[Sarah Oslund (sfoslund)]

Add Spdx30ComponentDetector (SPDX30SBOM) as a default-off detector for SPDX 3.0.0 and 3.0.1 compact JSON-LD documents.

• Discover only *.spdx.json files and register each document as one existing SpdxComponent, rather than importing its packages or dependency relationships.
• Resolve embedded or referenced creation information and creator tool/organization nodes.
• Record the document IRI, name, first root element, file path, and lowercase SHA1 checksum. Use the document IRI when the name or root element is absent, and warn when selecting among multiple roots.
• Reject unsupported versions, ambiguous documents, and duplicate element identifiers.
• Register the detector in DI and add focused unit tests plus a local verification fixture. Leave the existing SPDX 2.2 detector unchanged.

Enable alongside SPDX 2.2 with:

--DetectorArgs SPDX22SBOM=EnableIfDefaultOff,SPDX30SBOM=EnableIfDefaultOff

Validation

• dotnet build test\Microsoft.ComponentDetection.Detectors.Tests\Microsoft.ComponentDetection.Detectors.Tests.csproj --no-restore --verbosity quiet — passed, zero warnings or errors.
• dotnet run --project test\Microsoft.ComponentDetection.Detectors.Tests\Microsoft.ComponentDetection.Detectors.Tests.csproj --no-build -- --filter "FullyQualifiedName~Spdx" — passed, all 36 SPDX tests.
• dotnet build src\Microsoft.ComponentDetection\Microsoft.ComponentDetection.csproj --no-restore --verbosity quiet — passed, zero warnings or errors.
• The following CLI smoke test passed and produced exactly one SPDX30SBOM document component with both detectors enabled:

dotnet run --project src\Microsoft.ComponentDetection\Microsoft.ComponentDetection.csproj --no-build -- scan `
  --SourceDirectory test\Microsoft.ComponentDetection.VerificationTests\resources\spdx30 `
  --DetectorArgs "SPDX22SBOM=EnableIfDefaultOff,SPDX30SBOM=EnableIfDefaultOff" `
  --ManifestFile "$env:TEMP\component-detection-spdx30-pr-result.json" `
  --NoSummary

Combined scans containing both SPDX 2.2 and 3.0 documents also found both document components. Default-off behavior and exclusion of alternate filename suffixes were checked locally.

The full solution test suite and snapshot verification suite were not run. The fixture is included in this repository; a separate verification-repository PR has not been created. No README feature-table changes are included.

New Detector Checklist

• I have gone through the docs for creating a new detector here
• My new detector implements IDefaultOffComponentDetector
• I have created a PR to the verification repo with components that my new detector can find
• (If necessary) I have updated the Feature Overview table in the README

[Copilot]

🟡 Changes recommended

Embedded-reference resolution can skip supported documents, and component registration leaves the document without a dependency root.

2 open issues

• Mark the document as an explicitly referenced root · New
• Index embedded definitions for reference resolution · New

What changed in this PR

Adds an opt-in SPDX 3.0 detector that records each supported document as one existing SpdxComponent, alongside the unchanged SPDX 2.2 detector.

Changes:

• Parses SPDX 3.0.0 and 3.0.1 compact JSON-LD documents, including document metadata, creators, roots, and checksums.
• Registers SPDX30SBOM as a default-off detector.
• Adds focused unit tests and a local verification fixture.

File	Description
test/​Microsoft.ComponentDetection.VerificationTests/​resources/​spdx30/​manifest.spdx.json	Adds a sample SPDX 3.0.1 document.
test/​Microsoft.ComponentDetection.Detectors.Tests/​Spdx30ComponentDetectorTests.cs	Tests detection, metadata resolution, fallbacks, and rejection cases.
src/​Microsoft.ComponentDetection.Orchestrator/​Extensions/​ServiceCollectionExtensions.cs	Registers the new detector in dependency injection.
src/​Microsoft.ComponentDetection.Detectors/​spdx/​Spdx30ComponentDetector.cs	Implements document discovery, parsing, validation, and component registration.

_{Review effort: Balanced}

[Ryan Brandenburg (ryanbrandenburg)]

Looks good, some questions about edge-case stuff but nothing to block on for a default-off Detector as long as you give them some thought.

[Copilot]

🔵 Needs a closer look

Valid standalone SPDX documents are skipped because the detector requires an @graph wrapper.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Handle root-level SPDX 3.0 documents without @​graph

src/​Microsoft.ComponentDetection.Detectors/​spdx/​Spdx30ComponentDetector.cs:146

This guard skips compact SPDX documents that put SpdxDocument directly at the JSON root. The SPDX project's 3.0.0 example uses this form with embedded creationInfo and no @graph. It therefore produces no component here even though the remaining parsing logic supports its fields and version. Normalize a standalone document into a one-element sequence while retaining graph support, and add a regression test for this form.

2 resolved since last review

• Index embedded definitions for reference resolution
• Mark the document as an explicitly referenced root

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No blocking issues remain in the opt-in detector, its integration, or its focused test coverage.

No open issues 🎉

_{Review effort: Balanced}

[github-actions]

👋 Hi! It looks like you modified some files in the Detectors folder.
You may need to bump the detector versions if any of the following scenarios apply:

• The detector detects more or fewer components than before
• The detector generates different parent/child graph relationships than before
• The detector generates different devDependencies values than before

If none of the above scenarios apply, feel free to ignore this comment 🙂