✨ Core v1.7 Enablement #37

pboling · 2025-10-26T00:07:25Z

#	📍 NOTE	What
1️⃣	#38 is first	Modernize gem structure
2️⃣	Then see #37 next	Upgrade to v1.7 spec	<=== You are here
3️⃣	Then see #39	Add --validate feature
4️⃣	Then see #40	Add --include-metadata feature

Add spec version selection end-to-end with a new --spec-version flag (default 1.7).
Update JSON and XML outputs to honor the selected spec version.
Update fixtures, help text, tests, and docs.

NOTE:

Additional fields like bom-ref, publisher, metadata.tools, dependencies are optional and can be added incrementally.

Files:

lib/bom_helpers.rb:
- Added SUPPORTED_SPEC_VERSIONS, cyclonedx_xml_namespace helper. build_bom now accepts spec_version and routes to:
  - build_json_bom(gems, spec_version) sets specVersion to the provided version.
  - build_bom_xml(gems, spec_version) sets xmlns to http://cyclonedx.org/schema/bom/.
lib/bom_builder.rb:
- Added --spec-version with validation; default is 1.7.
- Pass @spec_version into build_bom(@gems, @bom_output_format, @spec_version).

Copilot

Pull Request Overview

This PR enables CycloneDX specification version selection (default 1.7) across the BOM generation pipeline. Users can now specify their desired spec version via a new --spec-version flag, and the output will conform to that version's schema.

Added --spec-version flag with validation (supports 1.1–1.7, defaults to 1.7)
Updated JSON and XML BOM generation to use the selected spec version
Refactored path handling to use absolute paths and improved error message formatting

Reviewed Changes

Copilot reviewed 12 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
lib/bom_helpers.rb	Added `SUPPORTED_SPEC_VERSIONS`, `cyclonedx_xml_namespace()` helper, and propagated `spec_version` to JSON/XML builders
lib/bom_builder.rb	Added `--spec-version` option parsing, validation, and normalized project path handling; improved backtrace formatting
spec/bom_helpers_spec.rb	Added tests verifying spec version is correctly set in JSON and XML outputs
spec/spec_helper.rb	Added `require 'ostruct'` for test utilities
features/step_definitions/json_bom_matching.rb	Added `.rstrip` to normalize trailing whitespace in JSON comparisons
features/help.feature	Updated help text to document new `--spec-version` option
features/json_format.feature	Removed trailing blank line
features/fixtures/simple/bom.xml.expected	Updated fixture to expect CycloneDX 1.7 namespace
features/fixtures/simple/bom.json.expected	Updated fixture to expect `specVersion: 1.7`
features/fixtures/simple/Gemfile	Pinned gem versions for deterministic test output
cyclonedx-ruby.gemspec	Updated cucumber and aruba dev dependencies
README.md	Documented new `--spec-version` flag with examples

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

lib/bom_helpers.rb

lib/bom_builder.rb

Signed-off-by: Peter H. Boling <[email protected]>

- .gitignore - .rspec Signed-off-by: Peter H. Boling <[email protected]>

Signed-off-by: Peter H. Boling <[email protected]>

### Added - `CHANGELOG.md` file to document notable changes in keep-a-changelog format - `Cyclonedx::BomHelpers` module to house helper methods, replacing global methods - `Cyclonedx::BomBuilder` class, replacing `Bombuilder` (note the capitalization change) - `Cyclonedx::BomComponent` class, replacing `BomComponent` - `Cyclonedx::Ruby::Version::VERSION` constant to hold the version number (also available as `Cyclonedx::VERSION`) - `Cyclonedx::Ruby::Deprecation` module to help manage deprecations ### Changed - Updated gemspec metadata for clarity and consistency - Modernized Rakefile, dotfiles, and test setup - `LICENSE` => `LICENSE.txt` to simplify parsing consistency on various platforms and tools - `cucumber` v8 => v10 - `aruba` v2.1 => v2.2 ### Deprecated - `BomComponent` => `Cyclonedx::BomComponent` - `Bombuilder` => `Cyclonedx::BomBuilder` (note the capitalization change) - `Object.purl` => `Cyclonedx::BomHelpers.purl` - `Object.random_urn_uuid` => `Cyclonedx::BomHelpers.random_urn_uuid` - `Object.build_bom` => `Cyclonedx::BomHelpers.build_bom` - `Object.build_json_bom` => `Cyclonedx::BomHelpers.build_json_bom` - `Object.build_bom_xml` => `Cyclonedx::BomHelpers.build_bom_xml` - `Object.get_gem` => `Cyclonedx::BomHelpers.get_gem` Signed-off-by: Peter H. Boling <[email protected]>

