Generated PURLs may contain invalid PURL types

[aried3r]

When generating an SPDX file for a Python project, the resulting PURL might be pkg:PIP/[email protected] using this GitHub Action which contains an invalid PURL type, "PIP". This seems to be because the GraphQL response contains uses the packageManager string directly and does not convert it to a valid PURL type, if it exists.

sbom-generator-action/src/index.js

Lines 81 to 85 in 337f599

	// Returns the PURL for the given dependency.
	function getPurl(dependency) {
	let version = getPackageVersion(dependency.requirements);
	return `pkg:${dependency.packageManager}/${dependency.packageName}@${version}`;
	}

The PURL type is case insensitive, but it's canonical form is lowercase, so perhaps calling .toLowerCase() on it might make sense as well.

Observed behavior

pkg:PIP/[email protected]

Expected behavior

pkg:pypi/[email protected]