diff --git a/providers/github/resources/github.lr b/providers/github/resources/github.lr index 05a4cd2fcb..7834a28179 100644 --- a/providers/github/resources/github.lr +++ b/providers/github/resources/github.lr @@ -420,6 +420,70 @@ github.repository @defaults("fullName") { environments() []github.environment // Deployments for the repository deployments() []github.deployment + // Software Bill of Materials (SPDX format) for the repository + spdxSbom() github.repository.sbom +} + +// SPDX SBOM for a GitHub repository +private github.repository.sbom @defaults("name spdxVersion") { + // SPDX identifier for the document + spdxId string + // Version of the SPDX specification (e.g., "SPDX-2.3") + spdxVersion string + // Name of the SPDX document (e.g., "owner/repo") + name string + // License under which the SPDX document is released + dataLicense string + // Namespace URI for the document + documentNamespace string + // Time when the SBOM was generated + createdAt time + // List of creators of the SBOM + creators []string + // List of packages described in the SBOM + packages []github.repository.sbom.package + // Dependency relationships between packages + relationships []github.repository.sbom.relationship +} + +// A package entry in a GitHub repository SBOM +private github.repository.sbom.package @defaults("name versionInfo") { + // Unique SPDX identifier for this package + spdxId string + // Package name + name string + // Package version or version range + versionInfo string + // Download location + downloadLocation string + // Whether file contents were analyzed + filesAnalyzed bool + // Concluded license + licenseConcluded string + // License declared by the package author + licenseDeclared string + // External references (e.g., purl) + externalRefs []github.repository.sbom.package.externalRef +} + +// An external reference for a package in a GitHub repository SBOM +private github.repository.sbom.package.externalRef { + // The category of reference to an external resource this reference refers to. E.g. `PACKAGE-MANAGER`. + referenceCategory string + // A locator for the particular external resource this reference refers to. E.g. `pkg:gem/rails@6.0.1`. + referenceLocator string + // The type of the external reference. E.g. `purl`. + referenceType string +} + +// A relationship entry between two SPDX elements +private github.repository.sbom.relationship { + // Type of relationship (e.g., "DEPENDS_ON") + relationshipType string + // SPDX identifier of the source element + spdxElementId string + // SPDX identifier of the target element + relatedSpdxElement string } // GitHub license diff --git a/providers/github/resources/github.lr.go b/providers/github/resources/github.lr.go index bf33eb4c0e..cced3c3ade 100644 --- a/providers/github/resources/github.lr.go +++ b/providers/github/resources/github.lr.go @@ -17,43 +17,47 @@ import ( // The MQL type names exposed as public consts for ease of reference. const ( - ResourceGithub string = "github" - ResourceGitCommit string = "git.commit" - ResourceGitCommitAuthor string = "git.commitAuthor" - ResourceGitGpgSignature string = "git.gpgSignature" - ResourceGithubOrganization string = "github.organization" - ResourceGithubOrganizationCustomProperty string = "github.organization.customProperty" - ResourceGithubUser string = "github.user" - ResourceGithubTeam string = "github.team" - ResourceGithubCollaborator string = "github.collaborator" - ResourceGithubPackage string = "github.package" - ResourceGithubPackages string = "github.packages" - ResourceGithubRepository string = "github.repository" - ResourceGithubLicense string = "github.license" - ResourceGithubFile string = "github.file" - ResourceGithubRelease string = "github.release" - ResourceGithubWebhook string = "github.webhook" - ResourceGithubWorkflow string = "github.workflow" - ResourceGithubBranch string = "github.branch" - ResourceGithubBranchprotection string = "github.branchprotection" - ResourceGithubCommit string = "github.commit" - ResourceGithubMergeRequest string = "github.mergeRequest" - ResourceGithubReview string = "github.review" - ResourceGithubInstallation string = "github.installation" - ResourceGithubGist string = "github.gist" - ResourceGithubGistfile string = "github.gistfile" - ResourceGithubMilestone