### Added - `CHANGELOG.md` file to document notable changes in keep-a-changelog format - `Cyclonedx::BomHelpers` module to house helper methods, replacing global methods - `Cyclonedx::BomBuilder` class, replacing `Bombuilder` (note the capitalization change) - `Cyclonedx::BomComponent` class, replacing `BomComponent` - `Cyclonedx::Ruby::Version::VERSION` constant to hold the version number (also available as `Cyclonedx::VERSION`) - `Cyclonedx::Ruby::Deprecation` module to help manage deprecations ### Changed - Updated gemspec metadata for clarity and consistency - Modernized Rakefile, dotfiles, and test setup - `LICENSE` => `LICENSE.txt` to simplify parsing consistency on various platforms and tools - `cucumber` v8 => v10 - `aruba` v2.1 => v2.2 ### Deprecated - `BomComponent` => `Cyclonedx::BomComponent` - `Bombuilder` => `Cyclonedx::BomBuilder` (note the capitalization change) - `Object.purl` => `Cyclonedx::BomHelpers.purl` - `Object.random_urn_uuid` => `Cyclonedx::BomHelpers.random_urn_uuid` - `Object.build_bom` => `Cyclonedx::BomHelpers.build_bom` - `Object.build_json_bom` => `Cyclonedx::BomHelpers.build_json_bom` - `Object.build_bom_xml` => `Cyclonedx::BomHelpers.build_bom_xml` - `Object.get_gem` => `Cyclonedx::BomHelpers.get_gem` ### Fixed - `Nokogiri::XML::Builder` context relies on `method_missing` - Globally defined `Object#purl` conflicted with `<purl>`. - Moved to `Cyclonedx::BomHelpers.purl` to avoid conflict in v2.0.0 (along with all other global methods) - Fixed existing usage via the built-in Nokogiri workaround of adding an underscore `purl_` - The XML tag is unchanged as `<purl>` Signed-off-by: Peter H. Boling <[email protected]>

Signed-off-by: Peter H. Boling <[email protected]>

- Bigger build matrix changes are needed to continue running against older bunlders. - will introduce the appraisal pattern later Signed-off-by: Peter H. Boling <[email protected]>

Signed-off-by: Peter H. Boling <[email protected]>

Signed-off-by: Jan Kowalleck <[email protected]>

- cleanup spec.files Signed-off-by: Peter H. Boling <[email protected]>

Signed-off-by: Peter H. Boling <[email protected]>

@Gems

- Add spec version selection end-to-end with a new --spec-version flag (default 1.7). - Update JSON and XML outputs to honor the selected spec version. - Update fixtures, help text, tests, and docs. Files: - lib/bom_helpers.rb: - Added SUPPORTED_SPEC_VERSIONS, cyclonedx_xml_namespace helper. build_bom now accepts spec_version and routes to: - build_json_bom(gems, spec_version) sets specVersion to the provided version. - build_bom_xml(gems, spec_version) sets xmlns to http://cyclonedx.org/schema/bom/<version>.</version> - lib/bom_builder.rb: - Added --spec-version with validation; default is 1.7. - Pass @spec_version into build_bom(@Gems, @bom_output_format, @spec_version). Signed-off-by: Peter H. Boling <[email protected]>

Signed-off-by: Peter H. Boling <[email protected]>

Copilot AI review requested due to automatic review settings October 26, 2025 00:07

