streamline demo with CycloneDX/sbom-examples about cyclonedx-php-composer

[coderpatros]

That’s a great idea. Looking forward to see how you tackle this. I should do the same for the .NET implementation.

[jkowalleck]

@coderpatros
i did a demo setup before, since i found the tests insufficient. I did not want to improve the tests, since i am working on a unit-tested rewrite already. So i came up with a demo as some kind of end-t-end integration test.

this exciting demo was runable in every supported env,
but therefore it's output SBOM files were not reproducible.

SO via #59 + #66 is added the demo with thee needed laravel/laravel:7.12.0 as a reproducible setup.

Since i am pinning to outdated versions in my demo, i still need to get dependabot to ignore these demo files.
this was tried to do via via #60 and #63(important - see #61)
without some affect:

• dependencies still are listed and marked as vulnerable - https://github.com/CycloneDX/cyclonedx-php-composer/network/dependencies.
• denependabot ignores those dependencies as expected - https://github.com/CycloneDX/cyclonedx-php-composer/network/updates
• vulnerable dep "laravel:7.12: is ignored by dependabot alerts as expected - https://github.com/CycloneDX/cyclonedx-php-composer/security/dependabot
• result: this repo does not prompt as vulnerable, demo deps are not managed by dependabot.

[jkowalleck]

@coderpatros
i wonder if i tackeled this right.

the idea: i want to have reproducible builds. therefor i need a composer.lock file.
since https://github.com/laravel/laravel/tree/v7.12.0 did not have one.

i creeated a demo project that requires laravel/framework:7.12.0 - seamed far enough for me ....
then i pinned the dependencies, to keep track of the versions so i get reproducible SBOM files.

anyways, i decided to require the whole laravel via #66

[jkowalleck]

@coderpatros
addendum: added CI tests to check that reproducible files are produced without changes - via #70

[jkowalleck]

all done