Support Integration with SCM and Dependency Track

[abhisek]

Problem

Dependency Track is a continuous SBOM management and analysis platform. For DT to be effective, it is important to continuously import SBOMs into DT. We want vet to make it very easy for an organization to continuously sync there repositories into DT by generating SBOM and using DT's REST API to upload to DT

Solution

We will start by supporting Github and eventually may be Gitlab. For the Github integration, we will provide an experience on top of the existing --github scan option to scan a remote Github repository. The scan will look like

vet scan --github-org https://github.com/safedep

For syncing results to DependencyTrack, we will build a new reporting module that syncs to DependencyTrack instance.

VET_DT_BASE_URL="..." VET_DT_TOKEN="..." \
vet scan --github-org https://github.com/safedep --report-dependency-track