Skip to content

Commit 90fad1b

Browse files
saquibsaifeesaquibsaifee
authored
Merge branch 'main' into refactor/remove-package-url
2 parents d453450 + 4ef5bc3 commit 90fad1b

34 files changed

Lines changed: 642 additions & 95 deletions

‎.github/workflows/python.yml‎

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -33,16 +33,16 @@ jobs:
3333
steps:
3434
- name: Checkout
3535
# see https://github.com/actions/checkout
36-
uses: actions/checkout@v6
36+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3737
- name: Setup Python Environment
3838
# see https://github.com/actions/setup-python
39-
uses: actions/setup-python@v6
39+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
4040
with:
4141
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
4242
architecture: 'x64'
4343
- name: Install poetry
4444
# see https://github.com/marketplace/actions/setup-poetry
45-
uses: Gr1N/setup-poetry@v9
45+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
4646
with:
4747
poetry-version: ${{ env.POETRY_VERSION }}
4848
- name: Install dependencies
@@ -57,16 +57,16 @@ jobs:
5757
steps:
5858
- name: Checkout
5959
# see https://github.com/actions/checkout
60-
uses: actions/checkout@v6
60+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
6161
- name: Setup Python Environment
6262
# see https://github.com/actions/setup-python
63-
uses: actions/setup-python@v6
63+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
6464
with:
6565
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
6666
architecture: 'x64'
6767
- name: Install poetry
6868
# see https://github.com/marketplace/actions/setup-poetry
69-
uses: Gr1N/setup-poetry@v9
69+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
7070
with:
7171
poetry-version: ${{ env.POETRY_VERSION }}
7272
- name: Install dependencies
@@ -81,16 +81,16 @@ jobs:
8181
steps:
8282
- name: Checkout
8383
# see https://github.com/actions/checkout
84-
uses: actions/checkout@v6
84+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
8585
- name: Setup Python Environment
8686
# see https://github.com/actions/setup-python
87-
uses: actions/setup-python@v6
87+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
8888
with:
8989
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
9090
architecture: 'x64'
9191
- name: Install poetry
9292
# see https://github.com/marketplace/actions/setup-poetry
93-
uses: Gr1N/setup-poetry@v9
93+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
9494
with:
9595
poetry-version: ${{ env.POETRY_VERSION }}
9696
- name: Install dependencies
@@ -105,16 +105,16 @@ jobs:
105105
steps:
106106
- name: Checkout
107107
# see https://github.com/actions/checkout
108-
uses: actions/checkout@v6
108+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
109109
- name: Setup Python Environment
110110
# see https://github.com/actions/setup-python
111-
uses: actions/setup-python@v6
111+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
112112
with:
113113
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
114114
architecture: 'x64'
115115
- name: Install poetry
116116
# see https://github.com/marketplace/actions/setup-poetry
117-
uses: Gr1N/setup-poetry@v9
117+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
118118
with:
119119
poetry-version: ${{ env.POETRY_VERSION }}
120120
- name: Install dependencies
@@ -141,16 +141,16 @@ jobs:
141141
steps:
142142
- name: Checkout
143143
# see https://github.com/actions/checkout
144-
uses: actions/checkout@v6
144+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
145145
- name: Setup Python Environment
146146
# see https://github.com/actions/setup-python
147-
uses: actions/setup-python@v6
147+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
148148
with:
149149
