@cyclonedx/cdxgen 12.3.0 → 12.3.2

package/lib/helpers/ciParsers/githubActions.poku.js

@@ -145,6 +145,41 @@ describe("githubActionsParser", () => {
     assert.deepStrictEqual(result.workflows, []);
   });
 
+  it("gracefully handles non-string run fields", () => {
+    const tmpDir = mkdtempSync(path.join(os.tmpdir(), "cdxgen-gha-"));
+    const workflowFile = path.join(tmpDir, "non-string-run.yml");
+    writeFileSync(
+      workflowFile,
+      [
+        "name: Non-string run",
+        "on: push",
+        "jobs:",
+        "  build:",
+        "    runs-on: ubuntu-latest",
+        "    steps:",
+        "      - name: Numeric run",
+        "        run: 42",
+        "      - name: Object run",
+        "        run:",
+        "          nested: true",
+      ].join("\n"),
+    );
+
+    try {
+      const result = parseWorkflowFile(workflowFile, { specVersion: 1.7 });
+      assert.strictEqual(result.workflows.length, 1);
+      assert.ok(result.workflows[0].tasks?.length > 0);
+      const runStepComp = result.components.find(
+        (component) =>
+          getProp(component, "cdx:github:step:type") === "run" &&
+          getProp(component, "cdx:github:step:command") === "42",
+      );
+      assert.ok(runStepComp, "expected numeric run step to be normalized");
+    } finally {
+      rmSync(tmpDir, { force: true, recursive: true });
+    }
+  });
+
   it("derives unnamed workflow names from the file stem without leaking Windows-style path segments", () => {
     const tmpDir = mkdtempSync(path.join(os.tmpdir(), "cdxgen-gha-"));
     const workflowFile = path.join(tmpDir, "nested\\workflow-file.yml");
@@ -220,6 +255,81 @@ describe("githubActionsParser", () => {
     );
   });
 
+  it("annotates Cargo setup, cache, and cargo run steps", () => {
+    const tmpDir = mkdtempSync(path.join(os.tmpdir(), "cdxgen-gha-cargo-"));
+    const workflowFile = path.join(tmpDir, "cargo.yml");
+    writeFileSync(
+      workflowFile,
+      [
+        "name: Cargo CI",
+        "on: push",
+        "jobs:",
+        "  rust:",
+        "    runs-on: ubuntu-latest",
+        "    steps:",
+        "      - uses: dtolnay/rust-toolchain@stable",
+        "      - uses: actions/cache@v4",
+        "        with:",
+        "          path: |",
+        "            ~/.cargo/registry",
+        "            ~/.cargo/git",
+        "          key: cargo-$" +
+          "{{ runner.os }}-$" +
+          "{{ hashFiles('**/Cargo.lock') }}",
+        "      - run: cargo build --workspace && cargo test --workspace",
+      ].join("\n"),
+    );
+
+    try {
+      const result = parseWorkflowFile(workflowFile, { specVersion: 1.7 });
+      const cargoToolchainComp = result.components.find(
+        (component) =>
+          getProp(component, "cdx:github:action:uses") ===
+          "dtolnay/rust-toolchain@stable",
+      );
+      const cargoCacheComp = result.components.find(
+        (component) =>
+          getProp(component, "cdx:github:action:uses") === "actions/cache@v4",
+      );
+      const cargoRunComp = result.components.find(
+        (component) =>
+          getProp(component, "cdx:github:step:usesCargo") === "true",
+      );
+      assert.ok(
+        cargoToolchainComp,
+        "expected Cargo toolchain action component",
+      );
+      assert.strictEqual(
+        getProp(cargoToolchainComp, "cdx:github:action:ecosystem"),
+        "cargo",
+      );
+      assert.strictEqual(
+        getProp(cargoToolchainComp, "cdx:github:action:role"),
+        "toolchain",
+      );
+      assert.ok(cargoCacheComp, "expected Cargo cache action component");
+      assert.strictEqual(
+        getProp(cargoCacheComp, "cdx:github:action:ecosystem"),
+        "cargo",
+      );
+      assert.strictEqual(
+        getProp(cargoCacheComp, "cdx:github:action:role"),
+        "cache",
+      );
+      assert.ok(cargoRunComp, "expected Cargo run step component");
+      assert.strictEqual(
+        getProp(cargoRunComp, "cdx:github:step:cargoSubcommands"),
+        "build,test",
+      );
+      assert.strictEqual(
+        getProp(cargoRunComp, "cdx:github:step:cargoWorkspaceScope"),
+        "true",
+      );
+    } finally {
+      rmSync(tmpDir, { force: true, recursive: true });
+    }
+  });
+
   describe("checkout persist-credentials property emission", () => {
     it("emits persistCredentials=true when not specified (default)", () => {
       const result = parseWorkflow("checkout-default.yml");