Add demo option for both sample SBOMs

Author: osmankaankars

README.md

@@ -57,6 +57,7 @@ Demo options:
 svs demo --out reports --no-open
 svs demo --out reports --min-severity high
 svs demo --sbom path/to/your-sbom.json --out reports --summary-out svs-summary.md
+svs demo --both-samples --out reports
 ```
 
 ## Quick SBOM generation
@@ -87,7 +88,7 @@ npm sbom --sbom-format=cyclonedx --sbom-type=application > sbom.cdx.json
 - Use `svs summary --report <report.json>` or `svs summary --latest --dir reports` to generate the PR summary locally.
 - Use `svs open-report --dir reports` (or `--path report.html`) to open the latest HTML report.
 - Use `svs demo --out reports` to run a full local demo (scan + summary + open report).
-- Demo flags: `--no-open` to skip opening the browser, `--min-severity` to filter results, `--summary-out` to control the summary filename.
+- Demo flags: `--no-open` to skip opening the browser, `--min-severity` to filter results, `--summary-out` to control the summary filename, `--both-samples` to scan CycloneDX + SPDX samples.
 
 ## Community & Governance
 - Code of Conduct: `CODE_OF_CONDUCT.md`

src/svs/cli.py

@@ -264,6 +264,11 @@ def demo(
         readable=True,
         help="SBOM to scan (default: examples/sample-sbom.json). CycloneDX or SPDX JSON.",
     ),
+    both_samples: bool = typer.Option(
+        False,
+        "--both-samples",
+        help="Scan both bundled samples (CycloneDX + SPDX). Overrides --sbom.",
+    ),
     out: Path = typer.Option(
         Path("reports"),
         "--out",
@@ -290,22 +295,46 @@ def demo(
     ),
 ) -> None:
     """Run a local demo: scan, write a summary, and open the HTML report."""
-    scan(
-        sbom=sbom,
-        out=out,
-        json_output=True,
-        html_output=True,
-        sarif_output=True,
-        min_severity=min_severity,
-        timeout=30,
-        retries=3,
+    if both_samples and sbom != Path("examples/sample-sbom.json"):
+        raise typer.BadParameter("Use --both-samples without --sbom (or leave --sbom as default).")
+
+    sboms = (
+        [Path("examples/sample-sbom.json"), Path("examples/sample-spdx.json")]
+        if both_samples
+        else [sbom]
     )
 
-    latest_report = _latest_json_report(out)
-    report_data = json.loads(latest_report.read_text(encoding="utf-8"))
-    markdown = build_pr_summary(report_data)
-    summary_out.write_text(markdown, encoding="utf-8")
-    console.print(f"Summary written: {summary_out}")
+    generated_reports: list[Path] = []
+    for sbom_path in sboms:
+        scan(
+            sbom=sbom_path,
+            out=out,
+            json_output=True,
+            html_output=True,
+            sarif_output=True,
+            min_severity=min_severity,
+            timeout=30,
+            retries=3,
+        )
+        generated_reports.append(_latest_json_report(out))
+
+    if len(generated_reports) == 1:
+        report_data = json.loads(generated_reports[0].read_text(encoding="utf-8"))
+        markdown = build_pr_summary(report_data)
+        summary_out.write_text(markdown, encoding="utf-8")
+        console.print(f"Summary written: {summary_out}")
+    else:
+        summary_dir = summary_out.parent
+        base = summary_out.stem or "svs-summary"
+        suffix = summary_out.suffix or ".md"
+        for report_path in generated_reports:
+            report_data = json.loads(report_path.read_text(encoding="utf-8"))
+            sbom_path = report_data.get("metadata", {}).get("sbom", {}).get("path") or report_path.stem
+            sbom_name = Path(str(sbom_path)).stem
+            target = summary_dir / f"{base}-{sbom_name}{suffix}"
+            markdown = build_pr_summary(report_data)
+            target.write_text(markdown, encoding="utf-8")
+            console.print(f"Summary written: {target}")
 
     if open_browser:
         open_report(path=None, reports_dir=out)