adjust bom generation to only use runtime by Siedlerchr · Pull Request #14809 · JabRef/jabref

Siedlerchr · 2026-01-05T20:29:16Z

User description

Only generate runtime configuration bom

Closes _____

Steps to test

Mandatory checks

I own the copyright of the code submitted and I license it under the MIT license
[.] I manually tested my changes in running JabRef (always required)
[.] I added JUnit tests for changes (if applicable)
[.] I added screenshots in the PR description (if change is visible to the user)
[.] I described the change in CHANGELOG.md in a way that is understandable for the average user (if change is visible to the user)
[.] I checked the user documentation: Is the information available and up to date? If not, I created an issue at https://github.com/JabRef/user-documentation/issues or, even better, I submitted a pull request updating file(s) in https://github.com/JabRef/user-documentation/tree/main/en.

PR Type

Enhancement

Description

Reformats build.gradle.kts with improved code formatting
Configures CycloneDX BOM generation to include runtime and compile classpath
Excludes test-related and rewrite configurations from SBOM
Improves readability through multi-line parameter formatting

Diagram Walkthrough

flowchart LR
  A["build.gradle.kts"] -->|"Add CycloneDX config"| B["includeConfigs: runtimeClasspath, compileClasspath"]
  A -->|"Add CycloneDX config"| C["skipConfigs: test and rewrite configs"]
  A -->|"Reformat"| D["Multi-line parameter formatting"]

File Walkthrough

Relevant files

Configuration changes

build.gradle.kts `Configure CycloneDX BOM and reformat build script` build.gradle.kts Reformatted dependency declarations and task configurations with improved multi-line formatting Added `includeConfigs` to CycloneDX BOM task specifying `runtimeClasspath` and `compileClasspath` Added `skipConfigs` to exclude test-related and rewrite configurations from SBOM generation Enhanced code readability through consistent indentation and parameter separation	+43/-12

qodo-free-for-open-source-projects · 2026-01-05T20:29:41Z

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance

🟢

No security concerns identified

No security vulnerabilities detected by AI analysis. Human verification advised for critical code.

Ticket Compliance

🟡

🎫 #13109

🔴	Add Pseudonymization functionality to the CLI
	Make org.jabref.logic.pseudonymization.Pseudonymization available on the CLI
	Provide similar CLI experience to the consistency check
	Implement similar to org.jabref.cli.CheckConsistency class

Codebase Duplication Compliance

⚪

Codebase context is not defined

Follow the guide to enable codebase context checks.

Custom Compliance

🟢

Generic: Comprehensive Audit Trails

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Meaningful Naming and Self-Documenting Code

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Robust Error Handling and Edge Case Management

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Error Handling

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Logging Practices

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Security-First Input Validation and Data Handling

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Update

Compliance status legend

🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

qodo-free-for-open-source-projects · 2026-01-05T20:30:50Z

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
High-level	PR content mismatches linked issue The PR's changes, which focus on build configuration, do not match the linked issue about adding a new CLI feature. The PR should be linked to a relevant issue that describes its actual purpose. Examples: build.gradle.kts [1-99] plugins { id("org.jabref.gradle.base.repositories") id("org.jabref.gradle.feature.compile") // for openrewrite id("org.openrewrite.rewrite") version "7.23.0" id("org.itsallcode.openfasttrace") version "3.1.0" id("org.cyclonedx.bom") version "3.1.0" } // OpenRewrite should rewrite all sources // This is the behavior when applied in the root project (https://docs.openrewrite.org/reference/gradle-plugin-configuration#multi-module-gradle-projects) ... (clipped 89 lines) Solution Walkthrough: Before: // PR is linked to Issue #13109: "Add Pseudonymization to CLI" // PR content in build.gradle.kts: allprojects { tasks.cyclonedxDirectBom { includeConfigs = listOf( "runtimeClasspath", "compileClasspath" ) skipConfigs = listOf( "testRuntimeClasspath", ... ) } } After: // PR should be linked to a new or relevant issue, e.g., "Configure CycloneDX BOM generation" // PR content in build.gradle.kts remains the same: allprojects { tasks.cyclonedxDirectBom { includeConfigs = listOf( "runtimeClasspath", "compileClasspath" ) skipConfigs = listOf( "testRuntimeClasspath", ... ) } } Suggestion importance[1-10]: 10 __ Why: The suggestion correctly identifies a critical mismatch between the PR's build script changes and the linked issue's goal of adding a new CLI feature, which is a fundamental problem blocking any meaningful review.	High
Possible issue	✅ ~~Refine SBOM to exclude compile-only dependencies~~ Suggestion Impact: The suggestion was directly implemented. The commit removed "compileClasspath" from the includeConfigs list (line 50 deleted) in the cyclonedxDirectBom task configuration, exactly as suggested. Additionally, the commit added two more configurations to skipConfigs ("mockitoAgent" and "antlr"), which goes beyond the suggestion but aligns with the goal of refining the SBOM. code diff: @@ -78,14 +66,15 @@ includeConfigs = listOf( "runtimeClasspath", - "compileClasspath" ) skipConfigs = listOf( "testRuntimeClasspath", "testCompileClasspath", "testImplementation", - "rewrite" + "rewrite", + "mockitoAgent", + "antlr" ) } Remove `compileClasspath` from the `includeConfigs` list in the `cyclonedxDirectBom` task to ensure the generated SBOM only contains runtime dependencies and is more accurate. build.gradle.kts [77-91] tasks.cyclonedxDirectBom { includeConfigs = listOf( - "runtimeClasspath", - "compileClasspath" + "runtimeClasspath" ) skipConfigs = listOf( "testRuntimeClasspath", "testCompileClasspath", "testImplementation", "rewrite" ) } `[To ensure code accuracy, apply this suggestion manually]` Suggestion importance[1-10]: 8 __ Why: The suggestion correctly identifies that including `compileClasspath` can lead to an inaccurate SBOM by including compile-only dependencies, which could cause false positives in security scans.	Medium
Update

