🎨 modernize for 2025 (chores & slight refactoring) #38

pboling · 2025-10-26T03:19:40Z

#	📍 NOTE	What
1️⃣	This one first	Modernize gem structure	<=== You are here
2️⃣	Then see #37 next	Upgrade to v1.7 spec
3️⃣	Then see #39	Add --validate feature
4️⃣	Then see #40	Add --include-metadata feature

🎨 modernize for 2025

Added

CONTRIBUTING.md file to help people find their way to contributing
CHANGELOG.md file to document notable changes in keep-a-changelog format
Cyclonedx::BomHelpers module to house helper methods, replacing global methods
Cyclonedx::BomBuilder class, replacing Bombuilder (note the capitalization change)
Cyclonedx::BomComponent class, replacing BomComponent
Cyclonedx::Ruby::Version::VERSION constant to hold the version number (also available as Cyclonedx::VERSION)
Cyclonedx::Ruby::Deprecation module to help manage deprecations
dev dependency: stone_checksums
- For SHA-256 and SHA-512 checksum generation for each release.
signed gem releases
- See: RubyGems Security Guide
CI matrix testing on Ruby 3.3, 3.4

Changed

Updated gemspec metadata for clarity and consistency
Modernized Rakefile, dotfiles, and test setup
LICENSE => LICENSE.txt to simplify parsing consistency on various platforms and tools
cucumber v8 => v10
aruba v2.1 => v2.2

Deprecated

BomComponent => Cyclonedx::BomComponent
Bombuilder => Cyclonedx::BomBuilder (note the capitalization change)
Object.purl => Cyclonedx::BomHelpers.purl
Object.random_urn_uuid => Cyclonedx::BomHelpers.random_urn_uuid
Object.build_bom => Cyclonedx::BomHelpers.build_bom
Object.build_json_bom => Cyclonedx::BomHelpers.build_json_bom
Object.build_bom_xml => Cyclonedx::BomHelpers.build_bom_xml
Object.get_gem => Cyclonedx::BomHelpers.get_gem

Fixed

Nokogiri::XML::Builder context relies on method_missing
- Globally defined Object#purl conflicted with <purl>.
- Moved to Cyclonedx::BomHelpers.purl to avoid conflict in v2.0.0 (along with all other global methods)
- Fixed existing usage via the built-in Nokogiri workaround of adding an underscore purl_
- The XML tag is unchanged as <purl>

Signed-off-by: Peter H. Boling [email protected]

Copilot

Pull Request Overview

This PR modernizes the cyclonedx-ruby gem for 2025 by refactoring the codebase to use proper namespacing under the Cyclonedx module, introducing a deprecation system for backward compatibility, and updating dependencies. The changes prepare for a v2.0.0 release while maintaining compatibility with existing code through deprecated aliases.

Key changes:

Refactored global methods and classes into the Cyclonedx namespace with deprecation warnings for legacy usage
Fixed Nokogiri XML builder conflict with globally-scoped purl method
Updated development dependencies (cucumber v8→v10, aruba v2.1→v2.2)

Reviewed Changes

Copilot reviewed 25 out of 34 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
lib/cyclonedx/ruby.rb	New main entry point that requires all Cyclonedx module components
lib/cyclonedx/bom_helpers.rb	Refactored helper methods into `Cyclonedx::BomHelpers` module
lib/cyclonedx/bom_component.rb	Moved `BomComponent` class into `Cyclonedx` namespace
lib/cyclonedx/bom_builder.rb	Moved `Bombuilder` class into `Cyclonedx` namespace as `BomBuilder`
lib/cyclonedx/ruby/version.rb	New version constant structure
lib/cyclonedx/ruby/deprecation.rb	New deprecation management module
lib/cyclonedx_deprecated.rb	Compatibility layer providing deprecated aliases
lib/bom_*.rb	Legacy entry points now redirect to new namespaced code
spec/spec_helper.rb	Updated test configuration and loading logic
spec/cyclonedx/*.rb	New namespaced test files
cyclonedx-ruby.gemspec	Updated metadata and dependency versions
exe/cyclonedx-ruby	Updated executable with backward compatibility logic
CHANGELOG.md	New changelog documenting all changes

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

spec/cyclonedx/bom_helpers_spec.rb

.rspec

bom.json

bom.xml

LICENSE.txt

bin/setup

lib/bom_builder.rb

jkowalleck · 2025-10-27T17:09:49Z

some SCA is failing: https://app.codacy.com/gh/CycloneDX/cyclonedx-ruby-gem/pull-requests/38/issues

pboling · 2025-10-27T19:27:48Z

@jkowalleck there are 10 minor and 60 medium SCA violations. I'd like to focus on this PR not changing much runtime logic. Would you prefer to fix them in a separate PR, or just the medium ones here, or all of them here?

jkowalleck · 2025-10-28T08:52:07Z

@jkowalleck there are 10 minor and 60 medium SCA violations. I'd like to focus on this PR not changing much runtime logic. Would you prefer to fix them in a separate PR, or just the medium ones here, or all of them here?

