Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

support generating sbom for particular branch using tool method #33

Merged
merged 1 commit into from
Feb 10, 2025

Conversation

viveksahu26
Copy link
Contributor

This PR add the following changes:

  • Added support for fetching SBOMs from a specific branch in the GitHub Tool Method.
  • Adds the separate flag for branch : in-github-branch.
    • If branch is provided, then it will clone that specific branch and generates SBOM.
    • If branch is not provided, which is by default empty, then in that case, it will pull up repo for default branch

NOTE:

  • This branch method only supports for tool method, whereas api and release won't support.

Description:

Why API and Release Methods Don't Support Branch Selection ?

  • GitHub API Method: The dependency graph only provides SBOMs for the default branch and does not allow fetching SBOMs for arbitrary branches.
  • GitHub Release Method: SBOMs are generated for tagged releases, which are typically based on the main branch and do not support fetching from specific branches.

Why Tool Method Supports Branch Selection ?

  • The Tool Method clones the repository locally, allowing us to check out any specific branch and generate an SBOM from that branch using an external tool like Syft.

@viveksahu26 viveksahu26 merged commit 6d67883 into main Feb 10, 2025
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant