Adds support for specifying npm install args (#1428)

* Adds support for specifying npm install args Signed-off-by: Prabhu Subramanian <[email protected]> * Update nvm Signed-off-by: Prabhu Subramanian <[email protected]> --------- Signed-off-by: Prabhu Subramanian <[email protected]>
CycloneDX · Oct 22, 2024 · b309cff · b309cff
1 parent 341ae63
commit b309cff
Show file tree

Hide file tree

Showing 14 changed files with 88 additions and 75 deletions.
diff --git a/ci/Dockerfile b/ci/Dockerfile
@@ -90,7 +90,7 @@ RUN set -e; \
     && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
     && cargo --version \
     && rustc --version \
-    && curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash \
+    && curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash \
     && source /root/.nvm/nvm.sh \
     && nvm install ${NODE_VERSION} \
     && node --version \

diff --git a/ci/base-images/sle/Dockerfile.lang b/ci/base-images/sle/Dockerfile.lang
@@ -41,7 +41,7 @@ RUN set -e; \
     && sdk offline enable \
     && mv /root/.sdkman/candidates/* /opt/ \
     && rm -rf /root/.sdkman \
-    && curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash \
+    && curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash \
     && source /root/.nvm/nvm.sh \
     && nvm install ${NODE_VERSION} \
     && npm install -g node-gyp \

diff --git a/ci/base-images/sle/Dockerfile.node20 b/ci/base-images/sle/Dockerfile.node20
@@ -5,6 +5,8 @@ ARG GCC_VERSION=13
 
 ENV JAVA_VERSION=$JAVA_VERSION \
     JAVA_HOME="/opt/java/${JAVA_VERSION}" \
+    NVM_DIR="/root/.nvm" \
+    npm_config_python=/usr/bin/python3.11 \
     LC_ALL=en_US.UTF-8 \
     LANG=en_US.UTF-8 \
     LANGUAGE=en_US.UTF-8
@@ -44,6 +46,8 @@ RUN set -e; \
     && node -v \
     && npm -v \
     && python --version \
+    && curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash \
+    && source /root/.nvm/nvm.sh \
     && curl -L --output /usr/bin/bazel https://github.com/bazelbuild/bazelisk/releases/latest/download/bazelisk-linux-${GOBIN_VERSION} \
     && chmod +x /usr/bin/bazel \
     && bazel --version \

diff --git a/ci/base-images/sle/Dockerfile.python311 b/ci/base-images/sle/Dockerfile.python311
@@ -46,7 +46,7 @@ RUN set -e; \
     && rm -rf /root/.sdkman \
     && python3 -m pip install --no-cache-dir --upgrade pip virtualenv \
     && python3 -m pip install --no-cache-dir --upgrade pipenv poetry --target /opt/pypi \
-    && curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash \
+    && curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash \
     && source /root/.nvm/nvm.sh \
     && nvm install ${NODE_VERSION} \
     && npm install -g node-gyp \

diff --git a/ci/base-images/sle/Dockerfile.python36 b/ci/base-images/sle/Dockerfile.python36
@@ -43,7 +43,7 @@ RUN set -e; \
     && rm -rf /root/.sdkman \
     && python3 -m pip install --no-cache-dir --upgrade pip virtualenv \
     && python3 -m pip install --no-cache-dir --upgrade --user pipenv poetry \
-    && curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash \
+    && curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash \
     && source /root/.nvm/nvm.sh \
     && nvm install ${NODE_VERSION} \
     && node -v \

