Use rules_nodejs toolchain for hermetic cdxgen execution

[olivembo]

Summary

This PR makes SBOM generation more reproducible and closer to hermetic builds.

What changed

• Switched cdxgen execution to Bazel-managed Node toolchain in rules.bzl.
• Added cdxgen_version parameter through macro/rule in defs.bzl and rules.bzl.
• Replaced shell-based crates cache generation with a Bazel py_binary action path in BUILD.bazel and rules.bzl.
• Updated module/tooling setup and reproducibility settings in MODULE.bazel, MODULE.bazel.lock, and .bazelrc.
  Updated docs/tests and removed legacy npm wrapper in README.md, test_generate_crates_metadata_cache.py, BUILD.bazel, and npm_wrapper.sh.

Notes

Includes both branch commits (23d543e, d56768c).
auto_cdxgen still requires network and no-sandbox behavior as configured.

[Copilot]

Pull request overview

This PR aims to make SBOM generation more reproducible by moving cdxgen execution onto a Bazel-managed Node/npm toolchain and by refining how Rust crate metadata is generated (crates.io-first, with optional dash-license-scan).

Changes:

• Switched auto-cdxgen to run via rules_nodejs toolchain and added a pinned cdxgen_version parameter.
• Updated Rust crates metadata cache generation to use crates.io metadata by default, with optional dash-license-scan via CLI flag.
• Removed the legacy host npm_wrapper and tightened Bazel reproducibility with lockfile enforcement.

Reviewed changes

Copilot reviewed 10 out of 12 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/rules.bzl	Uses Bazel-managed Node toolchain for cdxgen; refactors crates cache generation to a Bazel py_binary; adds cdxgen_version; adds Node toolchain requirement.
defs.bzl	Threads cdxgen_version through the public sbom() macro.
scripts/generate_crates_metadata_cache.py	Adds crates.io license fallback and optional dash-license-scan execution via --use-dash-license-scan.
scripts/BUILD.bazel	Adds py_binary target for generate_crates_metadata_cache to support Bazel execution.
tests/test_generate_crates_metadata_cache.py	Adds unit tests for crates.io license normalization and precedence over dash-license-scan.
README.md	Updates documentation to reflect Bazel-managed Node/npm usage, crates.io-first Rust metadata, and new cdxgen_version.
MODULE.bazel	Adds rules_nodejs and configures Node toolchain; configures uv extension as a dev dependency.
MODULE.bazel.lock	Adds the module lockfile to the repo to support --lockfile_mode=error reproducibility.
BUILD.bazel	Removes the legacy npm_wrapper sh_binary.
npm_wrapper.sh	Deletes the host npm/nvm wrapper script.
.bazelrc	Enforces lockfile reproducibility with --lockfile_mode=error.
.gitignore	Stops ignoring MODULE.bazel.lock so it can be checked in.

Comments suppressed due to low confidence (1)

internal/rules.bzl:146

• The cdxgen action passes node_info.npm.path as a script argument, but node_info.npm itself is not explicitly declared as an input/tool. If npm_sources doesn’t include the entrypoint file, the action will fail with a missing file at execution time.

        ctx.actions.run(
            outputs = [cdxgen_sbom],
            tools = [node_info.node],
            inputs = node_info.npm_sources,
            executable = node_info.node,

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.