[SizzleUnrlsd]

Closes #149.

Until now, reports named only the engine. The advisories that decide the dependency findings and the VEX statements come from plugins and advisory files, which change on their own schedule. A result could therefore not be traced to its data, nor reproduced. CoreTrace-Entreprise/coretrace-python-analyzer-plugins#2 needs this before its advisory data gets versioned.

What changes

• ProjectAnalysis.components lists what a directory check was produced with, besides the engine and the sources:

  • each loaded plugin, by manifest name and version;
  • each advisory file that loaded, by path (relative to the root when under it).

  Each component carries a sha256: digest of its content. For a plugin it is the directory digest the cache already computes, bytecode and hidden files excluded; for a file, its bytes. The new type is coretrace_python.findings.Component, next to Coverage, because the dependency layer (VEX, SBOM) and the reporters must both import it.

• Each format shows them:

  • JSON: tool.components;
  • SARIF: tool.extensions, with kind and digest in properties;
  • CycloneDX SBOM: metadata.tools.components, a plugin as application, a file as data, each with its SHA-256;
  • OpenVEX: tooling (coretrace-python-analyzer 0.10.0; curated-advisories 2026.09.25 (sha256:…)). As a result, the document @id changes when the advisory data changes.

  A single-file check lists no components.

• advisory_source on every finding about an advisory: name@version for a plugin, the path for a file. When several sources define the same advisory, it is the one whose definition wins the merge. _merge_advisories now keeps each advisory's contributor, in the same order as before, so repr(advisories) and the cache key do not change. The source is added after cached modules are read, so findings served from the cache carry it too, and the cache format is unchanged.

• Cache key. It now reads each plugin's identity from the same components the report shows, instead of computing the digest separately.

Tests

• tests/test_provenance.py, 9 tests:
  • the plugin and file components with their digests, including a file outside the root;
  • a plugin's digest follows its data and ignores bytecode;
  • a file that fails to load is not a component;
  • advisory_source from a plugin, from a file that redefines the advisory, and from the cache;
  • each format (JSON, SARIF, SBOM, VEX), including the VEX @id changing with the data;
  • the command line, for a directory and for a single file.
• Full suite: 1110 passed, 2 skipped. Regression snapshots under Python 3.12: 19 passed, unchanged. mypy and ruff: clean.