I dont know whether the SCA issue already existed, and were reported only because the code moved from one file to another.
Anyway, i believe in continuous improvements and small iterations. I would be okay with a follow-up ticket and PR to address these findings later, especially since we have PRs that build on the code in this PR.

jkowalleck · 2025-10-28T08:53:14Z

there seams to be some CI/CT failing.
could you have a look? https://github.com/CycloneDX/cyclonedx-ruby-gem/actions/runs/18813396802?pr=38

pboling · 2025-10-28T19:10:14Z

Looking into the CI failures, and will fix the license link in README, and add CONTRIBUTING.md. I looked at other projects in this org, and it seems the are using contributor covenant v2.0. So following that pattern I'm adding contributor covenant v2.1, using the same contact email as the other projects have.
Rebasing the PRs that are on top of this one, is effort, but not horrible; the splits are pretty clean. :)

mperham · 2025-10-29T23:46:55Z

I’d like to see this work integrated too. Thanks @pboling!

one request: remove unnecessary 3rd party dependencies. No real reason this lib needs nokogiri or rest-client.

Signed-off-by: Peter H. Boling <[email protected]>

- .gitignore - .rspec Signed-off-by: Peter H. Boling <[email protected]>

Signed-off-by: Peter H. Boling <[email protected]>

### Added - `CHANGELOG.md` file to document notable changes in keep-a-changelog format - `Cyclonedx::BomHelpers` module to house helper methods, replacing global methods - `Cyclonedx::BomBuilder` class, replacing `Bombuilder` (note the capitalization change) - `Cyclonedx::BomComponent` class, replacing `BomComponent` - `Cyclonedx::Ruby::Version::VERSION` constant to hold the version number (also available as `Cyclonedx::VERSION`) - `Cyclonedx::Ruby::Deprecation` module to help manage deprecations ### Changed - Updated gemspec metadata for clarity and consistency - Modernized Rakefile, dotfiles, and test setup - `LICENSE` => `LICENSE.txt` to simplify parsing consistency on various platforms and tools - `cucumber` v8 => v10 - `aruba` v2.1 => v2.2 ### Deprecated - `BomComponent` => `Cyclonedx::BomComponent` - `Bombuilder` => `Cyclonedx::BomBuilder` (note the capitalization change) - `Object.purl` => `Cyclonedx::BomHelpers.purl` - `Object.random_urn_uuid` => `Cyclonedx::BomHelpers.random_urn_uuid` - `Object.build_bom` => `Cyclonedx::BomHelpers.build_bom` - `Object.build_json_bom` => `Cyclonedx::BomHelpers.build_json_bom` - `Object.build_bom_xml` => `Cyclonedx::BomHelpers.build_bom_xml` - `Object.get_gem` => `Cyclonedx::BomHelpers.get_gem` Signed-off-by: Peter H. Boling <[email protected]>

### Added - `CHANGELOG.md` file to document notable changes in keep-a-changelog format - `Cyclonedx::BomHelpers` module to house helper methods, replacing global methods - `Cyclonedx::BomBuilder` class, replacing `Bombuilder` (note the capitalization change) - `Cyclonedx::BomComponent` class, replacing `BomComponent` - `Cyclonedx::Ruby::Version::VERSION` constant to hold the version number (also available as `Cyclonedx::VERSION`) - `Cyclonedx::Ruby::Deprecation` module to help manage deprecations ### Changed - Updated gemspec metadata for clarity and consistency - Modernized Rakefile, dotfiles, and test setup - `LICENSE` => `LICENSE.txt` to simplify parsing consistency on various platforms and tools - `cucumber` v8 => v10 - `aruba` v2.1 => v2.2 ### Deprecated - `BomComponent` => `Cyclonedx::BomComponent` - `Bombuilder` => `Cyclonedx::BomBuilder` (note the capitalization change) - `Object.purl` => `Cyclonedx::BomHelpers.purl` - `Object.random_urn_uuid` => `Cyclonedx::BomHelpers.random_urn_uuid` - `Object.build_bom` => `Cyclonedx::BomHelpers.build_bom` - `Object.build_json_bom` => `Cyclonedx::BomHelpers.build_json_bom` - `Object.build_bom_xml` => `Cyclonedx::BomHelpers.build_bom_xml` - `Object.get_gem` => `Cyclonedx::BomHelpers.get_gem` ### Fixed - `Nokogiri::XML::Builder` context relies on `method_missing` - Globally defined `Object#purl` conflicted with `<purl>`. - Moved to `Cyclonedx::BomHelpers.purl` to avoid conflict in v2.0.0 (along with all other global methods) - Fixed existing usage via the built-in Nokogiri workaround of adding an underscore `purl_` - The XML tag is unchanged as `<purl>` Signed-off-by: Peter H. Boling <[email protected]>

