.github/workflows/repotests.yml

name: Repo tests

on:
  workflow_dispatch:
  pull_request:
    paths-ignore:
      - 'docs/**'
      - '*.md'
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true
jobs:
  cli-tests:
    strategy:
      fail-fast: true
      matrix:
        node-version: ['23.x']
        os: ['windows-latest']
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '23'
      - uses: actions/setup-go@v5
        with:
          go-version: '1.23'
      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
      - uses: denoland/setup-deno@v2
        with:
          deno-version: v2.x
      - uses: oven-sh/setup-bun@v1
      - name: Trim CI agent
        if: matrix.os == 'ubuntu-24.04' || matrix.os == 'ubuntu-24.04-arm'
        run: |
          chmod +x contrib/free_disk_space.sh
          ./contrib/free_disk_space.sh
      - uses: sbt/setup-sbt@v1
      - name: Install bazelisk - linux
        if: matrix.os == 'ubuntu-24.04'
        run: |
          curl -LO "https://github.com/bazelbuild/bazelisk/releases/download/v1.20.0/bazelisk-linux-amd64"
          sudo mv bazelisk-linux-amd64 /usr/local/bin/bazel
          chmod +x /usr/local/bin/bazel
      - name: Install bazelisk - linux arm
        if: matrix.os == 'ubuntu-24.04-arm'
        run: |
          curl -LO "https://github.com/bazelbuild/bazelisk/releases/download/v1.20.0/bazelisk-linux-arm64"
          sudo mv bazelisk-linux-arm64 /usr/local/bin/bazel
          chmod +x /usr/local/bin/bazel
      - name: Install bazelisk - mac
        if: matrix.os == 'macos-15'
        run: |
          brew install bazelisk
      - name: Install bazelisk - windows
        if: matrix.os == 'windows-latest'
        run: choco install -y bazel
      - name: npm install, build and test
        run: |
          corepack enable
          corepack pnpm install --package-import-method copy
          corepack pnpm test
          mkdir -p repotests
          mkdir -p bomresults
          mkdir -p denoresults
        env:
          CI: true
          CDXGEN_TEMP_DIR: ${{ runner.temp }}/cdxgen-repotests
      - name: Setup Android SDK
        uses: android-actions/setup-android@v3
        with:
          packages: 'platform-tools'
      - run: sdkmanager --uninstall "build-tools;30.0.3"
      - uses: swift-actions/setup-swift@v2
        if: matrix.os == 'ubuntu-24.04' || matrix.os == 'macos-15'
        with:
          swift-version: '6.0'
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.4'
          bundler-cache: true
      - name: pip install custom-json-diff
        run: |
          pip install custom-json-diff
#      - uses: actions/checkout@v4
#        with:
#          repository: 'ShiftLeftSecurity/shiftleft-java-example'
#          path: 'repotests/shiftleft-java-example'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'ShiftLeftSecurity/shiftleft-ts-example'
#          path: 'repotests/shiftleft-ts-example'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'ShiftLeftSecurity/shiftleft-go-example'
#          path: 'repotests/shiftleft-go-example'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'prabhu/shiftleft-scala-example'
#          path: 'repotests/shiftleft-scala-example'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'HooliCorp/vulnerable_net_core'
#          path: 'repotests/vulnerable_net_core'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'HooliCorp/Goatly.NET'
#          path: 'repotests/Goatly.NET'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'HooliCorp/DjanGoat'
#          path: 'repotests/DjanGoat'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'prabhu/Vulnerable-Web-Application'
#          path: 'repotests/Vulnerable-Web-Application'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'prabhu/railsgoat'
#          path: 'repotests/railsgoat'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'bazelbuild/examples'
#          path: 'repotests/bazel-examples'
#          ref: 'b51e3bdd468ce8c4a516d7dca993909dcc84af32'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'flutter/gallery'
#          ref: 'v2.10.2'
#          path: 'repotests/gallery'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'gojek/ziggurat'
#          ref: '4.9.4'
#          path: 'repotests/ziggurat'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'apple/swift-markdown'
#          ref: '0.3.0'
#          path: 'repotests/swift-markdown'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'GoogleCloudPlatform/microservices-demo'
#          ref: 'v0.8.1'
#          path: 'repotests/microservices-demo'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'zoom/meetingsdk-vuejs-sample'
#          ref: 'v2.18.0'
#          path: 'repotests/meetingsdk-vuejs-sample'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'kriasoft/react-app'
#          path: 'repotests/react-app'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'patrickjuchli/basic-ftp'
#          path: 'repotests/basic-ftp'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'Atome-FE/llama-node'
