feat(sbomgen): expose library API for programmatic SBOM generation (SCI Usage)#155
Conversation
- Add pkg/sbomgen package with GenerateSBOM() and DefaultOptions() API - GenerateSBOM accepts directory paths and options, returns CycloneDX JSON bytes - Options struct exposes Recursive and ExcludePaths configuration - Wraps scanner.DoScan and internal/output serialization without CLI dependencies - Add tests: happy path with fixture scan, empty dirs error, default options validation - Add testdata fixture with minimal Cargo.lock for isolated testing Rationale: The CLI-only interface prevents programmatic usage of the SBOM generator from Go code. This library API enables embedding SBOM generation in other tools (e.g., GitHub Actions, CI pipelines) without shelling out to the CLI binary. This commit made by [/dd:git:commit:atomic](https://github.com/DataDog/claude-marketplace/tree/main/dd/commands/git/commit/atomic.md)
…ibrary usage
- Add examples/main.go that calls sbomgen.GenerateSBOM() and prints CycloneDX JSON
- Accepts optional directory argument; defaults to pkg/sbomgen/testdata
- Demonstrates the minimal API: GenerateSBOM([]string{dir}, DefaultOptions())
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
This comment has been minimized.
This comment has been minimized.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 956e325e5e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Recursive: opts.Recursive, | ||
| } | ||
|
|
||
| r := reporter.NewCycloneDXReporter(&bytes.Buffer{}, &bytes.Buffer{}, reporter.WarnLevel) |
There was a problem hiding this comment.
When a scan contains at least one valid lockfile plus another lockfile that fails to parse, scanner.DoScan only reports the failed file via Reporter.Warnf and still returns results for the valid packages. This reporter writes warnings into private buffers that are never returned or exposed, so GenerateSBOM can return a successful but incomplete SBOM with no indication to library callers that some dependencies were skipped. The CLI surfaces the same condition on stderr, so the library wrapper should either expose warnings/errors or use a caller-provided reporter/writer.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
We can do it later
anderruiz
changed the title
anderruiz
changed the title
dastrong
left a comment
dastrong
left a comment
There was a problem hiding this comment.
Should we update the readme with this?
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
2 participants
Summary
pkg/sbomgenpackage with aGenerateSBOM(dirs []string, opts Options) ([]byte, error)function that wraps the scanner + CycloneDX output for external consumersOptionsstruct andDefaultOptions()with recursive scanning enabled by defaultexamples/main.godemonstrating library usage (temporary reference implementation)Motivation
The tool was previously only usable as a CLI binary. Any Go project wanting to generate SBOMs programmatically had to shell out to the binary. This change exposes a clean public API in
pkg/sbomgen/that can be imported directly.Usage
Test plan
TestGenerateSBOM_HappyPath— scans a Cargo.lock fixture, validates CycloneDX outputTestGenerateSBOM_EmptyDirs— returns error on empty dirs sliceTestDefaultOptions— validates default option valuesexamples/main.gocompiles and runs, printing valid CycloneDX JSON🤖 Generated with Claude Code