SBOM: export a selected element by path, with the transitive chain - #172
Merged
villelaitila merged 1 commit intoAug 5, 2026
Merged
Conversation
generate_for_element_from_sgraph(sgraph, '/Project/repo/dir', transitive=...) produces one CycloneDX SBOM rooted at the chosen element: the element is the metadata component and its descendants define the scope. Its peers at the same tree depth form the internal-dependency universe — the same universe the level-based multi mode uses — so with transitive=True the SBOM inlines the chain of directly and indirectly used internal elements and their 3rd-party components exactly like the multi mode does per element, and the two outputs compose instead of contradicting each other. The shared machinery (content-element walk, external lookup, serial and bom-ref identity, per-element SBOM assembly) is refactored out of generate_multi_from_sgraph into _multi_sbom_context and _sbom_for_content_element; the two duplicated level-walk closures fold into one _content_elements_at_level. bom-refs gain deterministic '-2', '-3' suffixes on name collisions: unique at repo level, but a dir-level split makes collisions ordinary (every repo has a 'src') and a collision inside one transitive BOM would corrupt its dependencies graph. CLI: --element-path (mutually exclusive with --level), composes with --transitive. Unknown paths and paths inside the External subtree are rejected with a ValueError.
Softagram Impact Report for pull/172 (head commit: 7087825)TL;DR Changed code files: 2 | Directly impacted code files: 1⭐ Change Overview
⭐ Details of Dependency Changes
[] 📄 Full report
Impact Report explained. Give feedback on this report to support@softagram.com |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
generate_for_element_from_sgraph(sgraph, element_path, transitive=False)— one CycloneDX 1.7 SBOM rooted at a chosen element (typically/Project/repoor/Project/repo/dir):transitive=Trueinlines the chain of directly and indirectly used internal elements and their 3rd-party components, exactly like the multi mode does per element (DT-safe: every ref resolves in-BOM)ValueErrorCLI:
--element-path /Project/repo/dir(mutually exclusive with--level), composes with--transitive.Example (multi-repo fixture,
--element-path /OrgName/GroupA/repoA --transitive):Refactoring
The shared machinery is extracted from
generate_multi_from_sgraphinto_multi_sbom_context+_sbom_for_content_element, and the two duplicated level-walk closures fold into one_content_elements_at_level. Multi-mode behavior is unchanged (locked by the existing 16 multi/transitive tests).New behavior forced by deep paths
bom-refs get deterministic
-2,-3suffixes on name collisions. Names are unique at repo level, but a dir-level selection makes collisions ordinary (every repo has asrc), and a collision inside one transitive BOM would corrupt its dependencies graph.Tests
7 new (single-SBOM contract, transitive chain, deep path + collision suffix, both error cases, CLI incl. mutual exclusion). Full suite: 237 passed.