Merge branch 'master' of https://github.com/CycloneDX/cyclonedx-go into bugfix/alistair-mclean-add-missing-fields

Author: Alistair McLean

.github/workflows/ci.yml

@@ -17,9 +17,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout Repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.2.2
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
     - name: Check license headers
-      uses: apache/skywalking-eyes@5c5b974209f0de5d905f37deb69369068ebfc15c # tag=v0.7.0
+      uses: apache/skywalking-eyes@61275cc80d0798a405cb070f7d3a8aaf7cf2c2c1 # tag=v0.8.0
       with:
         config: .licenserc.yml
 
@@ -29,9 +29,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout Repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.2.2
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
     - name: Setup Go
-      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # tag=v5.5.0
+      uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # tag=v6.2.0
       with:
         go-version: "1.22"
         check-latest: true
@@ -54,11 +54,11 @@ jobs:
         - "1.22"
     steps:
     - name: Setup Go
-      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # tag=v5.5.0
+      uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # tag=v6.2.0
       with:
         go-version: ${{ matrix.go }}
         check-latest: true
     - name: Checkout Repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.2.2
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
     - name: Test
       run: make test

.github/workflows/goreleaser.yml

@@ -16,11 +16,11 @@ jobs:
       contents: write
     steps:
     - name: Checkout Repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.2.2
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
       with:
         fetch-depth: 0
     - name: Setup Go
-      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # tag=v5.5.0
+      uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # tag=v6.2.0
       with:
         go-version: "1.22"
         check-latest: true
@@ -29,7 +29,7 @@ jobs:
       with:
         version: v1
     - name: Run GoReleaser
-      uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # tag=v6.3.0
+      uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # tag=v6.4.0
       with:
         version: latest
         args: release --clean

Dockerfile.gitpod

@@ -15,4 +15,4 @@
 # SPDX-License-Identifier: Apache-2.0
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
-FROM gitpod/workspace-go:latest@sha256:8985eb7cf5f155eb83f07294e9bd1a7e8066f969711f51a166ef60d17d409eb0
+FROM gitpod/workspace-go:latest@sha256:08a7c684831db627751aa03b78179456c11497dcfa6de8d7d46a9b119fc0123a

convert.go

@@ -165,6 +165,7 @@ func componentConverter(specVersion SpecVersion) func(*Component) {
 			c.OmniborID = nil
 			c.Manufacturer = nil
 			c.Authors = nil
+			c.Tags = nil
 		}
 
 		if !specVersion.supportsComponentType(c.Type) {

convert_test.go

@@ -269,9 +269,30 @@ func Test_convertTrustZone(t *testing.T) {
 				TrustZone: "trusted",
 			},
 		}
+		bom.convert(SpecVersion1_5)
+		assert.Equal(t, "trusted", (*bom.Services)[0].TrustZone)
+	})
+}
+
+func Test_convertTags(t *testing.T) {
+	t.Run("spec 1.5 and lower", func(t *testing.T) {
+		bom := NewBOM()
+		bom.Metadata = &Metadata{
+			Component: &Component{
+				Name: "test",
+				Tags: &[]string{"tag1", "tag2"},
+			},
+		}
+		bom.Components = &[]Component{
+			{
+				Name: "foo",
+				Tags: &[]string{"tag3", "tag4"},
+			},
+		}
 
 		bom.convert(SpecVersion1_5)
 
-		assert.Equal(t, "trusted", (*bom.Services)[0].TrustZone)
+		assert.Nil(t, bom.Metadata.Component.Tags)
+		assert.Nil(t, (*bom.Components)[0].Tags)
 	})
 }

go.mod

@@ -4,7 +4,7 @@ go 1.20
 
 require (
 	github.com/bradleyjkemp/cupaloy/v2 v2.8.0
-	github.com/stretchr/testify v1.10.0
+	github.com/stretchr/testify v1.11.1
 	github.com/terminalstatic/go-xsd-validate v0.1.6
 	github.com/xeipuuv/gojsonschema v1.2.0
 )

go.sum

@@ -9,8 +9,8 @@ github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/terminalstatic/go-xsd-validate v0.1.6 h1:TenYeQ3eY631qNi1/cTmLH/s2slHPRKTTHT+XSHkepo=
 github.com/terminalstatic/go-xsd-validate v0.1.6/go.mod h1:18lsvYFofBflqCrvo1umpABZ99+GneNTw2kEEc8UPJw=
 github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f h1:J9EGpcZtP0E/raorCMxlFGSTBrsSlaDGf3jU/qvAE2c=