CycloneDX / CycloneDX/cyclonedx-python

Feature request: Add native uv project support (pyproject.toml + uv.lock) via cyclonedx-py uv subcommand

クローズ
#1,029 コメント 6 件 リアクション 1 件 担当者 0 名 @m7mdhka が担当を希望しています GitHub で見る
enhancement source: uv
主要言語
Python
スター
390
フォーク
98
平均マージ
2日 23時間
マージ済み PR(30日)
2

説明

## Is your feature request related to a problem? Please describe.

Yes. `cyclonedx-py` currently supports generating SBOMs from environments, requirements, Pipenv, and Poetry projects, but there is no first-class `uv` project workflow in released versions.
This makes it harder for teams using `uv` to generate lockfile-based SBOMs directly from `pyproject.toml` + `uv.lock`, and can block adoption in projects where `uv` is the package manager of record.

## Describe the solution you'd like

Add native `uv` project support as a dedicated CLI subcommand (for example, `cyclonedx-py uv`) that:

- accepts a project directory (or `uv.lock` path),
- reads `pyproject.toml` and `uv.lock`,
- resolves dependency groups/extras in a way consistent with `uv`,
- generates CycloneDX JSON/XML output with the same quality and validation behavior as existing subcommands,
- is documented in `README` and `docs/usage.rst`,
- includes integration/unit tests and snapshot coverage.

## Describe alternatives you've considered

- **Environment scan (`cyclonedx-py environment`)**: works for installed packages, but is less lockfile-centric and can differ from the exact declared lock resolution.
- **Converting/exporting through external tools first**: adds extra steps and potential drift between source lock data and generated SBOM.
- **Maintaining custom scripts**: increases maintenance burden and reduces consistency with official tool behavior.

## Additional context

`uv` adoption is growing quickly, and users expect parity with other mainstream Python dependency workflows.
A dedicated `uv` subcommand would improve reproducibility, reduce friction in CI pipelines, and align with lockfile-driven supply chain practices.

## Contribution

- [x] I am willing to provide an implementation
- [ ] I will wait until somebody else implements it

コントリビューションガイド

コントリビューションガイドを開く

調査の方向性

Start by reviewing the existing cyclonedx-py subcommands and the linked pull request #1028, then read README and docs/usage.rst for the documented CLI patterns. Done means a dedicated uv workflow accepts pyproject.toml and uv.lock, produces the requested CycloneDX outputs, and has the requested unit, integration, and snapshot coverage.

索引モデルが issue の本文から書いたものです。

評価

技術スタック
python
領域
cli, documentation, tooling
issue の種類
機能追加
難易度
5/5
見積もり時間
1週間以上
活発さ
停滞
明瞭さ
おおむね明確
初心者へのやさしさ
25/100

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。