|
4 | 4 | For Developers & Integrators |
5 | 5 | ==================================== |
6 | 6 |
|
7 | | -Welcome! If you're integrating AboutCode tools into your development workflow, CI/CD |
8 | | -pipeline, or building applications that consume AboutCode data, you're in the right place. |
| 7 | +If you're integrating AboutCode into your development workflow, CI/CD pipeline, or building |
| 8 | +applications that consume AboutCode data, this is your starting point. |
9 | 9 |
|
10 | | -AboutCode provides powerful APIs, command-line tools, and libraries that you can use to |
11 | | -automate scanning, generate SBOMs, and integrate license and vulnerability analysis into |
12 | | -your systems. |
| 10 | +Quick Start Paths |
| 11 | +================= |
13 | 12 |
|
14 | | -What You Can Accomplish |
15 | | -======================= |
| 13 | +**Command-Line Usage** |
| 14 | + → :ref:`scancode-toolkit-project` - CLI scanning and SBOM generation |
16 | 15 |
|
17 | | -With AboutCode, you can: |
| 16 | +**API Integration** |
| 17 | + → :ref:`scancodeio-project` - REST API documentation |
| 18 | + → :ref:`vulnerablecode-project` - Vulnerability API |
| 19 | + → https://purldb.readthedocs.io - Package metadata API |
18 | 20 |
|
19 | | -- **Automate Code Scanning**: Run license and vulnerability scans from the command line or CI/CD |
20 | | -- **Generate SBOMs Programmatically**: Create CycloneDX and SPDX SBOMs via API or CLI |
21 | | -- **Integrate with Your Tools**: Use REST APIs to query vulnerability data and package metadata |
22 | | -- **Build Custom Workflows**: Create pipelines that combine scanning, analysis, and reporting |
23 | | -- **Parse and Process Results**: Work with structured JSON/YAML output for downstream processing |
| 21 | +**CI/CD Pipelines** |
| 22 | + → :ref:`scancode-action-project` - GitHub Actions integration |
24 | 23 |
|
25 | | -Key Workflows |
26 | | -============= |
| 24 | +**SBOM Workflows** |
| 25 | + → :ref:`create-sboms` - Generate SPDX and CycloneDX SBOMs |
| 26 | + → :ref:`consume-sboms` - Import and process SBOMs |
27 | 27 |
|
28 | | -1. Command-Line Scanning |
29 | | ------------------------- |
30 | | - |
31 | | -Use ScanCode Toolkit from the command line to scan code, detect licenses, extract |
32 | | -copyrights, and identify packages. |
33 | | - |
34 | | -The CLI provides extensive options for customizing scans, filtering results, and |
35 | | -generating output in various formats (JSON, YAML, SPDX, CycloneDX). |
| 28 | +Quick Examples |
| 29 | +============== |
36 | 30 |
|
37 | | -**Example:** |
| 31 | +**Basic CLI Scan:** |
38 | 32 |
|
39 | 33 | .. code-block:: bash |
40 | 34 |
|
41 | | - # Basic scan |
42 | 35 | scancode -clpieu --json-pp output.json /path/to/code |
43 | 36 |
|
44 | | - # Scan with license policies |
45 | | - scancode --license-policy policies.yml --json output.json /path/to/code |
46 | | -
|
47 | | - # Generate SPDX SBOM |
48 | | - scancode --spdx output.spdx /path/to/code |
49 | | -
|
50 | | -**Learn more:** :ref:`scancode-toolkit-project` |
51 | | - |
52 | | -**Tools you'll use:** ScanCode Toolkit |
53 | | - |
54 | | -2. API Integration |
55 | | ------------------- |
| 37 | +**Generate SPDX SBOM:** |
56 | 38 |
|
57 | | -ScanCode.io provides a REST API for triggering scans, retrieving results, and managing |
58 | | -projects programmatically. |
| 39 | +.. code-block:: bash |
59 | 40 |
|
60 | | -You can integrate scanning into your CI/CD pipeline, automate SBOM generation, or build |
61 | | -custom applications that consume scan data. |
| 41 | + scancode --spdx output.spdx /path/to/code |
62 | 42 |
|
63 | | -**Example:** |
| 43 | +**Python API Usage:** |
64 | 44 |
|
65 | 45 | .. code-block:: python |
