pyproject.toml

[build-system]
requires = ["poetry-core>=1.0.0"]
build-backend = "poetry.core.masonry.api"



[tool.poetry]
name = "cyclonedx-bom"
version = "5.5.0"
description = "CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments"
authors = [
  "Jan Kowalleck <jan.kowalleck@gmail.com>",
]
maintainers = [
  "Jan Kowalleck <jan.kowalleck@gmail.com>",
]
license = "Apache-2.0"
readme = "README.md"
homepage = "https://github.com/CycloneDX/cyclonedx-python/#readme"
repository = "https://github.com/CycloneDX/cyclonedx-python/"
documentation = "https://cyclonedx-bom-tool.readthedocs.io/"
packages = [
  { include = "cyclonedx_py" }
]
include = [
  # all is an object -> prevent parse issue with dependabot
  { path="README.md", format =["sdist"] },
  { path="tests", format=["sdist"] },
  { path="CHANGELOG.md", format=["sdist"] },
  { path="docs", format=["sdist"] },
]
exclude = [
  "**/.*", # exclude dotfiles and dotfolders
  "docs/_build", "docs/processes",
]
keywords = [
  "OWASP", "CycloneDX",
  "bill-of-materials", "BOM", "software-bill-of-materials","SBOM",
  "environment", "virtualenv", "venv", "Poetry", "Pipenv", "requirements", "PDM", "Conda",
  "SPDX", "licenses", "PURL", "package-url", "dependency-graph",
]
classifiers = [
  # Trove classifiers - https://packaging.python.org/specifications/core-metadata/#metadata-classifier
  # Full list: https://pypi.python.org/pypi?%3Aaction=list_classifiers
  "Development Status :: 5 - Production/Stable",
  "Environment :: Console",
  "Intended Audience :: Developers",
  "Intended Audience :: Information Technology",
  "Intended Audience :: Legal Industry",
  "Intended Audience :: System Administrators",
  "Topic :: Security",
  "Topic :: Software Development",
  "Topic :: System :: Software Distribution",
  "License :: OSI Approved :: Apache Software License",
  "Programming Language :: Python :: 3.8",
  "Programming Language :: Python :: 3.9",
  "Programming Language :: Python :: 3.10",
  "Programming Language :: Python :: 3.11",
  "Programming Language :: Python :: 3.12",
  "Programming Language :: Python :: 3.13",
  "Typing :: Typed"
]
[tool.poetry.urls]
"Bug Tracker" = "https://github.com/CycloneDX/cyclonedx-python/issues"
"Funding" = "https://owasp.org/donate/?reponame=www-project-cyclonedx&title=OWASP+CycloneDX"

[tool.poetry.scripts]
cyclonedx-py = "cyclonedx_py._internal.cli:run"

[tool.poetry.dependencies]
python = "^3.8"
cyclonedx-python-lib = { version = "^8.0 || ^9.0 || ^10", extras = ["validation"] }
packageurl-python = ">=0.11, <2"  # keep in sync with same dep in `cyclonedx-python-lib`
pip-requirements-parser = "^32.0"
packaging = "^22 || ^23 || ^24 || ^25"
tomli = { version = "^2.0.1", python = "<3.11" }
chardet = "^5.1"

[tool.poetry.group.dev.dependencies]
# pin to exact versions, if the tool/lib/plugin is process-relevant
coverage = "7.6.1"
ddt = "1.7.2"
flake8 = { version = "7.1.2", python = ">=3.8.1" }
flake8-annotations = { version = "3.1.1", python = ">=3.8.1" }
flake8-bugbear = { version = "24.12.12", python = ">=3.8.1" }
flake8-copyright-validator = "^0.0.1"
flake8-isort = "6.1.1"
flake8-quotes = "3.4.0"
flake8-use-fstring = "1.4"
pep8-naming = "0.14.1"
flake8-logging = "1.6.0"
isort = "5.13.2"
autopep8 = "2.3.1"
mypy = "1.14.1"
bandit = "1.7.10"
tomli = { version = "^2.0.1", python = "<3.11" }
tox = "4.25.0"

# min version required to be able to install some dependencies
# see https://github.com/MichaelKim0407/flake8-use-fstring/issues/33
setuptools = ">= 47.0.0"

# some package managers needed for setup/init of testbeds for `environment` purpose.
# we do not relaly care for exact versions, as long as they have a stable CLI and craft usable virtual-environments
pip = ">=23.0"
pipenv = ">=2023.11.5"
poetry = "^1.7"
pdm = "^2.11"
uv = "0.6.14"  # keep pinned to exact version, until a v1.0.0 is released




[tool.semantic_release]
# see https://python-semantic-release.readthedocs.io/en/latest/configuration.html
commit_author = "semantic-release <semantic-release@bot.local>"
commit_message = "chore(release): {version}\n\nAutomatically generated by python-semantic-release\n\nSigned-off-by: semantic-release <semantic-release@bot.local>"
upload_to_vcs_release = true
build_command = "pip install poetry && poetry build"
version_toml = ["pyproject.toml:tool.poetry.version"]
version_variables = [
  "cyclonedx_py/__init__.py:__version__",
  "docs/conf.py:release",
]

[tool.semantic_release.publish]
dist_glob_patterns = ["dist/*"]
upload_to_vcs_release = true

[tool.semantic_release.changelog]
changelog_file = "CHANGELOG.md"
exclude_commit_patterns = [
  '''chore(?:\([^)]*?\))?: .+''',
  '''ci(?:\([^)]*?\))?: .+''',
  '''refactor(?:\([^)]*?\))?: .+''',
  '''style(?:\([^)]*?\))?: .+''',
  '''tests?(?:\([^)]*?\))?: .+''',
  '''build\((?!deps\): .+)''',
]

[tool.semantic_release.branches.main]
match = "(main|master)"
prerelease = false

[tool.semantic_release.branches."step"]
match = "(build|chore|ci|docs|feat|fix|perf|style|refactor|tests?)"
prerelease = true
prerelease_token = "alpha"

[tool.semantic_release.branches."major-dev"]
match = "(\\d+\\.0\\.0-(dev|rc)|dev/\\d+\\.0\\.0)"
prerelease = true
prerelease_token = "rc"