Add filename annotation post-processing to LoadSBOMFromFile and LoadArtifactFromFile

[JeromySt]

• LoadSBOMFromFile and LoadArtifactFromFile now check if the descriptor has a title annotation
• If no title annotation exists, they add one using filepath.Base(filename)
• This ensures only the filename (not the full path) is used in the annotation
• LoadSBOMFromReader and LoadArtifactFromReader remain unchanged (no annotations added)
• Added comprehensive tests to verify the behavior
• Tests ensure annotations are only added by *FromFile functions, not *FromReader functions
• Maintains backward compatibility and doesn't overwrite existing annotations

[ridhoq]

➜  obom git:(users/jstatia/add_filename_annotation_postprocess) ./obom push -f /path/to/my/sbom/grafana-10.4.4.json ridhoq.azurecr.io/sboms/grafana:10.4.4
================================================================================
Document Name:         docker.io/grafana/grafana
Document Namespace:    https://anchore.com/syft/image/docker.io/grafana/grafana-f58f1584-bbb9-4388-90ff-515b2b0c6a13
SPDX Version:          SPDX-2.3
Creation Date:         2024-06-19T19:41:41Z
Creators:              Anchore, Inc
                       syft-1.1.1
Packages:              428
Files:                 1103
Digest:                sha256:228f2967a14c4df0a41b801b77274534921d043a815059cb24f3be1b30f44d91
================================================================================
Pushing SBOM to ridhoq.azurecr.io/sboms/grafana:10.4.4@sha256:228f2967a14c4df0a41b801b77274534921d043a815059cb24f3be1b30f44d91...
SBOM pushed to ridhoq.azurecr.io/sboms/grafana:10.4.4@sha256:cd98a5fd8b33702fa06ea7aa83f4bd7065c3f4c12e405c0b4d10b5898770d1ae
➜  obom git:(users/jstatia/add_filename_annotation_postprocess) oras manifest fetch ridhoq.azurecr.io/sboms/grafana:10.4.4 | jq .
{
  "schemaVersion": 2,
  "mediaType": "application/vnd.oci.image.manifest.v1+json",
  "artifactType": "application/spdx+json",
  "config": {
    "mediaType": "application/vnd.oci.empty.v1+json",
    "digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
    "size": 2,
    "data": "e30="
  },
  "layers": [
    {
      "mediaType": "application/spdx+json",
      "digest": "sha256:228f2967a14c4df0a41b801b77274534921d043a815059cb24f3be1b30f44d91",
      "size": 1775331,
      "annotations": {
        "org.opencontainers.image.title": "grafana-10.4.4.json"
      }
    }
  ],
  "annotations": {
    "org.opencontainers.image.created": "2025-07-22T02:04:49Z",
    "org.spdx.created": "2024-06-19T19:41:41Z",
    "org.spdx.creator": "Organization: Anchore, Inc, Tool: syft-1.1.1",
    "org.spdx.name": "docker.io/grafana/grafana",
    "org.spdx.namespace": "https://anchore.com/syft/image/docker.io/grafana/grafana-f58f1584-bbb9-4388-90ff-515b2b0c6a13",
    "org.spdx.version": "SPDX-2.3"
  }
}

Local testing looks good 👍🏽

[ridhoq]

Left a suggestion, but otherwise looks good. Thanks!

[ridhoq]

LGTM, thanks again!