imports
@@ -124,7 +124,6 @@ aibom-generator/
 │   │   ├── validation.py     # CycloneDX 1.6 schema validation
 │   │   ├── license_utils.py  # License normalization
 │   │   └── analytics.py      # Usage tracking
-│   ├── schemas/              # JSON schemas (CycloneDX, SPDX)
 │   └── templates/            # HTML templates
 ├── tests/                    # Unit and integration tests
 └── requirements.txt
@@ -135,7 +134,8 @@ aibom-generator/
 
 - **Service-oriented architecture**: Core logic lives in `models/service.py`
 - **Registry-driven fields**: Field definitions from `models/registry.py`
-- **CycloneDX 1.6 compliance**: All AIBOMs validate against the schema
+- **CycloneDX Python Library**: BOM serialization, schema validation, and SPDX license handling delegate to [`cyclonedx-python-lib`](https://github.com/CycloneDX/cyclonedx-python-lib) — avoid manual JSON construction for anything the library supports
+- **CycloneDX 1.6 compliance**: All AIBOMs validate against the schema via the library's built-in `JsonValidator`
 - **Completeness scoring**: Quality metrics in `models/scoring.py`
 
 ## Running Tests

README.md

@@ -21,6 +21,8 @@ The tool is also listed in the official **[CycloneDX Tool Center](https://cyclon
 - Calculates **AIBOM completeness scoring** with recommendations  
 - Supports metadata extraction from model cards, configurations, and repository files  
 
+> **Built on [CycloneDX Python Library](https://github.com/CycloneDX/cyclonedx-python-lib)** — BOM generation, schema validation, and SPDX license handling are all powered by the official `cyclonedx-python-lib`, ensuring spec-compliant output without manual JSON construction.
+
 ---
 
 ## 🛠 Features

pyproject.toml

@@ -18,15 +18,14 @@ classifiers = [
 ]
 dependencies = [
     "beautifulsoup4>=4.11.0",
+    "cyclonedx-python-lib[json-validation]>=11.7.0",
     "datasets>=2.0.0",
     "fastapi>=0.104.0",
     "flask>=2.3.0",
     "gunicorn>=21.2.0",
     "httpx>=0.25.0",
     "huggingface_hub>=0.19.0",
     "jinja2>=3.0.0",
-    "jsonschema>=4.17.0",
-    "license-expression>=30.4.4",
     "packageurl-python>=0.11.1",
     "pydantic>=2.4.0",
     "python-multipart",
@@ -36,6 +35,7 @@ dependencies = [
     "torch>=2.0.0",
     "transformers>=4.36.0",
     "uvicorn>=0.24.0",
+    "safetensors>=0.4.0",
 ]
 
 [project.optional-dependencies]
@@ -71,5 +71,9 @@ pythonpath = [
 
 [dependency-groups]
 dev = [
+    "pytest>=7.0.0",
+    "pytest-cov>=4.0.0",
+    "pytest-mock>=3.10.0",
+    "ruff",
     "gguf>=0.6.0",
 ]