#          path: 'repotests/llama-node'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'DIYgod/RSSHub'
#          path: 'repotests/RSSHub'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'sveltejs/examples'
#          path: 'repotests/sveltejs-examples'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'openpbs/openpbs'
#          ref: 'v23.06.06'
#          path: 'repotests/openpbs'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'home-assistant/android'
#          ref: '2023.11.3'
#          path: 'repotests/ha-android'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'rust-lang/rust'
#          ref: '1.74.0'
#          path: 'repotests/rs-rust'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'rust-lang/cargo'
#          ref: '0.75.0'
#          path: 'repotests/rs-cargo'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'Keats/validator'
#          ref: 'v0.15.0'
#          path: 'repotests/rs-validator'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'tokio-rs/axum'
#          ref: 'axum-v0.6.20'
#          path: 'repotests/rs-axum'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'fsprojects/FAKE'
#          ref: '6.0.0'
#          path: 'repotests/dotnet-paket'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'timheuer/SimpleFrameworkApp'
#          ref: 'master'
#          path: 'repotests/SimpleFrameworkApp'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'chabbasaad/Reporting-Windows-Application'
#          ref: 'master'
#          path: 'repotests/Reporting-Windows-Application'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'appthreat/blint'
#          ref: 'v1.0.34'
#          path: 'repotests/blint'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'hoolicorp/java-sec-code'
#          path: 'repotests/java-sec-code'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'DefectDojo/django-DefectDojo'
#          ref: '2.28.2'
#          path: 'repotests/django-DefectDojo'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'googleprojectzero/Jackalope'
#          path: 'repotests/Jackalope'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'hritik14/broken-mvn-wrapper'
#          path: 'repotests/broken-mvn-wrapper'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'microsoft/dotnet-podcasts'
#          path: 'repotests/dotnet-podcasts'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'microsoft/react-native-windows'
#          path: 'repotests/react-native-windows'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'oracle/dbt-oracle'
#          path: 'repotests/dbt-oracle'
#          ref: 'v1.7.6'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'fortra/impacket'
#          path: 'repotests/impacket'
#          ref: 'impacket_0_9_20'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'wix/greyhound'
#          path: 'repotests/greyhound'
#          ref: '385bb84a6f712ee18064a3b5ecb8d9dcbc1c75f3'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'owasp-dep-scan/blint'
#          path: 'repotests/blint'
#          ref: 'v2.2.2'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'malice00/cdxgen-expo-test'
#          ref: 'android'
#          path: 'repotests/expo-test'
      - uses: actions/checkout@v4
        with:
          repository: 'elastic/elasticsearch'
          path: 'repotests/elasticsearch'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'quarkusio/quarkus-quickstarts'
#          path: 'repotests/quarkus-quickstarts'
#          ref: '3.17.3'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'aws-solutions/iot-device-simulator'
#          path: 'repotests/iot-device-simulator'
#          ref: 'v3.0.9'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'bionomia/bionomia'
#          path: 'repotests/bionomia'
#          ref: '5ada8b5f4a5f68561a7195e2badc2f744dc4676e'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'ollama/ollama'
#          path: 'repotests/ollama'
#          ref: 'v0.5.7'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'caddyserver/caddy'
#          path: 'repotests/caddy'
#          ref: 'v2.9.1'
#      - uses: dtolnay/rust-toolchain@stable
#      - name: setup sdkman
#        run: |
#          curl -s "https://get.sdkman.io" | bash
#        if: runner.os != 'Windows'
#      - name: setup rbenv
#        run: |
#          git clone https://github.com/rbenv/rbenv.git --depth=1 ~/.rbenv
#          echo 'export PATH="~/.rbenv/bin:$PATH"' >> ~/.bashrc
#          echo 'eval "$(~/.rbenv/bin/rbenv init - bash)"' >> ~/.bashrc
#          source ~/.bashrc
#          mkdir -p "~/.rbenv/plugins"
#          git clone https://github.com/rbenv/ruby-build.git --depth=1 "~/.rbenv/plugins/ruby-build"
#        if: runner.os != 'Windows'
#      - name: repotests react-app
#        run: |
#          FETCH_LICENSE=false bin/cdxgen.js -p -t nodejs8 repotests/react-app -o bomresults/react-app.json --fail-on-error
#          node bin/evinse.js -i bomresults/react-app.json -o bomresults/react-app.evinse.json -l javascript --with-data-flow -p repotests/react-app
#        shell: bash
#      - name: repotests basic-ftp
#        run: |
#          FETCH_LICENSE=false bin/cdxgen.js -p -t nodejs10 repotests/basic-ftp -o bomresults/basic-ftp.json --fail-on-error
#        shell: bash
#      - name: repotests llama-node
#        run: |
#          FETCH_LICENSE=false bin/cdxgen.js -p -t nodejs16 repotests/llama-node -o bomresults/llama-node.json --fail-on-error
#        shell: bash
#      - name: repotests RSSHub
#        run: |
#          FETCH_LICENSE=false bin/cdxgen.js -p -t nodejs22 repotests/RSSHub -o bomresults/RSSHub.json --fail-on-error
#        shell: bash
#      - name: repotests java-sec-code
#        run: |
#          bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-1.json --include-formulation --include-crypto --fail-on-error
#          bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-2.json --author foo --author bar --standard asvs-4.0.3
#          bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-3.json --required-only --fail-on-error
#          bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-4.json --filter postgres --filter json
#          bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-5.json --only spring --fail-on-error
#          bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-6.json --deep --evidence
#          bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-7.json --profile research --export-proto
#          bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-8.json --profile license-compliance
#          bin/cdxgen.js -p -t java -t github repotests/java-sec-code -o bomresults/bom-java-sec-code-9.json
#          bin/cdxgen.js -p -t java -exclude-type js repotests/java-sec-code -o bomresults/bom-java-sec-code-10.json
#        shell: bash
#      - name: repotests greyhound
#        if: matrix.os == 'ubuntu-24.04'
#        run: |
#          bin/cdxgen.js -p -r -t java11 repotests/greyhound -o bomresults/bom-greyhound-java.json
#          bin/cdxgen.js -p -r -t gradle repotests/greyhound -o bomresults/bom-greyhound-gradle.json
#          bin/cdxgen.js -p -r -t java11 --exclude-type bazel --exclude-type sbt repotests/greyhound -o bomresults/bom-greyhound-wobazel.json
#        shell: bash
#        env:
#          JAVA_HOME: ""
#      - name: repotests quarkus-quickstarts
#        run: |
#          bin/cdxgen.js -p -r -t quarkus repotests/quarkus-quickstarts -o bomresults/bom-quarkus-quickstarts-quarkus.json --no-recurse --fail-on-error
#          bin/cdxgen.js -p -r -t quarkus repotests/quarkus-quickstarts -o bomresults/bom-quarkus-quickstarts-quarkus.json --no-recurse --spec-version 1.5 --fail-on-error
#        shell: bash
#      - name: repotests iot-device-simulator
#        run: |
#          bin/cdxgen.js -p -t js -o bomresults/bom-iot.json repotests/iot-device-simulator --fail-on-error
#          bin/cdxgen.js -p -t js -o bomresults/bom-iot15.json repotests/iot-device-simulator --spec-version 1.5 --fail-on-error
#        shell: bash
#      - name: repotests evidence
#        run: |
#          bin/cdxgen.js -p -t js --no-recurse -o bomresults/bom.json --evidence .
#        shell: bash
#      - name: repotests django-DefectDojo
#        run: |
#          bin/cdxgen.js -t python repotests/django-DefectDojo -o bomresults/django-DefectDojo-safe.json --feature-flags safe-pip-install --fail-on-error
#          bin/cdxgen.js -t python repotests/django-DefectDojo -o bomresults/django-DefectDojo.json --deep --include-crypto --spec-version 1.6
#        shell: bash
#      - name: repotests blint
#        run: |
#          python -m pip install poetry
#          bin/cdxgen.js -t python repotests/blint -o bomresults/blint-req.json --required-only -p --fail-on-error
#          bin/cdxgen.js -t python repotests/blint -o bomresults/blint-research.json --profile research -p --fail-on-error
#        shell: bash
#      - name: repotests dbt-oracle
#        run: |
#          bin/cdxgen.js -t python repotests/dbt-oracle -o bomresults/dbt-oracle.json --deep --spec-version 1.6 --fail-on-error
#        shell: bash
#      - name: repotests impacket
#        run: |
#          bin/cdxgen.js -t python repotests/impacket -o bomresults/impacket.json --fail-on-error
#        shell: bash
#      - name: repotests pixi
#        run: |
#          mkdir pixi-sample
#          cd pixi-sample
#          curl -LO https://raw.githubusercontent.com/prefix-dev/pixi/main/pixi.lock
#          curl -LO https://raw.githubusercontent.com/prefix-dev/pixi/main/pixi.toml
#          cd ..
