.github/workflows/ci.yml

@@ -19,7 +19,7 @@ jobs:
     - name: Checkout Repository
       uses: actions/checkout@v3.0.2
     - name: Check license headers
-      uses: apache/skywalking-eyes@v0.3.0
+      uses: apache/skywalking-eyes@v0.4.0
       with:
         config: .licenserc.yml
 
@@ -31,9 +31,9 @@ jobs:
     - name: Checkout Repository
       uses: actions/checkout@v3.0.2
     - name: Setup Go
-      uses: actions/setup-go@v3.1.0
+      uses: actions/setup-go@v3.3.0
       with:
-        go-version: "1.17"
+        go-version: "1.19"
         check-latest: true
     - name: Run golangci-lint
       uses: golangci/golangci-lint-action@v3.2.0
@@ -47,12 +47,12 @@ jobs:
     strategy:
       matrix:
         go:
-        - "1.15"
-        - "1.16"
         - "1.17"
+        - "1.18"
+        - "1.19"
     steps:
     - name: Setup Go
-      uses: actions/setup-go@v3.1.0
+      uses: actions/setup-go@v3.3.0
       with:
         go-version: ${{ matrix.go }}
         check-latest: true

.github/workflows/goreleaser.yml

@@ -19,16 +19,16 @@ jobs:
       with:
         fetch-depth: 0
     - name: Setup Go
-      uses: actions/setup-go@v3.1.0
+      uses: actions/setup-go@v3.3.0
       with:
-        go-version: "1.17"
+        go-version: "1.19"
         check-latest: true
     - name: Install cyclonedx-gomod
       uses: CycloneDX/gh-gomod-generate-sbom@v1
       with:
         version: v1
     - name: Run GoReleaser
-      uses: goreleaser/goreleaser-action@v2
+      uses: goreleaser/goreleaser-action@v3
       with:
         version: latest
         args: release --rm-dist

.gitpod.Dockerfile

@@ -1,10 +1,10 @@
-FROM gitpod/workspace-go:2022-02-04-10-54-10@sha256:8ea7684f6b1294c21065918880e6f31d16ac58b61361754b8d384b8e8f8279ae
+FROM gitpod/workspace-go:latest
 
 USER root
 
 RUN \
-    wget -O "/usr/local/bin/cyclonedx" https://github.com/CycloneDX/cyclonedx-cli/releases/download/v0.22.0/cyclonedx-linux-x64 && \
-    echo "ae39404a9dc8b2e7be0a9559781ee9fe3492201d2629de139d702fd4535ffdd6 /usr/local/bin/cyclonedx" | sha256sum -c && \
+    wget -O "/usr/local/bin/cyclonedx" https://github.com/CycloneDX/cyclonedx-cli/releases/download/v0.24.0/cyclonedx-linux-x64 && \
+    echo "691cf7ed82ecce1f85e6d21bccd1ed2d7968e40eb6be7504b392c8b3a0943891 /usr/local/bin/cyclonedx" | sha256sum -c && \
     chmod +x "/usr/local/bin/cyclonedx"
 
 USER gitpod

.licenserc.yml

@@ -3,17 +3,18 @@ header:
     spdx-id: Apache-2.0
     copyright-owner: OWASP Foundation
   paths-ignore:
+    - "**/*.md"
+    - "**/go.mod"
+    - "**/go.sum"
+    - "**/testdata/**"
     - ".github/**"
     - ".gitignore"
     - ".gitpod.*"
     - ".golangci.yml"
     - ".goreleaser.yml"
     - ".licenserc.yml"
-    - "**/*.md"
-    - "**/go.mod"
-    - "**/go.sum"
-    - "**/testdata/**"
     - "CODEOWNERS"
     - "LICENSE"
     - "Makefile"
-    - "NOTICE"
+    - "NOTICE"
+    - "cyclonedx_string.go"

Makefile

@@ -10,5 +10,13 @@ clean:
 	go clean
 .PHONY: clean
 
+generate:
+	go generate
+.PHONY: generate
+
+lint:
+	golangci-lint run
+.PHONY: lint
+
 all: clean build test
 .PHONY: all

README.md

@@ -28,15 +28,18 @@ Also, checkout the [`examples`](./example_test.go) to get an idea of how this li
 
 | cyclonedx-go versions | Supported Go versions | Supported CycloneDX spec |
 |:---------------------:|:---------------------:|:------------------------:|
-|    < v0.4.0           |         1.14+         |           1.2            |
-|   == v0.4.0           |         1.14+         |           1.3            |
-|   >= v0.5.0           |         1.15+         |           1.4            |
+|       < v0.4.0        |         1.14+         |           1.2            |
+|       == v0.4.0       |         1.14+         |           1.3            |
+|  >= v0.5.0, < v0.7.0  |         1.15+         |           1.4            |
+|       >= v0.7.0       |         1.17+         |         1.0-1.4          |
 
 We're aiming to support all [officially supported](https://golang.org/doc/devel/release.html#policy) Go versions, plus
 an additional older version.
 
-This library will only support the latest version of the CycloneDX specification. While it's generally possible to 
-*read* BOMs of an older spec, *writing* will exclusively produce BOMs conforming to the latest supported spec.
+Prior to v0.7.0, this library only supported the latest version of the CycloneDX specification. While it is generally 
+possible to *read* BOMs of an older spec, *writing* would exclusively produce BOMs conforming to the latest supported spec.
+
+Starting with v0.7.0, writing BOMs conforming to all previous version of the spec is also possible.
 
 ## Copyright & License