Stop adding self references and dependency constraints as direct dependencies - #670
Conversation
| final ResolvedComponentResult dependencyComponent = | ||
| ((ResolvedDependencyResult) dep).getSelected(); | ||
| if (graphNode.id.equals(dependencyComponent.getId())) { | ||
| continue; // Skip self-references |
There was a problem hiding this comment.
Im not sure how these appear, but this was a difference discovered between the direct task and aggregate task.
Due to line 105 here
The self references are hidden from the aggregate bom, but why even include them in the first place?
This in turn forced changes to how the test below asserts how many dependencies the root has. I think the test case is a bit weird. But maybe there is a good explanation for adding self-references currently? (And testing it)
|
I realize now after looking at open PRs that #641 incorporates the dependency constraint fix. Let me know if you want to prioritize that draft PR instead @skhokhlov |
@tjog it's fine to keep this PR instead |
1b20509 to
1c74ec6
Compare
Signed-off-by: Tobias Jogården <28024277+tjog@users.noreply.github.com>
This is to enable the direct bom task to also pass the dependency count test.
The cyclonedxBom aggregate task solved this by these lines in CyclonedxAggregateTask#mergeAll
```java
dependenciesByBomRef.compute(bomRef, (key, existingDeps) -> {
final List<String> nextLevelDeps = dependency.getDependencies().stream()
.map(BomReference::getRef)
.filter(ref -> !ref.equals(key))
.collect(Collectors.toList());
if (existingDeps == null) {
return new TreeSet<>(nextLevelDeps);
} else {
existingDeps.addAll(nextLevelDeps);
return existingDeps;
}
});
```
Signed-off-by: Tobias Jogården <28024277+tjog@users.noreply.github.com>
|
Hi, the failing test execution were due to the recent changes that require |
2 participants
Fixes #669
Would be great if this makes 3.0.0