feat(sca): CycloneDX SBOM export via --format cyclonedx (closes #31) - #36
Merged
Conversation
Implements SBOM export requested in #31. The SCA engine already discovers a dependency inventory; this surfaces it as a standard CycloneDX 1.5 JSON BOM so results can be consumed by Grype, Trivy, and Dependency-Track. - sca: retain the full dependency inventory from Analyze (Engine.Dependencies) so an SBOM can be built without re-walking the tree - analyzer: carry the inventory on ScanResult.Dependencies - reporter: new CycloneDXReporter emitting CycloneDX 1.5 with per-ecosystem Package URLs (npm, pypi, golang, maven, gem, composer, pub), component dedup by purl, stable sorting, and a urn:uuid serial number - cli: register the `cyclonedx` format and shell-completion entry - tests: purl derivation (incl. npm scopes and golang module paths), dedup, sorting, and valid-JSON output Scope note: this is a flat component list. The SCA engine resolves manifests, not full lockfiles, so the transitive dependency graph is not yet expressed. Transitive resolution and SPDX output are planned for a later release. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
filipi86
added a commit
that referenced
this pull request
Jun 23, 2026
Follows up #36 by documenting the new --format cyclonedx everywhere users look for output formats. - docs/usage.md: bump "four formats" to five, add the format to the table, add a dedicated CycloneDX SBOM section with example output and scope/usage notes - docs/modules.md: add an SBOM Export subsection under the SCA engine - docs/index.md: list CycloneDX in standards and the reporter package comment - docs/branch-monitoring.md: add cyclonedx to the monitor --format values - docs/security.md: include cyclonedx in the 0600 report-permission note - README.md: reporter package comment - cli/monitor: add cyclonedx to the --format help text (monitor routes through reporter.New, so the format already works there) Co-authored-by: filipi86 <filipi86@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements the SBOM export requested in #31. The SCA engine already discovers a dependency inventory; this surfaces it as a standard CycloneDX 1.5 JSON BOM so results can be consumed by Grype, Trivy, and Dependency-Track.
drogonsec scan . --format cyclonedx --output sbom.jsonCycloneDX is itself an OWASP project, so this also strengthens the OWASP-alignment story.
What's included
Engine.Dependencies()retains the full inventory fromAnalyzeso the SBOM is built without re-walking the tree.ScanResult.Dependencies.CycloneDXReporteremitting CycloneDX 1.5 with:pkg:npm/%40angular/core@...) and full golang module pathsurn:uuidserial numbercyclonedxformat and a shell-completion entry.Verified locally
drogonsec scan . --format cyclonedx -o sbom.jsonagainst this repo produced a valid CycloneDX 1.5 BOM with 43 components and correctpkg:golang/...purls.go build,go vet,gofmt, and the full test suite pass.Scope note (v1)
This is a flat component list. The SCA engine resolves manifests, not full lockfiles, so the transitive dependency graph is not yet expressed. Transitive resolution and SPDX output are planned for a later release, as discussed in #31.
Closes #31
🤖 Generated with Claude Code