[WIP] CycloneDX v2.0 Specification

.github/dependabot.yml

@@ -25,7 +25,25 @@ updates:
       prefix: 'chore'   ## prefix maximum string length of 15
       include: 'scope'
     open-pull-requests-limit: 999
-  - package-ecosystem: 'maven'
+  # region docs
+  - # docs v1
+    package-ecosystem: 'pip'
+    directories:
+      - '/docgen/*'
+    schedule:
+      interval: 'weekly'
+      day: 'saturday'
+    cooldown:
+      default-days: 7
+    labels: [ 'dependencies' ]
+    commit-message:
+      prefix: 'chore'   ## prefix maximum string length of 15
+      include: 'scope'
+    open-pull-requests-limit: 999
+  # endregion docs
+  # region tools
+  - # tools Java
+    package-ecosystem: 'maven'
     directory: '/tools'
     schedule:
       interval: 'weekly'
@@ -37,8 +55,43 @@ updates:
       prefix: 'chore'   ## prefix maximum string length of 15
       include: 'scope'
     open-pull-requests-limit: 999
-  - package-ecosystem: 'composer'
-    directory: '/tools/src/test/php'
+  - # tools JS: bundler
+    package-ecosystem: 'npm'
+    directory: '/tools/src/main/js/bundler'
+    schedule:
+      interval: 'weekly'
+      day: 'saturday'
+    cooldown:
+      default-days: 7
+    labels: [ 'dependencies' ]
+    commit-message:
+      prefix: 'chore'   ## prefix maximum string length of 15
+      include: 'scope'
+    open-pull-requests-limit: 999
+    groups:
+      all-deps:  # we have a lockfile - we want all deps updates in one PR
+        applies-to: 'version-updates'
+        patterns: [ '*' ]
+  - # tools JS: linter
+    package-ecosystem: 'npm'
+    directory: '/tools/src/main/js/linter'
+    schedule:
+      interval: 'weekly'
+      day: 'saturday'
+    cooldown:
+      default-days: 7
+    labels: [ 'dependencies' ]
+    commit-message:
+      prefix: 'chore'   ## prefix maximum string length of 15
+      include: 'scope'
+    open-pull-requests-limit: 999
+    groups:
+      all-deps:   # we have a lockfile - we want all deps updates in one PR
+        applies-to: 'version-updates'
+        patterns: [ '*' ]
+  - # tools python
+    package-ecosystem: 'pip'
+    directory: '/tools/src/main/python'
     schedule:
       interval: 'weekly'
       day: 'saturday'
@@ -49,8 +102,10 @@ updates:
       prefix: 'chore'   ## prefix maximum string length of 15
       include: 'scope'
     open-pull-requests-limit: 999
-  - package-ecosystem: 'npm'
-    directory: '/tools/src/test/js'
+  - # tests PHP
+    package-ecosystem: 'composer'
+    directories:
+      - '/tools/src/test/php/*'
     schedule:
       interval: 'weekly'
       day: 'saturday'
@@ -61,8 +116,10 @@ updates:
       prefix: 'chore'   ## prefix maximum string length of 15
       include: 'scope'
     open-pull-requests-limit: 999
-  - package-ecosystem: 'pip'
-    directory: '/docgen/json'
+  - # tests JS
+    package-ecosystem: 'npm'
+    directories:
+      - '/tools/src/test/js/*'
     schedule:
       interval: 'weekly'
       day: 'saturday'
@@ -73,3 +130,4 @@ updates:
       prefix: 'chore'   ## prefix maximum string length of 15
       include: 'scope'
     open-pull-requests-limit: 999
+  # endregion tools

.github/workflows/build_docs.yml → .github/workflows/build_1.x_docs.yml

@@ -1,4 +1,4 @@
-name: Build Docs
+name: Build CDX-1.x Docs
 
 on:
   push:
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     defaults:
       run:
-        working-directory: docgen/xml
+        working-directory: docgen/schema-v1/xml
     steps:
     - name: Checkout
       # see https://github.com/actions/checkout
@@ -38,13 +38,13 @@ jobs:
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: XML-Schema-documentation
-        path: docgen/xml/docs
+        path: docgen/schema-v1/xml/docs
         if-no-files-found: error
   docs_json:
     runs-on: ubuntu-latest
     defaults:
       run:
-        working-directory: docgen/json
+        working-directory: docgen/schema-v1/json
     steps:
     - name: Checkout
       # see https://github.com/actions/checkout
@@ -64,13 +64,13 @@ jobs:
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: JSON-Schema-documentation
-        path: docgen/json/docs
+        path: docgen/schema-v1/json/docs
         if-no-files-found: error
   docs_proto:
     runs-on: ubuntu-latest
     defaults:
       run:
-        working-directory: docgen/proto
+        working-directory: docgen/schema-v1/proto
     steps:
     - name: Checkout
       # see https://github.com/actions/checkout
@@ -84,5 +84,5 @@ jobs:
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: PROTO-Schema-documentation
-        path: docgen/proto/docs
+        path: docgen/schema-v1/proto/docs
         if-no-files-found: error

