Type Members

1.  final case class DependencyNode(package_url: Option[String], metadata: Map[String, String], relationship: Option[DependencyRelationship], scope: Option[DependencyScope], dependencies: Seq[String]) extends Product with Serializable

   Represents a single dependency.

   Represents a single dependency.

   package_url

   Package-url (PURL) of dependency. See https://github.com/package-url/purl-spec for more details.

   metadata

   User-defined metadata to store domain-specific information limited to 8 keys with scalar values.

   relationship

   A notation of whether a dependency is requested directly by this manifest or is a dependency of another dependency.

   scope

   A notation of whether the dependency is required for the primary build artifact (runtime) or is only used for development. Future versions of this specification may allow for more granular scopes.

   dependencies

   Array of package-url (PURLs) of direct child dependencies.

2.  sealed trait DependencyRelationship extends Product with Serializable

   A notation of whether a dependency is requested directly by this manifest, or is a dependency of another dependency.

3.  sealed trait DependencyScope extends Product with Serializable

   A notation of whether the dependency is required for the primary build artifact (runtime), or is only used for development.

   A notation of whether the dependency is required for the primary build artifact (runtime), or is only used for development. Future versions of this specification may allow for more granular scopes, like runtime:server, runtime:shipped, development:test, development:benchmark.

4.  final case class DependencySnapshot(version: Int, job: Job, sha: String, ref: String, detector: Detector, metadata: Map[String, String], manifests: Map[String, Manifest], scanned: String) extends Product with Serializable

   Dependency submission snapshot for GitHub.

   Dependency submission snapshot for GitHub. Modeled after the info found in: https://docs.github.com/en/rest/dependency-graph/dependency-submission#create-a-snapshot-of-dependencies-for-a-repository

   version

   The version of the repository snapshot submission

   job

   The Job being sumbitted

   sha

   The commit SHA associated with this dependency snapshot

   ref

   The repository branch that triggered this snapshot

   detector

   A description of the detector used.

   metadata

   User-defined metadata to store domain-specific information limited to 8 keys with scalar values

   manifests

   A collection of package manifests

   scanned

   The time at which the snapshot was scanned in ISO8601Date

5.  final case class Detector(name: String, url: String, version: String) extends Product with Serializable

   Detector is the representation of the tool used to gather the dependency snapshot information.

   Detector is the representation of the tool used to gather the dependency snapshot information.

   name

   The name of the detector used

   url

   The url of the detector used

   version

   The version of the detector used

6.  final case class FileInfo(source_location: String) extends Product with Serializable

   Representing the infomation for the manifest file.

   Representing the infomation for the manifest file.

   source_location

   The path of the manifest file relative to the root of the Git repository.

7.  final case class Job(id: String, correlator: String, html_url: Option[String]) extends Product with Serializable

   Job that is being submitted by the dependency snapshot

   Job that is being submitted by the dependency snapshot

   id

   The external ID of the job

   correlator

   Correlator provides a key that is used to group snapshots submitted over time. Only the "latest" submitted snapshot for a given combination of job.correlator and detector.name will be considered when calculating a repository's current dependencies. Correlator should be as unique as it takes to distinguish all detection runs for a given "wave" of CI workflow you run. If you're using GitHub Actions, a good default value for this could be the environment variables GITHUB_WORKFLOW and GITHUB_JOB concatenated together. If you're using a build matrix, then you'll also need to add additional key(s) to distinguish between each submission inside a matrix variation.

   html_url

   The url for the job

8.  final case class Manifest(name: String, file: Option[FileInfo], metadata: Map[String, String], resolved: Map[String, DependencyNode]) extends Product with Serializable

   User-defined metadata to store domain-specific information limited to 8 keys with scalar values.

   User-defined metadata to store domain-specific information limited to 8 keys with scalar values.

   name

   The name of the manifest

   file

   The FileInfo

   metadata

   User-defined metadata to store domain-specific information limited to 8 keys with scalar values

   resolved

   The resolved dependnecy nodes for this manifest