Skip to content

Commit 17ac1bb

Browse files
jkowalleckjkowalleck
authored
initial implementation
 ## Responsibilities * Provide a general purpose _JavaScript_-implementation of [_CycloneDX_][CycloneDX] for _Node.js_ and _WebBrowsers_. * Provide typing for said implementation, so developers and dev-tools can rely on it. * Provide data models to work with _CycloneDX_. * Provide a JSON- and an XML-normalizer, that... * supports all shipped data models. * respects any injected [_CycloneDX_ Specification][CycloneDX-spec] and generates valid output according to it. * can be configured to generate reproducible/deterministic output. * can prepare data structures for JSON- and XML-serialization. * Serialization: * Provide a universal JSON-serializer for all target environments. * Provide an XML-serializer for all target environments. * Support the downstream implementation of custom XML-serializers tailored to specific environments by providing an abstract base class that takes care of normalization and BomRef-discrimination. This is done, because there is no universal XML support in _JavaScript_. ## Capabilities * Enums for the following use cases * `AttachmentEncoding` * `ComponentScope` * `ComponentType` * `ExternalReferenceType` * `HashAlgorithm` * Data models for the following use cases * `Attachment` * `Bom` * `BomRef`, `BomRefRepository` * `Component`, `ComponentRepository` * `ExternalReference`, `ExternalReferenceRepository` * `HashContent`, `Hash`, `HashRepository` * `LicenseExpression`, `NamedLicense`, `SpdxLicense`, `LicenseRepository` * `Metadata` * `OrganizationalContact`, `OrganizationalContactRepository` * `OrganizationalEntity` * `SWID` * `Tool`, `ToolRepository` * Factory, that can create data models from any license descriptor string * Implementation of the [_CycloneDX_ Specification][CycloneDX-spec] for the following versions: * `1.4` * `1.3` * `1.2` * Normalizers that convert data models to JSON structures * Normalizers that convert data models to XML structures * Universal serializer that converts `Bom` data models to JSON string * Serializer that converts `Bom` data models to XML string: * Specific to _WebBrowsers_: implementation utilizes browser-specific document generators and printers. * Specific to _Node.js_: implementation plugs/requires/utilizes one of the following *optional* libraries * [xmlbuilder2](https://www.npmjs.com/package/xmlbuilder2) * ... to be continued ... (pull requests are welcome)
1 parent b054288 commit 17ac1bb

File tree

142 files changed

+37367
-2
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

142 files changed

+37367
-2
lines changed

‎.editorconfig

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# EditorConfig is awesome: https://EditorConfig.org
2+
3+
root = true
4+
5+
[*]
6+
end_of_line = lf
7+
insert_final_newline = true
8+
9+
[*.md]
10+
# trailing white spaces are used for linebreaks in paragraphs.
11+
trim_trailing_whitespace = false
12+
13+
[*.{ts,js,cjs,mjs}]
14+
charset = utf-8
15+
end_of_line = lf
16+
indent_style = space
17+
indent_size = 2
18+
trim_trailing_whitespace = true
19+
insert_final_newline = true
20+
21+
[*.{json,cjson,cjsn}]
22+
charset = utf-8
23+
end_of_line = lf
24+
indent_style = space
25+
indent_size = 2
26+
trim_trailing_whitespace = true
27+
insert_final_newline = true
28+
29+
[*.html]
30+
charset = utf-8
31+
end_of_line = lf
32+
indent_style = space
33+
indent_size = 2
34+
trim_trailing_whitespace = true
35+
insert_final_newline = true

‎.eslintignore

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
/dist/**
2+
/dist.*/**
3+
/node_modules/**
4+
5+
!/src/**

‎.eslintrc.js

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
'use strict'
2+
/*!
3+
This file is part of CycloneDX JavaScript Library.
4+
5+
Licensed under the Apache License, Version 2.0 (the "License");
6+
you may not use this file except in compliance with the License.
7+
You may obtain a copy of the License at
8+
9+
http://www.apache.org/licenses/LICENSE-2.0
10+
11+
Unless required by applicable law or agreed to in writing, software
12+
distributed under the License is distributed on an "AS IS" BASIS,
13+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
See the License for the specific language governing permissions and
15+
limitations under the License.
16+
17+
SPDX-License-Identifier: Apache-2.0
18+
Copyright (c) OWASP Foundation. All Rights Reserved.
19+
*/
20+
21+
/**
22+
* @see {@link https://eslint.org/}
23+
* @type {import('eslint').Linter.Config}
24+
*/
25+
module.exports = {
26+
root: true,
27+
// see https://github.com/standard/ts-standard
28+
extends: 'standard-with-typescript',
29+
parserOptions: {
30+
project: './tsconfig.json'
31+
},
32+
env: {
33+
node: true,
34+
browser: true
35+
}
36+
}