string = "github.milestone" - ResourceGithubIssue string = "github.issue" - ResourceGithubDependabotAlert string = "github.dependabotAlert" - ResourceGithubSecretScanningAlert string = "github.secretScanningAlert" - ResourceGithubCodeScanningAlert string = "github.codeScanningAlert" - ResourceGithubAuditLogEntry string = "github.auditLogEntry" - ResourceGithubRunner string = "github.runner" - ResourceGithubRunnerLabel string = "github.runnerLabel" - ResourceGithubEnvironment string = "github.environment" - ResourceGithubEnvironmentProtectionRule string = "github.environmentProtectionRule" - ResourceGithubDeployment string = "github.deployment" - ResourceGithubDeploymentStatus string = "github.deploymentStatus" + ResourceGithub string = "github" + ResourceGitCommit string = "git.commit" + ResourceGitCommitAuthor string = "git.commitAuthor" + ResourceGitGpgSignature string = "git.gpgSignature" + ResourceGithubOrganization string = "github.organization" + ResourceGithubOrganizationCustomProperty string = "github.organization.customProperty" + ResourceGithubUser string = "github.user" + ResourceGithubTeam string = "github.team" + ResourceGithubCollaborator string = "github.collaborator" + ResourceGithubPackage string = "github.package" + ResourceGithubPackages string = "github.packages" + ResourceGithubRepository string = "github.repository" + ResourceGithubRepositorySbom string = "github.repository.sbom" + ResourceGithubRepositorySbomPackage string = "github.repository.sbom.package" + ResourceGithubRepositorySbomPackageExternalRef string = "github.repository.sbom.package.externalRef" + ResourceGithubRepositorySbomRelationship string = "github.repository.sbom.relationship" + ResourceGithubLicense string = "github.license" + ResourceGithubFile string = "github.file" + ResourceGithubRelease string = "github.release" + ResourceGithubWebhook string = "github.webhook" + ResourceGithubWorkflow string = "github.workflow" + ResourceGithubBranch string = "github.branch" + ResourceGithubBranchprotection string = "github.branchprotection" + ResourceGithubCommit string = "github.commit" + ResourceGithubMergeRequest string = "github.mergeRequest" + ResourceGithubReview string = "github.review" + ResourceGithubInstallation string = "github.installation" + ResourceGithubGist string = "github.gist" + ResourceGithubGistfile string = "github.gistfile" + ResourceGithubMilestone string = "github.milestone" + ResourceGithubIssue string = "github.issue" + ResourceGithubDependabotAlert string = "github.dependabotAlert" + ResourceGithubSecretScanningAlert string = "github.secretScanningAlert" + ResourceGithubCodeScanningAlert string = "github.codeScanningAlert" + ResourceGithubAuditLogEntry string = "github.auditLogEntry" + ResourceGithubRunner string = "github.runner" + ResourceGithubRunnerLabel string = "github.runnerLabel" + ResourceGithubEnvironment string = "github.environment" + ResourceGithubEnvironmentProtectionRule string = "github.environmentProtectionRule" + ResourceGithubDeployment string = "github.deployment" + ResourceGithubDeploymentStatus string = "github.deploymentStatus" ) var resourceFactories map[string]plugin.ResourceFactory @@ -108,6 +112,22 @@ func init() { Init: initGithubRepository, Create: createGithubRepository, }, + "github.repository.sbom": { + // to override args, implement: initGithubRepositorySbom(runtime *plugin.Runtime, args map[string]*llx.RawData) (map[string]*llx.RawData, plugin.Resource, error) + Create: createGithubRepositorySbom, + }, + "github.repository.sbom.package": { + // to override args, implement: initGithubRepositorySbomPackage(runtime *plugin.Runtime, args map[string]*llx.RawData) (map[string]*llx.RawData, plugin.Resource, error) + Create: createGithubRepositorySbomPackage, + }, + "github.repository.sbom.package.externalRef": { + // to override args, implement: initGithubRepositorySbomPackageExternalRef(runtime *plugin.Runtime, args map[string]*llx.RawData) (map[string]*llx.RawData, plugin.Resource, error) + Create: createGithubRepositorySbomPackageExternalRef, + }, + "github.repository.sbom.relationship": { + // to override args, implement: initGithubRepositorySbomRelationship(runtime *plugin.Runtime, args map[string]*llx.RawData) (map[string]*llx.RawData, plugin.Resource, error) + Create: createGithubRepositorySbomRelationship, + }, "github.license": { // to override args, implement: initGithubLicense(runtime *plugin.Runtime, args map[string]*llx.RawData) (map[string]*llx.RawData, plugin.Resource, error) Create: createGithubLicense, @@ -846,6 +866,78 @@ var getDataFields = map[string]func(r plugin.Resource) *plugin.DataRes{ "github.repository.deployments": func(r plugin.Resource) *plugin.DataRes { return (r.