Skip to content

Commit 3335cd6

Browse files
janbiasijanbiasi
committed
feat: support rolldown, closes #256 
1 parent 7e7c038 commit 3335cd6

25 files changed

Lines changed: 631 additions & 28 deletions

‎README.md‎

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ Create [SBOMs]() _(Software Bill of Materials)_ in [CycloneDX](https://cyclonedx
1616
- [Usage guide](#usage)
1717
- [Usage with Vite](#usage-with-vite)
1818
- [Usage with Rollup](#usage-with-rollup)
19+
- [Usage with Rolldown](#usage-with-rolldown)
1920
- [Configuration options and defaults](#configuration-options)
2021
- [Debugging](#debugging)
2122
- [Sequence chart](#sequence-chart)
@@ -28,11 +29,11 @@ Create [SBOMs]() _(Software Bill of Materials)_ in [CycloneDX](https://cyclonedx
2829

2930
### Requirements and Compatibility
3031

31-
| Plugin | Vite | Rollup | Node | CDX Spec |
32-
| ------ | -------------- | ------ | ---------- | -------- |
33-
| v1 | v4, v5 | v3, v4 | 18, 20 | 1.5 |
34-
| v2 | v4, v5, v6 | v3, v4 | 18, 20, 22 | 1.6 |
35-
| v3 | v5, v6, v7, v8 | v4 | 20, 22, 24 | 1.6 |
32+
| Plugin | Vite | Rollup | Rolldown | Node | CDX Spec |
33+
| ------ | ---------- | ------ | -------- | ---------- | -------- |
34+
| v1 | 4, 5 | 3, 4 | - | 18, 20 | 1.5 |
35+
| v2 | 4, 5, 6 | 3, 4 | - | 18, 20, 22 | 1.6 |
36+
| v3 | 5, 6, 7, 8 | 4 | 1 | 20, 22, 24 | 1.6 |
3637

3738
We're always supporting LTS Node.js versions and versions which still have security support.
3839
Plugin support will be dropped once a Node.js version reaches its final EOL.
@@ -80,6 +81,17 @@ export default {
8081
};
8182
```
8283

84+
#### Usage with [Rolldown](https://rolldown.rs/)
85+
86+
```js
87+
import { defineConfig } from "rolldown";
88+
import sbom from "rollup-plugin-sbom";
89+
90+
export default defineConfig({
91+
plugins: [sbom()],
92+
});
93+
```
94+
8395
#### Configuration Options
8496

8597
| Name | Default | Description |
@@ -110,7 +122,7 @@ This plugin added `debug` logs to gather information about how your SBOM is buil
110122
understand why which dependency was added to the graph. To enable debugging, you can set the `logLevel` option to `"debug"`.
111123

112124
```ts
113-
// rollup
125+
// rollup and rolldown
114126
export default {
115127
logLevel: "debug",
116128
};

‎package.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,12 +75,16 @@
7575
"peerDependencies": {
7676
"rollup": "^4",
7777
"vite": "^5 || ^6 || ^7 || ^8",
78-
"xmlbuilder2": "^3 || ^4"
78+
"xmlbuilder2": "^3 || ^4",
79+
"rolldown": "^1.0.0-rc || ^1"
7980
},
8081
"peerDependenciesMeta": {
8182
"rollup": {
8283
"optional": true
8384
},
85+
"rolldown": {
86+
"optional": true
87+
},
8488
"vite": {
8589
"optional": true
8690
},

‎pnpm-lock.yaml‎

Lines changed: 210 additions & 21 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pnpm-workspace.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ blockExoticSubdeps: true
55
minimumReleaseAgeExclude:
66
- "@cyclonedx/cyclonedx-library"
77
- "normalize-package-data"
8+
- "rolldown"
9+
- "@rolldown/*"
810
packages:
911
- test/fixtures/*
1012
overrides:

‎test/fixtures/rolldown-v1/.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
!fake-tree
2+
!fake-tree/**/node_modules

