Expand manifest-parser ecosystem coverage (#702)

gitgalaxy/galaxyscope.py

@@ -970,14 +970,20 @@ def execute_pipeline(self, output_file: str = "galaxy.json"):
             # union, ecosystems MANIFEST_MAP doesn't track (composer.json,
             # requirements.txt) silently never reach the SBOM whenever any other
             # manifest is also present in the repo.
-            from gitgalaxy.security.manifest_parser import SUPPORTED_MANIFEST_FILENAMES, ManifestParser
+            from gitgalaxy.security.manifest_parser import (
+                SUPPORTED_MANIFEST_FILENAMES,
+                SUPPORTED_MANIFEST_SUFFIXES,
+                ManifestParser,
+            )
 
             guidestar_config = self.config.get("GUIDESTAR_CONFIG", {})
             target_manifests = set(guidestar_config.get("MANIFEST_MAP", {}).keys()) | set(SUPPORTED_MANIFEST_FILENAMES)
             manifest_paths = [
                 str(self.root / rel_path)
                 for rel_path in self.stem_map.values()
-                if Path(rel_path).name in target_manifests
+                # Suffix check covers per-project-named manifests (e.g. *.csproj)
+                # that can't live in the exact-filename SUPPORTED_MANIFEST_FILENAMES set.
+                if Path(rel_path).name in target_manifests or Path(rel_path).suffix in SUPPORTED_MANIFEST_SUFFIXES
             ]
 
             # 2. Build the global translation map

gitgalaxy/recorders/sbom_recorder.py

@@ -19,7 +19,11 @@
 # UniversalManifestSlicer now lives in the canonical manifest module (PR A of
 # the dependency-audit overhaul). Re-imported here so existing consumers and
 # tests importing it from this module keep working unchanged.
-from gitgalaxy.security.manifest_parser import SUPPORTED_MANIFEST_FILENAMES, UniversalManifestSlicer
+from gitgalaxy.security.manifest_parser import (
+    SUPPORTED_MANIFEST_FILENAMES,
+    SUPPORTED_MANIFEST_SUFFIXES,
+    UniversalManifestSlicer,
+)
 
 # Import exclusively from the GitGalaxy Hub
 from gitgalaxy.security.security_lens import SecurityLens
@@ -94,6 +98,10 @@ def generate_report(
             manifests_found = [
                 (target_path / m, target_path) for m in self._MANIFEST_NAMES if (target_path / m).exists()
             ]
+            # Suffix-matched manifests (e.g. *.csproj) can't be enumerated by exact
+            # name; glob for them at the root, matching the non-recursive scope above.
+            for suffix in SUPPORTED_MANIFEST_SUFFIXES:
+                manifests_found += [(p, target_path) for p in target_path.glob(f"*{suffix}")]
 
         if not manifests_found:
             self.logger.warning("SBOM: No supported manifests found. Outputting empty BOM.")