export_cbom
Export a directory scan as a CycloneDX 1.6 CBOM with coverage metadata, enabling auditors and pipelines to verify exactly which files were examined.
Instructions
Scan one directory and return a CycloneDX 1.6 CBOM that carries its own coverage.
Same reading as scan_repo; a different document. Use this when the result has to
leave the machine -- an auditor, a customer, a pipeline artefact -- and scan_repo
when a person or an agent is going to read it here.
What the document carries beyond the components: compositions.aggregate states how
complete the list is in the schema's own vocabulary, complete only when every file
present was examined; properties carries the whole coverage block flattened,
including every file not examined with its reason; and each asset carries
evidence.occurrences with file, line and matched text.
The coverage block travels as properties because the CycloneDX root object is
additionalProperties: false and the format has no field for it. That is the point
of emitting it this way rather than a limitation to work around.
The serial number is derived from the target, the two pins and a digest of the findings, so two runs of the same code over the same corpus that find the same things share it and a different result does not. The timestamp and coverage window record when each run happened.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Directory to scan and export, same argument as `scan_repo`. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||