‎test/fixtures/rolldown-v1/README.md‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
# Resolution Fixture
2+
3+
This test project verifies that modules and also nested modules are resolved correctly. It also considers the following common cases:
4+
- A package is installed in multiple different versions with the same name
5+
- A side-effect free package is imported but not used (tree-shaking)
6+
- A package with side-effects is imported as a transitive dependency (impure)
7+
8+
### Development
9+
10+
The modules from `fake-tree` are automatically moved to the `node_modules` on postinstall. If you're developing and changing the modules, you can sync them with `pnpm postinstall`.
11+
12+
```sh
13+
pnpm postinstall
14+
pnpm build
15+
```
16+
17+
### Module-/Import Tree
18+
19+
App depends on:
20+
- A@v1
21+
- B@v1
22+
23+
A@v1 depends on:
24+
- C@v1
25+
- unused@v1 (not used).
26+
27+
B@v1 depends on:
28+
- A@v2
29+
- side-effect@v1 (no exports, not tree-shakeable)
30+
31+
```mermaid
32+
flowchart LR
33+
App
34+
App -- Imports --> a1
35+
App -- Imports --> b1
36+
a1 -- Imports --> c1
37+
a1 -- Imports --> unused
38+
b1 -- Imports --> a2
39+
b1 -- Imports --> side-effect
40+
```
41+
42+
### Expected SBOM result
43+
44+
#### Components
45+
46+
```json
47+
[
48+
{
49+
"type": "library",
50+
"name": "a",
51+
"version": "1.0.0",
52+
"bom-ref": "pkg:npm/a@1.0.0",
53+
"purl": "pkg:npm/a@1.0.0"
54+
},
55+
{
56+
"type": "library",
57+
"name": "c",
58+
"version": "1.0.0",
59+
"bom-ref": "pkg:npm/c@1.0.0",
60+
"purl": "pkg:npm/c@1.0.0"
61+
},
62+
{
63+
"type": "library",
64+
"name": "side-effect",
65+
"version": "1.0.0",
66+
"bom-ref": "pkg:npm/side-effect@1.0.0",
67+
"purl": "pkg:npm/side-effect@1.0.0"
68+
},
69+
{
70+
"type": "library",
71+
"name": "b",
72+
"version": "1.0.0",
73+
"bom-ref": "pkg:npm/b@1.0.0",
74+
"purl": "pkg:npm/b@1.0.0"
75+
},
76+
{
77+
"type": "library",
78+
"name": "a",
79+
"version": "2.0.0",
80+
"bom-ref": "pkg:npm/a@2.0.0",
81+
"purl": "pkg:npm/a@2.0.0"
82+
}
83+
]
84+
```
85+
86+
#### Dependencies
87+
88+
Acceptance Criteria for the generated SBOM
89+
- `a` must be included in both version `1` and `2`
90+
- `b` must include a reference to the package `a` in version `2` (transitive dependency)
91+
- `unused` must not be part of the depencies at it was removed during tree-shaking (no [side-effects](https://rollupjs.org/configuration-options/#no-side-effects))
92+
- `side-effect` must be included as the side-effect is not marked as [pure](https://rollupjs.org/configuration-options/#pure)
93+
94+
```json
95+
[
96+
{
97+
"ref": "pkg:npm/a@1.0.0",
98+
"dependsOn": [
99+
"pkg:npm/c@1.0.0"
100+
]
101+
},
102+
{
103+
"ref": "pkg:npm/c@1.0.0"
104+
},
105+
{
106+
"ref": "pkg:npm/side-effect@1.0.0"
107+
},
108+
{
109+
"ref": "pkg:npm/b@1.0.0",
110+
"dependsOn": [
111+
"pkg:npm/a@2.0.0",
112+
"pkg:npm/side-effect@1.0.0"
113+
]
114+
},
115+
{
116+
"ref": "pkg:npm/a@2.0.0"
117+
}
118+
]
119+
```

‎test/fixtures/rolldown-v1/fake-tree/a/a2.js‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
import d from 'd';
2+
3+
/*@__PURE__*/ console.log('Module A@1 loaded - imports %s', d);
4+
5+
export default 'Local Package A 2 - V1'

‎test/fixtures/rolldown-v1/fake-tree/a/index.js‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
import c from 'c';
2+
3+
/*@__PURE__*/ console.log('Module A@1 loaded - imports %s', c);
4+
5+
export default 'Local Package A - V1'

‎test/fixtures/rolldown-v1/fake-tree/a/node_modules/c/index.js‎

Lines changed: 3 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎test/fixtures/rolldown-v1/fake-tree/a/node_modules/c/package.json‎

Lines changed: 6 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)