Feat/005 cyclonedx SBOM release - #10
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Generate two CycloneDX 1.7 documents into sbom/ (gitignored, out of the npm tarball): the authoritative runtime SBOM (sbom.cdx.json), enriched with peerDependencies resolved from the lockfile and marked cdx:npm:peer, and a build-toolchain SBOM (sbom-dev.cdx.json). verify-sbom.mjs validates both against the CycloneDX 1.7 schema and checks consistency with package.json. Adds @cyclonedx/cyclonedx-library plus its required ajv optional peers as devDependencies (used only for schema validation, never in the publish job). Refs spec 005-cyclonedx-sbom-release. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Fixture-based unit tests for enrichWithPeers, sortBom, verifyStructure, and the file/schema helpers — every scenario in behaviors.md, with no pnpm sbom subprocess so the local test loop stays fast. Broadens the vitest include to scripts/**/*.test.mjs. Refs spec 005-cyclonedx-sbom-release. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
CI generates both SBOMs and runs verification on every pull request and push to main, turning the PR red if a dependency change breaks the SBOM. release.yml generates and verifies before pnpm stage publish (no release ships without a valid SBOM) and attaches sbom.cdx.json (authoritative) and sbom-dev.cdx.json to the draft release, naming the authoritative document in the notes. Refs spec 005-cyclonedx-sbom-release. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
README gains an SBOM section: the two release assets, that sbom.cdx.json is authoritative, how to obtain one per version, and the peer-version caveat. Corrects two design claims found inaccurate against the real `pnpm sbom` output: the dev document scopes the root to devDependencies (not dependencies + devDependencies), and resolves the open question — the cyclonedx-library validates 1.7 given its ajv optional peers. Refs spec 005-cyclonedx-sbom-release. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
pnpm add had alphabetized all three dependency blocks; restore the original order so the diff shows only the intended additions (the two sbom scripts and the four SBOM-validator devDependencies). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces full support for generating and verifying Software Bill of Materials (SBOM) in the CycloneDX format for every release and pull request. It ensures that all dependency information is transparent and validated before publishing, addressing compliance requirements such as the Cyber Resilience Act. The SBOM process is now integrated into CI/CD workflows, and relevant documentation and dependencies have been updated accordingly.
SBOM generation and verification integration:
pnpm run sbomandpnpm run sbom:verifyscripts topackage.jsonfor generating and validating CycloneDX 1.7 SBOMs, along with all required dependencies (@cyclonedx/cyclonedx-library,ajv,ajv-formats,ajv-formats-draft2019). ([[1]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519R44-R45),[[2]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519L83-R89),[[3]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-32824c984905bb02bc7ffcef96a77addd1f1602cff71a11fbbfdd7f53ee026bbR48-R50),[[4]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-32824c984905bb02bc7ffcef96a77addd1f1602cff71a11fbbfdd7f53ee026bbR69-R77),[[5]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-32824c984905bb02bc7ffcef96a77addd1f1602cff71a11fbbfdd7f53ee026bbR259-R285),[[6]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-32824c984905bb02bc7ffcef96a77addd1f1602cff71a11fbbfdd7f53ee026bbR1710-R1728))pnpm-lock.yamlto include new dependencies required for SBOM tooling and validation. ([[1]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-32824c984905bb02bc7ffcef96a77addd1f1602cff71a11fbbfdd7f53ee026bbR1820-R1822),[[2]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-32824c984905bb02bc7ffcef96a77addd1f1602cff71a11fbbfdd7f53ee026bbR1879-R1881),[[3]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-32824c984905bb02bc7ffcef96a77addd1f1602cff71a11fbbfdd7f53ee026bbR1934),[[4]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-32824c984905bb02bc7ffcef96a77addd1f1602cff71a11fbbfdd7f53ee026bbR1969-R1971),[[5]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-32824c984905bb02bc7ffcef96a77addd1f1602cff71a11fbbfdd7f53ee026bbR1985-R1987),[[6]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-32824c984905bb02bc7ffcef96a77addd1f1602cff71a11fbbfdd7f53ee026bbR2117-R2119),[[7]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-32824c984905bb02bc7ffcef96a77addd1f1602cff71a11fbbfdd7f53ee026bbR2190-R2192),[[8]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-32824c984905bb02bc7ffcef96a77addd1f1602cff71a11fbbfdd7f53ee026bbR2204-R2207),[[9]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-32824c984905bb02bc7ffcef96a77addd1f1602cff71a11fbbfdd7f53ee026bbR2335-R2341),[[10]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-32824c984905bb02bc7ffcef96a77addd1f1602cff71a11fbbfdd7f53ee026bbR2398-R2412),[[11]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-32824c984905bb02bc7ffcef96a77addd1f1602cff71a11fbbfdd7f53ee026bbR2434-R2436),[[12]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-32824c984905bb02bc7ffcef96a77addd1f1602cff71a11fbbfdd7f53ee026bbR2457-R2460),[[13]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-32824c984905bb02bc7ffcef96a77addd1f1602cff71a11fbbfdd7f53ee026bbR2904-R2909),[[14]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-32824c984905bb02bc7ffcef96a77addd1f1602cff71a11fbbfdd7f53ee026bbR4334-R4359),[[15]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-32824c984905bb02bc7ffcef96a77addd1f1602cff71a11fbbfdd7f53ee026bbR4438-R4439),[[16]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-32824c984905bb02bc7ffcef96a77addd1f1602cff71a11fbbfdd7f53ee026bbR4482-R4483),[[17]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-32824c984905bb02bc7ffcef96a77addd1f1602cff71a11fbbfdd7f53ee026bbR4603-R4604),[[18]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-32824c984905bb02bc7ffcef96a77addd1f1602cff71a11fbbfdd7f53ee026bbR4613-R4614))CI/CD workflow enhancements:
.github/workflows/ci.ymland.github/workflows/release.ymlto generate and verify SBOMs on every pull request and before publishing a release, ensuring that any dependency change breaking the SBOM fails the build or release process. ([[1]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-b803fcb7f17ed9235f1e5cb1fcd2f5d3b2838429d4368ae4c57ce4436577f03fR27-R33),[[2]](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-87db21a973eed4fef5f32b267aa60fcee5cbdf03c67fafdc2a9b553bb0b15f34R56-R63))[.github/workflows/release.ymlL65-R82](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-87db21a973eed4fef5f32b267aa60fcee5cbdf03c67fafdc2a9b553bb0b15f34L65-R82))Documentation updates:
README.mdexplaining the SBOM process, the difference between runtime and dev SBOMs, and how peer dependencies are represented. ([README.mdR41-R67](https://github.com/OpenElementsLabs/open-elements-ui/pull/10/files#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5R41-R67))