Draft
Conversation
Implement UvBB to build CycloneDX SBOMs from pyproject.toml and uv.lock, including dependency groups and extras. Register the subcommand in the CLI, document usage in README and docs/usage.rst, and add uv to package keywords. Signed-off-by: Mohammed Abbadi <mhamedrhamnah@gmail.com>
- Build marker env base from default_environment() items as str/str pairs. - Use a mutable set when assembling dependency groups before frozenset. - Add _bom_ref_value helper for non-optional bom_ref string keys. Signed-off-by: Mohammed Abbadi <mhamedrhamnah@gmail.com>
- Sort local imports in cli.py for isort (I001). - Drop duplicate ComponentType in TYPE_CHECKING; add noqa for high-complexity uv methods; wrap long signatures (F811, C901, E501, E125). Signed-off-by: Mohammed Abbadi <mhamedrhamnah@gmail.com>
Fix flake8 W391 (blank line at end of file). Signed-off-by: Mohammed Abbadi <mhamedrhamnah@gmail.com>
Documentation build overview
Show files changed (2 files in total): 📝 2 modified | ➕ 0 added | ➖ 0 deleted
|
Member
|
thank for your pushing this topic forward. We dont have any issue discussing integration with as long as these things are not clarified, i will put this PR in "draft" mode. |
2 tasks
2 tasks
jkowalleck
changed the title
uv subcommand
Member
|
might close #907 |
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This pull request adds first-class support for uv-managed projects by implementing a new
uvsubcommand that builds CycloneDX SBOMs frompyproject.tomlanduv.lock, instead of relying only on scanning a virtual environment.What changed
cyclonedx_py/_internal/uv.py(UvBB)Resolves dependencies from the lockfile, respects PEP 735
dependency-groupsand uv’s group/extra semantics (including options such as--group/--no-group/--only-group,--all-groups,--no-default-groups,--no-dev,-E/--all-extras, and optional resolution-markers handling where applicable). Produces components with PURLs, distribution external references (sdist/wheels), and dependency relationships consistent with other backends.CLI (
cyclonedx_py/_internal/cli.py)Registers
UvBBunder theuvsubcommand.Documentation
README.md: lists uv manifest + lockfile as supported; help snippet includesuv.docs/usage.rst: dedicated “For uv” section withcyclonedx-py uv --helpstyle output and usage notes.Packaging metadata (
pyproject.toml)Adds
uvto package keywords for discoverability.Tests
tests/integration/test_cli_uv.py– CLI + snapshot regression for uv fixtures.tests/unit/test_uv.py– unit coverage for uv parsing/behavior.tests/_data/infiles/uv/via-uv/– samplepyproject.toml+uv.lock.tests/_data/snapshots/uv/– golden JSON/XML snapshots across CycloneDX spec versions used by the suite.Quality / CI
mypy-lowest, Python 3.9): marker environment fromdefault_environment(),bom_reftyping helper, and group set typing fixes.cliimports; remove duplicateComponentTypeinTYPE_CHECKING;# noqa: C901+ signature wrapping where complexity is high; W391 fix ontest_cli_uv.py.Motivation
uv is widely used for lockfile-centric workflows; a dedicated path gives reproducible SBOMs aligned with the lockfile and documents uv-specific behavior in the manual.
Resolves or fixes issue: #1029.
AI Tool Disclosure
OpenAIgpt 5.2 (extra-high)[e.g. backbone for the uv file, mypy/flake8 fixes]Affirmation