Merge pull request #1457 from simonbaird/looser-purl-matches

Match kebab or snake case in sbom purl

Author: simonbaird

policy/release/pre_build_script_task/pre_build_script_task.rego

@@ -152,7 +152,7 @@ _purls_from_sbom(s) := purls if {
 		some pkg in s.packages
 		some ref in pkg.externalRefs
 		ref.referenceType == "purl"
-		ref.referenceCategory == "PACKAGE-MANAGER"
+		ref.referenceCategory in {"PACKAGE-MANAGER", "PACKAGE_MANAGER"}
 	}
 	count(purls) > 0
 }

policy/release/pre_build_script_task/pre_build_script_task_test.rego

@@ -194,7 +194,8 @@ _spdx_sbom_attestation := {"statement": {
 			"referenceLocator": "pkg:oci/ubi7@sha256:bcd?repository_url=registry.redhat.io/ubi7",
 		},
 		{
-			"referenceCategory": "PACKAGE-MANAGER",
+			# Intentionally different referenceCategory here
+			"referenceCategory": "PACKAGE_MANAGER",
 			"referenceType": "purl",
 			"referenceLocator": "pkg:oci/bazel6-ubi9@sha256:def?repository_url=quay.io/konflux-ci/bazel6-ubi9",
 		},