Fix(UV): returning empty sbom when only and excluded groups fully overlap

[bd-spratikbharti]

Description

When detect.uv.dependency.groups.only and detect.uv.dependency.groups.excluded contained the same values, the effective group list became empty but the detector would ignore both settings and scan everything.

After the fix, It instead produces an empty BOM, since the user explicitly asked to scan only those groups but also excluded all of them — leaving nothing to scan.

[Copilot]

Pull request overview

This PR fixes UV dependency-group filtering so that when detect.uv.dependency.groups.only and detect.uv.dependency.groups.excluded fully overlap, Detect returns an intentionally empty SBOM (rather than ignoring both settings and scanning all dependencies).

Changes:

• Update UVBuildExtractor to detect when no effective only groups remain after exclusions and return a successful extraction with an empty dependency graph instead of executing uv tree.
• Adjust argument-building logic to signal the “no effective groups” scenario via Optional<List<String>>.
• Update unit tests to assert uv tree is not executed and that an empty BOM (single code location, zero root dependencies) is produced.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
detectable/src/main/java/com/blackduck/integration/detectable/detectables/uv/buildexe/UVBuildExtractor.java	Returns an empty BOM when only - excluded yields no groups, avoiding an unintended full dependency scan.
detectable/src/test/java/com/blackduck/integration/detectable/detectables/uv/unit/UVBuildExtractorTest.java	Updates the overlap test to validate no CLI execution and an empty dependency graph result.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.