#          bin/cdxgen.js -t python pixi-sample -o bomresults/bom-pixi.json -p --fail-on-error
#        shell: bash
#      - name: repotests shiftleft-java-example
#        run: |
#          bin/cdxgen.js -p -r -t java repotests/shiftleft-java-example -o bomresults/bom-java.json --generate-key-and-sign
#          node bin/evinse.js -i bomresults/bom-java.json -o bomresults/bom-java.evinse.json -l java --with-data-flow -p repotests/shiftleft-java-example
#          SBOM_SIGN_ALGORITHM=RS512 SBOM_SIGN_PRIVATE_KEY=bomresults/private.key SBOM_SIGN_PUBLIC_KEY=bomresults/public.key bin/cdxgen.js -p -r -t github repotests/shiftleft-java-example -o bomresults/bom-github.json
#        shell: bash
#      - name: repotests shiftleft-ts-example
#        run: |
#          FETCH_LICENSE=false bin/cdxgen.js -p -t js repotests/shiftleft-ts-example -o bomresults/bom-ts-1.json --include-formulation
#          node bin/evinse.js -i bomresults/bom-ts-1.json -o bomresults/bom-ts.evinse.json -l javascript --with-data-flow -p repotests/shiftleft-ts-example
#          FETCH_LICENSE=true bin/cdxgen.js -p -t js repotests/shiftleft-ts-example --required-only -o bomresults/bom-ts-2.json --fail-on-error
#          FETCH_LICENSE=1 bin/cdxgen.js -p -r -t js repotests/shiftleft-ts-example -o bomresults/bom-ts-3.json --fail-on-error
#        shell: bash
#      - name: repotests meetingsdk-vuejs-sample
#        run: |
#          FETCH_LICENSE=false bin/cdxgen.js -p -t js repotests/meetingsdk-vuejs-sample -o bomresults/bom-vue.json
#          node bin/evinse.js -i bomresults/bom-vue.json -o bomresults/bom-vue.evinse.json -l javascript --with-data-flow -p repotests/meetingsdk-vuejs-sample
#        shell: bash
#      - name: repotests sveltejs-examples
#        run: |
#          CDXGEN_DEBUG_MODE=debug ASTGEN_IGNORE_DIRS="" FETCH_LICENSE=false bin/cdxgen.js -p -t js repotests/sveltejs-examples -o bomresults/bom-svelte.json
#          CDXGEN_DEBUG_MODE=debug ASTGEN_IGNORE_DIRS="" node bin/evinse.js -i bomresults/bom-svelte.json -o bomresults/bom-svelte.evinse.json -l javascript --with-data-flow -p repotests/sveltejs-examples
#          CDXGEN_DEBUG_MODE=debug ASTGEN_IGNORE_DIRS="" node bin/evinse.js -i bomresults/bom-svelte.json -o bomresults/bom-svelte.evinse.json -l javascript --with-reachables -p repotests/sveltejs-examples
#        shell: bash
#      - name: repotests shiftleft-go-example
#        run: |
#          FETCH_LICENSE=false bin/cdxgen.js -p -r -t golang repotests/shiftleft-go-example -o bomresults/bom-go.json --fail-on-error --export-proto
#        shell: bash
#      - name: repotests ollama
#        run: |
#          bin/cdxgen.js -p -r -t go repotests/ollama -o bomresults/bom-ollama.json --fail-on-error
#          bin/cdxgen.js -p -r -t go repotests/caddy -o bomresults/bom-caddy.json --fail-on-error
#        shell: bash
#      - name: repotests go mod tests
#        run: |
#          mkdir -p gomod-example
#          cd gomod-example
#          curl -LO https://raw.githubusercontent.com/anchore/syft/main/go.mod
#          cd ..
#          bin/cdxgen.js -p -r -t go gomod-example -o bomresults/bom-gomod.json -p
#        shell: bash
#      - name: repotests vulnerable_net_core
#        run: |
#          FETCH_LICENSE=true bin/cdxgen.js -p -r -t csharp repotests/vulnerable_net_core -o bomresults/bom-csharp2.json --include-formulation
#        shell: bash
#      - name: repotests Goatly.NET
#        run: |
#          FETCH_LICENSE=false bin/cdxgen.js -p -r repotests/Goatly.NET -o bomresults/bom-csharp3.json --include-formulation
#        shell: bash
#      - name: repotests DjanGoat
#        run: |
#          FETCH_LICENSE=true bin/cdxgen.js -p -r -t python repotests/DjanGoat -o bomresults/bom-python.json --fail-on-error
#        shell: bash
#      - name: repotests Vulnerable-Web-Application
#        run: |
#          bin/cdxgen.js -p -t php repotests/Vulnerable-Web-Application -o bomresults/bom-php-1.json --fail-on-error
#          bin/cdxgen.js -p -t php --no-recurse repotests/Vulnerable-Web-Application -o bomresults/bom-php-2.json --fail-on-error --profile research -p
#        shell: bash
#      - name: repotests railsgoat
#        run: |
#          bin/cdxgen.js -r -t ruby repotests/railsgoat -o bomresults/bom-ruby.json --fail-on-error
#        shell: bash
#      - name: repotests bionomia
#        run: |
#          bin/cdxgen.js -r -t ruby repotests/bionomia -o bomresults/bom-bionomia.json --fail-on-error
#        shell: bash
#      - name: repotests bazel-examples
#        run: |
#          bin/cdxgen.js -p -r -t java17 repotests/bazel-examples/java-maven -o bomresults/bom-bazel.json
#        shell: bash
#      - name: repotests gallery
#        run: |
#          bin/cdxgen.js -p -r -t dart repotests/gallery -o bomresults/bom-pub.json --fail-on-error
#        shell: bash
#      - name: repotests ziggurat
#        run: |
#          CDXGEN_DEBUG_MODE=debug bin/cdxgen.js -p -r -t clojure repotests/ziggurat -o bomresults/bom-clj.json --fail-on-error
#        shell: bash
#      - name: repotests swift-markdown
#        if: matrix.os == 'ubuntu-24.04' || matrix.os == 'macos-15'
#        run: |
#          CDXGEN_DEBUG_MODE=debug bin/cdxgen.js -p -r -t swift repotests/swift-markdown -o bomresults/bom-swift.json
#          CDXGEN_DEBUG_MODE=debug bin/cdxgen.js -p -r -t swift repotests/swift-markdown -o bomresults/bom-swift.json --profile research
