feat: add switch --lockfile-only

[molikuner]

Description

Using the new --lockfile-only flag it's possible to generate an SBOM locally, without connecting to the internet, even if the dependencies aren't cached or are inaccessible at the moment. It purely depends on the local files.

Resolves or fixes issue: #49

AI Tool Disclosure

• My contribution does not include any AI-generated content

Affirmation

• My code follows the CONTRIBUTING.md guidelines

[jkowalleck]

love the implementation.
thank you very much for this.

could you add a README.md for the newly added testbed?

[molikuner]

Thanks @jkowalleck for looking at the PR. I've added a README.md to the testbed. Please let me know what you think.

[jkowalleck]

the implementation looks solid.
Could you update the projects readme and add the updated yarn cyclonedx --help page?

[molikuner]

Sorry, I've missed that before. I've now added the new option to the projects README. Do you want me to add anything else to the README?

[jkowalleck]

Thank you for taking care of the feature.
Implementation looks solid.

some things dare still open:

• please read https://github.com/CycloneDX/cyclonedx-node-yarn/blob/main/CONTRIBUTING.md#sign-off-your-commits
• follow these instructions to signoff your already committed code: https://github.com/CycloneDX/cyclonedx-node-yarn/pull/490/checks?check_run_id=68399276482

[molikuner]

Thanks @jkowalleck for the review. I fixed the last commit missing the signoff. Please let me know in case anything else is missing.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric	Results
Duplication	0

View in Codacy

_{TIP This summary will be updated as you push new changes. Give us feedback}

[jkowalleck]

@molikuner i am still thinking about the switch's name.
what do you think which suites better and is more natural to yarn?

• --package-lock-only -- name borrowed from npm
• --lockfile-only -

my concern - the word "package" in --package-lock-only is not quire right. it is a lock for the entire space, not just the package ...

[molikuner]

Hey @jkowalleck,
I fully agree. In fact I had first implemented the switch named --lockfile-only but later changed it to --package-lock-only as the issue #49 mentioned this exact name. If you agree, I would go ahead and change the name.

[jkowalleck]

Hey @jkowalleck,
I fully agree. In fact I had first implemented the switch named --lockfile-only but later changed it to --package-lock-only as the issue #49 mentioned this exact name. If you agree, I would go ahead and change the name.

Yes, please go ahead.