2.0 dev threat modeling petras suggestions

.github/workflows/build_docs.yml

@@ -21,7 +21,7 @@ jobs:
     steps:
     - name: Checkout
       # see https://github.com/actions/checkout
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
     - name: Set up JDK
       # see https://github.com/actions/setup-java
       uses: actions/setup-java@v5
@@ -33,7 +33,7 @@ jobs:
       run: ./gen.sh
     - name: Archive Schema documentation
       # https://github.com/actions/upload-artifact
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v6
       with:
         name: XML-Schema-documentation
         path: docgen/xml/docs
@@ -46,7 +46,7 @@ jobs:
     steps:
     - name: Checkout
       # see https://github.com/actions/checkout
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
     - name: Setup Python Environment
       # see https://github.com/actions/setup-python
       uses: actions/setup-python@v6
@@ -57,7 +57,7 @@ jobs:
       run: ./gen.sh
     - name: Archive Schema documentation
       # https://github.com/actions/upload-artifact
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v6
       with:
         name: JSON-Schema-documentation
         path: docgen/json/docs
@@ -70,12 +70,12 @@ jobs:
     steps:
     - name: Checkout
       # see https://github.com/actions/checkout
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
     - name: Generate Schema documentation
       run: ./gen.sh
     - name: Archive Schema documentation
       # https://github.com/actions/upload-artifact
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v6
       with:
         name: PROTO-Schema-documentation
         path: docgen/proto/docs

.github/workflows/bundle-schema.yml

@@ -0,0 +1,42 @@
+name: Bundle JSON Schema with Versioned Output
+
+on:
+  push:
+    paths:
+      - 'schemas/**'
+      - '.github/workflows/bundle-schema.yml'
+  workflow_dispatch:
+
+jobs:
+  bundle-schema:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install AJV CLI
+        run: npm install -g ajv-cli
+
+      - name: Extract Version and Bundle Schema
+        run: |
+          VERSION=$(basename schemas/cyclonedx-bom-*.schema.json | sed -E 's/bom-([0-9]+\.[0-9]+)\.schema\.json/\1/')
+          echo "Detected version: $VERSION"
+
+          mkdir -p dist
+
+          ajv compile \
+            -s schemas/cyclonedx-bom-$VERSION.schema.json \
+            -r schemas/cyclonedx-metadata-$VERSION.schema.json \
+            -o dist/cyclonedx-bom-combined-$VERSION.schema.json \
+            --strict=false
+
+      - name: Upload Combined Schema
+        uses: actions/upload-artifact@v4
+        with:
+          name: bundled-schema
+          path: dist/bom-*-combined.schema.json

.github/workflows/bundle_2.0_schemas.yml

@@ -7,7 +7,7 @@ on:
       - 2.0-dev-threatmodeling
     paths:
       - 'schema/2.0/**/*.schema.json'
-      - 'tools/src/main/js/bundler/bundle-schemas.js'
+      - 'tools/src/main/js/bundle-schemas.js'
   workflow_dispatch:  # Allows manual trigger
 
 jobs:
@@ -19,41 +19,40 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '20'
 
       - name: Install dependencies
-        working-directory: tools/src/main/js/bundler
+        working-directory: tools/src/main/js
         run: npm install
 
       - name: Bundle schemas
-        working-directory: tools/src/main/js/bundler
+        working-directory: tools/src/main/js
         run: |
           node bundle-schemas.js \
-            ../../../../../schema/2.0/model \
-            ../../../../../schema/2.0/cyclonedx-2.0.schema.json
+            ../../../../schema/2.0/model \
+            ../../../../schema/2.0/cyclonedx-2.0.schema.json
 
       - name: Check for changes and commit
         run: |
           BUNDLED_FILE="schema/2.0/cyclonedx-2.0-bundled.schema.json"
-          MINIFIED_FILE="schema/2.0/cyclonedx-2.0-bundled.min.schema.json"
 
-          # Add both files (works for both new and modified files)
-          git add "$BUNDLED_FILE" "$MINIFIED_FILE"
+          # Add the file (works for both new and modified files)
+          git add "$BUNDLED_FILE"
 
           # Check if there are staged changes
           if git diff --staged --quiet; then
-            echo "No changes to bundled schemas"
+            echo "No changes to bundled schema"
           else
             echo "Committing bundled schema changes"
             git config --local user.email "github-actions[bot]@users.noreply.github.com"
             git config --local user.name "github-actions[bot]"
-            git commit -m "chore: update bundled schemas [skip ci]"
+            git commit -m "chore: update bundled schema [skip ci]"
             git push
-          fi
+          fi

.github/workflows/test_java.yml

@@ -23,7 +23,7 @@ jobs:
     steps:
     - name: Checkout
       # see https://github.com/actions/checkout
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
     - name: Set up JDK
       # see https://github.com/actions/setup-java
       uses: actions/setup-java@v5

.github/workflows/test_js.yml

@@ -26,7 +26,7 @@ jobs:
     steps:
       - name: Checkout
         # see https://github.com/actions/checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Setup Node.js
         # see https://github.com/actions/setup-node
         uses: actions/setup-node@v6

.github/workflows/test_php.yml

@@ -26,7 +26,7 @@ jobs:
     steps:
       - name: Checkout
         # see https://github.com/actions/checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Setup PHP
         # see https://github.com/shivammathur/setup-php
         uses: shivammathur/setup-php@v2

.github/workflows/test_proto.yml

@@ -26,6 +26,6 @@ jobs:
     steps:
       - name: Checkout
         # see https://github.com/actions/checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Run test
         run: ./test.sh

CycloneDX Specifiation.xpr

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project>
+    <meta>
+        <filters directoryPatterns="" filePatterns="\QCycloneDX Specifiation.xpr\E" positiveFilePatterns="" showHiddenFiles="false"/>
+        <options/>
+    </meta>
+    <projectTree name="CycloneDX%20Specifiation.xpr">
+        <folder path="."/>
+    </projectTree>
+</project>