feat: emit webpack as metadata.tools (CycloneDX#1354)

in preparation for CycloneDX#1019 --------- Signed-off-by: Jan Kowalleck <[email protected]>
jeremylong · Jan 23, 2025 · 62a5c27 · 62a5c27
1 parent 8175f47
commit 62a5c27
Show file tree

Hide file tree

Showing 4 changed files with 223 additions and 7 deletions.
diff --git a/HISTORY.md b/HISTORY.md
@@ -10,6 +10,8 @@ All notable changes to this project will be documented in this file.
   * Option `specVersion` defaults to `"1.6"`, was `"1.4"` ([#1329] via [#1333])
   * Emit `.metadata.tools` as components ([#1330] via [#1331])  
     This affects only CycloneDX spec-version 1.5 and later.
+* Added
+  * Emit "webpack" as part of `.metadata.tools` (via [#1354])
 * Build
   * Use _TypeScript_ `v5.7.3` now, was `v5.6.3` (via [#1351])
 
@@ -18,6 +20,7 @@ All notable changes to this project will be documented in this file.
 [#1331]: https://github.com/CycloneDX/cyclonedx-webpack-plugin/pull/1331
 [#1333]: https://github.com/CycloneDX/cyclonedx-webpack-plugin/pull/1333
 [#1351]: https://github.com/CycloneDX/cyclonedx-webpack-plugin/pull/1351
+[#1354]: https://github.com/CycloneDX/cyclonedx-webpack-plugin/pull/1354
 
 ## 3.17.0 - 2025-01-10
 

diff --git a/src/plugin.ts b/src/plugin.ts
@@ -21,7 +21,7 @@ import * as CDX from '@cyclonedx/cyclonedx-library'
 import { existsSync } from 'fs'
 import * as normalizePackageJson from 'normalize-package-data'
 import { join as joinPath, resolve } from 'path'
-import { Compilation, type Compiler, sources } from 'webpack'
+import { Compilation, type Compiler, sources, version as WEBPACK_VERSION } from 'webpack'
 
 import { getPackageDescription, iterableSome, loadJsonFile } from './_helpers'
 import { Extractor } from './extractor'
@@ -385,6 +385,11 @@ export class CycloneDxWebpackPlugin {
       ? undefined
       : new Date()
 
+    bom.metadata.tools.components.add(new CDX.Models.Component(
+      CDX.Enums.ComponentType.Application,
+      'webpack',
+      { version: WEBPACK_VERSION }
+    ))
     for (const toolC of this.#makeToolCs(cdxComponentBuilder, logger.getChildLogger('ToolMaker'))) {
       bom.metadata.tools.components.add(toolC)
     }