feat(sbom): write CycloneDX 1.7 by default - #357
Open
bomly-guy wants to merge 1 commit into
Open
Conversation
The codec and cyclonedx-go v0.11.0 already supported 1.7 end to end (targets, encoder cases, ingest auto-detection for 1.4-1.7); only the write default still selected 1.6. Flip the two selection points (render.SBOMTarget, benchmark bomlySBOMTarget), point the interop assurance at v1_7 (the pinned cyclonedx-cli v0.32.0 validator already accepts it — verified by running it against a generated 1.7 document), and update the recorded workflow checksum in the evidence catalog. Ingest is unchanged: CycloneDX 1.4-1.7 and SPDX 2.3 remain accepted, and the existing 1.6 smoke fixture keeps exercising 1.6 ingest. Docs sweep updates every current-behavior mention of 1.6 (SBOM, output formats, getting started, glossary, scan targets, README, faq.json, manifest, evidence pages); the dated July 24 workflow-run statement in EVIDENCE.md intentionally keeps saying 1.6. Also fixes stale detector prose that claimed only 1.6 ingest was supported and 1.5 was future work — 1.4-1.7 have all been accepted by the codec. Verified: emitted document reports specVersion 1.7 and passes cyclonedx-cli v0.32.0 validation with --input-version v1_7; ingest round-trips the generated 1.7 file; make evidence, make fuzz, make generate, and the full test suite pass. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (18)
📝 WalkthroughWalkthroughCycloneDX output and validation references move from 1.6 to 1.7. Documentation now describes 1.7 output and 1.4–1.7 ingestion, while tests, benchmarks, workflow text, and evidence checksums are updated accordingly. ChangesCycloneDX version alignment
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Bomly Diff SummaryCompared Overview
Dependency Changes✅ No dependency changes. Vulnerabilities✅ No vulnerability changes. License Changes✅ No license changes. Project Posture✅ No project posture changes ( Policy Findings✅ No policy differences were identified. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
--format cyclonedx/-o cyclonedx=…(was 1.6). The codec, targets, andcyclonedx-gov0.11.0 already supported 1.7 — this flips the two write-default selection points (render.SBOMTarget, benchmarkbomlySBOMTarget).v1_7. No validator bump needed — the pinnedcyclonedx-cliv0.32.0 already supports--input-version v1_7(verified by running it). The evidence catalog's recorded checksum for the workflow file is updated accordingly (make evidencepasses).faq.json, manifest, evidence pages). The dated July 24 run description in EVIDENCE.md intentionally still says 1.6. Bonus accuracy fix: the SBOM detector prose claimed only 1.6 ingest was supported with 1.5 as future work — the codec has accepted 1.4–1.7 all along; the generated ecosystem page now says so.Validation
specVersion: 1.7and passescyclonedx-cliv0.32.0 validation with--input-version v1_7 --fail-on-errorsbomly scan --sbomround-trips the generated 1.7 filemake evidence(24 cases),make fuzz FUZZTIME=5s(SBOM handling touched),make generate(no drift beyond the intended prose regeneration),make test(68 packages), offline link check — all greenNotes
--sbom-versionselector can be a follow-up.feat:for a minor version bump.🤖 Generated with Claude Code
Summary by CodeRabbit