依赖图与SBOM一致性门禁治理（Graph-对齐-阻断）最佳实践

实现示例type Component = { name: string; version: string }

type Node = { name: string; version: string }

function semverLike(v: string): boolean { return /^(\d+\.\d+\.\d+)(?:[-A-Za-z0-9_.]+)?$/.test(v) }

function align(graph: Node[], sbom: Component[]): { ok: boolean; missing: string[]; mismatched: string[] } {

const sb = new Map<string, string>()

for (const c of sbom) if (c.name && semverLike(c.version)) sb.set(c.name, c.version)

const missing: string[] = []

const mismatched: string[] = []

for (const n of graph) {

const v = sb.get(n.name)

if (!v) missing.push(n.name)

else if (v !== n.version) mismatched.push(`${n.name}:${n.version}->${v}`)

}

return { ok: missing.length === 0 && mismatched.length === 0, missing, mismatched }

}

审计与CI门禁记录缺失与不一致清单；不通过直接阻断并提示修复路径。SBOM与依赖图变更需审批与归档。