منصوبے کے بارے میں

Central Cyclone is a centralized Software Bill of Materials (SBOM) generation service designed to streamline dependency tracking across multiple repositories. Built around the `cdxgen` tool, it allows users to configure and analyze multiple targets and repositories from a single JSON configuration file, eliminating the need to create separate pipelines for each project. This approach is similar to how Renovate manages multiple repositories. Key features include: - **Centralized Configuration**: Manage all SBOM targets and settings in one config file. The configuration includes sections for DependencyTrack connection details, repository URLs with specific targets (e.g., node, java), and optional application definitions for future GitOps capabilities. - **DependencyTrack Integration**: Uploads generated SBOMs directly to a DependencyTrack instance. It requires the `DEPENDENCYTRACK_API_KEY` environment variable and mandatory DependencyTrack configuration. - **CLI Commands**: - `analyze`: Clones and analyzes configured repositories. Results can be saved locally or uploaded directly. - `upload`: Uploads previously generated SBOM files, useful for two-stage pipelines in restricted network environments. - `dt projects sync`: Creates and syncs DependencyTrack projects based on the application definitions in the config. - **Private Repository Support**: Supports cloning private repos from GitHub and Azure DevOps using access tokens. GitHub requires fine-grained personal access tokens with read-only Contents permissions, while Azure DevOps requires PATs with Code read permissions. - **Docker Support**: An official Docker image is provided, which includes necessary dependencies like `git` and `cdxgen`. Users can mount their config file and work folder to run the tool easily. - **GitOps Mode**: Currently in alpha, this feature aims to monitor GitOps repositories and automatically create SBOMs for deployed versions. The tool is configuration-driven, supporting various programming languages and monorepo structures via the `directory` property in targets. It is designed for automation and ease of use in CI/CD pipelines.