python-version: ${{ matrix.python-version }}
150150
architecture: 'x64'
151151
- name: Install poetry
152152
# see https://github.com/marketplace/actions/setup-poetry
153-
uses: Gr1N/setup-poetry@v9
153+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
154154
with:
155155
poetry-version: ${{ env.POETRY_VERSION }}
156156
- name: Install dependencies
@@ -191,12 +191,12 @@ jobs:
191191
git config --global core.eol lf
192192
- name: Checkout
193193
# see https://github.com/actions/checkout
194-
uses: actions/checkout@v6
194+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
195195
- name: Create reports directory
196196
run: mkdir ${{ env.REPORTS_DIR }}
197197
- name: Setup Python Environment
198198
# see https://github.com/actions/setup-python
199-
uses: actions/setup-python@v6
199+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
200200
with:
201201
python-version: ${{ matrix.python-version }}
202202
architecture: 'x64'
@@ -207,7 +207,7 @@ jobs:
207207
print('Python %s on %s in %s' % (sys.version, sys.platform, sys.getdefaultencoding()))
208208
- name: Install poetry
209209
# see https://github.com/marketplace/actions/setup-poetry
210-
uses: Gr1N/setup-poetry@v9
210+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
211211
with:
212212
poetry-version: ${{ env.POETRY_VERSION }}
213213
- name: Install dependencies
@@ -226,7 +226,7 @@ jobs:
226226
- name: Artifact reports
227227
if: ${{ ! cancelled() }}
228228
# see https://github.com/actions/upload-artifact
229-
uses: actions/upload-artifact@v6
229+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
230230
with:
231231
name: ${{ env.TESTS_REPORTS_ARTIFACT }}-${{ matrix.os }}-py${{ matrix.python-version }}${{ matrix.toxenv-factors }}
232232
path: ${{ env.REPORTS_DIR }}
@@ -236,11 +236,11 @@ jobs:
236236
name: Publish test coverage
237237
needs: [ "build-and-test" ]
238238
runs-on: ubuntu-latest
239-
timeout-minutes: 5
239+
timeout-minutes: 10
240240
steps:
241241
- name: fetch test artifacts
242242
# see https://github.com/actions/download-artifact
243-
uses: actions/download-artifact@v7
243+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
244244
with:
245245
path: ${{ env.REPORTS_DIR }}
246246
pattern: ${{ env.TESTS_REPORTS_ARTIFACT }}-*
@@ -250,7 +250,7 @@ jobs:
250250
CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }}
251251
if: ${{ env.CODACY_PROJECT_TOKEN != '' }} ## see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-using-secrets
252252
# see https://github.com/codacy/codacy-coverage-reporter-action
253-
uses: codacy/codacy-coverage-reporter-action@v1
253+
uses: codacy/codacy-coverage-reporter-action@89d6c85cfafaec52c72b6c5e8b2878d33104c699 # v1
254254
with:
255255
project-token: ${{ env.CODACY_PROJECT_TOKEN }}
256256
coverage-reports: ${{ env.REPORTS_DIR }}/coverage/*
@@ -269,10 +269,10 @@ jobs:
269269
steps:
270270
- name: Checkout
271271
# see https://github.com/actions/checkout
272-
uses: actions/checkout@v6
272+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
273273
- name: Setup Python Environment
274274
# see https://github.com/actions/setup-python
275-
uses: actions/setup-python@v6
275+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
276276
with:
277277
python-version: '>=3.9 <=3.14' # supported version range
278278
- name: Validate Python Environment
@@ -282,7 +282,7 @@ jobs:
282282
print('Python %s on %s in %s' % (sys.version, sys.platform, sys.getdefaultencoding()))
283283
- name: Install poetry
284284
# see https://github.com/marketplace/actions/setup-poetry
285-
uses: Gr1N/setup-poetry@v9
285+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
286286
with:
287287
poetry-version: ${{ env.POETRY_VERSION }}
288288
- name: Install package and prod dependencies