Signed-off-by: Peter H. Boling <[email protected]>

- Bigger build matrix changes are needed to continue running against older bunlders. - will introduce the appraisal pattern later Signed-off-by: Peter H. Boling <[email protected]>

Signed-off-by: Peter H. Boling <[email protected]>

pboling · 2025-10-30T07:27:21Z

@jkowalleck this is done, I tihnk. CI matrix should be passing now, and all comments have been addressed. LMK if there is anything else to be done here. I've got a lot more improvements I'd like to make, so these initial 4 PRs are just the beginning.
I had to drop the older versions of ruby, and added the newer ones to replace them.
The older ones will not work with latest version of bundler, because they are EOL, and thus continuing to run them in CI requires additional configuration, but I'd like to do that in an isolated PR, because it will be many lines of code (appraisals is a useful pattern for this usecase).

Gemfile.lock

pboling · 2025-10-30T18:27:17Z

@mperham - yes, I'll be trimming the dependencies in a future PR.

.github/workflows/ruby.yml

Gemfile.lock

bom.xml

certs/pboling.pem

CONTRIBUTING.md

cyclonedx-ruby.gemspec

Signed-off-by: Jan Kowalleck <[email protected]>

- cleanup spec.files Signed-off-by: Peter H. Boling <[email protected]>

Signed-off-by: Peter H. Boling <[email protected]>

pboling · 2025-10-31T16:41:31Z

@jkowalleck I'm not sure what happened, but it seems the Codacy issues are no longer extant. Maybe the linting auto-fixes resolved them? :)

Copilot

Pull Request Overview

Copilot reviewed 34 out of 44 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

lib/cyclonedx/bom_helpers.rb

lib/cyclonedx/ruby/deprecation.rb

spec/spec_helper.rb

Signed-off-by: Peter H. Boling <[email protected]>

Copilot

Pull Request Overview

Copilot reviewed 34 out of 44 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

lib/cyclonedx/bom_builder.rb

lib/cyclonedx/ruby/deprecation.rb

Signed-off-by: Peter H. Boling <[email protected]>

jkowalleck · 2025-11-05T11:31:41Z

thank you so much for this, @pboling .

thank you for reviewing, @seuros .

Copilot AI review requested due to automatic review settings October 26, 2025 03:19

pboling changed the title ~~🔨 binstubs: console, setup, rake, rspec, cucumber~~ 🎨 modernize for 2025 Oct 26, 2025

Copilot AI reviewed Oct 26, 2025

View reviewed changes

spec/cyclonedx/bom_helpers_spec.rb Show resolved Hide resolved

.rspec Show resolved Hide resolved

bom.json Outdated Show resolved Hide resolved

bom.xml Outdated Show resolved Hide resolved

This was referenced Oct 26, 2025

✨ Core v1.7 Enablement #37

Open

✨ --validate #39

Open

✨ --include-metadata (metadata.tools) & --enrich-components #40

Open

jkowalleck reviewed Oct 27, 2025

View reviewed changes

LICENSE.txt Show resolved Hide resolved

bin/setup Show resolved Hide resolved

lib/bom_builder.rb Show resolved Hide resolved

pboling requested a review from a team as a code owner October 30, 2025 06:57

pboling added 9 commits October 30, 2025 00:59

🔨 binstubs: console, setup, rake, rspec, cucumber

6a174b8

Signed-off-by: Peter H. Boling <[email protected]>

🚚 rename LICENSE => LICENSE.txt

76c388f

Signed-off-by: Peter H. Boling <[email protected]>

🎨 modernize dotfiles

6d29520

- .gitignore - .rspec Signed-off-by: Peter H. Boling <[email protected]>

🎨 modernize Rakefile

ea1339d

Signed-off-by: Peter H. Boling <[email protected]>

⚡️ Frozen Strings (performance benefit)

c91de22

Signed-off-by: Peter H. Boling <[email protected]>

⏪️ Revert accidental changes

cbd8f71

Signed-off-by: Peter H. Boling <[email protected]>

🚨 Linting

dded808

Signed-off-by: Peter H. Boling <[email protected]>

pboling force-pushed the fix/nokogiri-incompatible-with-global-purl branch from 1352653 to 6ebe091 Compare October 30, 2025 06:59

