That’s certainly an interesting idea: submitting a standardised SBoM through an API would allow Actions to be created for pretty much any language, without requiring GH involvement. But I imagine it would require some significant changes on GitHub’s side. Right now their tooling is driven off of files found in the repo, as long as they are recognised as supported dependency declaration formats.
voltone
hauleth
Official GitHub Response
Hi Łukasz,
Thanks for your feedback! We’re always working to improve GitHub and we consider every suggestion we receive. I have added your request for CycloneDX support in the dependency graph to our internal Feature Request List.
We can’t say if/when we may add a feature, however your feedback has definitely been recorded.
Thanks,
Steve G.
GitHub Support
So there is chance that this may happen. It still would be easier than implementing each language separately.
1
voltone
Version 3.7.1 of OWASP Dependency-Track comes with Hex integration, flagging available package updates:
4
voltone
Ownership of the sbom package has been transferred to the EEF Security WG. The project is now hosted here.
Version 0.8.0 has been released, with too many enhancements and fixes to list here; please check the full release notes. Thanks to @maennchen for picking this up and making this huge leap forward happen!
11