v1.0-dev

.editorconfig

@@ -0,0 +1,35 @@
+# EditorConfig is awesome: https://EditorConfig.org
+
+root = true
+
+[*]
+end_of_line = lf
+insert_final_newline = true
+
+[*.md]
+# trailing white spaces are used for linebreaks in paragraphs.
+trim_trailing_whitespace = false
+
+[*.sh]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 2
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.{ts,js,cjs,mjs}]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 2
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.{json,json5,cjson,cjsn}]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 2
+trim_trailing_whitespace = true
+insert_final_newline = true

.eslintignore

@@ -0,0 +1,5 @@
+/dist/**
+/dist.*/**
+/node_modules/**
+
+!/src/**

.eslintrc.js

@@ -0,0 +1,62 @@
+'use strict'
+/*!
+This file is part of CycloneDX generator for NPM projects.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+SPDX-License-Identifier: Apache-2.0
+Copyright (c) OWASP Foundation. All Rights Reserved.
+*/
+
+/**
+ * @see {@link https://eslint.org/}
+ * @type {import('eslint').Linter.Config}
+ */
+module.exports = {
+  root: true,
+  /** @see https://github.com/standard/ts-standard */
+  extends: 'standard-with-typescript',
+  parserOptions: {
+    project: './tsconfig.json'
+  },
+  plugins: [
+    'simple-import-sort'
+  ],
+  env: {
+    commonjs: true,
+    node: true
+  },
+  overrides: [
+    {
+      files: [
+        '*.spec.*',
+        '*.test.*'
+      ],
+      env: {
+        jest: true,
+        commonjs: true,
+        node: true
+      }
+    }
+  ],
+  rules: {
+    // region sort imports/exports
+    /** disable other sorters in favour of `simple-import-sort` **/
+    'import/order': 0,
+    'sort-imports': 0,
+    /** @see https://github.com/lydell/eslint-plugin-simple-import-sort/ */
+    'simple-import-sort/imports': 'error',
+    'simple-import-sort/exports': 'error'
+    // endregion sort imports/exports
+  }
+}

.gitattributes

@@ -0,0 +1,3 @@
+
+tsconfig.json       linguist-language=JSON-with-Comments
+tsconfig.*.json     linguist-language=JSON-with-Comments

.github/dependabot.yml

@@ -0,0 +1,27 @@
+# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: 'npm'
+    directory: '/'
+    schedule:
+      interval: 'weekly'
+      day: 'saturday'
+    allow:
+      - dependency-type: 'all'
+    versioning-strategy: 'auto'
+    labels: [ 'dependencies' ]
+    commit-message:
+      prefix: 'chore'  ## prefix maximum string length of 15
+      include: 'scope'
+    open-pull-requests-limit: 999
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'weekly'
+      day: 'saturday'
+    labels: [ 'dependencies' ]
+    commit-message:
+      prefix: 'chore'   ## prefix maximum string length of 15
+      include: 'scope'
+    open-pull-requests-limit: 999

.github/workflows/nodejs.yml

@@ -0,0 +1,120 @@
+# For details of what checks are run for PRs please refer below
+# docs: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions
+
+name: Node CI
+
+on:
+  push:
+    branches: [ 'master', '1.0-dev' ]
+  pull_request:
+  workflow_dispatch:
+
+env:
+  DIST_DIR: dist
+  REPORTS_DIR: reports
+  NODE_ACTIVE_LTS: '16'  # https://nodejs.org/en/about/releases/
+
+jobs:
+  build:
+    name: build
+    runs-on: 'ubuntu-latest'
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        # see https://github.com/actions/checkout
+        uses: actions/checkout@v3
+      - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }}
+        # see https://github.com/actions/setup-node
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ env.NODE_ACTIVE_LTS }}
+          cache: 'npm'
+      - name: setup subject
+        run: npm ci --ignore-scripts
+      - name: build
+        run: npm run build
+      - name: artifact build result
+        # see https://github.com/actions/upload-artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: ${{ env.DIST_DIR }}
+          path: ${{ env.DIST_DIR }}
+          if-no-files-found: error
+  test-standards:
+    name: test standards
+    timeout-minutes: 30
+    runs-on: 'ubuntu-latest'
+    steps:
+      - name: Checkout
+        # see https://github.com/actions/checkout
+        uses: actions/checkout@v3
+      - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }}
+        # see https://github.com/actions/setup-node
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ env.NODE_ACTIVE_LTS }}
+          cache: 'npm'
+      - name: install subject
+        run: npm ci
+      - name: run tests
+        run: npm run test:standard
+  test-jest:
+    needs: [ 'build' ]
+    name: jest (node${{ matrix.node-version }} ${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version:
+          ## action based on https://github.com/actions/node-versions/releases
+          ## see also: https://nodejs.org/en/about/releases/
+          - '18'      # Current
+          - '16'      # Active LTS
+          - '14'      # Maintenance LTS
+          - '14.0.0'  # Lowest supported by this project
+        os:
+          - ubuntu-latest
+          - windows-latest
+          # - macos-latest # hanging for unknown reasons. but is unix-like so "ubuntu-latest" should be enough
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        # see https://github.com/actions/checkout
+        uses: actions/checkout@v3
+      - name: Setup Node.js ${{ matrix.node-version }}
+        # see https://github.com/actions/setup-node
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: 'npm'
+      - name: setup subject
+        run: npm ci --ignore-scripts
+      - name: fetch build artifact
+        # see https://github.com/actions/download-artifact
+        uses: actions/download-artifact@v3
+        with:
+          name: ${{ env.DIST_DIR }}
+          path: ${{ env.DIST_DIR }}
+      - name: test
+        run: >
+          npm run test:jest -- 
+          --ci
+          --verbose
+          --runInBand
+          --logHeapUsage
+      - name: artifact test logs
+        if: ${{ failure() }}
+        # see https://github.com/actions/upload-artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: logs-jest-node${{ matrix.node-version }}-${{ matrix.os }}
+          path: tests/_log
+          if-no-files-found: error
+      - name: artifact test reports
+        if: ${{ failure() }}
+        # see https://github.com/actions/upload-artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: reports-jest-node${{ matrix.node-version }}-${{ matrix.os }}
+          path: ${{ env.REPORTS_DIR }}
+          if-no-files-found: error