#        shell: bash
#      - name: repotests microservices-demo
#        if: matrix.os == 'windows-latest'
#        run: |
#          bin/cdxgen.js -p --no-recurse repotests/microservices-demo -o bomresults/bom-msd-1.json
#          bin/cdxgen.js -p -r repotests/microservices-demo -o bomresults/bom-msd-2.json
#          bin/cdxgen.js -p -r -t universal repotests/microservices-demo -o bomresults/bom-yaml.json
#        shell: bash
#      - name: repotests openpbs
#        run: |
#          bin/cdxgen.js -p -r -t c repotests/openpbs -o bomresults/bom-openpbs.json
#          bin/cdxgen.js -p -r -t c repotests/openpbs -o bomresults/bom-openpbs.json --min-confidence 0.4
#          bin/cdxgen.js -p -r -t c repotests/openpbs -o bomresults/bom-openpbs.json --technique manifest-analysis
#        shell: bash
#      - name: repotests Jackalope
#        run: |
#          bin/cdxgen.js -p -r -t c repotests/Jackalope -o bomresults/bom-Jackalope.json
#        shell: bash
#      - name: repotests ha-android
#        run: |
#          cd repotests/ha-android && ./gradlew assembleDebug || true && cd ../..
#          bin/cdxgen.js -r -t java repotests/ha-android -o bomresults/bom-android.json
#          CDXGEN_DEBUG_MODE=debug bin/evinse.js -i bomresults/bom-android.json -o bomresults/bom-android.evinse.json -l java repotests/ha-android
#        shell: bash
#      - name: repotests rust
#        run: |
#          bin/cdxgen.js -p -r -t rust repotests/rs-rust -o bomresults/bom-rs-rust.json --fail-on-error
#          bin/cdxgen.js -p -r -t rust repotests/rs-cargo -o bomresults/bom-rs-cargo.json --fail-on-error
#          cargo generate-lockfile --manifest-path repotests/rs-validator/validator/Cargo.toml
#          bin/cdxgen.js -p -r -t rust repotests/rs-validator -o bomresults/bom-rs-validator.json --fail-on-error
#          bin/cdxgen.js -p -r -t rust repotests/rs-axum -o bomresults/bom-rs-axum.json --fail-on-error
#        shell: bash
#      - name: repotests dotnet-paket
#        run: |
#          bin/cdxgen.js -r -t dotnet repotests/dotnet-paket -o bomresults/bom-dotnet-paket.json --deep
#          FETCH_LICENSE=true bin/cdxgen.js -r -t dotnet repotests/dotnet-paket -o bomresults/bom-dotnet-paket-2.json --fail-on-error
#          bin/cdxgen.js -r -t dotnet repotests/dotnet-podcasts -o bomresults/bom-dotnet-podcasts.json --profile research --export-proto
#          bin/cdxgen.js -r -t dotnet repotests/react-native-windows -o bomresults/bom-react-native-windows.json
#        shell: bash
#      - name: repotests SimpleFrameworkApp
#        run: |
#          bin/cdxgen.js -p -r -t dotnet-framework repotests/SimpleFrameworkApp -o bomresults/bom-dotnet-framework.json
#          bin/cdxgen.js -p -r -t dotnet-framework repotests/Reporting-Windows-Application -o bomresults/bom-dotnet-framework-reporting.json --deep
