CycloneDX / CycloneDX/bom-examples

chore: make sure all examples are schema-valid

Open
#51 0 comments 0 reactions 1 assignee Claimed by @jkowalleck View on GitHub
chore
Dominant language
No language data
Stars
238
Forks
83
PR merge metrics
No merged PRs in 30d

Description

## problem

we have a lot of documents here, and while they claim to stick to the specs and authoritative guides, this needs to checked/reviewed manually.

what we might automate is:
detect which schema version the respective examples intend to comply to, and check that they actually do this.

## possible solution

the following process it intended to run on each change of the default branch, as well as on every pull-request:

1. rename all CycloneDX example files to `*.cdx.{json,xml}` -- so they are distinguished from other files in the example folders
2. traverse over all example files - `*.cdx.{json,xml}`
1. detect the schema
- JSON: `$.schemaVersion` starts with main version - like `1.2.xyz` -> `CycloneDX v1.2`
- XML: see the actual XML schema of the document root node
2. validate against the respective schema

### Implementation details:

- unclear whether to use one/many of our existing CycloneDX libraries, or to implement a standalone-solution in here.

#### pro/cons of using existing library
```text
+ easy to implement, as most work was done already
+ maintenance can be driven by dependabot/renovate
- rely on the library being up-to-date
```

### pro/cons of standalone
```text
+ independent
- initial development might be slow
- needs manual maintenance
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.