fix(sbom): add devextreme-extra-deps

.github/workflows/packages_publishing.yml

@@ -85,14 +85,9 @@ jobs:
       # Generates CycloneDX SBOM JSON files for the selected packages using the just-built tgz files.
       # Produces packages/sbom/dist/*.cdx.json.
       - name: Build SBOMs
-        working-directory: packages/sbom
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          pnpm install --frozen-lockfile
-          rm -rf dist/
-          pnpm dx-make-sbom ../../ dist/ "$SBOM_PACKAGES"
-          cp dist/devextreme.cdx.json dist/devextreme-dist.cdx.json
+        run: pnpm nx make sbom --packages="$SBOM_PACKAGES"
 
       # Collects concrete SBOM file paths for validation because the shared action expects explicit file names.
       # Produces the sbomFiles.outputs.files multiline output.

packages/sbom/README.md

@@ -11,7 +11,7 @@ Generates Software Bill of Materials (SBOM) files in CycloneDX format for DevExt
 ### Build SBOM for All Public Packages
 
 ```shell
-pnpm nx build sbom
+pnpm nx make sbom
 ```
 
 Generates SBOM files for all public packages:
@@ -26,15 +26,15 @@ Generates SBOM files for all public packages:
 ### Generate SBOM for Specific Package (development)
 
 ```shell
-pnpm nx make sbom <package-name> [--debug]
+pnpm nx make sbom --packages=<package-name>
 ```
 
-Generates SBOM for a single package. Use `--debug` to preserve the raw output from [cdxgen](https://github.com/cdxgen/cdxgen).
+Generates SBOM for a single package.
 
 **Example:**
 
 ```shell
-pnpm nx make sbom devextreme --debug
+pnpm nx make sbom --packages=devextreme
 ```
 
 ## Notes

packages/sbom/devextreme-extra-deps/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "devextreme-extra-deps",
+  "version": "26.2.0",
+  "private": true,
+  "packageManager": "pnpm@11.9.0+sha512.bd682d5d03fe525ef7c9fd6780c6884d1e756ac4c9c9fe00c538782824310dcf90e3ddc4f53835f06dfaebd5085e41855e0bcbb3b60de2ac5bbab89e5036f03b",
+  "dependencies": {
+    "cldr-core": "36.0.0",
+    "cldr-dates-modern": "36.0.0",
+    "cldr-numbers-modern": "36.0.0"
+  }
+}

packages/sbom/devextreme-extra-deps/pnpm-workspace.yaml

@@ -0,0 +1,2 @@
+packages:
+  - '.'

packages/sbom/package.json

@@ -3,7 +3,7 @@
   "version": "26.2.0",
   "private": true,
   "devDependencies": {
-    "@devexpress/sbom-toolkit": "0.13.0"
+    "@devexpress/sbom-toolkit": "0.14.0"
   },
   "packageManager": "pnpm@11.9.0+sha512.bd682d5d03fe525ef7c9fd6780c6884d1e756ac4c9c9fe00c538782824310dcf90e3ddc4f53835f06dfaebd5085e41855e0bcbb3b60de2ac5bbab89e5036f03b"
 }

packages/sbom/project.json

@@ -9,27 +9,20 @@
         "command": "pnpm install --frozen-lockfile"
       }
     },
-    "build": {
+    "make": {
       "executor": "nx:run-commands",
       "dependsOn": ["install-dependencies"],
       "options": {
         "cwd": "{projectRoot}",
         "parallel": false,
+        "forwardAllArgs": false,
+        "packages": "devextreme,devextreme-react,devextreme-angular,devextreme-vue,devextreme-themebuilder",
         "commands": [
           "rm -rf dist/",
-          "pnpm dx-make-sbom ../../ dist/ devextreme,devextreme-react,devextreme-angular,devextreme-vue,devextreme-themebuilder",
-          "cp dist/devextreme.cdx.json dist/devextreme-dist.cdx.json"
+          "pnpm dx-make-sbom ../../ dist/ \"{args.packages}\" --extra-sbom=\"devextreme:packages/sbom/devextreme-extra-deps\"",
+          "test -f dist/devextreme.cdx.json && cp dist/devextreme.cdx.json dist/devextreme-dist.cdx.json || true"
         ]
       }
-    },
-    "make": {
-      "executor": "nx:run-commands",
-      "dependsOn": ["install-dependencies"],
-      "options": {
-        "cwd": "{projectRoot}",
-        "parallel": false,
-        "commands": ["pnpm dx-make-sbom ../../ dist/"]
-      }
     }
   }
 }