‎.gitattributes

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
2+
tsconfig.json linguist-language=JSON-with-Comments
3+
tsconfig.*.json linguist-language=JSON-with-Comments

‎.github/dependabot.yml

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
2+
3+
version: 2
4+
updates:
5+
- package-ecosystem: "npm"
6+
directory: "/"
7+
schedule:
8+
interval: 'weekly'
9+
day: 'saturday'
10+
11+
- package-ecosystem: "github-actions"
12+
directory: "/"
13+
schedule:
14+
interval: 'weekly'
15+
day: 'saturday'

‎.github/workflows/nodejs.yml

+108
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
# docs: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions
2+
3+
name: Node CI
4+
5+
on:
6+
push:
7+
branches: [ master ]
8+
pull_request:
9+
workflow_dispatch:
10+
11+
12+
env:
13+
NODE_ACTIVE_LTS: "16" # see https://nodejs.org/en/about/releases/
14+
15+
jobs:
16+
build:
17+
name: build ${{ matrix.target }}
18+
runs-on: "ubuntu-latest"
19+
timeout-minutes: 30
20+
strategy:
21+
fail-fast: false
22+
matrix:
23+
target:
24+
- node
25+
- web
26+
steps:
27+
- name: Checkout
28+
# see https://github.com/actions/checkout
29+
uses: actions/checkout@v3
30+
- name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }}
31+
# see https://github.com/actions/setup-node
32+
uses: actions/setup-node@v3
33+
with:
34+
node-version: ${{ env.NODE_ACTIVE_LTS }}
35+
cache: "npm"
36+
cache-dependency-path: "**/package-lock.json"
37+
- name: setup project
38+
run: npm ci --ignore-scripts
39+
- name: build for ${{ matrix.target }}
40+
run: npm run build:${{ matrix.target }}
41+
- name: artifact build result
42+
# see https://github.com/actions/upload-artifact
43+
uses: actions/upload-artifact@v3
44+
with:
45+
name: dist.${{ matrix.target }}
46+
path: dist.${{ matrix.target }}
47+
if-no-files-found: error
48+
test-standard:
49+
name: test standard
50+
runs-on: ubuntu-latest
51+
timeout-minutes: 30
52+
steps:
53+
- name: Checkout
54+
# see https://github.com/actions/checkout
55+
uses: actions/checkout@v3
56+
- name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }}
57+
# see https://github.com/actions/setup-node
58+
uses: actions/setup-node@v3
59+
with:
60+
node-version: ${{ env.NODE_ACTIVE_LTS }}
61+
cache: "npm"
62+
cache-dependency-path: "**/package-lock.json"
63+
- name: setup project
64+
run: npm ci --ignore-scripts
65+
- name: test
66+
run: npm run test:standard
67+
test-node:
68+
needs: [ 'build' ]
69+
name: test node (${{ matrix.node-version }}, ${{ matrix.os }})
70+
runs-on: ${{ matrix.os }}
71+
strategy:
72+
fail-fast: false
73+
matrix:
74+
node-version:
75+
# action based on https://github.com/actions/node-versions/releases
76+
# see also: https://nodejs.org/en/about/releases/
77+
- "18" # current
78+
- "16" # active LTS
79+
- "14"
80+
- "14.0.0" # lowest supported
81+
os:
82+
- ubuntu-latest
83+
- macos-latest
84+
- windows-latest
85+
timeout-minutes: 30
86+
steps:
87+
- name: Checkout
88+
# see https://github.com/actions/checkout
89+
uses: actions/checkout@v3
90+
- name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }}
91+
# see https://github.com/actions/setup-node
92+
uses: actions/setup-node@v3
93+
with:
94+
node-version: ${{ matrix.node-version }}
95+
cache: "npm"
96+
cache-dependency-path: "**/package-lock.json"
97+
- name: setup project
98+
run: npm ci --ignore-scripts
99+
- name: fetch build artifact
100+
# see https://github.com/actions/download-artifact
101+
uses: actions/download-artifact@v3
102+
with:
103+
name: dist.node
104+
path: dist.node
105+
- name: test
106+
run: npm run test:node
107+
# test-web:
108+
# TODO via https://github.com/CycloneDX/cyclonedx-javascript-library/issues/51