(*mqlGithubRepository).GetDeployments()).ToDataRes(types.Array(types.Resource("github.deployment"))) }, + "github.repository.spdxSbom": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlGithubRepository).GetSpdxSbom()).ToDataRes(types.Resource("github.repository.sbom")) + }, + "github.repository.sbom.spdxId": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlGithubRepositorySbom).GetSpdxId()).ToDataRes(types.String) + }, + "github.repository.sbom.spdxVersion": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlGithubRepositorySbom).GetSpdxVersion()).ToDataRes(types.String) + }, + "github.repository.sbom.name": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlGithubRepositorySbom).GetName()).ToDataRes(types.String) + }, + "github.repository.sbom.dataLicense": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlGithubRepositorySbom).GetDataLicense()).ToDataRes(types.String) + }, + "github.repository.sbom.documentNamespace": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlGithubRepositorySbom).GetDocumentNamespace()).ToDataRes(types.String) + }, + "github.repository.sbom.createdAt": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlGithubRepositorySbom).GetCreatedAt()).ToDataRes(types.Time) + }, + "github.repository.sbom.creators": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlGithubRepositorySbom).GetCreators()).ToDataRes(types.Array(types.String)) + }, + "github.repository.sbom.packages": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlGithubRepositorySbom).GetPackages()).ToDataRes(types.Array(types.Resource("github.repository.sbom.package"))) + }, + "github.repository.sbom.relationships": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlGithubRepositorySbom).GetRelationships()).ToDataRes(types.Array(types.Resource("github.repository.sbom.relationship"))) + }, + "github.repository.sbom.package.spdxId": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlGithubRepositorySbomPackage).GetSpdxId()).ToDataRes(types.String) + }, + "github.repository.sbom.package.name": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlGithubRepositorySbomPackage).GetName()).ToDataRes(types.String) + }, + "github.repository.sbom.package.versionInfo": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlGithubRepositorySbomPackage).GetVersionInfo()).ToDataRes(types.String) + }, + "github.repository.sbom.package.downloadLocation": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlGithubRepositorySbomPackage).GetDownloadLocation()).ToDataRes(types.String) + }, + "github.repository.sbom.package.filesAnalyzed": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlGithubRepositorySbomPackage).GetFilesAnalyzed()).ToDataRes(types.Bool) + }, + "github.repository.sbom.package.licenseConcluded": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlGithubRepositorySbomPackage).GetLicenseConcluded()).ToDataRes(types.String) + }, + "github.repository.sbom.package.licenseDeclared": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlGithubRepositorySbomPackage).GetLicenseDeclared()).ToDataRes(types.String) + }, + "github.repository.sbom.package.externalRefs": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlGithubRepositorySbomPackage).GetExternalRefs()).ToDataRes(types.Array(types.Resource("github.repository.sbom.package.externalRef"))) + }, + "github.repository.sbom.package.externalRef.referenceCategory": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlGithubRepositorySbomPackageExternalRef).GetReferenceCategory()).ToDataRes(types.String) + }, + "github.repository.sbom.package.externalRef.referenceLocator": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlGithubRepositorySbomPackageExternalRef).GetReferenceLocator()).ToDataRes(types.String) + }, + "github.repository.sbom.package.externalRef.referenceType": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlGithubRepositorySbomPackageExternalRef).GetReferenceType()).ToDataRes(types.String) + }, + "github.repository.sbom.relationship.relationshipType": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlGithubRepositorySbomRelationship).GetRelationshipType()).ToDataRes(types.String) + }, + "github.repository.sbom.relationship.spdxElementId": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlGithubRepositorySbomRelationship).GetSpdxElementId()).ToDataRes(types.String) + }, + "github.repository.sbom.relationship.relatedSpdxElement": func(r plugin.Resource) *plugin.DataRes { + return (r.