CycloneDX / CycloneDX/bom-examples
chore: make sure all examples are schema-valid
- Dominant language
- No language data
- Stars
- 238
- Forks
- 83
- PR merge metrics
- No merged PRs in 30d
Description
## problem
we have a lot of documents here, and while they claim to stick to the specs and authoritative guides, this needs to checked/reviewed manually.
what we might automate is:
detect which schema version the respective examples intend to comply to, and check that they actually do this.
## possible solution
the following process it intended to run on each change of the default branch, as well as on every pull-request:
1. rename all CycloneDX example files to `*.cdx.{json,xml}` -- so they are distinguished from other files in the example folders
2. traverse over all example files - `*.cdx.{json,xml}`
1. detect the schema
- JSON: `$.schemaVersion` starts with main version - like `1.2.xyz` -> `CycloneDX v1.2`
- XML: see the actual XML schema of the document root node
2. validate against the respective schema
### Implementation details:
- unclear whether to use one/many of our existing CycloneDX libraries, or to implement a standalone-solution in here.
#### pro/cons of using existing library
```text
+ easy to implement, as most work was done already
+ maintenance can be driven by dependabot/renovate
- rely on the library being up-to-date
```
### pro/cons of standalone
```text
+ independent
- initial development might be slow
- needs manual maintenance
```
Contributor guide
Assessment
This issue has not been assessed yet.