.github/workflows/bundle_2.0_schemas.yml

@@ -6,10 +6,14 @@ on:
       - 2.0-dev
       - 2.0-dev-threatmodeling
     paths:
+      - '.github/workflows/bundle_2.0_schemas.yml' # self
       - 'schema/2.0/**/*.schema.json'
-      - 'tools/src/main/js/bundle-schemas.js'
+      - 'tools/src/main/js/bundler/**'
   workflow_dispatch:  # Allows manual trigger
 
+# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions: {}
+
 jobs:
   bundle-schemas:
     runs-on: ubuntu-latest
@@ -31,32 +35,33 @@ jobs:
           node-version: '20'
 
       - name: Install dependencies
-        working-directory: tools/src/main/js
+        working-directory: tools/src/main/js/bundler
         run: npm install
 
       - name: Bundle schemas
-        working-directory: tools/src/main/js
-        run: |
-          node bundle-schemas.js \
-            ../../../../schema/2.0/model \
-            ../../../../schema/2.0/cyclonedx-2.0.schema.json
+        working-directory: tools/src/main/js/bundler
+        run: >-
+          node bundle-schemas.js
+          ../../../../../schema/2.0/model
+          ../../../../../schema/2.0/cyclonedx-2.0.schema.json
 
       - name: Check for changes and commit
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           BUNDLED_FILE="schema/2.0/cyclonedx-2.0-bundled.schema.json"
+          MINIFIED_FILE="schema/2.0/cyclonedx-2.0-bundled.min.schema.json"
 
-          # Add the file (works for both new and modified files)
-          git add "$BUNDLED_FILE"
+          # Add both files (works for both new and modified files)
+          git add "$BUNDLED_FILE" "$MINIFIED_FILE"
 
           # Check if there are staged changes
           if git diff --staged --quiet; then
-            echo "No changes to bundled schema"
+            echo "No changes to bundled schemas"
           else
             echo "Committing bundled schema changes"
             git config --local user.email "github-actions[bot]@users.noreply.github.com"
             git config --local user.name "github-actions[bot]"
-            git commit -m "chore: update bundled schema [skip ci]"
+            git commit -m "chore: update bundled schemas [skip ci]"
             git push "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
           fi

.github/workflows/test_java.yml → .github/workflows/test_1.x_java.yml

@@ -1,4 +1,4 @@
-name: CT Java
+name: CT CDX-1.x Java
 
 on:
   push:
@@ -34,4 +34,4 @@ jobs:
         distribution: 'zulu'
         java-package: jdk
     - name: test with Maven
-      run: mvn clean test
+      run: mvn clean test -Pschema-v1-tests

.github/workflows/test_js.yml → .github/workflows/test_1.x_js.yml

@@ -1,6 +1,6 @@
 # docs: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions
 
-name: CT JavaScript
+name: CT CDX-1.x JavaScript
 
 on:
   push:
@@ -14,7 +14,7 @@ concurrency:
 
 defaults:
   run:
-    working-directory: tools/src/test/js
+    working-directory: tools/src/test/js/schema-v1
 
 # https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
 permissions: {}

.github/workflows/test_php.yml → .github/workflows/test_1.x_php.yml

@@ -1,6 +1,6 @@
 # docs: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions
 
-name: CT PHP
+name: CT CDX-1.x PHP
 
 on:
   push:
@@ -14,7 +14,7 @@ concurrency:
 
 defaults:
   run:
-    working-directory: tools/src/test/php
+    working-directory: tools/src/test/php/schema-v1
 
 # https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
 permissions: {}

.github/workflows/test_proto.yml → .github/workflows/test_1.x_proto.yml

@@ -1,6 +1,6 @@
 # docs: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions
 
-name: CT ProtoBuf
+name: CT CDX-1.x ProtoBuf
 
 on:
   push:
@@ -14,7 +14,7 @@ concurrency:
 
 defaults:
   run:
-    working-directory: tools/src/test/proto
+    working-directory: tools/src/test/proto/schema-v1
 
 # https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
 permissions: {}

.github/workflows/test_2.x_java.yml

@@ -0,0 +1,37 @@
+name: CT CDX-2.x Java
+
+on:
+  push:
+    branches: ['master', 'main']
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    working-directory: tools
+
+# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions: {}
+
+jobs:
+  test_java:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      # see https://github.com/actions/checkout
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
+    - name: Set up JDK
+      # see https://github.com/actions/setup-java
+      uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+      with:
+        java-version: '8'
+        distribution: 'zulu'
+        java-package: jdk
+    - name: test with Maven
+      run: mvn clean test -Pschema-v2-tests

.github/workflows/test_2.x_js.yml

@@ -0,0 +1,50 @@
+# docs: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions
+
+name: CT CDX-2.x JavaScript
+
+on:
+  push:
+    branches: ['master', 'main']
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    working-directory: tools/src/test/js/schema-v2
+
+# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions: {}
+
+jobs:
+  test_js:
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        # see https://github.com/actions/checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Setup Node.js
+        # see https://github.com/actions/setup-node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        with:
+          node-version: '26.x'
+          package-manager-cache: false
+      - name: Install Dependencies
+        run: npm install
+      - name: Run test
+        env:
+          VALIDATE_BUNDLED: >-
+            ${{ github.ref == 'refs/heads/master'
+             || github.ref == 'refs/heads/main'
+             || github.ref == 'refs/heads/2.0-dev'
+             || (  github.event_name == 'pull_request' 
+                && github.base_ref == 'master'
+                )
+            }}
+        run: npm test