(*mqlGithubRepositorySbomRelationship).GetRelatedSpdxElement()).ToDataRes(types.String) + }, "github.license.key": func(r plugin.Resource) *plugin.DataRes { return (r.(*mqlGithubLicense).GetKey()).ToDataRes(types.String) }, @@ -2391,6 +2483,118 @@ var setDataFields = map[string]func(r plugin.Resource, v *llx.RawData) bool{ r.(*mqlGithubRepository).Deployments, ok = plugin.RawToTValue[[]any](v.Value, v.Error) return }, + "github.repository.spdxSbom": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepository).SpdxSbom, ok = plugin.RawToTValue[*mqlGithubRepositorySbom](v.Value, v.Error) + return + }, + "github.repository.sbom.__id": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbom).__id, ok = v.Value.(string) + return + }, + "github.repository.sbom.spdxId": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbom).SpdxId, ok = plugin.RawToTValue[string](v.Value, v.Error) + return + }, + "github.repository.sbom.spdxVersion": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbom).SpdxVersion, ok = plugin.RawToTValue[string](v.Value, v.Error) + return + }, + "github.repository.sbom.name": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbom).Name, ok = plugin.RawToTValue[string](v.Value, v.Error) + return + }, + "github.repository.sbom.dataLicense": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbom).DataLicense, ok = plugin.RawToTValue[string](v.Value, v.Error) + return + }, + "github.repository.sbom.documentNamespace": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbom).DocumentNamespace, ok = plugin.RawToTValue[string](v.Value, v.Error) + return + }, + "github.repository.sbom.createdAt": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbom).CreatedAt, ok = plugin.RawToTValue[*time.Time](v.Value, v.Error) + return + }, + "github.repository.sbom.creators": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbom).Creators, ok = plugin.RawToTValue[[]any](v.Value, v.Error) + return + }, + "github.repository.sbom.packages": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbom).Packages, ok = plugin.RawToTValue[[]any](v.Value, v.Error) + return + }, + "github.repository.sbom.relationships": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbom).Relationships, ok = plugin.RawToTValue[[]any](v.Value, v.Error) + return + }, + "github.repository.sbom.package.__id": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbomPackage).__id, ok = v.Value.(string) + return + }, + "github.repository.sbom.package.spdxId": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbomPackage).SpdxId, ok = plugin.RawToTValue[string](v.Value, v.Error) + return + }, + "github.repository.sbom.package.name": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbomPackage).Name, ok = plugin.RawToTValue[string](v.Value, v.Error) + return + }, + "github.repository.sbom.package.versionInfo": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbomPackage).VersionInfo, ok = plugin.RawToTValue[string](v.Value, v.Error) + return + }, + "github.repository.sbom.package.downloadLocation": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbomPackage).DownloadLocation, ok = plugin.RawToTValue[string](v.Value, v.Error) + return + }, + "github.repository.sbom.package.filesAnalyzed": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbomPackage).FilesAnalyzed, ok = plugin.RawToTValue[bool](v.Value, v.Error) + return + }, + "github.repository.sbom.package.licenseConcluded": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbomPackage).LicenseConcluded, ok = plugin.RawToTValue[string](v.Value, v.Error) + return + }, + "github.repository.sbom.package.licenseDeclared": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbomPackage).LicenseDeclared, ok = plugin.RawToTValue[string](v.Value, v.Error) + return + }, + "github.repository.sbom.package.externalRefs": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbomPackage).ExternalRefs, ok = plugin.RawToTValue[[]any](v.Value, v.Error) + return + }, + "github.repository.sbom.package.externalRef.