CycloneDX / CycloneDX/cyclonedx-python
Feature request: Add native uv project support (pyproject.toml + uv.lock) via cyclonedx-py uv subcommand
- Langage dominant
- Python
- Étoiles
- 390
- Forks
- 98
- Merge moyen
- 2 j 23 h
- PR mergées (30 j)
- 2
Description
## Is your feature request related to a problem? Please describe.
Yes. `cyclonedx-py` currently supports generating SBOMs from environments, requirements, Pipenv, and Poetry projects, but there is no first-class `uv` project workflow in released versions.
This makes it harder for teams using `uv` to generate lockfile-based SBOMs directly from `pyproject.toml` + `uv.lock`, and can block adoption in projects where `uv` is the package manager of record.
## Describe the solution you'd like
Add native `uv` project support as a dedicated CLI subcommand (for example, `cyclonedx-py uv`) that:
- accepts a project directory (or `uv.lock` path),
- reads `pyproject.toml` and `uv.lock`,
- resolves dependency groups/extras in a way consistent with `uv`,
- generates CycloneDX JSON/XML output with the same quality and validation behavior as existing subcommands,
- is documented in `README` and `docs/usage.rst`,
- includes integration/unit tests and snapshot coverage.
## Describe alternatives you've considered
- **Environment scan (`cyclonedx-py environment`)**: works for installed packages, but is less lockfile-centric and can differ from the exact declared lock resolution.
- **Converting/exporting through external tools first**: adds extra steps and potential drift between source lock data and generated SBOM.
- **Maintaining custom scripts**: increases maintenance burden and reduces consistency with official tool behavior.
## Additional context
`uv` adoption is growing quickly, and users expect parity with other mainstream Python dependency workflows.
A dedicated `uv` subcommand would improve reproducibility, reduce friction in CI pipelines, and align with lockfile-driven supply chain practices.
## Contribution
- [x] I am willing to provide an implementation
- [ ] I will wait until somebody else implements it
Guide de contribution
Ouvrir le guide de contribution
Piste de recherche
Start by reviewing the existing cyclonedx-py subcommands and the linked pull request #1028, then read README and docs/usage.rst for the documented CLI patterns. Done means a dedicated uv workflow accepts pyproject.toml and uv.lock, produces the requested CycloneDX outputs, and has the requested unit, integration, and snapshot coverage.
Rédigé par le modèle d'indexation à partir du texte de l'issue.
Évaluation
- Stack technique
- python
- Domaine
- cli, documentation, tooling
- Type d'issue
- Fonctionnalité
- Difficulté
- 5/5
- Temps estimé
- Plus d'une semaine
- Activité
- À l'abandon
- Clarté
- Plutôt claire
- Accessibilité débutants
- 25/100