style: modernize eslint & apply code-style cb9013d691 (#1170)

based on
#1169

---------

Signed-off-by: dependabot[bot] <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: jkowalleck

.github/workflows/nodejs.yml

@@ -80,13 +80,20 @@ jobs:
         run: npm run test:lint
 
   test-standard:
+    needs: [ 'build' ]
     name: test standard
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - name: Checkout
         # see https://github.com/actions/checkout
         uses: actions/checkout@v4
+      - name: fetch build artifact
+        # see https://github.com/actions/download-artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: dist.d
+          path: dist.d
       - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }}
         # see https://github.com/actions/setup-node
         uses: actions/setup-node@v4
@@ -99,6 +106,17 @@ jobs:
           echo "::group::install deps"
           npm i --ignore-scripts --loglevel=silly
           echo "::endgroup::"
+          echo "::group::install example javascript"
+          npm --prefix examples/node/javascript i --ignore-scripts --loglevel=silly
+          echo "::endgroup::"
+          echo "::group::install example typescript cjs"
+          npm --prefix examples/node/typescript/example.cjs i --ignore-scripts --loglevel=silly
+          echo "::endgroup::"
+          echo "::group::install examples typescript mjs"
+          npm --prefix examples/node/typescript/example.mjs i --ignore-scripts --loglevel=silly
+          echo "::endgroup::"
+      - name: setup tools
+        run: |
           echo "::group::install docs-gen deps"
           npm --prefix tools/docs-gen i --ignore-scripts --loglevel=silly
           echo "::endgroup::"
@@ -110,15 +128,15 @@ jobs:
       - name: test
         run: >
           npm run -- test:standard
-          --format checkstyle
-          --output-file "$PWD/$REPORTS_DIR/eslint.xml"
-      - name: Publish Checkstyle report
-        # see https://github.com/Juuxel/publish-checkstyle-report
-        uses: Juuxel/publish-checkstyle-report@v1
+          --format json
+          --output-file "$PWD/$REPORTS_DIR/eslint.json"
+      - name: Annotate Code
         if: ${{ failure() || success() }}
+        # see https://github.com/DerLev/eslint-annotations
+        uses: DerLev/eslint-annotations@v2
         with:
-          reports: ${{ env.REPORTS_DIR }}/eslint.xml
-      - name: artifact build result
+          eslint-report: ${{ env.REPORTS_DIR }}/eslint.json
+      - name: artifact eslint result
         # see https://github.com/actions/upload-artifact
         uses: actions/upload-artifact@v4
         if: ${{ failure() }}

examples/node/typescript/example.mjs/src/example.ts

@@ -54,6 +54,7 @@ const serializedJson = jsonSerializer.serialize(bom)
 console.log(serializedJson)
 const jsonValidator = new CDX.Validation.JsonStrictValidator(serializeSpec.version)
 try {
+  /* eslint-disable-next-line @typescript-eslint/no-unsafe-assignment -- intended */
   const validationErrors = await jsonValidator.validate(serializedJson)
   if (validationErrors === null) {
     console.info('JSON valid')
@@ -75,6 +76,7 @@ const serializedXML = xmlSerializer.serialize(bom)
 console.log(serializedXML)
 const xmlValidator = new CDX.Validation.XmlValidator(serializeSpec.version)
 try {
+  /* eslint-disable-next-line @typescript-eslint/no-unsafe-assignment -- intended */
   const validationErrors = await xmlValidator.validate(serializedXML)
   if (validationErrors === null) {
     console.info('XML valid')

src/_helpers/packageJson.ts

@@ -25,7 +25,7 @@ Copyright (c) OWASP Foundation. All Rights Reserved.
  * Having multiple slashes(`/`) is basically no issue.
  */
 export function splitNameGroup (data: string): [string, string?] {
-  const delimGroup = data[0] === '@'
+  const delimGroup = data.startsWith('@')
     ? data.indexOf('/', 2)
     : 0
   return delimGroup > 0

src/_optPlug.node/__jsonValidators/ajv.ts

@@ -36,15 +36,19 @@ const ajvOptions: AjvOptions = Object.freeze({
 
 /** @internal */
 export default (async function (schemaPath: string, schemaMap: Record<string, string> = {}): Promise<Validator> {
+  /* eslint-disable @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-return -- intended */
   const [schema, schemas] = await Promise.all([
     readFile(schemaPath, 'utf-8').then(c => JSON.parse(c)),
     Promise.all(Object.entries(schemaMap).map(
       async ([k, v]) => await readFile(v, 'utf-8').then(c => [k, JSON.parse(c)])
     )).then(es => Object.fromEntries(es))
   ])
+  /* eslint-enable @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-return  */
 