__id": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbomPackageExternalRef).__id, ok = v.Value.(string) + return + }, + "github.repository.sbom.package.externalRef.referenceCategory": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbomPackageExternalRef).ReferenceCategory, ok = plugin.RawToTValue[string](v.Value, v.Error) + return + }, + "github.repository.sbom.package.externalRef.referenceLocator": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbomPackageExternalRef).ReferenceLocator, ok = plugin.RawToTValue[string](v.Value, v.Error) + return + }, + "github.repository.sbom.package.externalRef.referenceType": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbomPackageExternalRef).ReferenceType, ok = plugin.RawToTValue[string](v.Value, v.Error) + return + }, + "github.repository.sbom.relationship.__id": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbomRelationship).__id, ok = v.Value.(string) + return + }, + "github.repository.sbom.relationship.relationshipType": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbomRelationship).RelationshipType, ok = plugin.RawToTValue[string](v.Value, v.Error) + return + }, + "github.repository.sbom.relationship.spdxElementId": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbomRelationship).SpdxElementId, ok = plugin.RawToTValue[string](v.Value, v.Error) + return + }, + "github.repository.sbom.relationship.relatedSpdxElement": func(r plugin.Resource, v *llx.RawData) (ok bool) { + r.(*mqlGithubRepositorySbomRelationship).RelatedSpdxElement, ok = plugin.RawToTValue[string](v.Value, v.Error) + return + }, "github.license.__id": func(r plugin.Resource, v *llx.RawData) (ok bool) { r.(*mqlGithubLicense).__id, ok = v.Value.(string) return @@ -4889,6 +5093,7 @@ type mqlGithubRepository struct { Runners plugin.TValue[[]any] Environments plugin.TValue[[]any] Deployments plugin.TValue[[]any] + SpdxSbom plugin.TValue[*mqlGithubRepositorySbom] } // createGithubRepository creates a new instance of this resource @@ -5520,6 +5725,293 @@ func (c *mqlGithubRepository) GetDeployments() *plugin.TValue[[]any] { }) } +func (c *mqlGithubRepository) GetSpdxSbom() *plugin.TValue[*mqlGithubRepositorySbom] { + return plugin.GetOrCompute[*mqlGithubRepositorySbom](&c.SpdxSbom, func() (*mqlGithubRepositorySbom, error) { + if c.MqlRuntime.HasRecording { + d, err := c.MqlRuntime.FieldResourceFromRecording("github.repository", c.__id, "spdxSbom") + if err != nil { + return nil, err + } + if d != nil { + return d.Value.(*mqlGithubRepositorySbom), nil + } + } + + return c.spdxSbom() + }) +} + +// mqlGithubRepositorySbom for the github.repository.sbom resource +type mqlGithubRepositorySbom struct { + MqlRuntime *plugin.Runtime + __id string + // optional: if you define mqlGithubRepositorySbomInternal it will be used here + SpdxId plugin.TValue[string] + SpdxVersion plugin.TValue[string] + Name plugin.TValue[string] + DataLicense plugin.TValue[string] + DocumentNamespace plugin.TValue[string] + CreatedAt plugin.TValue[*time.Time] + Creators plugin.TValue[[]any] + Packages plugin.TValue[[]any] + Relationships plugin.TValue[[]any] +} + +// createGithubRepositorySbom creates a new instance of this resource +func createGithubRepositorySbom(runtime *plugin.Runtime, args map[string]*llx.RawData) (plugin.Resource, error) { + res := &mqlGithubRepositorySbom{ + MqlRuntime: runtime, + } + + err := SetAllData(res, args) + if err != nil { + return res, err + } + + // to override __id implement: id() (string, error) + + if runtime.HasRecording { + args, err = runtime.ResourceFromRecording("github.repository.sbom", res.__id) + if err != nil || args == nil { + return res, err + } + return res, SetAllData(res, args) + } + + return res, nil +} + +func (c *mqlGithubRepositorySbom) MqlName() string { + return "github.repository.sbom" +} + +func (c *mqlGithubRepositorySbom) MqlID() string { + return c.