koppor

I just overlook the training comma 😅

…es/jablib/src/main/resources/csl-locales-50e46eb * upstream/main: (119 commits) chore(sbom): update CycloneDX SBOM files (#14813) Add "preferences" constant to ServiceLocator initialization (#14810) adjust bom generation to only use runtime (#14809) Remove (nearly) obsolete hint in ghprcomment.yml Update dependency org.apache.commons:commons-lang3 to v3.20.0 (#14808) Fix Nullwarnings - B (#14802) Add https Add ouput Fix stale (again) Fix output Fix re-downloading of ltwa file Chore(deps): Bump jablib/src/main/resources/csl-styles from `9bb1fc1` to `0201999` (#14796) Chore(deps): Bump org.ow2.asm:asm from 9.9 to 9.9.1 in /versions (#14799) Chore(deps): Bump org.controlsfx:controlsfx in /versions (#14800) Chore(deps): Bump org.postgresql:postgresql in /versions (#14798) Chore(deps): Bump jablib/src/main/abbrv.jabref.org (#14795) Chore(deps): Bump org.apache.logging.log4j:log4j-to-slf4j in /versions (#14797) Chore(deps): Bump org.apache.commons:commons-text from 1.14.0 to 1.15.0 in /versions (#14801) fix postgres for arm (#14792) Docs: minor grammar and clarity fixes in privacy policy (#14786) ...

adjust bom generation

9c569d9

qodo-free-for-open-source-projects Bot added the Review effort 1/5 label Jan 5, 2026

formatting

08be544

Siedlerchr added 4 commits January 5, 2026 21:33

more exlusions

9a831ed

formatting

bf82a12

only runtime

fe6b151

only runtime

f5f1d61

Siedlerchr changed the title ~~adjust bom generation~~ adjust bom generation to only use runtime Jan 5, 2026

koppor previously approved these changes Jan 5, 2026

View reviewed changes

remove comma

3a1c010

Siedlerchr dismissed koppor’s stale review via 3a1c010 January 5, 2026 21:18

Siedlerchr enabled auto-merge January 5, 2026 21:18

Siedlerchr requested a review from koppor January 5, 2026 21:18

Siedlerchr disabled auto-merge January 5, 2026 22:34

Siedlerchr merged commit d8c1532 into main Jan 5, 2026
52 checks passed

Siedlerchr deleted the cylconeDxConfig branch January 5, 2026 22:34

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

adjust bom generation to only use runtime#14809

adjust bom generation to only use runtime#14809
Siedlerchr merged 7 commits into
mainfrom
cylconeDxConfig

Siedlerchr commented Jan 5, 2026 •

edited

Loading

Uh oh!

qodo-free-for-open-source-projects Bot commented Jan 5, 2026 •

edited

Loading

Uh oh!

qodo-free-for-open-source-projects Bot commented Jan 5, 2026 •

edited

Loading

Examples:

Solution Walkthrough:

Before:

After:

Uh oh!

koppor left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Siedlerchr commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User description

Steps to test

Mandatory checks

PR Type

Description

Diagram Walkthrough

File Walkthrough

Uh oh!

qodo-free-for-open-source-projects Bot commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Compliance Guide 🔍

Uh oh!

qodo-free-for-open-source-projects Bot commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Code Suggestions ✨

Examples:

Solution Walkthrough:

Before:

After:

Uh oh!

koppor left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Siedlerchr commented Jan 5, 2026 •

edited

Loading

qodo-free-for-open-source-projects Bot commented Jan 5, 2026 •

edited

Loading

qodo-free-for-open-source-projects Bot commented Jan 5, 2026 •

edited

Loading