revisit formulations

Open

#1,089 opened on Sep 8, 2026 1 comment 0 reactions 1 assignee View on GitHub

@jkowalleck is already working on this.

Since Sep 8, 2026.

Assessment

This issue has not been assessed yet.

cap: formulation

formulations have some issues:

steps can not have own input/output, but tasks can -- how would you craft a task that runs multiple steps, where every step then hands over a new piece of information to the next one?
docs are misleading or confusing
- where does this "inbound"/"outbound" come from? what is a "data flow"?
  - https://github.com/CycloneDX/specification/blob/a1c8aeb2e4e6a72851fd937f210e9b5add1cf514/schema/2.0/model/cyclonedx-formulation-2.0.schema.json#L653
  - https://github.com/CycloneDX/specification/blob/a1c8aeb2e4e6a72851fd937f210e9b5add1cf514/schema/2.0/model/cyclonedx-formulation-2.0.schema.json#L753
- ... to be continued ...
examples dont validate against own schema.
- per JSON schema spec, examples should validate against their schema.
  see https://json-schema.org/understanding-json-schema/reference/annotations
- here, the target is a complex object(resourceReferenceChoice), but the example is a string
  https://github.com/CycloneDX/specification/blob/a1c8aeb2e4e6a72851fd937f210e9b5add1cf514/schema/2.0/model/cyclonedx-formulation-2.0.schema.json#L751-L756
- ... to be continued ...
input/output in general are not system-independent
a workflow must have a taskTypes, but may have no tasks at all
a workflow may have a task and steps, while a task has steps itself.
... to be continued ...

PS: Some of the "issues" I raised may be mistaken on my part — feel free to correct me in the discussion.

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.