__id +} + +func (c *mqlGithubRepositorySbom) GetSpdxId() *plugin.TValue[string] { + return &c.SpdxId +} + +func (c *mqlGithubRepositorySbom) GetSpdxVersion() *plugin.TValue[string] { + return &c.SpdxVersion +} + +func (c *mqlGithubRepositorySbom) GetName() *plugin.TValue[string] { + return &c.Name +} + +func (c *mqlGithubRepositorySbom) GetDataLicense() *plugin.TValue[string] { + return &c.DataLicense +} + +func (c *mqlGithubRepositorySbom) GetDocumentNamespace() *plugin.TValue[string] { + return &c.DocumentNamespace +} + +func (c *mqlGithubRepositorySbom) GetCreatedAt() *plugin.TValue[*time.Time] { + return &c.CreatedAt +} + +func (c *mqlGithubRepositorySbom) GetCreators() *plugin.TValue[[]any] { + return &c.Creators +} + +func (c *mqlGithubRepositorySbom) GetPackages() *plugin.TValue[[]any] { + return &c.Packages +} + +func (c *mqlGithubRepositorySbom) GetRelationships() *plugin.TValue[[]any] { + return &c.Relationships +} + +// mqlGithubRepositorySbomPackage for the github.repository.sbom.package resource +type mqlGithubRepositorySbomPackage struct { + MqlRuntime *plugin.Runtime + __id string + // optional: if you define mqlGithubRepositorySbomPackageInternal it will be used here + SpdxId plugin.TValue[string] + Name plugin.TValue[string] + VersionInfo plugin.TValue[string] + DownloadLocation plugin.TValue[string] + FilesAnalyzed plugin.TValue[bool] + LicenseConcluded plugin.TValue[string] + LicenseDeclared plugin.TValue[string] + ExternalRefs plugin.TValue[[]any] +} + +// createGithubRepositorySbomPackage creates a new instance of this resource +func createGithubRepositorySbomPackage(runtime *plugin.Runtime, args map[string]*llx.RawData) (plugin.Resource, error) { + res := &mqlGithubRepositorySbomPackage{ + MqlRuntime: runtime, + } + + err := SetAllData(res, args) + if err != nil { + return res, err + } + + // to override __id implement: id() (string, error) + + if runtime.HasRecording { + args, err = runtime.ResourceFromRecording("github.repository.sbom.package", res.__id) + if err != nil || args == nil { + return res, err + } + return res, SetAllData(res, args) + } + + return res, nil +} + +func (c *mqlGithubRepositorySbomPackage) MqlName() string { + return "github.repository.sbom.package" +} + +func (c *mqlGithubRepositorySbomPackage) MqlID() string { + return c.__id +} + +func (c *mqlGithubRepositorySbomPackage) GetSpdxId() *plugin.TValue[string] { + return &c.SpdxId +} + +func (c *mqlGithubRepositorySbomPackage) GetName() *plugin.TValue[string] { + return &c.Name +} + +func (c *mqlGithubRepositorySbomPackage) GetVersionInfo() *plugin.TValue[string] { + return &c.VersionInfo +} + +func (c *mqlGithubRepositorySbomPackage) GetDownloadLocation() *plugin.TValue[string] { + return &c.DownloadLocation +} + +func (c *mqlGithubRepositorySbomPackage) GetFilesAnalyzed() *plugin.TValue[bool] { + return &c.FilesAnalyzed +} + +func (c *mqlGithubRepositorySbomPackage) GetLicenseConcluded() *plugin.TValue[string] { + return &c.LicenseConcluded +} + +func (c *mqlGithubRepositorySbomPackage) GetLicenseDeclared() *plugin.TValue[string] { + return &c.LicenseDeclared +} + +func (c *mqlGithubRepositorySbomPackage) GetExternalRefs() *plugin.TValue[[]any] { + return &c.ExternalRefs +} + +// mqlGithubRepositorySbomPackageExternalRef for the github.repository.sbom.package.externalRef resource +type mqlGithubRepositorySbomPackageExternalRef struct { + MqlRuntime *plugin.Runtime + __id string + // optional: if you define mqlGithubRepositorySbomPackageExternalRefInternal it will be used here + ReferenceCategory plugin.TValue[string] + ReferenceLocator plugin.TValue[string] + ReferenceType plugin.TValue[string] +} + +// createGithubRepositorySbomPackageExternalRef creates a new instance of this resource +func createGithubRepositorySbomPackageExternalRef(runtime *plugin.Runtime, args map[string]*llx.RawData) (plugin.Resource, error) { + res := &mqlGithubRepositorySbomPackageExternalRef{ + MqlRuntime: runtime, + } + + err := SetAllData(res, args) + if err != nil { + return res, err + } + + // to override __id implement: id() (string, error) + + if runtime.HasRecording { + args, err = runtime.ResourceFromRecording("github.repository.sbom.package.externalRef", res.__id) + if err != nil || args == nil { + return res, err + } + return res, SetAllData(res, args) + } + + return res, nil +} + +func (c *mqlGithubRepositorySbomPackageExternalRef) MqlName() string { + return "github.repository.sbom.package.externalRef" +} + +func (c *mqlGithubRepositorySbomPackageExternalRef) MqlID() string { + return c.