+  /* eslint-disable-next-line @typescript-eslint/no-unsafe-assignment -- intended */
   const ajv = new Ajv({ ...ajvOptions, schemas })
   addFormats(ajv)
+  /* eslint-disable-next-line @typescript-eslint/no-unsafe-call -- intended */
   addFormats2019(ajv, { formats: ['idn-email'] })
   // there is just no working implementation for format "iri-reference": see https://github.com/luzlab/ajv-formats-draft2019/issues/22
   ajv.addFormat('iri-reference', true)

src/_optPlug.node/errors.ts

@@ -22,6 +22,7 @@ export class OptPlugError extends Error {
 
   constructor (message: string, cause?: any) {
     super(message)
+    /* eslint-disable-next-line @typescript-eslint/no-unsafe-assignment -- intended */
     this.cause = cause
   }
 }

src/_optPlug.node/jsonValidator.ts

@@ -24,8 +24,11 @@ export type Validator = (data: string) => null | ValidationError
 export type Functionality = (schemaPath: string, schemaMap: Record<string, string>) => Promise<Validator>
 
 export default opWrapper<Functionality>('JsonValidator', [
-  /* eslint-disable @typescript-eslint/no-var-requires */
+  /* eslint-disable @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-return, @typescript-eslint/no-require-imports
+     -- needed */
+
   ['( ajv && ajv-formats && ajv-formats-draft2019 )', () => require('./__jsonValidators/ajv').default]
   // ... add others here, pull-requests welcome!
-  /* eslint-enable @typescript-eslint/no-var-requires */
+
+/* eslint-enable @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-return, @typescript-eslint/no-require-imports */
 ]) satisfies Functionality | WillThrow

src/_optPlug.node/xmlStringify.ts

@@ -24,8 +24,11 @@ import opWrapper, { type WillThrow } from './_wrapper'
 export type Functionality = (element: SimpleXml.Element, options?: SerializerOptions) => string
 
 export default opWrapper<Functionality>('XmlStringifier', [
-  /* eslint-disable @typescript-eslint/no-var-requires */
+  /* eslint-disable @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-return, @typescript-eslint/no-require-imports
+     -- needed */
+
   ['xmlbuilder2', () => require('./__xmlStringifiers/xmlbuilder2').default]
   // ... add others here, pull-requests welcome!
-  /* eslint-enable @typescript-eslint/no-var-requires */
+
+  /* eslint-enable @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-return, @typescript-eslint/no-require-imports */
 ]) satisfies Functionality | WillThrow

src/_optPlug.node/xmlValidator.ts

@@ -24,8 +24,11 @@ export type Validator = (data: string) => null | ValidationError
 export type Functionality = (schemaPath: string) => Promise<Validator>
 
 export default opWrapper<Functionality>('XmlValidator', [
-  /* eslint-disable @typescript-eslint/no-var-requires */
+  /* eslint-disable @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-return, @typescript-eslint/no-require-imports
+     -- needed */
+
   ['libxmljs2', () => require('./__xmlValidators/libxmljs2').default]
   // ... add others here, pull-requests welcome!
-  /* eslint-enable @typescript-eslint/no-var-requires */
+
+  /* eslint-enable @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-return, @typescript-eslint/no-require-imports */
 ]) satisfies Functionality | WillThrow

src/builders/fromNodePackageJson.node.ts

@@ -127,7 +127,7 @@ export class ComponentBuilder {
     if (Array.isArray(data.licenses)) {
       /* see https://github.com/SchemaStore/schemastore/blob/master/src/schemas/json/package.json */
       for (const licenseData of data.licenses) {
-        if (typeof licenseData?.type === 'string') {
+        if (typeof licenseData.type === 'string') {
           const license = this.#licenseFactory.makeDisjunctive(licenseData.type)
           license.url = typeof licenseData.url === 'string'
             ? licenseData.url

src/factories/fromNodePackageJson.node.ts

@@ -54,8 +54,8 @@ export class ExternalReferenceFactory {
   makeVcs (data: PackageJson): ExternalReference | undefined {
     /* see https://docs.npmjs.com/cli/v9/configuring-npm/package-json#repositoryc */
     const repository = data.repository
-    let url
-    let comment: string | undefined
+    let url = undefined
+    let comment: string | undefined = undefined
     if (typeof repository === 'object') {
       url = tryCanonicalizeGitUrl(repository.url)
       comment = 'as detected from PackageJson property "repository.url"'
@@ -87,8 +87,8 @@ export class ExternalReferenceFactory {
   makeIssueTracker (data: PackageJson): ExternalReference | undefined {
     /* see https://docs.npmjs.com/cli/v9/configuring-npm/package-json#bugs */
     const bugs = data.bugs
-    let url
-    let comment: string | undefined
+    let url = undefined
+    let comment: string | undefined = undefined
     if (typeof bugs === 'object') {
       url = bugs.url
       comment = 'as detected from PackageJson property "bugs.url"'
@@ -113,6 +113,7 @@ const npmDefaultRepositoryMatcher = /^https?:\/\/registry\.npmjs\.org(:?\/|$)/
  * @see {@link https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#npm}
  */
 export class PackageUrlFactory extends PlainPackageUrlFactory<'npm'> {
+  /* eslint-disable-next-line @typescript-eslint/no-inferrable-types -- docs */
   override makeFromComponent (component: Component, sort: boolean = false): PackageURL | undefined {
     const purl = super.makeFromComponent(component, sort)
     return purl === undefined

