feat: add rootComponentVCS configuration

HISTORY.md

@@ -10,9 +10,11 @@ All notable changes to this project will be documented in this file.
 
 * Added
   * Configuration option for `rootComponentBuildSystem` ([#1344] via [#1349])
+  * Configuration option for `rootComponentVCS` ([#1344] via [#1350])
 
 [#1344]: https://github.com/CycloneDX/cyclonedx-webpack-plugin/issues/1344
 [#1349]: https://github.com/CycloneDX/cyclonedx-webpack-plugin/pull/1349
+[#1350]: https://github.com/CycloneDX/cyclonedx-webpack-plugin/pull/1350
 
 ## 3.15.1 - 2024-12-03
 

README.md

@@ -57,6 +57,7 @@ new CycloneDxWebpackPlugin(options?: object)
 | **`rootComponentName`** | optional `{string}` | `undefined` | If `rootComponentAutodetect` is disabled, then this value is assumed as the "name" of the `package.json`. |
 | **`rootComponentVersion`** | optional `{string}` | `undefined` | If `rootComponentAutodetect` is disabled, then this value is assumed as the "version" of the `package.json`. |
 | **`rootComponentBuildSystem`** | optional `{string}` | `undefined` | Set's the URL for the RootComponent's External References' build-system. |
+| **`rootComponentVCS`** | optional `{string}` | `undefined` | If `rootComponentAutodetect` is disabled or the VCS is not defined in the package.json, then this value is used as the URL for the RootComponent's External Referencees' Version Control System. |
 | **`collectEvidence`** | `{boolean}` | `false` | Whether to collect (license) evidence and attach them to the resulting SBOM. |
 
 ### Example

examples/simple/webpack.config.js

@@ -33,6 +33,7 @@ const cycloneDxWebpackPluginOptions = {
   rootComponentName: undefined,
   rootComponentVersion: undefined,
   rootComponentBuildSystem: undefined,
+  rootComponentVCS: undefined,
   collectEvidence: true
 }
 

src/plugin.ts

@@ -110,6 +110,11 @@ export interface CycloneDxWebpackPluginOptions {
    * See {@link https://cyclonedx.org/docs/1.6/json/#metadata_component_externalReferences}.
    */
   rootComponentBuildSystem?: CycloneDxWebpackPlugin['rootComponentBuildSystem']
+  /**
+   * Set the externalReference URL for the version control system for the RootComponent.
+   * See {@link https://cyclonedx.org/docs/1.6/json/#metadata_component_externalReferences}.
+   */
+  rootComponentVCS?: CycloneDxWebpackPlugin['rootComponentVCS']
 
   /**
    * Whether to collect (license) evidence and attach them to the resulting SBOM.
@@ -142,6 +147,7 @@ export class CycloneDxWebpackPlugin {
   rootComponentName: CDX.Models.Component['name'] | undefined
   rootComponentVersion: CDX.Models.Component['version'] | undefined
   rootComponentBuildSystem: CDX.Models.ExternalReference['url'] | undefined
+  rootComponentVCS: CDX.Models.ExternalReference['url'] | undefined
 
   collectEvidence: boolean
 
@@ -157,6 +163,7 @@ export class CycloneDxWebpackPlugin {
     rootComponentName = undefined,
     rootComponentVersion = undefined,
     rootComponentBuildSystem = undefined,
+    rootComponentVCS = undefined,
     collectEvidence = false
   }: CycloneDxWebpackPluginOptions = {}) {
     this.specVersion = specVersion
@@ -172,6 +179,7 @@ export class CycloneDxWebpackPlugin {
     this.rootComponentName = rootComponentName
     this.rootComponentVersion = rootComponentVersion
     this.rootComponentBuildSystem = rootComponentBuildSystem
+    this.rootComponentVCS = rootComponentVCS
     this.collectEvidence = collectEvidence
   }
 
@@ -328,6 +336,18 @@ export class CycloneDxWebpackPlugin {
       )
       logger.debug('Added rootComponent BuildSystem URL:', this.rootComponentBuildSystem)
     }
+    if (typeof this.rootComponentVCS === 'string' &&
+      this.rootComponentVCS.length > 0 &&
+      ![...component.externalReferences].some(ref => ref.type === CDX.Enums.ExternalReferenceType.VCS)) {
+      component.externalReferences.add(
+        new CDX.Models.ExternalReference(
+          this.rootComponentVCS,
+          CDX.Enums.ExternalReferenceType.VCS,
+          { comment: 'as declared via cyclonedx-webpack-plugin config "rootComponentVCS"' }
+        )
+      )
+      logger.debug('Added rootComponent VCS URL:', this.rootComponentVCS)
+    }
   }
 
   #makeRootComponent (