__id +} + +func (c *mqlGithubRepositorySbomPackageExternalRef) GetReferenceCategory() *plugin.TValue[string] { + return &c.ReferenceCategory +} + +func (c *mqlGithubRepositorySbomPackageExternalRef) GetReferenceLocator() *plugin.TValue[string] { + return &c.ReferenceLocator +} + +func (c *mqlGithubRepositorySbomPackageExternalRef) GetReferenceType() *plugin.TValue[string] { + return &c.ReferenceType +} + +// mqlGithubRepositorySbomRelationship for the github.repository.sbom.relationship resource +type mqlGithubRepositorySbomRelationship struct { + MqlRuntime *plugin.Runtime + __id string + // optional: if you define mqlGithubRepositorySbomRelationshipInternal it will be used here + RelationshipType plugin.TValue[string] + SpdxElementId plugin.TValue[string] + RelatedSpdxElement plugin.TValue[string] +} + +// createGithubRepositorySbomRelationship creates a new instance of this resource +func createGithubRepositorySbomRelationship(runtime *plugin.Runtime, args map[string]*llx.RawData) (plugin.Resource, error) { + res := &mqlGithubRepositorySbomRelationship{ + MqlRuntime: runtime, + } + + err := SetAllData(res, args) + if err != nil { + return res, err + } + + // to override __id implement: id() (string, error) + + if runtime.HasRecording { + args, err = runtime.ResourceFromRecording("github.repository.sbom.relationship", res.__id) + if err != nil || args == nil { + return res, err + } + return res, SetAllData(res, args) + } + + return res, nil +} + +func (c *mqlGithubRepositorySbomRelationship) MqlName() string { + return "github.repository.sbom.relationship" +} + +func (c *mqlGithubRepositorySbomRelationship) MqlID() string { + return c.__id +} + +func (c *mqlGithubRepositorySbomRelationship) GetRelationshipType() *plugin.TValue[string] { + return &c.RelationshipType +} + +func (c *mqlGithubRepositorySbomRelationship) GetSpdxElementId() *plugin.TValue[string] { + return &c.SpdxElementId +} + +func (c *mqlGithubRepositorySbomRelationship) GetRelatedSpdxElement() *plugin.TValue[string] { + return &c.RelatedSpdxElement +} + // mqlGithubLicense for the github.license resource type mqlGithubLicense struct { MqlRuntime *plugin.Runtime diff --git a/providers/github/resources/github.lr.versions b/providers/github/resources/github.lr.versions index 6fa2bd8b8b..94984dcb97 100644 --- a/providers/github/resources/github.lr.versions +++ b/providers/github/resources/github.lr.versions @@ -377,8 +377,36 @@ github.repository.private 9.0.0 github.repository.pushedAt 9.0.0 github.repository.releases 9.0.0 github.repository.runners 11.4.123 +github.repository.sbom 11.4.129 +github.repository.sbom.createdAt 11.4.129 +github.repository.sbom.creators 11.4.129 +github.repository.sbom.dataLicense 11.4.129 +github.repository.sbom.documentNamespace 11.4.129 +github.repository.sbom.name 11.4.129 +github.repository.sbom.package 11.4.129 +github.repository.sbom.package.downloadLocation 11.4.129 +github.repository.sbom.package.externalRef 11.4.129 +github.repository.sbom.package.externalRef.referenceCategory 11.4.129 +github.repository.sbom.package.externalRef.referenceLocator 11.4.129 +github.repository.sbom.package.externalRef.referenceType 11.4.129 +github.repository.sbom.package.externalRefs 11.4.129 +github.repository.sbom.package.filesAnalyzed 11.4.129 +github.repository.sbom.package.licenseConcluded 11.4.129 +github.repository.sbom.package.licenseDeclared 11.4.129 +github.repository.sbom.package.name 11.4.129 +github.repository.sbom.package.spdxId 11.4.129 +github.repository.sbom.package.versionInfo 11.4.129 +github.repository.sbom.packages 11.4.129 +github.repository.sbom.relationship 11.4.129 +github.repository.sbom.relationship.relatedSpdxElement 11.4.129 +github.repository.sbom.relationship.relationshipType 11.4.129 +github.repository.sbom.relationship.spdxElementId 11.4.129 +github.repository.sbom.relationships 11.4.129 +github.repository.sbom.spdxId 11.4.129 +github.repository.sbom.spdxVersion 11.4.129 github.repository.secretScanningAlerts 11.4.121 github.repository.securityFile 11.4.14 +github.repository.spdxSbom 11.4.129 github.repository.sshUrl 9.0.0 github.repository.stargazers 9.0.0 github.repository.stargazersCount 9.0.0 diff --git a/providers/github/resources/github_repo.go b/providers/github/resources/github_repo.go index dabcc28257..98bccc06fa 100644 --- a/providers/github/resources/github_repo.go +++ b/providers/github/resources/github_repo.go @@ -2236,3 +2236,105 @@ func (g *mqlGithubRepository) codeScanningAlerts() ([]any, error) { return res, nil } + +func (g *mqlGithubRepository) spdxSbom() (*mqlGithubRepositorySbom, error) { + conn := g.MqlRuntime.Connection.