add option to make sbom reproducible & more privates & various fixes

.eslintrc

@@ -0,0 +1,3 @@
+{
+  "extends": "standard"
+}

.github/workflows/nodejs.yml

@@ -54,7 +54,7 @@ jobs:
         run: npm run setup-tests
       - name: run tests
         run: >
-          npm run test:unit --
+          npm run test:jest --
           --ci
           --no-cache
           --all

HISTORY.md

@@ -4,6 +4,23 @@ All notable changes to this project will be documented in this file.
 
 ## unreleased
 
+* Added 
+  * Environment variable `BOM_REPRODUCIBLE` cause resulting files to be more reproducible
+    by omitting time/rand-based values, and sorting lists. (via [#288])
+  * Method `Component.compare()` compares self by `purl` or `group`/`name`/`version`. (via [#288])
+  * Method `ExternalReference.compare()` compares self by `type`/`url`. (via [#288])
+  * Method `Hash.compare()` compares self by `algorithm`/`value`. (via [#288])
+  * JSDoc for `ExternalReference`, `ExternalReferenceList`, `Hash`, `HashList`. (via [#288])
+* Fixed
+  * `ExternalReference.url` is now correctly treated as mandatory. (via [#288])
+  * `Hash.value` is now correctly treated as mandatory. (via [#288])
+  * `ExternalReferenceList.isEligibleHomepage` now returns the correct result, was inverted. (via [#288])
+* Changed
+  * Private properties of `ExternalReference`, `ExternalReferenceList`,  `Hash`, `HashList`
+    became inaccessible. ([#233] via [#288])
+
+[#288]: https://github.com/CycloneDX/cyclonedx-node-module/pull/288
+
 ## 3.7.0 - 2022-04-13
 
 * Added

README.md

@@ -44,6 +44,9 @@ Options:
   -t, --type <type>           Project type (default: "library")
   -ns, --no-serial-number     Do not include BOM serial number
   -h, --help                  display help for command
+
+Environment variable BOM_REPRODUCIBLE causes bom result to be more consistent
+over multiple runs by omitting time/rand-based values, and sorting lists.
 ```
 
 ### Example (default: XML)

bin/make-bom.js

@@ -43,6 +43,9 @@ let filePath = '.'
 
 cdx
   .description(program.description)
+  .addHelpText('afterAll', '\n\n' +
+    'Environment variable BOM_REPRODUCIBLE causes bom result to be more consistent\n' +
+    'over multiple runs by omitting time/rand-based values, and sorting lists.\n')
   .version(program.version, '-v, --version')
   .argument('[path]', 'Path to analyze')
   .option('-d, --include-dev', 'Include devDependencies', false)