.github/workflows/npm-ls_demo-results.yml

@@ -0,0 +1,96 @@
+# For details of what checks are run for PRs please refer below
+# docs: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions
+
+name: npm-ls demo results
+
+on:
+  #push:
+  #  branches: [ 'master', '1.0-dev' ]
+  #  paths:
+  #    - '!**'
+  #    - 'demos/*/project/*'
+  #    - '.github/workflows/npm-ls_demo-results.yml' # this file
+  #pull_request:
+  #  paths:
+  #    - '!**'
+  #    - 'demos/*/project/**'
+  #    - '.github/workflows/npm-ls_demo-results.yml' # this file
+  workflow_dispatch:
+
+env:
+  DEMO_ROOT_DIR: demo
+  RESULTS_DIR: CI_results
+  RESULTS_ARTIFACT: npm-ls-results
+
+jobs:
+  demo-results:
+    name: ${{ matrix.subject }} npm${{ matrix.npm-version }} node${{ matrix.node-version }} ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false # gather all the results !
+      matrix:
+        subject:
+          - bundled-dependencies
+          - dev-dependencies
+          - local-dependencies
+          - local-workspaces
+          - juice-shop
+        npm-version:
+          - '8'      # Current
+          - '7'      # Legacy
+          - '6'      # Legacy
+          - '6.0.0'  # Lowest supported by this project
+        node-version:
+          ## action based on https://github.com/actions/node-versions/releases
+          ## see also: https://nodejs.org/en/about/releases/
+          - '18'      # Current
+          - '16'      # Active LTS
+          - '14'      # Maintenance LTS
+        os:
+          - ubuntu-latest
+          - windows-latest
+          - macos-latest
+        exclude:
+          - # juice-shop might not be node14 compatible
+            subject: juice-shop
+            node-version: '14'
+    timeout-minutes: 10 # this is a large matrix, just don't waste time!
+    steps:
+      - name: Checkout
+        # see https://github.com/actions/checkout
+        uses: actions/checkout@v3
+      - name: prepare output
+        run: |
+          mkdir -p '${{ env.RESULTS_DIR }}'
+          echo 'OUT_FILE_PREFIX=${{ env.RESULTS_DIR }}/npm-ls_npm${{ matrix.npm-version }}_node${{ matrix.node-version }}_${{ matrix.os }}' >> $GITHUB_ENV
+        working-directory: ${{ env.DEMO_ROOT_DIR}}/${{ matrix.subject }}
+        shell: bash # don't want to write tht code twice, windows and unix-like
+      - name: Setup Node.js ${{ matrix.node-version }}
+        # see https://github.com/actions/setup-node
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: 'npm'
+          cache-dependency-path: ${{ env.DEMO_ROOT_DIR }}/${{ matrix.subject }}/project/package.json
+      - name: report versions
+        run: |
+          node --version
+          npm  --version
+      - name: setup reproducible demo
+        run: npm i --no-audit --no-fund
+        working-directory: ${{ env.DEMO_ROOT_DIR }}/${{ matrix.subject }}/project
+      - name: npm-ls --all --long --json
+        # important: the command in use is the same used by the internal builders of this project
+        run: >
+          npm --prefix project
+          ls --all --long --json
+          2> ${{ env.OUT_FILE_PREFIX }}.err.log
+          >  ${{ env.OUT_FILE_PREFIX }}.json
+        working-directory: ${{ env.DEMO_ROOT_DIR}}/${{ matrix.subject }}
+      - name: Artifact RESULTS
+        # see https://github.com/actions/upload-artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: ${{ env.RESULTS_ARTIFACT }}
+          path: ${{ env.DEMO_ROOT_DIR}}/*/${{ env.RESULTS_DIR }}
+          if-no-files-found: error