diff --git a/contrib/lima/cdxgen-opensuse.yaml b/contrib/lima/cdxgen-opensuse.yaml
@@ -5,8 +5,6 @@ images:
 - location: "https://download.opensuse.org/distribution/leap/15.6/appliances/openSUSE-Leap-15.6-Minimal-VM.aarch64-Cloud.qcow2"
   arch: "aarch64"
 mounts:
-- location: "~"
-  mountPoint: /home/cdxgen
 - location: "/tmp/cdxgen"
   writable: true
 containerd:
@@ -24,6 +22,7 @@ env:
   SBT_CMD: /.sdkman/candidates/sbt/current/bin/sbt
   SDKMAN_DIR: /.sdkman
   SDKMAN_CANDIDATES_DIR: /.sdkman/candidates
+  NVM_DIR: /.nvm
 provision:
 - mode: dependency
   skipDefaultDependencyResolution: false
@@ -60,9 +59,9 @@ provision:
     curl -s "https://get.sdkman.io" | bash
     echo -e "sdkman_auto_answer=true\nsdkman_selfupdate_feature=false\nsdkman_auto_env=true\nsdkman_curl_connect_timeout=60\nsdkman_curl_max_time=0" >> /.sdkman/etc/config
     source "/.sdkman/bin/sdkman-init.sh"
-    sdk install maven $MAVEN_VERSION
-    sdk install gradle $GRADLE_VERSION
-    sdk install sbt $SBT_VERSION
+    sdk install maven $MAVEN_VERSION || true
+    sdk install gradle $GRADLE_VERSION || true
+    sdk install sbt $SBT_VERSION || true
     mkdir -p /opt
     npm install -g node-gyp @cyclonedx/cdxgen --omit=dev
     npx node-gyp install
@@ -71,3 +70,4 @@ provision:
     gcc --version
     zypper clean -a
     cdxgen --version
+    curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash
diff --git a/deno.json b/deno.json
@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "10.10.6",
+  "version": "10.10.7",
   "exports": "./lib/cli/index.js",
   "compilerOptions": {
     "lib": ["deno.window"],

diff --git a/docs/ENV.md b/docs/ENV.md
diff --git a/jsr.json b/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "10.10.6",
+  "version": "10.10.7",
   "exports": "./lib/cli/index.js",
   "include": ["*.js", "lib/**", "bin/**", "data/**", "types/**"],
   "exclude": [

diff --git a/lib/cli/index.js b/lib/cli/index.js
@@ -2267,14 +2267,21 @@ export async function createNodejsBom(path, options) {
     const pkgData = JSON.parse(readFileSync(`${path}/package.json`, "utf8"));
     const mgrData = pkgData.packageManager;
     let mgr = "";
+    let installArgs = ["install"];
     if (mgrData) {
       mgr = mgrData.split("@")[0];
     }
     if (supPkgMgrs.includes(mgr)) {
       pkgMgr = mgr;
     }
-    console.log(`Executing '${pkgMgr} install' in`, path);
-    const result = spawnSync(pkgMgr, ["install"], {
+    // Support for passing additional args to the install command
+    if (process.env[`${pkgMgr.toUpperCase()}_INSTALL_ARGS`]) {
+      const addArgs =
+        process.env[`${pkgMgr.toUpperCase()}_INSTALL_ARGS`].split(" ");
+      installArgs = installArgs.concat(addArgs);
+    }
+    console.log(`Executing '${pkgMgr} ${installArgs.join(" ")}' in`, path);
+    const result = spawnSync(pkgMgr, installArgs, {
       cwd: path,
       encoding: "utf-8",
       timeout: TIMEOUT_MS,

diff --git a/lib/stages/pregen/pregen.js b/lib/stages/pregen/pregen.js
@@ -213,12 +213,13 @@ export function doNpmInstall(filePath, nvmNodePath) {
     return;
   }
   const newPath = `${nvmNodePath}${delimiter}${process.env.PATH}`;
+  const installArgs = process.env.NPM_INSTALL_ARGS || "--package-lock-only";
   const resultNpmInstall = spawnSync(
     process.env.SHELL || "bash",
     [
       "-i",
       "-c",
-      `export PATH='${nvmNodePath}${delimiter}$PATH' && npm install --package-lock-only`,
+      `export PATH='${nvmNodePath}${delimiter}$PATH' && npm install ${installArgs}`,
     ],
     {
       encoding: "utf-8",

diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "10.10.6",
+  "version": "10.10.7",
   "description": "Creates CycloneDX Software Bill of Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <[email protected]>",

diff --git a/types/lib/cli/index.d.ts.map b/types/lib/cli/index.d.ts.map
diff --git a/types/lib/stages/pregen/pregen.d.ts.map b/types/lib/stages/pregen/pregen.d.ts.map