cdxgen-bun is confused and using npm/yarn

[crimsonvspurple]

I have a simple bun project.

On local, i tried this command:
docker run --rm -e CDXGEN_DEBUG_MODE=debug -v .:/app -t ghcr.io/cyclonedx/cdxgen-bun:master

This worked fine but then the same command didn't work in Github Actions. With some trial an error, I realized the followings:

• This will work if node_modules is already present.
• Will not work if not present. In that case, it will try
  • either npm npm install has failed. Generated SBOM will be empty or with a lower precision.
  • or yarn yarn install has failed. Generated SBOM will be empty or with a lower precision.

I'm not sure when it tries npm or yarn.

The project has bun.lockb file.

[prabhu]

Interesting. We don't support bun.lockb format, so when node_modules is available cdxgen would work in a fallback mode to recover at least the components.

I would also check the argument .:/app, since dot stands for the current directory from where the command gets executed, which could be different depending on how the CI agents interpret it and execute all the commands. So best to always pass absolute paths in CI use cases. Example: ${GITHUB_WORKSPACE}

[crimsonvspurple]

Yes, I do that in CI (use gh workspace var). But this command was something I was running on local for testing. The path (.:/app) is correct as it works just fine as long as node_modules folder is there.

Does cdxgen support bun.lock ? If not, is this planned?

And since it is a cdxgen-bun image, should it not try bun install if it can't find the lock file but finds the package file?

Right now, in the CI, I'm executing bun install --production manually before calling cdxgen.

Thank you for this great tool.

[prabhu]

I would love to add support for bun lock file. Unfortunately, at 479 downloads, it is very difficult to prioritize bun over the rest of the tickets. Happy to collaborate if you are willing to give it a go and have a branch going.

[crimsonvspurple]

I know very little about ClyconeDX; only learned about it in less than 6 months ago. But I'm happy to give it a shot.

I guess, essentially, I need to mostly copy-paste (of how yarn is supported) and work on reading bun.lock.
Would you be kind enough to give me a list of relevant files and an overview of changes/tests needed?