‎.github/workflows/release.yml‎

Lines changed: 33 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -48,16 +48,16 @@ jobs:
4848
steps:
4949
- name: Checkout code
5050
# see https://github.com/actions/checkout
51-
uses: actions/checkout@v6
51+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
5252
- name: Setup Python Environment
5353
# see https://github.com/actions/setup-python
54-
uses: actions/setup-python@v6
54+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
5555
with:
5656
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
5757
architecture: 'x64'
5858
- name: Install poetry
5959
# see https://github.com/marketplace/actions/setup-poetry
60-
uses: Gr1N/setup-poetry@v9
60+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
6161
with:
6262
poetry-version: ${{ env.POETRY_VERSION }}
6363
- name: Install dependencies
@@ -70,16 +70,16 @@ jobs:
7070
steps:
7171
- name: Checkout code
7272
# see https://github.com/actions/checkout
73-
uses: actions/checkout@v6
73+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
7474
- name: Setup Python Environment
7575
# see https://github.com/actions/setup-python
76-
uses: actions/setup-python@v6
76+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
7777
with:
7878
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
7979
architecture: 'x64'
8080
- name: Install poetry
8181
# see https://github.com/marketplace/actions/setup-poetry
82-
uses: Gr1N/setup-poetry@v9
82+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
8383
with:
8484
poetry-version: ${{ env.POETRY_VERSION }}
8585
- name: Install dependencies
@@ -103,21 +103,38 @@ jobs:
103103
id-token: write
104104
contents: write
105105
steps:
106+
- name: Generate GitHub App Token
107+
id: release-bot-token
108+
# see https://github.com/actions/create-github-app-token
109+
uses: actions/create-github-app-token@v3
110+
with:
111+
# see https://github.com/organizations/CycloneDX/settings/apps/cyclonedx-releases
112+
app-id: 3335294
113+
private-key: ${{ secrets.CDX_RELEASE_BOT_PRIVATE_KEY }}
114+
- name: Get GitHub App User ID
115+
id: release-bot-user-id
116+
run: |
117+
set -xeu
118+
echo "user-id=$(gh api "/users/${{ steps.release-bot-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
119+
env:
120+
GH_TOKEN: ${{ steps.release-bot-token.outputs.token }}
121+
106122
- name: Checkout code
107123
# see https://github.com/actions/checkout
108-
uses: actions/checkout@v6
124+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
109125
with:
110126
fetch-depth: 0
127+
token: ${{ steps.release-bot-token.outputs.token }}
111128

112129
- name: Setup python
113130
# see https://github.com/actions/setup-python
114-
uses: actions/setup-python@v6
131+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
115132
with:
116133
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
117134
architecture: 'x64'
118135
- name: Install and configure Poetry
119136
# See https://github.com/marketplace/actions/install-poetry-action
120-
uses: snok/install-poetry@v1
137+
uses: snok/install-poetry@76e04a911780d5b312d89783f7b1cd627778900a # v1
121138
with:
122139
version: ${{ env.POETRY_VERSION }}
123140
virtualenvs-create: true
@@ -132,24 +149,26 @@ jobs:
132149
id: release
133150
# see https://python-semantic-release.readthedocs.io/en/latest/automatic-releases/github-actions.html
134151
# see https://github.com/python-semantic-release/python-semantic-release
135-
uses: python-semantic-release/python-semantic-release@v10.0.2
152+
uses: python-semantic-release/python-semantic-release@1a324000f2251a9e722e77b128bf72712653813f # v10.0.2
136153
with:
137-
github_token: ${{ secrets.GITHUB_TOKEN }}
154+
git_committer_name: ${{ steps.release-bot-token.outputs.app-slug }}[bot]
155+
git_committer_email: ${{ steps.release-bot-user-id.outputs.user-id }}+${{ steps.release-bot-token.outputs.app-slug }}[bot]@users.noreply.github.com
156+
github_token: ${{ steps.release-bot-token.outputs.token }}
138157
force: ${{ github.event.inputs.release_force }}
139158
prerelease: ${{ github.event.inputs.prerelease }}
140159
prerelease_token: ${{ github.event.inputs.prerelease_token }}
141160

142161
- name: Publish package distributions to PyPI
143162
if: steps.release.outputs.released == 'true'
144163
# see https://github.com/pypa/gh-action-pypi-publish
145-
uses: pypa/gh-action-pypi-publish@release/v1
164+
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
146165
with:
147166
attestations: true
148167

149168
- name: Publish package distributions to GitHub Releases
150169
if: steps.release.outputs.released == 'true'
151170
# see https://python-semantic-release.readthedocs.io/en/latest/automatic-releases/github-actions.html#python-semantic-release-publish-action
152-
uses: python-semantic-release/publish-action@v10
171+
uses: python-semantic-release/publish-action@310a9983a0ae878b29f3aac778d7c77c1db27378 # v10
153172
with:
154-
github_token: ${{ secrets.GITHUB_TOKEN }}
173+
github_token: ${{ steps.release-bot-token.outputs.token }}
155174
tag: ${{ steps.release.outputs.tag }}

