Deprecated packages identification using SBOM scripts in CI steps

[elnyry-sam-k]

Request Summary:

SBOMs for each repo generated during CI cycle (circleci) and specifically, "deprecated" packages at any level identified and listed as "warning" currently.

DA to decide whether to mark the step as fail or mark as warning to be addressed on a case-by-case basis (after currently identified issues are addressed)

Request Details:

• Deadline: n/a
• Impact (Teams): All contributors, release cycle and core & maintenance team
• Impact (Components): Releases, all repos using CI/CD

Artifacts:

• Artifact to consider [@contributor]

Dependencies:

• If Applicable

Accountability:

• Owner: @elnyry-sam-k
• Raised By: @elnyry-sam-k

Decision(s):

• DA agreed to include this in the CI and print deprecations as warnings

• A future decision is to be made when a deprecation in a package will be marked as an error and block the CI step.

• Approved By:

Details

• Actual decision made as a result of discussion

Follow-up:

• Actions to implement the decisions

[elnyry-sam-k]

Here's a circleCI run on how this would look like: https://app.circleci.com/pipelines/github/mojaloop/sdk-standard-components/1138/workflows/4855ebe2-e9c1-4709-baa7-2b0b748417ea/jobs/5443

sample output (only WARNINGS now, not ERRORs):

`Checking dependencies at root level...

1. eslint@8.57.0 DEPRECATED
   WARNING!! Deprecated results found at root level.

Checking all dependencies (including transitive)...

1. eslint@8.57.0 DEPRECATED
2. superagent@7.1.6 DEPRECATED
3. highlightjs@9.16.2 DEPRECATED
4. mkdirp-promise@1.1.0 DEPRECATED
5. har-validator@5.1.5 DEPRECATED
6. @humanwhocodes/config-array@0.11.14 DEPRECATED
7. @humanwhocodes/object-schema@2.0.3 DEPRECATED
8. rimraf@3.0.2 DEPRECATED
9. glob@7.2.3 DEPRECATED
10. inflight@1.0.6 DEPRECATED
11. q@1.5.1 DEPRECATED
12. stringify-package@1.0.1 DEPRECATED
    WARNING!! Deprecated results found in dependencies.
    `

[bushjames]

Implemented in CI but currently only reports "warning". To be discussed at next available DA session in more detail.