skills.rest
cdxgen
cdxgenOFFICIAL
Explore all skills by this author →
GitHub

ecosystem-onboarding

Guides adding new language and package manager support to cdxgen.

1.1k|260|Updated Dec 30, 2019
Search Tags:#parser#ecosystem#Package Manager#sbom#lockfile#CycloneDX#cdxgen
One-click install
npx skills add https://github.com/cdxgen/cdxgen --skill ecosystem-onboarding
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ecosystem-onboarding
Source: https://github.com/cdxgen/cdxgen/tree/main/.agents/skills/ecosystem-onboarding
Command: npx skills add https://github.com/cdxgen/cdxgen --skill ecosystem-onboarding

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Adding support for a new language, package manager, or lockfile format to cdxgen touches many files and conventions, and missing any of them causes review failures or broken BOM output. This Skill provides the checklist and conventions so contributors register aliases, parsers, dispatch branches, purls, fixtures, tests, and docs correctly the first time.

Core Features & Use Cases

  • Onboarding Checklist: Walks through alias registration in PROJECT_TYPE_ALIASES, parser placement in lib/ecosystems/utils.js, create-Lang-Bom functions, and createXBom dispatch branches.
  • Convention Enforcement: Covers purl construction via tryBuildPurl/applyPurl, integrity hashes via _integrity, layering rules, safe subprocess/fs wrappers, and custom property documentation requirements.
  • Verification Workflow: Provides poku test, Biome lint, and CLI commands to validate the emitted BOM against bundled schemas.
  • Use Case: A contributor wants cdxgen to parse a new lockfile format; the Skill directs them to add aliases, write the parser, wire the dispatch branch, add fixtures and poku tests, and update PROJECT_TYPES.md.

Quick Start

Use the ecosystem-onboarding skill to add support for a new package manager lockfile format to cdxgen.

Frequently Asked Questions about ecosystem-onboarding

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add support for a new package manager to cdxgen?▼

Add the canonical type and aliases to PROJECT_TYPE_ALIASES in lib/core/env.js, write a lockfile parser in lib/ecosystems/utils.js, create a create-Lang-Bom function in lib/cli/index.js, and register the dispatch branch in createXBom. Then add fixtures, poku tests, and update docs/PROJECT_TYPES.md.

How do I add a new lockfile parser to cdxgen?▼

Place the parser in lib/ecosystems/utils.js or a dedicated helper module under lib/helpers/ or lib/inventory/ for larger formats. Follow pure-ESM conventions with node:-prefixed imports, and prefer lockfile parsing over executing package managers when the lockfile contains names, versions, deps, and integrity data.

How should purls be constructed when adding a cdxgen ecosystem?▼

Build purls only via tryBuildPurl and applyPurl from lib/inventory/purl.js, never by concatenating strings. If coordinates cannot form a valid purl, drop it or use pkg:generic with the cdx:purl:proposedType property.

What tests are required when adding a new ecosystem to cdxgen?▼

Add co-located <module>.poku.js test files using the poku framework covering parsing and BOM generation, plus real-world sample lockfiles under test/. Tests must be cross-platform, accounting for Windows path separators, and verified with pnpm test and pnpm run lint.

Why does a cdxgen build fail after adding a custom cdx property?▼

Any new cdx:* property must be documented in docs/CUSTOM_PROPERTIES.md or the build fails. This is enforced by the custom-property-author skill conventions, so document the property before submitting.

Related Skills

Explore More Software Engineering Skills→
Z-M-HuangZ-M-Huang
14

vcp-dependency-check

Validate project dependencies against VCP dependency-management standards.

Community
Advanced
cdxgencdxgen
1.0k

cyclonedx-spec-reviewer

Review cdxgen changes for CycloneDX schema compliance and semantic correctness.

Official
Advanced
roanbrasilroanbrasil
5

property-based-testing

Generate property-based tests with Hypothesis, jqwik, or Kotest frameworks.

Community
Advanced
civitaicivitai
7.2k

add-ecosystem

Adds new ecosystems and base model records to basemodel.constants.ts for Civitai.

Official
Intermediate