src/factories/packageUrl.ts

@@ -34,9 +34,10 @@ export class PackageUrlFactory<PurlType extends PackageURL['type'] = PackageURL[
     return this.#type
   }
 
+  /* eslint-disable-next-line @typescript-eslint/no-inferrable-types -- docs */
   makeFromComponent (component: Component, sort: boolean = false): PackageURL | undefined {
     const qualifiers: PackageURL['qualifiers'] = {}
-    let subpath: PackageURL['subpath']
+    let subpath: PackageURL['subpath'] = undefined
 
     // sorting to allow reproducibility: use the last instance for a `extRef.type`, if multiples exist
     const extRefs = sort
@@ -51,6 +52,7 @@ export class PackageUrlFactory<PurlType extends PackageURL['type'] = PackageURL[
       // According to https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst
       // there is no formal requirement to a `..._url`.
       // Everything is possible: URL-encoded, not encoded, with schema, without schema
+      /* eslint-disable-next-line @typescript-eslint/switch-exhaustiveness-check -- intended */
       switch (extRef.type) {
         case ExternalReferenceType.VCS:
           [qualifiers[PackageUrlQualifierNames.VcsUrl], subpath] = url.split('#', 2)

src/serialize/bomRefDiscriminator.ts

@@ -24,6 +24,7 @@ export class BomRefDiscriminator {
 
   readonly #prefix: string
 
+  /* eslint-disable-next-line @typescript-eslint/no-inferrable-types -- docs */
   constructor (bomRefs: Iterable<BomRef>, prefix: string = 'BomRef') {
     this.#originalValues = Array.from(bomRefs, r => [r, r.value])
     this.#prefix = prefix

src/serialize/index.common.ts

@@ -21,6 +21,7 @@ Copyright (c) OWASP Foundation. All Rights Reserved.
 
 export * from './bomRefDiscriminator'
 export * from './errors'
+/* eslint-disable-next-line @typescript-eslint/consistent-type-exports -- backwards-compat TS4 */
 export * as Types from './types'
 
 // region base

src/serialize/json/types.ts

@@ -22,7 +22,7 @@ import type { HashContent } from '../../models'
 import type { SpdxId } from '../../spdx'
 import type { CPE, CWE, Integer } from '../../types'
 
-// eslint-disable-next-line @typescript-eslint/no-namespace
+/* eslint-disable-next-line @typescript-eslint/no-namespace -- needed */
 export namespace JsonSchema {
 
   /**
@@ -62,14 +62,15 @@ export namespace JsonSchema {
 
 }
 
-// eslint-disable-next-line @typescript-eslint/no-namespace
+/* eslint-disable-next-line @typescript-eslint/no-namespace -- needed */
 export namespace Normalized {
 
   export type RefType = string
   export type RefLinkType = RefType
 
   export type BomLinkDocumentType = string
   export type BomLinkElementType = string
+  /* eslint-disable-next-line @typescript-eslint/no-duplicate-type-constituents -- as of spec */
   export type BomLink = BomLinkDocumentType | BomLinkElementType
 
   export interface Bom {
@@ -218,6 +219,7 @@ export namespace Normalized {
   }
 
   export interface ExternalReference {
+    /* eslint-disable-next-line @typescript-eslint/no-duplicate-type-constituents -- as of spec */
     url: JsonSchema.IriReference | BomLink
     type: Enums.ExternalReferenceType
     hashes?: Hash[]
@@ -261,7 +263,7 @@ export namespace Normalized {
     properties?: Property[]
   }
 
