CycloneDX / CycloneDX/cyclonedx-python
Feature request: Add native uv project support (pyproject.toml + uv.lock) via cyclonedx-py uv subcommand
- 主要言語
- Python
- スター
- 390
- フォーク
- 98
- 平均マージ
- 2日 23時間
- マージ済み PR(30日)
- 2
説明
## Is your feature request related to a problem? Please describe.
Yes. `cyclonedx-py` currently supports generating SBOMs from environments, requirements, Pipenv, and Poetry projects, but there is no first-class `uv` project workflow in released versions.
This makes it harder for teams using `uv` to generate lockfile-based SBOMs directly from `pyproject.toml` + `uv.lock`, and can block adoption in projects where `uv` is the package manager of record.
## Describe the solution you'd like
Add native `uv` project support as a dedicated CLI subcommand (for example, `cyclonedx-py uv`) that:
- accepts a project directory (or `uv.lock` path),
- reads `pyproject.toml` and `uv.lock`,
- resolves dependency groups/extras in a way consistent with `uv`,
- generates CycloneDX JSON/XML output with the same quality and validation behavior as existing subcommands,
- is documented in `README` and `docs/usage.rst`,
- includes integration/unit tests and snapshot coverage.
## Describe alternatives you've considered
- **Environment scan (`cyclonedx-py environment`)**: works for installed packages, but is less lockfile-centric and can differ from the exact declared lock resolution.
- **Converting/exporting through external tools first**: adds extra steps and potential drift between source lock data and generated SBOM.
- **Maintaining custom scripts**: increases maintenance burden and reduces consistency with official tool behavior.
## Additional context
`uv` adoption is growing quickly, and users expect parity with other mainstream Python dependency workflows.
A dedicated `uv` subcommand would improve reproducibility, reduce friction in CI pipelines, and align with lockfile-driven supply chain practices.
## Contribution
- [x] I am willing to provide an implementation
- [ ] I will wait until somebody else implements it
コントリビューションガイド
調査の方向性
Start by reviewing the existing cyclonedx-py subcommands and the linked pull request #1028, then read README and docs/usage.rst for the documented CLI patterns. Done means a dedicated uv workflow accepts pyproject.toml and uv.lock, produces the requested CycloneDX outputs, and has the requested unit, integration, and snapshot coverage.
索引モデルが issue の本文から書いたものです。
評価
- 技術スタック
- python
- 領域
- cli, documentation, tooling
- issue の種類
- 機能追加
- 難易度
- 5/5
- 見積もり時間
- 1週間以上
- 活発さ
- 停滞
- 明瞭さ
- おおむね明確
- 初心者へのやさしさ
- 25/100