Unify Rust detection logic with SBOM mode, ownership mapping, and skip optimizations

[AMaini503]

Unified Rust Detector – SBOM, Fallback, and Ownership Enhancements

Summary

This PR introduces a unified Rust component detection model that consolidates SBOM, CLI, and Lock-based detection strategies into a single consistent implementation.
It also refactors supporting classes and introduces key performance and accuracy improvements.

Key Changes

1. Unified Detection Model

• When *.cargo-sbom.json files are found, detection runs purely in SBOM mode (most accurate).
• If no SBOMs are found, the detector operates in fallback mode:
  • Prefer cargo metadata on Cargo.toml.
  • If CLI is disabled or fails, fall back to equivalent Cargo.lock processing.
• Ensures a single consistent pipeline while retaining accuracy and resilience.

2. Parser Refactoring

• Extracted parsing logic for SBOM, CLI, and Lock files into separate interfaces for improved testability and maintainability.

3. RustContextMetadataBuilder Enhancements

• SBOMs don’t natively indicate which Cargo.toml introduced each dependency.
• This class now runs cargo metadata to map packages to their corresponding TOMLs.
• Enables ownership attribution to user-owned source files.

4. Skip Optimizations

• When cargo metadata is executed on a workspace root TOML, it inherently includes all member packages.
• The detector now skips redundant member TOML processing, improving scan efficiency and avoiding duplicate work.

5. Unit Test Coverage

• Added comprehensive tests for:
  • All Rust parsers (SBOM, CLI, Lock)
  • All Rust detectors
  • RustContextMetadataBuilder
• Verified behavioral parity with legacy detectors.

Validation

Manual validation confirms the unified detector produces identical results to the legacy detectors in both modes:

Test Repo	Old SBOM	New SBOM (SBOM Mode)	Old CLI	New SBOM (Fallback Mode)
Repo1	151	151	404	404
Repo2	489	489	590	590

[codecov]

Codecov Report

❌ Patch coverage is 97.86804% with 95 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.9%. Comparing base (cf8fa35) to head (9c5fa0a).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
...Detection.Detectors.Tests/RustSbomDetectorTests.cs	96.8%	6 Missing and 23 partials ⚠️
...ponentDetection.Detectors/rust/RustSbomDetector.cs	92.8%	8 Missing and 14 partials ⚠️
...tDetection.Detectors/rust/Parsers/RustCliParser.cs	93.3%	11 Missing and 4 partials ⚠️
...Detection.Detectors/rust/Parsers/RustSbomParser.cs	92.0%	11 Missing and 3 partials ⚠️
...tion.Detectors/rust/Parsers/RustCargoLockParser.cs	97.2%	4 Missing ⚠️
...ntDetection.Detectors.Tests/RustSbomParserTests.cs	99.4%	0 Missing and 4 partials ⚠️
...ction.Detectors/rust/RustMetadataContextBuilder.cs	97.8%	2 Missing and 1 partial ⚠️
...ection.Detectors.Tests/RustCargoLockParserTests.cs	99.6%	0 Missing and 2 partials ⚠️
...mponentDetection.Detectors/rust/RustCliDetector.cs	96.7%	1 Missing ⚠️
...Detectors.Tests/RustMetadataContextBuilderTests.cs	99.7%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##            main   #1474     +/-   ##
=======================================
+ Coverage   89.8%   90.9%   +1.0%     
=======================================
  Files        413     423     +10     
  Lines      33117   37163   +4046     
  Branches    2047    2228    +181     
=======================================
+ Hits       29767   33798   +4031     
+ Misses      2935    2922     -13     
- Partials     415     443     +28     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

👋 Hi! It looks like you modified some files in the Detectors folder.
You may need to bump the detector versions if any of the following scenarios apply:

• The detector detects more or fewer components than before
• The detector generates different parent/child graph relationships than before
• The detector generates different devDependencies values than before

If none of the above scenarios apply, feel free to ignore this comment 🙂