feat(contrib): populate component tags from npm keywords

[CAOShurong]

Closes #1055

Summary

Adds tags support to the Component model and populates it from array-form npm package.json keywords, serializing tags in both JSON and XML for CycloneDX 1.6 and later.

Changes

• Component.tags is a Set<string> with an empty default and participates in component comparison.
• Contrib.FromNodePackageJson.Builders.ComponentBuilder collects normalized array-form keywords through a dedicated generator, ignores non-array input, and filters non-string entries.
• JSON and XML normalizers emit sorted tags for CycloneDX 1.6 and 1.7 only.
• createComplexStructure covers tags and the JSON/XML normalization and serialization snapshots are updated for 1.6/1.7.
• Builder and model tests cover empty/default tags, malformed keywords, and comparison behavior.
• HISTORY.md records the model, serializer/normalizer, and contrib-builder capabilities separately.

The unrelated entity-address work remains split into #1513.

Verification

• Full Node test suite: 4170 passing, 4 pending, 0 failing
• npm run test:lint: passed
• Full repository ESLint: passed
• npm run build:node: passed
• npm run build:web: passed
• Type declaration build stage: passed (the existing Windows cpy post-script reports No files matched)

AI Tool Disclosure

• My contribution does not include any AI-generated content
• My contribution includes AI-generated content, as disclosed below:
  • AI Tools: OpenAI Codex
  • LLMs and versions: GPT-5 family
  • Prompts: Asked Codex to implement component tags from normalized npm keywords, follow maintainer review on data shape, comparison, changelog and fixture snapshots, and verify the focused and full test/build paths.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · -1 duplication

Metric	Results
Complexity	0
Duplication	-1

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[read-the-docs-community]

Documentation build overview

📚 CycloneDX JavaScript Library | 🛠️ Build #34260958 | 📁 Comparing f837fca against latest (ed03365)

  🔍 Preview build  

2 files changed

± changelog.html
± index.html

[CAOShurong]

The AI Tool Disclosure section from the PR template is now filled in (OpenAI Codex CLI / GPT-5-Codex, with a summary of the prompts). Sorry for missing it — happy to adjust anything else.

[jkowalleck]

better have this collection of tags separate - just like properties above.

Also, we dont care for any keywords that is not an array ....

As the doc string says:

Intended to run on normalized data structures

suggestion:

const tags = new Set(this.#makeTags(data.keywords))

* #makeTags (keywords: NodePackageJson['keywords']): Generator<string> {
  if (!Array.isArray(keywords)) continue;
  for (const kw of keywords) {
    if (typeof kw === 'string') {
      yield kw
    }
  }
}

[jkowalleck]

better:

Suggested change

	tags?: string[]
	keywords?: Set<string>

and the new property is misisng in the compare function

[jkowalleck]

tests are missing - please add the new capabilities to the createComplexStructure in file tests/_data/models.js and have the test running and snapshots updated.

see https://github.com/CycloneDX/cyclonedx-javascript-library/blob/main/tests/README.md

[jkowalleck]

split those new capabilities -and make them a post shorter, if possible, see the changelog from the past .
something like

Suggested change

	* `Contrib.FromNodePackageJson.Builders.ComponentBuilder` populates component `tags` from the npm `keywords` property; `tags` are serialised in JSON and XML for CycloneDX 1.6 and later ([#1055])
	* component model knownstags
	* serializers and normalizers canemit component tags
	* that contrib builder may populate tags ([#1055] via [#1511])

[jkowalleck]

Suggested change

	[#1055]: https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1055
	[#1055]: https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1055
	[#1511]: https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1511

[CAOShurong]

Addressed all requested changes in f837fca:

• tags are now a separate Set<string> and participate in Component.compare();
• the contrib builder accepts only array-form keywords through #makeTags() and filters non-strings;
• the changelog is split into the three shorter capability entries with the feat(contrib): populate component tags from npm keywords #1511 link;
• createComplexStructure now includes unsorted tags, with updated sorted-normalizer and JSON/XML serialization snapshots for specs 1.6 and 1.7;
• builder/model regressions cover non-array and malformed keywords, empty/default sets, and tag comparison.

Revalidated the pushed head: full Node suite 4170 passing / 4 pending, npm run test:lint passed, repository ESLint passed, and the Node/web/type-declaration build stages passed. The PR body now reflects the final data shape and verification.

[CAOShurong]

@jkowalleck, the requested model/builder, changelog, and fixture changes are now in f837fca, and all current checks are green. When you have a chance, could you please re-review? Thank you.