‎CHANGELOG.md‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,32 @@
22

33
<!-- version list -->
44

5+
## v11.7.0 (2026-03-17)
6+
7+
### Documentation
8+
9+
- Add comprehensive SBOM validation guide
10+
([#933](https://github.com/CycloneDX/cyclonedx-python-lib/pull/933),
11+
[`bf596c0`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/bf596c0ed1495bf42add39185f460605b0ecd12a))
12+
13+
- Docstrings for schema version classes
14+
([#946](https://github.com/CycloneDX/cyclonedx-python-lib/pull/946),
15+
[`6460b71`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/6460b71b5189a10819e539f1315a7c05b9b7e40e))
16+
17+
- Modernize RTF setup ([#921](https://github.com/CycloneDX/cyclonedx-python-lib/pull/921),
18+
[`af0059d`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/af0059d8fb6c9f8cc437f6c210487d131a6f658f))
19+
20+
### Features
21+
22+
- Add properties for licenses according to CycloneDX 1.5
23+
([#947](https://github.com/CycloneDX/cyclonedx-python-lib/pull/947),
24+
[`375d209`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/375d209c738473ea2815fc4cb36806563be41e2e))
25+
26+
- Make schema deprecation warnings handle-able
27+
([#945](https://github.com/CycloneDX/cyclonedx-python-lib/pull/945),
28+
[`71edacf`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/71edacfaf5c46088d0ca08196b7c858ff39a23b5))
29+
30+
531
## v11.6.0 (2025-12-02)
632

733
### Documentation

‎CONTRIBUTING.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ poetry install --all-extras
2121

2222
## Code style
2323

24-
THis project loves latest python features.
24+
This project loves latest python features.
2525
This project loves sorted imports.
2626
This project uses [PEP8] Style Guide for Python Code.
2727

@@ -67,7 +67,7 @@ Please sign off your commits, to show that you agree to publish your changes und
6767
, and to indicate agreement with [Developer Certificate of Origin (DCO)](https://developercertificate.org/).
6868

6969
```shell
70-
git commit --signed-off ...
70+
git commit -s ...
7171
```
7272

7373
## Pre-commit hooks

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,8 @@
1414

1515
----
1616

17-
OWASP [CycloneDX][link_website] is a full-stack Bill of Materials (BOM) standard
18-
that provides advanced supply chain capabilities for cyber risk reduction.
17+
OWASP [CycloneDX][link_website] is a full‑stack Bill of Materials (BOM) and system‑transparency standard
18+
that provides deep visibility into software, services, hardware, and AI components, enabling advanced supply‑chain security and cyber‑risk reduction.
1919

2020
This Python package provides data models, validators and more,
2121
to help you create/render/read CycloneDX documents.

‎cyclonedx/__init__.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,4 +22,4 @@
2222

2323
# !! version is managed by semantic_release
2424
# do not use typing here, or else `semantic_release` might have issues finding the variable
25-
__version__ = "11.6.0" # noqa:Q000
25+
__version__ = "11.7.0" # noqa:Q000

‎cyclonedx/model/bom.py‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
from .._internal.compare import ComparableTuple as _ComparableTuple
3131
from .._internal.time import get_now_utc as _get_now_utc
3232
from ..exception.model import LicenseExpressionAlongWithOthersException, UnknownComponentDependencyException
33+
from ..schema.deprecation import SchemaDeprecationWarning1Dot6
3334
from ..schema.schema import (
3435
SchemaVersion1Dot0,
3536
SchemaVersion1Dot1,
@@ -291,10 +292,7 @@ def manufacture(self, manufacture: Optional[OrganizationalEntity]) -> None:
291292
we should set this data on `.component.manufacturer`.
292293
"""
293294
if manufacture is not None:
294-
warn(
295-
'`bom.metadata.manufacture` is deprecated from CycloneDX v1.6 onwards. '
296-
'Please use `bom.metadata.component.manufacturer` instead.',
297-
DeprecationWarning)
295+
SchemaDeprecationWarning1Dot6._warn('bom.metadata.manufacture', 'bom.metadata.component.manufacturer')
298296
self._manufacture = manufacture
299297

300298
@property

0 commit comments

Comments
 (0)