diff --git a/.github/workflows/packages_publishing.yml b/.github/workflows/packages_publishing.yml index 1ec8978458f8..8d7fcb3d42c8 100644 --- a/.github/workflows/packages_publishing.yml +++ b/.github/workflows/packages_publishing.yml @@ -85,14 +85,9 @@ jobs: # Generates CycloneDX SBOM JSON files for the selected packages using the just-built tgz files. # Produces packages/sbom/dist/*.cdx.json. - name: Build SBOMs - working-directory: packages/sbom env: NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - pnpm install --frozen-lockfile - rm -rf dist/ - pnpm dx-make-sbom ../../ dist/ "$SBOM_PACKAGES" - cp dist/devextreme.cdx.json dist/devextreme-dist.cdx.json + run: pnpm nx make sbom --packages="$SBOM_PACKAGES" # Collects concrete SBOM file paths for validation because the shared action expects explicit file names. # Produces the sbomFiles.outputs.files multiline output. diff --git a/packages/sbom/README.md b/packages/sbom/README.md index 7c508656dc20..23a518bf9174 100644 --- a/packages/sbom/README.md +++ b/packages/sbom/README.md @@ -11,7 +11,7 @@ Generates Software Bill of Materials (SBOM) files in CycloneDX format for DevExt ### Build SBOM for All Public Packages ```shell -pnpm nx build sbom +pnpm nx make sbom ``` Generates SBOM files for all public packages: @@ -26,15 +26,15 @@ Generates SBOM files for all public packages: ### Generate SBOM for Specific Package (development) ```shell -pnpm nx make sbom [--debug] +pnpm nx make sbom --packages= ``` -Generates SBOM for a single package. Use `--debug` to preserve the raw output from [cdxgen](https://github.com/cdxgen/cdxgen). +Generates SBOM for a single package. **Example:** ```shell -pnpm nx make sbom devextreme --debug +pnpm nx make sbom --packages=devextreme ``` ## Notes diff --git a/packages/sbom/devextreme-extra-deps/package.json b/packages/sbom/devextreme-extra-deps/package.json new file mode 100644 index 000000000000..bc9f2dc9d1d0 --- /dev/null +++ b/packages/sbom/devextreme-extra-deps/package.json @@ -0,0 +1,11 @@ +{ + "name": "devextreme-extra-deps", + "version": "26.2.0", + "private": true, + "packageManager": "pnpm@11.9.0+sha512.bd682d5d03fe525ef7c9fd6780c6884d1e756ac4c9c9fe00c538782824310dcf90e3ddc4f53835f06dfaebd5085e41855e0bcbb3b60de2ac5bbab89e5036f03b", + "dependencies": { + "cldr-core": "36.0.0", + "cldr-dates-modern": "36.0.0", + "cldr-numbers-modern": "36.0.0" + } +} diff --git a/packages/sbom/devextreme-extra-deps/pnpm-lock.yaml b/packages/sbom/devextreme-extra-deps/pnpm-lock.yaml new file mode 100644 index 000000000000..ac57ebfecc44 --- /dev/null +++ b/packages/sbom/devextreme-extra-deps/pnpm-lock.yaml @@ -0,0 +1,46 @@ +lockfileVersion: '9.0' + +settings: + autoInstallPeers: true + excludeLinksFromLockfile: false + +importers: + + .: + dependencies: + cldr-core: + specifier: 36.0.0 + version: 36.0.0 + cldr-dates-modern: + specifier: 36.0.0 + version: 36.0.0(cldr-numbers-modern@36.0.0(cldr-core@36.0.0)) + cldr-numbers-modern: + specifier: 36.0.0 + version: 36.0.0(cldr-core@36.0.0) + +packages: + + cldr-core@36.0.0: + resolution: {integrity: sha512-QLnAjt20rZe38c8h8OJ9jPND+O4o5O8Nw0TK/P3KpNn1cmOhMu0rk6Kc3ap96c5OStQ9gAngs9+Be2sum26NOw==} + + cldr-dates-modern@36.0.0: + resolution: {integrity: sha512-YiUBgo0AqBVWMbZEtw2YFk6/YagcvGmcpARejeqXe9R2ZZvv7Ek40idaoIXEjBb0wKVtJ1cYBFpMChEC0CBbqQ==} + peerDependencies: + cldr-numbers-modern: 36.0.0 + + cldr-numbers-modern@36.0.0: + resolution: {integrity: sha512-+8u6N4WrhMIb66jcUlubW3uDyRWSuAY4OuXTizMKSQnHHdufnY5rO9A0GzopMiak3+bMj8LFaDlblXOTt+mifQ==} + peerDependencies: + cldr-core: 36.0.0 + +snapshots: + + cldr-core@36.0.0: {} + + cldr-dates-modern@36.0.0(cldr-numbers-modern@36.0.0(cldr-core@36.0.0)): + dependencies: + cldr-numbers-modern: 36.0.0(cldr-core@36.0.0) + + cldr-numbers-modern@36.0.0(cldr-core@36.0.0): + dependencies: + cldr-core: 36.0.0 diff --git a/packages/sbom/devextreme-extra-deps/pnpm-workspace.yaml b/packages/sbom/devextreme-extra-deps/pnpm-workspace.yaml new file mode 100644 index 000000000000..4de91a383ab1 --- /dev/null +++ b/packages/sbom/devextreme-extra-deps/pnpm-workspace.yaml @@ -0,0 +1,2 @@ +packages: + - '.' diff --git a/packages/sbom/package.json b/packages/sbom/package.json index f469948839e7..e0e24b8ad6b0 100644 --- a/packages/sbom/package.json +++ b/packages/sbom/package.json @@ -3,7 +3,7 @@ "version": "26.2.0", "private": true, "devDependencies": { - "@devexpress/sbom-toolkit": "0.13.0" + "@devexpress/sbom-toolkit": "0.14.0" }, "packageManager": "pnpm@11.9.0+sha512.bd682d5d03fe525ef7c9fd6780c6884d1e756ac4c9c9fe00c538782824310dcf90e3ddc4f53835f06dfaebd5085e41855e0bcbb3b60de2ac5bbab89e5036f03b" } diff --git a/packages/sbom/pnpm-lock.yaml b/packages/sbom/pnpm-lock.yaml index fd286ee42947..9f1030af15a2 100644 --- a/packages/sbom/pnpm-lock.yaml +++ b/packages/sbom/pnpm-lock.yaml @@ -18,8 +18,8 @@ importers: .: devDependencies: '@devexpress/sbom-toolkit': - specifier: 0.13.0 - version: 0.13.0 + specifier: 0.14.0 + version: 0.14.0 packages: @@ -152,8 +152,8 @@ packages: engines: {node: ^20 || ^22 || ^24 || ^25, pnpm: '>=10'} hasBin: true - '@devexpress/sbom-toolkit@0.13.0': - resolution: {integrity: sha512-YrcdWbNq4/deBTFEsxIPBdbqI1kyrjGWz88SwC+PYUf0J8Sq3lAxvDnVkgiGfJOzF8rJeyDqJNordOJKjWsTag==, tarball: https://npm.pkg.github.com/download/@devexpress/sbom-toolkit/0.13.0/f4a86cdecc2905cf15ad0934b86ffcfa832eed36} + '@devexpress/sbom-toolkit@0.14.0': + resolution: {integrity: sha512-89PWP+cuAt+BSx+Y7Lw1XOJZlxwPhuMTvIUg1LktxK7y7SG3wvCeBSNIecI2m1ARW4tccWKww3IJcACVIP9bvA==, tarball: https://npm.pkg.github.com/download/@devexpress/sbom-toolkit/0.14.0/bac6ddb5b5cf778408ac69230896877e2a688306} hasBin: true '@gar/promise-retry@1.0.3': @@ -1068,7 +1068,7 @@ snapshots: transitivePeerDependencies: - supports-color - '@devexpress/sbom-toolkit@0.13.0': + '@devexpress/sbom-toolkit@0.14.0': dependencies: '@cyclonedx/cdxgen': 12.5.1 spdx-license-ids: 3.0.23 diff --git a/packages/sbom/project.json b/packages/sbom/project.json index 4d9389597869..4a1212041088 100644 --- a/packages/sbom/project.json +++ b/packages/sbom/project.json @@ -9,27 +9,20 @@ "command": "pnpm install --frozen-lockfile" } }, - "build": { + "make": { "executor": "nx:run-commands", "dependsOn": ["install-dependencies"], "options": { "cwd": "{projectRoot}", "parallel": false, + "forwardAllArgs": false, + "packages": "devextreme,devextreme-react,devextreme-angular,devextreme-vue,devextreme-themebuilder", "commands": [ "rm -rf dist/", - "pnpm dx-make-sbom ../../ dist/ devextreme,devextreme-react,devextreme-angular,devextreme-vue,devextreme-themebuilder", - "cp dist/devextreme.cdx.json dist/devextreme-dist.cdx.json" + "pnpm dx-make-sbom ../../ dist/ \"{args.packages}\" --extra-sbom=\"devextreme:packages/sbom/devextreme-extra-deps\"", + "test -f dist/devextreme.cdx.json && cp dist/devextreme.cdx.json dist/devextreme-dist.cdx.json || true" ] } - }, - "make": { - "executor": "nx:run-commands", - "dependsOn": ["install-dependencies"], - "options": { - "cwd": "{projectRoot}", - "parallel": false, - "commands": ["pnpm dx-make-sbom ../../ dist/"] - } } } }