🔒️ Signed releases, checksums & CONTRIBUTING.md

14413f0

Signed-off-by: Peter H. Boling <[email protected]>

pboling force-pushed the fix/nokogiri-incompatible-with-global-purl branch 2 times, most recently from 39b4cb3 to 23ef3f8 Compare October 30, 2025 07:24

pboling added 2 commits October 30, 2025 01:25

👷 Update build matrix (light)

9980c19

- Bigger build matrix changes are needed to continue running against older bunlders. - will introduce the appraisal pattern later Signed-off-by: Peter H. Boling <[email protected]>

🔨 binstub: gem_checksums

e0de431

Signed-off-by: Peter H. Boling <[email protected]>

seuros reviewed Oct 30, 2025

View reviewed changes

Gemfile.lock Show resolved Hide resolved

pboling requested a review from jkowalleck October 30, 2025 16:33

Merge branch 'master' into fix/nokogiri-incompatible-with-global-purl

9f75e11

jkowalleck requested changes Oct 30, 2025

View reviewed changes

jkowalleck and others added 5 commits October 30, 2025 20:57

add NOTICE to extra_rdoc_files

9422296

Signed-off-by: Jan Kowalleck <[email protected]>

📝 Use hardcoded homepage roots

a492361

- cleanup spec.files Signed-off-by: Peter H. Boling <[email protected]>

🔥 Remove unnecessary test artifacts

d243fe2

Signed-off-by: Peter H. Boling <[email protected]>

🔥 Remove gem release signing logic

a5df2d4

Signed-off-by: Peter H. Boling <[email protected]>

🔥 Remove documentation uri

b2182d3

Signed-off-by: Peter H. Boling <[email protected]>

pboling requested a review from jkowalleck November 1, 2025 05:32

jkowalleck requested a review from Copilot November 3, 2025 13:27

Copilot AI reviewed Nov 3, 2025

View reviewed changes

lib/cyclonedx/bom_helpers.rb Outdated Show resolved Hide resolved

lib/cyclonedx/bom_helpers.rb Outdated Show resolved Hide resolved

lib/cyclonedx/ruby/deprecation.rb Outdated Show resolved Hide resolved

spec/spec_helper.rb Show resolved Hide resolved

jkowalleck reviewed Nov 3, 2025

View reviewed changes

spec/spec_helper.rb Show resolved Hide resolved

pboling added 3 commits November 3, 2025 12:25

🐛 Fix latent reference to BomComponent without namespace

a36b45a

Signed-off-by: Peter H. Boling <[email protected]>

🐛 Fix latent reference to @logger out of context

9834ae3

Signed-off-by: Peter H. Boling <[email protected]>

📄 Add back license, scoped to relevant lines

a17b6a3

Signed-off-by: Peter H. Boling <[email protected]>

pboling requested review from Copilot and jkowalleck November 3, 2025 19:46

Copilot AI reviewed Nov 3, 2025

View reviewed changes

lib/cyclonedx/bom_builder.rb Outdated Show resolved Hide resolved

lib/cyclonedx/ruby/deprecation.rb Outdated Show resolved Hide resolved

pboling added 2 commits November 3, 2025 14:43

🐛 fix reference to variable bom_directory within rescue block

ff97361

Signed-off-by: Peter H. Boling <[email protected]>

✏️ fix method indicator in deprecation warnings

7a55d34

Signed-off-by: Peter H. Boling <[email protected]>

jkowalleck changed the title ~~🎨 modernize for 2025~~ refactor: 🎨 modernize for 2025 Nov 5, 2025

jkowalleck changed the title ~~refactor: 🎨 modernize for 2025~~ 🎨 modernize for 2025 (chores & slight refactoring) Nov 5, 2025

jkowalleck approved these changes Nov 5, 2025

View reviewed changes

This was referenced Nov 5, 2025

fix activesupport (~> 7.0) being EOL #42

Open

CI/CT: test with alls supported ruby versions #43

Open

jkowalleck merged commit 004b462 into CycloneDX:master Nov 5, 2025
6 checks passed

Uh oh!

🎨 modernize for 2025 (chores & slight refactoring) #38

🎨 modernize for 2025 (chores & slight refactoring) #38

Uh oh!

Conversation

pboling commented Oct 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Added

Changed

Deprecated

Fixed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jkowalleck commented Oct 27, 2025

Uh oh!

pboling commented Oct 27, 2025

Uh oh!

jkowalleck commented Oct 28, 2025

Uh oh!

jkowalleck commented Oct 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pboling commented Oct 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mperham commented Oct 29, 2025

Uh oh!

pboling commented Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

pboling commented Oct 30, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pboling commented Oct 31, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jkowalleck commented Nov 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

pboling commented Oct 26, 2025 •

edited

Loading

jkowalleck commented Oct 28, 2025 •

edited

Loading

pboling commented Oct 28, 2025 •

edited

Loading

pboling commented Oct 30, 2025 •

edited

Loading