feat: add SPEC_VERSION config with syft

docs/Docusaurus/docs/modules/engine_core.md

@@ -127,6 +127,7 @@ Configuration of the driven adapters in the main layer and management of on/off
         "SYFT": {
             "SYFT_VERSION": "1.17.0",
             "OUTPUT_FORMAT": "cyclonedx-json",
+            "SPEC_VERSION": "1.6",
             "EXCLUDE_PATHS": ["**/test/**", "**/node_modules/**"],
             "EXCLUDE_CATALOGERS": [],
             "DEBUG_PIPELINES": ["pipeline_name1", "pipeline_name2"]
@@ -361,6 +362,7 @@ Configuration of the driven adapters in the main layer and management of on/off
     - **SYFT**
         - **SYFT_VERSION**: Version of Syft to download and use. Example: `"1.17.0"`.
         - **OUTPUT_FORMAT**: Output format for the SBOM. Default: `"cyclonedx-json"`. Other options include `"spdx-json"`, `"syft-json"`, `"table"`.
+        - **SPEC_VERSION**: Schema version to use for the SBOM output. Default: `"1.6"`. Only applied when `OUTPUT_FORMAT` supports versioning (`cyclonedx-json`, `cyclonedx-xml`, `spdx-json`, `spdx-tag-value`), appended to the format as `<format>@<version>` (e.g. `cyclonedx-json@1.6`). Ignored for formats without version support (e.g. `syft-json`, `table`).
         - **EXCLUDE_PATHS**: Array of glob patterns to exclude directories/files from analysis. Example: `["**/test/**", "**/node_modules/**"]`. Useful for skipping test files, build artifacts, or vendor directories.
         - **EXCLUDE_CATALOGERS**: Array of cataloger names to exclude from the default set. Catalogers are specialized modules that detect specific package types (e.g., `"java-archive-cataloger"`, `"python-package-cataloger"`). When specified, Syft uses `--select-catalogers -NAME` to remove these catalogers from analysis. Example: `["java-archive-cataloger", "binary-cataloger"]`.
         - **DEBUG_PIPELINES**: Array of pipeline names where Syft should run in verbose mode (`-v` flag). Useful for troubleshooting SBOM generation issues in specific pipelines. Example: `["pipeline_name1", "pipeline_name2"]`.

example_remote_config_local/engine_core/ConfigTool.json

@@ -107,6 +107,7 @@
         "SYFT": {
             "SYFT_VERSION": "1.42.2",
             "OUTPUT_FORMAT": "cyclonedx-json",
+            "SPEC_VERSION": "1.6",
             "EXCLUDE_PATHS": ["**/test/**"],
             "EXCLUDE_CATALOGERS": ["java-archive-cataloger"],
             "DEBUG_PIPELINES": ["pipeline_name1", "pipeline_name2"]

tools/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/syft/syft.py

@@ -21,6 +21,13 @@
 
 logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
+VERSIONED_OUTPUT_FORMATS = (
+    "cyclonedx-json",
+    "cyclonedx-xml",
+    "spdx-json",
+    "spdx-tag-value",
+)
+
 
 @dataclass
 class Syft(SbomManagerGateway):
@@ -62,12 +69,17 @@ def get_components(self, artifact, config, service_name) -> "list[Component]":
     def _run_syft(self, command_prefix, artifact, config, service_name):
         result_file = f"{service_name}_SBOM.json"
         syft_config = config['SYFT']
-
+
+        output_format = syft_config['OUTPUT_FORMAT']
+        spec_version = syft_config.get('SPEC_VERSION', "")
+        if spec_version and output_format in VERSIONED_OUTPUT_FORMATS:
+            output_format = f"{output_format}@{spec_version}"
+
         command = [
             command_prefix,
             artifact,
             "-o",
-            f"{syft_config['OUTPUT_FORMAT']}={result_file}",
+            f"{output_format}={result_file}",
         ]
 
         exclude_paths = syft_config.get('EXCLUDE_PATHS', [])