fix(eol-shared): preserve only EOL-relevant SBOM properties

src/trim-cdx-bom.test.ts

@@ -5,7 +5,7 @@ import type { CdxBom } from './types/index.ts';
 import { Enums } from '@cyclonedx/cyclonedx-library';
 
 describe('trimCdxBom', () => {
-  test('should remove external references, evidence, hashes, and properties from components', () => {
+  test('should remove external references, evidence, hashes, and non-EOL properties from components', () => {
     const mockBom: CdxBom = {
       bomFormat: 'CycloneDX',
       specVersion: '1.4',
@@ -24,7 +24,10 @@ describe('trimCdxBom', () => {
           hashes: [
             { alg: Enums.HashAlgorithm['SHA-1'], content: 'hash-content' },
           ],
-          properties: [{ name: 'prop1', value: 'value1' }],
+          properties: [
+            { name: 'prop1', value: 'value1' },
+            { name: 'gradleProfileName', value: 'runtimeClasspath' },
+          ],
         },
         {
           type: Enums.ComponentType.Library,
@@ -37,7 +40,10 @@ describe('trimCdxBom', () => {
           ],
           evidence: { copyright: [] },
           hashes: [{ alg: Enums.HashAlgorithm['MD5'], content: 'md5-hash' }],
-          properties: [{ name: 'prop2', value: 'value2' }],
+          properties: [
+            { name: 'prop2', value: 'value2' },
+            { name: 'GradleProfileName', value: 'testRuntimeClasspath' },
+          ],
         },
       ],
     };
@@ -49,13 +55,15 @@ describe('trimCdxBom', () => {
       externalReferences: [],
       evidence: {},
       hashes: [],
-      properties: [],
+      properties: [{ name: 'gradleProfileName', value: 'runtimeClasspath' }],
     });
     assert.partialDeepStrictEqual(result.components![1], {
       externalReferences: [],
       evidence: {},
       hashes: [],
-      properties: [],
+      properties: [
+        { name: 'GradleProfileName', value: 'testRuntimeClasspath' },
+      ],
     });
   });
 

src/trim-cdx-bom.ts

@@ -1,8 +1,10 @@
 import type { CdxBom } from './types/index.ts';
 
+const EOL_SCAN_PROPERTY_ALLOWLIST = new Set(['gradleprofilename']);
+
 /**
  * Creates a trimmed copy of a CycloneDX BOM by removing SBOM data not necessary for EOL scanning.
- * Removes externalReferences, evidence, hashes, and properties from components.
+ * Removes externalReferences, evidence, hashes, and non-EOL properties from components.
  * @param cdxBom - The CycloneDX BOM to trim
  * @returns A new trimmed CycloneDX BOM object
  */
@@ -13,6 +15,10 @@ export function trimCdxBom(cdxBom: CdxBom): CdxBom {
     component.externalReferences = [];
     component.evidence = {};
     component.hashes = [];
+    component.properties =
+      component.properties?.filter((property) =>
+        EOL_SCAN_PROPERTY_ALLOWLIST.has(property.name?.toLowerCase() ?? ''),
+      ) ?? [];
   }
 
   return newBom;