Copilot AI reviewed Oct 26, 2025

View reviewed changes

lib/bom_helpers.rb Outdated Show resolved Hide resolved

lib/bom_builder.rb Outdated Show resolved Hide resolved

pboling force-pushed the feat/spec-v1.7 branch from 7774b64 to f1ca5a7 Compare October 26, 2025 00:08

pboling marked this pull request as draft October 26, 2025 00:15

pboling changed the title ~~✨ Core v1.7 Enablement~~ [WIP] ✨ Core v1.7 Enablement Oct 26, 2025

pboling force-pushed the feat/spec-v1.7 branch from f1ca5a7 to c4e441c Compare October 26, 2025 03:46

pboling mentioned this pull request Oct 26, 2025

✨ --validate #39

Open

pboling force-pushed the feat/spec-v1.7 branch from c4e441c to 8be635e Compare October 26, 2025 05:13

pboling changed the title ~~[WIP] ✨ Core v1.7 Enablement~~ ✨ Core v1.7 Enablement Oct 26, 2025

pboling marked this pull request as ready for review October 26, 2025 05:15

This was referenced Oct 26, 2025

🎨 modernize for 2025 #38

Open

✨ --include-metadata (metadata.tools) & --enrich-components #40

Open

pboling added 12 commits October 30, 2025 00:59

🔨 binstubs: console, setup, rake, rspec, cucumber

6a174b8

Signed-off-by: Peter H. Boling <[email protected]>

🚚 rename LICENSE => LICENSE.txt

76c388f

Signed-off-by: Peter H. Boling <[email protected]>

🎨 modernize dotfiles

6d29520

- .gitignore - .rspec Signed-off-by: Peter H. Boling <[email protected]>

🎨 modernize Rakefile

ea1339d

Signed-off-by: Peter H. Boling <[email protected]>

⚡️ Frozen Strings (performance benefit)

c91de22

Signed-off-by: Peter H. Boling <[email protected]>

⏪️ Revert accidental changes

cbd8f71

Signed-off-by: Peter H. Boling <[email protected]>

🚨 Linting

dded808

Signed-off-by: Peter H. Boling <[email protected]>

🔒️ Signed releases, checksums & CONTRIBUTING.md

14413f0

Signed-off-by: Peter H. Boling <[email protected]>

👷 Update build matrix (light)

9980c19

- Bigger build matrix changes are needed to continue running against older bunlders. - will introduce the appraisal pattern later Signed-off-by: Peter H. Boling <[email protected]>

🔨 binstub: gem_checksums

e0de431

Signed-off-by: Peter H. Boling <[email protected]>

pboling force-pushed the feat/spec-v1.7 branch from 2cb9672 to 14e18f3 Compare October 30, 2025 07:34

pboling requested a review from a team as a code owner October 30, 2025 07:34

pboling force-pushed the feat/spec-v1.7 branch from 14e18f3 to 6682424 Compare October 30, 2025 07:39

jkowalleck and others added 3 commits October 30, 2025 20:53

Merge branch 'master' into fix/nokogiri-incompatible-with-global-purl

9f75e11

add NOTICE to extra_rdoc_files

9422296

Signed-off-by: Jan Kowalleck <[email protected]>

📝 Use hardcoded homepage roots

a492361

- cleanup spec.files Signed-off-by: Peter H. Boling <[email protected]>

🔥 Remove unnecessary test artifacts

d243fe2

Signed-off-by: Peter H. Boling <[email protected]>

pboling force-pushed the feat/spec-v1.7 branch from 6682424 to 46d35ae Compare October 30, 2025 21:25

pboling added 5 commits October 31, 2025 10:36

🔥 Remove gem release signing logic

a5df2d4

Signed-off-by: Peter H. Boling <[email protected]>

🔥 Remove documentation uri

b2182d3

Signed-off-by: Peter H. Boling <[email protected]>

🙈 Ignore .idea

86a28e6

Signed-off-by: Peter H. Boling <[email protected]>

✏️ Fix typo

2144134

Signed-off-by: Peter H. Boling <[email protected]>

pboling force-pushed the feat/spec-v1.7 branch from 46d35ae to 2144134 Compare October 31, 2025 16:44

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

✨ Core v1.7 Enablement #37

✨ Core v1.7 Enablement #37

Uh oh!

pboling commented Oct 26, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

✨ Core v1.7 Enablement #37

Are you sure you want to change the base?

✨ Core v1.7 Enablement #37

Uh oh!

Conversation

pboling commented Oct 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

pboling commented Oct 26, 2025 •

edited

Loading