jenkins/sap-jenkins-library
1
0
Fork 0
mirror of https://github.com/SAP/jenkins-library.git synced 2024-12-12 10:55:20 +02:00
Code Issues Releases Activity

fix(npm): Update npm cyclonedx/bom to cyclonedx-npm (#4342)

Browse Source 
* fix(npm): Update npm cycloneDx to cyclonedx-npm

* Remove --no-validate and fix ut

* remove global

* Change to npm

* Apply suggestions from code review

---------

Co-authored-by: Christopher Fenner <26137398+CCFenner@users.noreply.github.com>
This commit is contained in:
Ashly Mathew 2023-05-11 09:55:54 +02:00 committed by GitHub
parent 019ef17fd7
commit f476e8ddce
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 27 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
pkg/npm/npm.go
View File

@ -14,7 +14,9 @@ import (
)
const (
npmBomFilename = "bom-npm.xml"
npmBomFilename = "bom-npm.xml"
cycloneDxPackageVersion = "@cyclonedx/cyclonedx-npm@1.11.0"
cycloneDxSchemaVersion = "1.4"
)
// Execute struct holds utils to enable mocking and common parameters
@ -354,23 +356,28 @@ func (exec *Execute) checkIfLockFilesExist() (bool, bool, error) {
// CreateBOM generates BOM file using CycloneDX from all package.json files
func (exec *Execute) CreateBOM(packageJSONFiles []string) error {
execRunner := exec.Utils.GetExecRunner()
// Install CycloneDX Node.js module locally without saving in package.json
err := execRunner.RunExecutable("npm", "install", "@cyclonedx/bom@^3.10.6", "--no-save")
// Install CycloneDX Node.js module via npx without saving in package.json / polluting globals
// See https://github.com/CycloneDX/cyclonedx-node-npm#installation
err := execRunner.RunExecutable("npx", "--package", cycloneDxPackageVersion, "--call", "exit")
if err != nil {
return err
return fmt.Errorf("failed to install CycloneDX package: %w", err)
}
if len(packageJSONFiles) > 0 {
for _, packageJSONFile := range packageJSONFiles {
path := filepath.Dir(packageJSONFile)
params := []string{
"cyclonedx-bom",
path,
"--output", filepath.Join(path, npmBomFilename),
cycloneDxPackageVersion,
"--output-format",
"XML",
"--spec-version",
cycloneDxSchemaVersion,
"--output-file", filepath.Join(path, npmBomFilename),
packageJSONFile,
}
err := execRunner.RunExecutable("npx", params...)
if err != nil {
return err
return fmt.Errorf("failed to generate CycloneDX BOM: %w", err)
}
}
}

17
pkg/npm/npm_test.go
View File

@ -360,12 +360,19 @@ func TestNpm(t *testing.T) {
if assert.NoError(t, err) {
if assert.Equal(t, 3, len(utils.execRunner.Calls)) {
assert.Equal(t, mock.ExecCall{Exec: "npm", Params: []string{"install", "@cyclonedx/bom@^3.10.6", "--no-save"}}, utils.execRunner.Calls[0])
assert.Equal(t, mock.ExecCall{Exec: "npx", Params: []string{"cyclonedx-bom", ".",
"--output", "bom-npm.xml"}}, utils.execRunner.Calls[1])
assert.Equal(t, mock.ExecCall{Exec: "npx", Params: []string{"cyclonedx-bom", "src",
"--output", filepath.Join("src", "bom-npm.xml")}}, utils.execRunner.Calls[2])
assert.Equal(t, mock.ExecCall{Exec: "npx", Params: []string{"--package", "@cyclonedx/cyclonedx-npm@1.11.0", "--call", "exit"}}, utils.execRunner.Calls[0])
assert.Equal(t, mock.ExecCall{Exec: "npx", Params: []string{"@cyclonedx/cyclonedx-npm@1.11.0", "--output-format",
"XML",
"--spec-version",
"1.4",
"--output-file", "bom-npm.xml", "package.json"}}, utils.execRunner.Calls[1])
assert.Equal(t, mock.ExecCall{Exec: "npx", Params: []string{"@cyclonedx/cyclonedx-npm@1.11.0", "--output-format",
"XML",
"--spec-version",
"1.4",
"--output-file", filepath.Join("src", "bom-npm.xml"), filepath.Join("src", "package.json")}}, utils.execRunner.Calls[2])
}
}
})
}