#        shell: bash
#      - name: repotests blint
#        run: |
#          bin/cdxgen.js -p -t python repotests/blint -o bomresults/bom-blint.json
#          bin/cdxgen.js -p -t python repotests/blint -o bomresults/bom-blint-deep.json --deep
#          bin/cdxgen.js -p -t java repotests/broken-mvn-wrapper -o bomresults/bom-broken-mvn-wrapper.json
#        shell: bash
#      - name: repotests expo
#        run: |
#          cd repotests/expo-test && npm ci && cd ../..
#          GRADLE_ARGS_DEPENDENCIES="--configuration releaseRuntimeClasspath" GRADLE_SKIP_MODULES=root                               bin/cdxgen.js -p -t gradle        repotests/expo-test -o bomresults/bom-expo.json
#          GRADLE_ARGS_DEPENDENCIES="--configuration releaseRuntimeClasspath" GRADLE_SKIP_MODULES=root GRADLE_RESOLVE_FROM_NODE=true bin/cdxgen.js -p -t gradle        repotests/expo-test -o bomresults/bom-expo-npm.json
#          GRADLE_ARGS_DEPENDENCIES="--configuration releaseRuntimeClasspath" GRADLE_SKIP_MODULES=root GRADLE_RESOLVE_FROM_NODE=true bin/cdxgen.js -p -t gradle -t npm repotests/expo-test -o bomresults/bom-expo-multi.json
#        shell: bash
      - name: repotests elasticsearch
        run: |
          bin/cdxgen.js -t gradle repotests/elasticsearch -o bomresults/bom-elasticsearch.json
          GRADLE_INCLUDED_BUILDS=:build-conventions,:build-tools,:build-tools-internal bin/cdxgen.js -t gradle repotests/elasticsearch -o bomresults/bom-elasticsearch-with-included-builds.json
          custom-json-diff -i bomresults/bom-elasticsearch.json bomresults/bom-elasticsearch-with-included-builds.json -o bomresults/diff-elasticsearch preset-diff
        shell: bash
#      - name: jenkins plugins
#        run: |
#          mkdir -p jenkins
#          curl -LO https://updates.jenkins.io/download/plugins/sonar/2.14/sonar.hpi
#          curl -LO https://updates.jenkins.io/download/plugins/bouncycastle-api/2.26/bouncycastle-api.hpi
#          curl -LO https://updates.jenkins.io/download/plugins/jsch/0.1.55.61.va_e9ee26616e7/jsch.hpi
#          curl -LO https://updates.jenkins.io/download/plugins/momentjs/1.1.1/momentjs.hpi
#          mv *.hpi jenkins
#          CDXGEN_DEBUG_MODE=debug bin/cdxgen.js -p -r -t jenkins jenkins -o bomresults/bom-jenkins.json --fail-on-error
#        shell: bash
#      - name: standalone jar files
#        run: |
#          mkdir -p standalone-jar-files
#          curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/org/jacoco/org.jacoco.report/0.8.8/org.jacoco.report-0.8.8.jar
#          curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/org/apache/ws/xmlschema/xmlschema-core/2.2.5/xmlschema-core-2.2.5.jar
#          curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-core/2.16.0/jackson-core-2.16.0.jar
#          curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/junit/junit/4.13.2/junit-4.13.2.jar
#          curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/wsdl4j/wsdl4j/1.6.3/wsdl4j-1.6.3.jar
#          curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/org/apache/maven/maven-core/3.9.2/maven-core-3.9.2.jar
#          curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/displaytag/displaytag/1.2/displaytag-1.2.jar
#          curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/org/apache/poi/poi/3.17/poi-3.17.jar
#          curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/org/jacoco/org.jacoco.agent/0.8.8/org.jacoco.agent-0.8.8.jar
#          curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/javax/jws/javax.jws-api/1.1/javax.jws-api-1.1.jar
#          curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/org/jrobin/jrobin/1.5.9/jrobin-1.5.9.jar
#          FETCH_LICENSE=true bin/cdxgen.js -p standalone-jar-files -o bomresults/bom-standalone-jar-files.json --fail-on-error
#        shell: bash
#      - name: post-build lifecycle tests
#        run: |
#          pip install blint
#          mkdir -p bintests
#          cd bintests
#          curl -LO https://github.com/owasp-dep-scan/dosai/releases/download/v0.1.1/Dosai.exe
#          curl -LO https://github.com/owasp-dep-scan/dosai/releases/download/v0.1.1/Dosai
#          curl -LO https://github.com/owasp-dep-scan/dosai/releases/download/v0.1.1/Dosai-osx-arm64
#          cd ..
#          bin/cdxgen.js -p -t dotnet --lifecycle post-build -o bomresults/bom-binary.json bintests
#          mkdir -p gobintests
#          cd gobintests
#          curl -LO https://github.com/anchore/syft/releases/download/v1.0.1/syft_1.0.1_linux_arm64.tar.gz
#          tar -xvf syft_1.0.1_linux_arm64.tar.gz
#          rm syft_1.0.1_linux_arm64.tar.gz
#          curl -LO https://github.com/containerd/containerd/releases/download/v2.0.0-rc.0/containerd-static-2.0.0-rc.0-linux-amd64.tar.gz
#          tar -xvf containerd-static-2.0.0-rc.0-linux-amd64.tar.gz
#          rm containerd-static-2.0.0-rc.0-linux-amd64.tar.gz
#          cd ..
