From 342e8eeda4299ad2574eeebf8bfe29cbdea852c0 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 28 Aug 2026 14:50:41 +0200
Subject: [PATCH 1/2] linter: no todo's

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 tools/src/main/js/linter/checks/index.js      |  2 +
 .../main/js/linter/checks/no-todos.check.js   | 70 +++++++++++++++++++
 2 files changed, 72 insertions(+)
 create mode 100644 tools/src/main/js/linter/checks/no-todos.check.js

diff --git a/tools/src/main/js/linter/checks/index.js b/tools/src/main/js/linter/checks/index.js
index 13462bda..dc12726c 100644
--- a/tools/src/main/js/linter/checks/index.js
+++ b/tools/src/main/js/linter/checks/index.js
@@ -53,3 +53,5 @@ export * from './enum-value-formatting.check.js';
 export * from './enum-value-no-other.check.js';
 export * from './duplicate-content.check.js';
 export * from './duplicate-definitions.check.js';
+export * from './no-todos.check.js';
+
diff --git a/tools/src/main/js/linter/checks/no-todos.check.js b/tools/src/main/js/linter/checks/no-todos.check.js
new file mode 100644
index 00000000..b4dbe4e6
--- /dev/null
+++ b/tools/src/main/js/linter/checks/no-todos.check.js
@@ -0,0 +1,70 @@
+/**
+ * CycloneDX Schema Linter - No ToDo's Check
+ *
+ * @license Apache-2.0
+ */
+
+import { LintCheck, registerCheck, Severity, traverseSchema } from '../index.js';
+
+/**
+ * Patterns to detect ToDo's
+ */
+const TODO_PATTERNS = /\bToDo\b/i
+
+const DOCS_KEYS = Object.freeze(new Set([
+  '$comment',
+  'title',
+  'description',
+]))
+
+/**
+ * Check that validates there are no ToDo's
+ */
+class NoTodosCheck extends LintCheck {
+  constructor() {
+    super(
+      'no-todos',
+      'No ToDo\'s',
+      'Validates that there are no ToDo\'s' ,
+      Severity.ERROR
+    );
+  }
+
+  async run(schema, rawContent, config = {}) {
+    const issues = [];
+
+    // Allow "must" in specific contexts
+    const allowInContext = config.allowInContext ?? false;
+
+    traverseSchema(schema, (node, path, key, parent) => {
+      if (TODO_PATTERNS.test(key)) {
+        issues.push(this.createIssue(
+          `There is an open ToDO`,
+          path,
+          { key }
+        ));
+      }
+
+      if (typeof node !== 'string') return;
+
+      if (!DOCS_KEYS.has(key)) return;
+
+      if (TODO_PATTERNS.test(node)) {
+        issues.push(this.createIssue(
+          `There is an open ToDO: ${node}`,
+          path,
+          { text: node }
+        ));
+      }
+    });
+
+    return issues;
+  }
+}
+
+// Create and register the check
+const check = new NoTodosCheck();
+registerCheck(check);
+
+export { NoTodosCheck };
+export default check;

From df4a75d91d95e2433222160b399b823901ca2267 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 28 Aug 2026 14:52:59 +0200
Subject: [PATCH 2/2] linter: no todo's

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 tools/src/main/js/linter/checks/no-todos.check.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/src/main/js/linter/checks/no-todos.check.js b/tools/src/main/js/linter/checks/no-todos.check.js
index b4dbe4e6..b804b07b 100644
--- a/tools/src/main/js/linter/checks/no-todos.check.js
+++ b/tools/src/main/js/linter/checks/no-todos.check.js
@@ -39,7 +39,7 @@ class NoTodosCheck extends LintCheck {
     traverseSchema(schema, (node, path, key, parent) => {
       if (TODO_PATTERNS.test(key)) {
         issues.push(this.createIssue(
-          `There is an open ToDO`,
+          `There is an open ToDo`,
           path,
           { key }
         ));