include sbom param in git audit cmd

Author: attiasas

cli/docs/flags.go

@@ -183,7 +183,7 @@ var commandFlags = map[string][]string{
 		scanProjectKey, Watches, ScanVuln, Fail,
 		// Scan params
 		Threads, ExclusionsAudit,
-		Sca, Iac, Sast, Secrets, WithoutCA, SecretValidation,
+		Sca, Iac, Sast, Secrets, WithoutCA, SecretValidation, Sbom,
 		// Output params
 		Licenses, OutputFormat, ExtendedTable, OutputDir, UploadRtRepoPath,
 		// Scan Logic params

cli/gitcommands.go

@@ -70,6 +70,7 @@ func GitAuditCmd(c *components.Context) error {
 	} else if len(subScans) > 0 {
 		gitAuditCmd.SetScansToPerform(subScans)
 	}
+	gitAuditCmd.SetIncludeSbom(shouldIncludeSbom(c, format))
 	if threads, err := pluginsCommon.GetThreadsCount(c); err != nil {
 		return err
 	} else {

cli/scancommands.go

@@ -287,7 +287,7 @@ func ScanCmd(c *components.Context) error {
 		SetBaseRepoPath(repoPath).
 		SetIncludeVulnerabilities(c.GetBoolFlagValue(flags.Vuln) || shouldIncludeVulnerabilities(c)).
 		SetIncludeLicenses(c.GetBoolFlagValue(flags.Licenses)).
-		SetIncludeSbom(c.GetBoolFlagValue(flags.Sbom)).
+		SetIncludeSbom(shouldIncludeSbom(c, format)).
 		SetFail(c.GetBoolFlagValue(flags.Fail)).
 		SetPrintExtendedTable(c.GetBoolFlagValue(flags.ExtendedTable)).
 		SetBypassArchiveLimits(c.GetBoolFlagValue(flags.BypassArchiveLimits)).
@@ -453,16 +453,11 @@ func CreateAuditCmd(c *components.Context) (string, string, *coreConfig.ServerDe
 	auditCmd.SetScaScanStrategy(scaScanStrategy)
 	auditCmd.SetViolationGenerator(violationGenerator)
 	auditCmd.SetUploadCdxResults(uploadResults).SetRtResultRepository(c.GetStringFlagValue(flags.UploadRtRepoPath))
-	// Make sure include SBOM is only set if the output format supports it
-	includeSbom := c.GetBoolFlagValue(flags.Sbom)
-	if includeSbom && format != outputFormat.Table && format != outputFormat.CycloneDx {
-		log.Warn(fmt.Sprintf("The '--%s' flag is only supported with the 'table' or 'cyclonedx' output format. The SBOM will not be included in the output.", flags.Sbom))
-	}
 	auditCmd.SetTargetRepoPath(addTrailingSlashToRepoPathIfNeeded(c)).
 		SetProject(getProject(c)).
 		SetIncludeVulnerabilities(c.GetBoolFlagValue(flags.Vuln)).
 		SetIncludeLicenses(c.GetBoolFlagValue(flags.Licenses)).
-		SetIncludeSbom(includeSbom).
+		SetIncludeSbom(shouldIncludeSbom(c, format)).
 		SetFail(c.GetBoolFlagValue(flags.Fail)).
 		SetPrintExtendedTable(c.GetBoolFlagValue(flags.ExtendedTable)).
 		SetMinSeverityFilter(minSeverity).
@@ -709,7 +704,7 @@ func DockerScan(c *components.Context, image string) error {
 		SetBaseRepoPath(addTrailingSlashToRepoPathIfNeeded(c)).
 		SetIncludeVulnerabilities(c.GetBoolFlagValue(flags.Vuln) || shouldIncludeVulnerabilities(c)).
 		SetIncludeLicenses(c.GetBoolFlagValue(flags.Licenses)).
-		SetIncludeSbom(c.GetBoolFlagValue(flags.Sbom)).
+		SetIncludeSbom(shouldIncludeSbom(c, format)).
 		SetFail(c.GetBoolFlagValue(flags.Fail)).
 		SetPrintExtendedTable(c.GetBoolFlagValue(flags.ExtendedTable)).
 		SetBypassArchiveLimits(c.GetBoolFlagValue(flags.BypassArchiveLimits)).

cli/utils.go

@@ -187,3 +187,12 @@ func getFlagValueAsString(c *components.Context, flag components.Flag) string {
 	}
 	return ""
 }
+
+func shouldIncludeSbom(c *components.Context, format outputFormat.OutputFormat) bool {
+	// Make sure include SBOM is only set if the output format supports it
+	includeSbom := c.GetBoolFlagValue(flags.Sbom)
+	if includeSbom && format != outputFormat.Table && format != outputFormat.CycloneDx {
+		log.Warn(fmt.Sprintf("The '--%s' flag is only supported with the 'table' or 'cyclonedx' output format. The SBOM will not be included in the output.", flags.Sbom))
+	}
+	return includeSbom
+}

commands/git/audit/gitaudit.go

@@ -87,7 +87,7 @@ func toAuditParams(params GitAuditParams) *sourceAudit.AuditParams {
 		params.gitContext.Source.GitRepoHttpsCloneUrl,
 		params.resultsContext.IncludeVulnerabilities,
 		params.resultsContext.IncludeLicenses,
-		false,
+		params.includeSbom,
 	)
 	auditParams.SetResultsContext(resultContext)
 	log.Debug(fmt.Sprintf("Results context: %+v", resultContext))

commands/git/audit/gitauditparams.go

@@ -23,6 +23,7 @@ type GitAuditParams struct {
 	failBuild      bool
 	// Scan params
 	scansToPerform []utils.SubScanType
+	includeSbom    bool
 	threads        int
 	exclusions     []string
 	// Output params
@@ -163,3 +164,8 @@ func (gap *GitAuditParams) SetRtResultRepository(rtResultRepository string) *Git
 func (gap *GitAuditParams) RtResultRepository() string {
 	return gap.rtResultRepository
 }
+
+func (gap *GitAuditParams) SetIncludeSbom(includeSbom bool) *GitAuditParams {
+	gap.includeSbom = includeSbom
+	return gap
+}