(*connection.GithubConnection) + + if g.Name.Error != nil { + return nil, g.Name.Error + } + repoName := g.Name.Data + + if g.Owner.Error != nil { + return nil, g.Owner.Error + } + owner := g.Owner.Data + if owner.Login.Error != nil { + return nil, owner.Login.Error + } + ownerLogin := owner.Login.Data + + result, _, err := conn.Client().DependencyGraph.GetSBOM(conn.Context(), ownerLogin, repoName) + if err != nil { + return nil, err + } + if result == nil || result.SBOM == nil { + return nil, nil + } + info := result.SBOM + + var createdAt *time.Time + if info.CreationInfo != nil && info.CreationInfo.Created != nil { + createdAt = &info.CreationInfo.Created.Time + } + + creators := []any{} + if info.CreationInfo != nil { + for _, c := range info.CreationInfo.Creators { + creators = append(creators, c) + } + } + + packages := make([]any, 0, len(info.Packages)) + for i, pkg := range info.Packages { + externalRefs := make([]any, 0, len(pkg.ExternalRefs)) + for j, ref := range pkg.ExternalRefs { + mqlExternalRef, err := CreateResource(g.MqlRuntime, ResourceGithubRepositorySbomPackageExternalRef, map[string]*llx.RawData{ + "__id": llx.StringData(fmt.Sprintf("%s/%s/%s/%d/%d", ResourceGithubRepositorySbomPackageExternalRef, ownerLogin, repoName, i, j)), + "referenceCategory": llx.StringData(ref.ReferenceCategory), + "referenceType": llx.StringData(ref.ReferenceType), + "referenceLocator": llx.StringData(ref.ReferenceLocator), + }) + if err != nil { + return nil, err + } + externalRefs = append(externalRefs, mqlExternalRef) + } + mqlPkg, err := CreateResource(g.MqlRuntime, ResourceGithubRepositorySbomPackage, map[string]*llx.RawData{ + "__id": llx.StringData(fmt.Sprintf("%s/%s/%s/%d", ResourceGithubRepositorySbomPackage, ownerLogin, repoName, i)), + "spdxId": llx.StringDataPtr(pkg.SPDXID), + "name": llx.StringDataPtr(pkg.Name), + "versionInfo": llx.StringDataPtr(pkg.VersionInfo), + "downloadLocation": llx.StringDataPtr(pkg.DownloadLocation), + "filesAnalyzed": llx.BoolDataPtr(pkg.FilesAnalyzed), + "licenseConcluded": llx.StringDataPtr(pkg.LicenseConcluded), + "licenseDeclared": llx.StringDataPtr(pkg.LicenseDeclared), + "externalRefs": llx.ArrayData(externalRefs, types.Resource(ResourceGithubRepositorySbomPackageExternalRef)), + }) + if err != nil { + return nil, err + } + packages = append(packages, mqlPkg) + } + + relationships := make([]any, 0, len(info.Relationships)) + for i, rel := range info.Relationships { + mqlRel, err := CreateResource(g.MqlRuntime, ResourceGithubRepositorySbomRelationship, map[string]*llx.RawData{ + "__id": llx.StringData(fmt.Sprintf("%s/%s/%s/%d", ResourceGithubRepositorySbomRelationship, ownerLogin, repoName, i)), + "relationshipType": llx.StringData(rel.RelationshipType), + "spdxElementId": llx.StringData(rel.SPDXElementID), + "relatedSpdxElement": llx.StringData(rel.RelatedSPDXElement), + }) + if err != nil { + return nil, err + } + relationships = append(relationships, mqlRel) + } + + mqlSbom, err := CreateResource(g.MqlRuntime, ResourceGithubRepositorySbom, map[string]*llx.RawData{ + "__id": llx.StringData(ResourceGithubRepositorySbom + "/" + ownerLogin + "/" + repoName), + "spdxId": llx.StringDataPtr(info.SPDXID), + "spdxVersion": llx.StringDataPtr(info.SPDXVersion), + "name": llx.StringDataPtr(info.Name), + "dataLicense": llx.StringDataPtr(info.DataLicense), + "documentNamespace": llx.StringDataPtr(info.DocumentNamespace), + "createdAt": llx.TimeDataPtr(createdAt), + "creators": llx.ArrayData(creators, types.String), + "packages": llx.ArrayData(packages, types.Resource(ResourceGithubRepositorySbomPackage)), + "relationships": llx.ArrayData(relationships, types.Resource(ResourceGithubRepositorySbomRelationship)), + }) + if err != nil { + return nil, err + } + return mqlSbom.(*mqlGithubRepositorySbom), nil +}