‎.github/workflows/release.yml

+104
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
# docs: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions
2+
3+
name: Release
4+
5+
on:
6+
workflow_dispatch:
7+
inputs:
8+
newversion:
9+
# is param from `npm version`. therefore the description should reference all the options from there
10+
description: 'one of: [<newversion> | major | minor | patch | premajor | preminor | prepatch | prerelease | from-git]'
11+
required: true
12+
commitMessage:
13+
description: 'Release/commit message (%s will be replaced with the resulting version number)'
14+
default: '%s'
15+
required: true
16+
17+
env:
18+
REPORTS_DIR: CI_reports
19+
NODE_ACTIVE_LTS: "16"
20+
21+
jobs:
22+
bump:
23+
name: bump and tag release
24+
concurrency: release-bump
25+
outputs:
26+
version: ${{ steps.bump.outputs.version }}
27+
version_plain: ${{ steps.bump.outputs.version_plain }}
28+
runs-on: ubuntu-latest
29+
timeout-minutes: 30
30+
steps:
31+
- name: Checkout code
32+
# see https://github.com/actions/checkout
33+
uses: actions/checkout@v3
34+
- name: Configure Git
35+
# needed for push back of changes
36+
run: |
37+
git config --local user.email "${GITHUB_ACTOR}@users.noreply.github.com"
38+
git config --local user.name "${GITHUB_ACTOR}"
39+
- name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }}
40+
# see https://github.com/actions/setup-node
41+
uses: actions/setup-node@v3
42+
with:
43+
node-version: ${{ env.NODE_ACTIVE_LTS }}
44+
## ! no npm build at the moment
45+
- name: bump VERSION
46+
id: bump
47+
run: |
48+
VERSION="$(npm version "$NPMV_NEWVERSION" --message "$NPMV_MESSAGE")"
49+
echo "::debug::new version = $VERSION"
50+
VERSION_PLAIN="${VERSION:1}" # remove 'v' prefix
51+
echo "::debug::plain version = $VERSION_PLAIN"
52+
echo "::set-output name=version::$VERSION"
53+
echo "::set-output name=version_plain::$VERSION_PLAIN"
54+
env:
55+
NPMV_NEWVERSION: ${{ github.event.inputs.newversion }}
56+
NPMV_MESSAGE: ${{ github.event.inputs.commitMessage }}
57+
- name: git push back
58+
run: git push --follow-tags
59+
publish-NPMJS:
60+
needs:
61+
- "bump"
62+
name: NPMJS - publish
63+
runs-on: ubuntu-latest
64+
timeout-minutes: 30
65+
steps:
66+
- name: Checkout code
67+
# see https://github.com/actions/checkout
68+
uses: actions/checkout@v3
69+
with:
70+
ref: ${{ needs.bump.outputs.version }}
71+
- name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }}
72+
# see https://github.com/actions/setup-node
73+
uses: actions/setup-node@v3
74+
with:
75+
node-version: ${{ env.NODE_ACTIVE_LTS }}
76+
- name: install build tools
77+
run: npm ci --ignore-scripts
78+
# no explicit npm build. if a build is required, it should be configured as prepublish/prepublishOnly script of npm.
79+
- name: publish to NPMJS
80+
run: |
81+
npm config set "//registry.npmjs.org/:_authToken=$NPMJS_AUTH_TOKEN"
82+
npm publish --access public
83+
env:
84+
NPMJS_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
85+
release-GH:
86+
needs:
87+
- "bump"
88+
- "publish-NPMJS"
89+
name: GitHub - release
90+
runs-on: ubuntu-latest
91+
timeout-minutes: 30
92+
env:
93+
ASSETS_DIR: release_assets
94+
steps:
95+
- name: Create Release
96+
id: release
97+
# see https://github.com/softprops/action-gh-release
98+
uses: softprops/action-gh-release@v1
99+
env:
100+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
101+
with:
102+
tag_name: ${{ needs.bump.outputs.version }}
103+
name: ${{ needs.bump.outputs.version_plain }}
104+
prerelease: ${{ startsWith(github.event.inputs.newversion, 'pre') }}

0 commit comments

Comments
 (0)