#          bin/cdxgen.js -p -t go --lifecycle post-build -o bomresults/bom-go-binary.json gobintests
#        shell: bash
#      - name: repotests 1.6
#        run: |
#          bin/cdxgen.js -r -t java repotests/shiftleft-java-example -o bomresults/1.6-bom-java.json --generate-key-and-sign --spec-version 1.6
#          SBOM_SIGN_ALGORITHM=RS512 SBOM_SIGN_PRIVATE_KEY=bomresults/private.key SBOM_SIGN_PUBLIC_KEY=bomresults/public.key bin/cdxgen.js -p -r -t github repotests/shiftleft-java-example -o bomresults/1.6-bom-github.json --spec-version 1.6
#          FETCH_LICENSE=0 bin/cdxgen.js -r -t js repotests/shiftleft-ts-example -o bomresults/1.6-bom-ts-1.json --fail-on-error --spec-version 1.6
#          FETCH_LICENSE=1 bin/cdxgen.js -r -t javascript repotests/shiftleft-ts-example --required-only -o bomresults/1.6-bom-ts-2.json --fail-on-error --spec-version 1.6
#          FETCH_LICENSE=true bin/cdxgen.js -r -t csharp repotests/vulnerable_net_core -o bomresults/1.6-bom-csharp2.json --spec-version 1.6
#          FETCH_LICENSE=false bin/cdxgen.js -r repotests/Goatly.NET -o bomresults/1.6-bom-csharp3.json --spec-version 1.6
#          FETCH_LICENSE=true bin/cdxgen.js -r -t python repotests/DjanGoat -o bomresults/1.6-bom-python.json --fail-on-error --spec-version 1.6
#          bin/cdxgen.js -r -t php repotests/Vulnerable-Web-Application -o bomresults/1.6-bom-php.json --fail-on-error --spec-version 1.6
#        shell: bash
#      - name: repotests 1.4
#        run: |
#          bin/cdxgen.js -r -t java repotests/shiftleft-java-example -o bomresults/1.4-bom-java.json --generate-key-and-sign --spec-version 1.4
#          SBOM_SIGN_ALGORITHM=RS512 SBOM_SIGN_PRIVATE_KEY=bomresults/private.key SBOM_SIGN_PUBLIC_KEY=bomresults/public.key bin/cdxgen.js -p -r -t github repotests/shiftleft-java-example -o bomresults/1.4-bom-github.json --spec-version 1.4
#          FETCH_LICENSE=0 bin/cdxgen.js -r -t js repotests/shiftleft-ts-example -o bomresults/1.4-bom-ts-1.json --fail-on-error --spec-version 1.4
#          FETCH_LICENSE=1 bin/cdxgen.js -r -t javascript repotests/shiftleft-ts-example --required-only -o bomresults/1.4-bom-ts-2.json --fail-on-error --spec-version 1.4
#          FETCH_LICENSE=true bin/cdxgen.js -r -t csharp repotests/vulnerable_net_core -o bomresults/1.4-bom-csharp2.json --spec-version 1.4
#          FETCH_LICENSE=false bin/cdxgen.js -r repotests/Goatly.NET -o bomresults/1.4-bom-csharp3.json --spec-version 1.4
#          FETCH_LICENSE=true bin/cdxgen.js -r -t python repotests/DjanGoat -o bomresults/1.4-bom-python.json --fail-on-error --spec-version 1.4
#          bin/cdxgen.js -p -r -t php repotests/Vulnerable-Web-Application -o bomresults/1.4-bom-php.json --fail-on-error --spec-version 1.4
#        shell: bash
#      - name: list repotest bomresults
#        run: |
#          ls -ltr bomresults
#        shell: bash
#      - name: denotests
#        run: |
#          deno info bin/cdxgen.js
#          deno info bin/evinse.js
#          deno run --allow-read --allow-env --allow-run --allow-sys=uid,systemMemoryInfo,gid,homedir --allow-write --allow-net bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-deno.json --deep
#          deno run --allow-read --allow-env --allow-run --allow-sys=uid,systemMemoryInfo,gid,homedir --allow-write --allow-net bin/cdxgen.js -p -t python repotests/django-DefectDojo -o bomresults/django-DefectDojo-deno.json --deep
#        env:
#          FETCH_LICENSE: true
#        shell: bash
#      - name: buntests
#        run: |
#          rm -rf node_modules
#          bun install
#          bun --bun bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-bun.json --deep
#          bun --bun bin/cdxgen.js -p -t python repotests/django-DefectDojo -o bomresults/django-DefectDojo-bun.json
#        continue-on-error: true
#        shell: bash
#      - uses: actions/upload-artifact@v4
#        if: github.ref == 'refs/heads/master' && matrix.os == 'ubuntu-24.04-arm'
#        with:
#          name: bomresults
#          path: bomresults
#
#  secure-mode-tests:
#    strategy:
#      fail-fast: true
#      matrix:
#        node-version: ['23.x']
#        os: ['ubuntu-24.04', 'ubuntu-24.04-arm', 'macos-15']
#    runs-on: ${{ matrix.os }}
#    env:
#      CDXGEN_DEBUG_MODE: debug
#      NODE_NO_WARNINGS: 1
#    steps:
#      - uses: actions/checkout@v4
#      - name: Set up JDK
#        uses: actions/setup-java@v4
#        with:
#          distribution: 'temurin'
#          java-version: '23'
#      - uses: actions/setup-go@v5
#        with:
#          go-version: '1.23'
#      - name: Use Node.js ${{ matrix.node-version }}
#        uses: actions/setup-node@v4
#        with:
#          node-version: ${{ matrix.node-version }}
#      - name: Trim CI agent
#        if: matrix.os == 'ubuntu-24.04' || matrix.os == 'ubuntu-24.04-arm'
#        run: |
#          chmod +x contrib/free_disk_space.sh
#          ./contrib/free_disk_space.sh
#      - uses: sbt/setup-sbt@v1
#      - name: Install bazelisk - linux
#        if: matrix.os == 'ubuntu-24.04'
#        run: |
#          curl -LO "https://github.com/bazelbuild/bazelisk/releases/download/v1.20.0/bazelisk-linux-amd64"
#          sudo mv bazelisk-linux-amd64 /usr/local/bin/bazel
#          chmod +x /usr/local/bin/bazel
#      - name: Install bazelisk - linux arm
#        if: matrix.os == 'ubuntu-24.04-arm'
#        run: |
#          curl -LO "https://github.com/bazelbuild/bazelisk/releases/download/v1.20.0/bazelisk-linux-arm64"
#          sudo mv bazelisk-linux-arm64 /usr/local/bin/bazel
#          chmod +x /usr/local/bin/bazel
#      - name: Install bazelisk - mac
#        if: matrix.os == 'macos-15'
#        run: |
#          brew install bazelisk
#      - name: Install bazelisk - windows
#        if: matrix.os == 'windows-latest'
#        run: choco install -y bazel
#      - name: npm install, build and test
#        run: |
#          corepack enable
#          corepack pnpm install --package-import-method copy
#          mkdir -p repotests
#          mkdir -p bomresults
#        env:
#          CI: true
#          CDXGEN_TEMP_DIR: ${{ runner.temp }}/cdxgen-repotests
#      - name: Set up Python
#        uses: actions/setup-python@v5
#        with:
#          python-version: '3.12'
#      - uses: ruby/setup-ruby@v1
#        with:
#          ruby-version: '3.4'
#          bundler-cache: true
#      - name: pip install custom-json-diff
#        run: |
#          pip install custom-json-diff
#      - uses: actions/checkout@v4
#        with:
#          repository: 'hoolicorp/java-sec-code'
#          path: 'repotests/java-sec-code'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'quarkusio/quarkus-quickstarts'
#          path: 'repotests/quarkus-quickstarts'
#          ref: '3.17.3'
#      - uses: actions/checkout@v4
#        with:
#          repository: 'aws-solutions/iot-device-simulator'
#          path: 'repotests/iot-device-simulator'
#          ref: 'v3.0.9'
#      - name: setup sdkman
#        run: |
#          curl -s "https://get.sdkman.io" | bash
#        if: runner.os != 'Windows'
#      - name: setup rbenv
#        run: |
#          git clone https://github.com/rbenv/rbenv.git --depth=1 ~/.rbenv
#          echo 'export PATH="~/.rbenv/bin:$PATH"' >> ~/.bashrc
#          echo 'eval "$(~/.rbenv/bin/rbenv init - bash)"' >> ~/.bashrc
#          source ~/.bashrc
#          mkdir -p "~/.rbenv/plugins"
#          git clone https://github.com/rbenv/ruby-build.git --depth=1 "~/.rbenv/plugins/ruby-build"
#        if: runner.os != 'Windows'
#      - name: repotests - no exec
#        run: |
#          bin/cdxgen.js -p -t pnpm ${GITHUB_WORKSPACE} --no-recurse -o ${GITHUB_WORKSPACE}/bomresults/bom-self.json --fail-on-error
#        shell: bash
#        env:
#          NODE_OPTIONS: "--permission --allow-fs-read=${{ runner.temp }}/cdxgen-repotests/* --allow-fs-read=${{ github.workspace }}/* --allow-fs-write=${{ github.workspace }}/bomresults/bom-self.json --trace-warnings"
#          CDXGEN_TEMP_DIR: ${{ runner.temp }}/cdxgen-repotests
#          JAVA_HOME: ""
#      - name: repotests
#        run: |
#          bin/cdxgen.js -p -t java ${GITHUB_WORKSPACE}/repotests/java-sec-code -o ${GITHUB_WORKSPACE}/bomresults/bom-java-sec-code-1.json --fail-on-error
#          bin/cdxgen.js -p -t java ${GITHUB_WORKSPACE}/repotests/java-sec-code -o ${GITHUB_WORKSPACE}/bomresults/bom-java-sec-code-2.json --author foo --author bar --standard asvs-4.0.3
#          bin/cdxgen.js -p -t java ${GITHUB_WORKSPACE}/repotests/java-sec-code -o ${GITHUB_WORKSPACE}/bomresults/bom-java-sec-code-3.json --required-only --fail-on-error
#          bin/cdxgen.js -p -t java ${GITHUB_WORKSPACE}/repotests/java-sec-code -o ${GITHUB_WORKSPACE}/bomresults/bom-java-sec-code-4.json --filter postgres --filter json
#          bin/cdxgen.js -p -r -t quarkus ${GITHUB_WORKSPACE}/repotests/quarkus-quickstarts -o ${GITHUB_WORKSPACE}/bomresults/bom-quarkus-quickstarts-quarkus.json --no-recurse --fail-on-error
#          bin/cdxgen.js -p -t js -o ${GITHUB_WORKSPACE}/bomresults/bom-iot.json ${GITHUB_WORKSPACE}/repotests/iot-device-simulator --fail-on-error
#        shell: bash
#        env:
#          NODE_OPTIONS: "--permission --allow-fs-read=/home/runner/* --allow-fs-read=/tmp/* --allow-fs-read=/run/user/1001/* --allow-fs-read=/opt/hostedtoolcache/* --allow-fs-write=/tmp/* --allow-fs-read=/Users/runner/* --allow-fs-read=${{ github.workspace }}/* --allow-fs-write=${{ github.workspace }}/bomresults/*.json --allow-fs-read=${{ runner.temp }}/* --allow-fs-write=${{ runner.temp }}/* --allow-child-process --trace-warnings"
#          CDXGEN_TEMP_DIR: ${{ runner.temp }}/cdxgen-repotests