-  // eslint-disable-next-line @typescript-eslint/no-namespace
+  /* eslint-disable-next-line @typescript-eslint/no-namespace -- needed */
   export namespace Vulnerability {
     export interface Source {
       name?: string
@@ -300,6 +302,7 @@ export namespace Normalized {
     }
 
     export interface Affect {
+      /* eslint-disable-next-line @typescript-eslint/no-duplicate-type-constituents -- as of spec */
       ref: RefLinkType | BomLinkElementType
       versions?: AffectedVersion[]
     }

src/serialize/xml/normalize.ts

@@ -221,9 +221,7 @@ export class BomNormalizer extends BaseXmlNormalizer<Models.Bom> {
           : undefined
       },
       children: [
-        data.metadata
-          ? this._factory.makeForMetadata().normalize(data.metadata, options, 'metadata')
-          : undefined,
+        this._factory.makeForMetadata().normalize(data.metadata, options, 'metadata'),
         components,
         services,
         this._factory.spec.supportsDependencyGraph

src/serialize/xml/types.ts

@@ -17,7 +17,7 @@ SPDX-License-Identifier: Apache-2.0
 Copyright (c) OWASP Foundation. All Rights Reserved.
 */
 
-// eslint-disable-next-line @typescript-eslint/no-namespace
+/* eslint-disable-next-line @typescript-eslint/no-namespace -- needed */
 export namespace XmlSchema {
 
   const _AnyUriSchemePattern = /^[a-z][a-z0-9+\-.]*$/i
@@ -47,15 +47,13 @@ export namespace XmlSchema {
     }
 
     const fragmentPos = value.indexOf('#')
-    let beforeFragment: string
+    let beforeFragment = value
     if (fragmentPos >= 0) {
       if (value.includes('#', fragmentPos + 1)) {
         // has a second fragment marker
         return false
       }
       beforeFragment = value.slice(undefined, fragmentPos)
-    } else {
-      beforeFragment = value
     }
 
     const schemePos = beforeFragment.indexOf(':')
@@ -71,7 +69,7 @@ export namespace XmlSchema {
 
 }
 
-// eslint-disable-next-line @typescript-eslint/no-namespace
+/* eslint-disable-next-line @typescript-eslint/no-namespace -- needed */
 export namespace SimpleXml {
 
   /**

src/spdx.ts

@@ -38,7 +38,7 @@ const spdxLowerToActual: Readonly<Record<string, SpdxId>> = Object.freeze(Object
 ))
 
 export function isSupportedSpdxId (value: SpdxId | any): value is SpdxId {
-  /* eslint-disable-next-line @typescript-eslint/no-unsafe-argument */
+  /* eslint-disable-next-line @typescript-eslint/no-unsafe-argument -- fix */
   return spdxIds.has(value)
 }
 

src/spec/_protocol.ts

@@ -78,6 +78,7 @@ export class _Spec implements _SpecProtocol {
   readonly #supportsLicenseAcknowledgement: boolean
   readonly #supportsServices: boolean
 
+  /* eslint-disable-next-line @typescript-eslint/max-params -- architectural decision */
   constructor (
     version: Version,
     formats: Iterable<Format>,
@@ -125,17 +126,17 @@ export class _Spec implements _SpecProtocol {
   }
 
   supportsFormat (f: Format | any): boolean {
-    /* eslint-disable-next-line @typescript-eslint/no-unsafe-argument */
+    /* eslint-disable-next-line @typescript-eslint/no-unsafe-argument -- fix */
     return this.#formats.has(f)
   }
 
   supportsComponentType (ct: ComponentType | any): boolean {
-    /* eslint-disable-next-line @typescript-eslint/no-unsafe-argument */
+    /* eslint-disable-next-line @typescript-eslint/no-unsafe-argument -- fix */
     return this.#componentTypes.has(ct)
   }
 
   supportsHashAlgorithm (ha: HashAlgorithm | any): boolean {
-    /* eslint-disable-next-line @typescript-eslint/no-unsafe-argument */
+    /* eslint-disable-next-line @typescript-eslint/no-unsafe-argument -- fix */
     return this.#hashAlgorithms.has(ha)
   }
 
@@ -145,7 +146,7 @@ export class _Spec implements _SpecProtocol {
   }
 
   supportsExternalReferenceType (ert: ExternalReferenceType | any): boolean {
-    /* eslint-disable-next-line @typescript-eslint/no-unsafe-argument */
+    /* eslint-disable-next-line @typescript-eslint/no-unsafe-argument -- fix */
     return this.#externalReferenceTypes.has(ert)
   }
 
@@ -171,7 +172,7 @@ export class _Spec implements _SpecProtocol {
   }
 
   supportsVulnerabilityRatingMethod (rm: Vulnerability.RatingMethod | any): boolean {
-    /* eslint-disable-next-line @typescript-eslint/no-unsafe-argument */
+    /* eslint-disable-next-line @typescript-eslint/no-unsafe-argument -- any */
     return this.#vulnerabilityRatingMethods.has(rm)
   }
 

src/types/cwe.ts

@@ -35,4 +35,5 @@ export function isCWE (value: any): value is CWE {
   return isPositiveInteger(value)
 }
 
+/* eslint-disable-next-line @typescript-eslint/no-unnecessary-type-arguments -- docs */
 export class CweRepository extends SortableNumbers<CWE> {}