66 | 46 |
|
67 | 47 | import requests |
68 | | -
|
69 | | - # Create a project |
70 | 48 | response = requests.post( |
71 | 49 | 'https://your-scancodeio.com/api/projects/', |
72 | 50 | json={'name': 'my-project'}, |
73 | 51 | headers={'Authorization': 'Token your-api-token'} |
74 | 52 | ) |
75 | 53 |
|
76 | | - # Upload code and run pipeline |
77 | | - project_url = response.json()['url'] |
78 | | - # ... upload files and trigger pipeline |
79 | | -
|
80 | | -**Learn more:** :ref:`scancodeio-project` |
81 | | - |
82 | | -**Tools you'll use:** ScanCode.io API, VulnerableCode API, PurlDB API |
83 | | - |
84 | | -3. CI/CD Pipeline Integration |
85 | | ------------------------------ |
86 | | - |
87 | | -Integrate AboutCode scanning into your continuous integration pipeline to catch license |
88 | | -and security issues early in the development process. |
89 | | - |
90 | | -You can use GitHub Actions, GitLab CI, Jenkins, or any CI system that supports running |
91 | | -command-line tools or making API calls. |
92 | | - |
93 | | -**Example (GitHub Actions):** |
94 | | - |
95 | | -.. code-block:: yaml |
96 | | -
|
97 | | - - name: Scan with ScanCode |
98 | | - uses: aboutcode-org/scancode-action@v1 |
99 | | - with: |
100 | | - path: . |
101 | | - output: scancode-results.json |
102 | | -
|
103 | | -**Learn more:** :ref:`scancode-action-project` |
104 | | - |
105 | | -**Tools you'll use:** ScanCode Action, ScanCode Toolkit, ScanCode.io |
106 | | - |
107 | | -4. Creating and Consuming SBOMs |
108 | | -------------------------------- |
109 | | - |
110 | | -Generate software bills of materials (SBOMs) in industry-standard formats like SPDX |
111 | | -and CycloneDX. |
112 | | - |
113 | | -You can create SBOMs from scan results, import SBOMs from other tools, enrich them with |
114 | | -additional data, and export them for sharing with customers or partners. |
115 | | - |
116 | | -**Learn more:** :ref:`create-sboms` and :ref:`consume-sboms` |
117 | | - |
118 | | -**Tools you'll use:** ScanCode Toolkit, ScanCode.io, DejaCode |
119 | | - |
120 | | -Recommended Tools & Libraries |
121 | | -============================== |
122 | | - |
123 | | -**ScanCode Toolkit** |
124 | | - Command-line scanner with extensive options and multiple output formats. The |
125 | | - foundation for all AboutCode scanning. |
126 | | - |
127 | | - :ref:`scancode-toolkit-project` |
128 | | - |
129 | | - GitHub: https://github.com/aboutcode-org/scancode-toolkit |
| 54 | +Key Concepts |
| 55 | +============ |
130 | 56 |
|
131 | | -**ScanCode.io** |
132 | | - Web application with REST API for running complex scanning pipelines. Supports |
133 | | - Docker images, packages, and codebases. |
| 57 | +**Package URLs (PURLs)** |
| 58 | + Universal package identifiers: ``pkg:npm/express@4.18.2`` |
134 | 59 |
|
135 | | - :ref:`scancodeio-project` |
136 | | - |
137 | | - GitHub: https://github.com/aboutcode-org/scancode.io |
138 | | - |
139 | | -**VulnerableCode API** |
140 | | - REST API for querying vulnerability data by package, CVE, or PURL. |
141 | | - |
142 | | - :ref:`vulnerablecode-project` |
143 | | - |
144 | | - Public API: https://public.vulnerablecode.io/api/ |
145 | | - |
146 | | -**PurlDB API** |
147 | | - REST API for querying package metadata by PURL. |
148 | | - |
149 | | - https://purldb.readthedocs.io |
150 | | - |
151 | | - Public API: https://public.purldb.io/api/ |
| 60 | +**Output Formats** |
| 61 | + JSON, YAML, SPDX, CycloneDX, CSV, HTML |
152 | 62 |
|
153 | 63 | **Python Libraries** |
154 | | - - **license-expression**: Parse and normalize SPDX license expressions |
155 | | - - **packageurl-python**: Work with Package URLs (PURLs) |
156 | | - - **commoncode**: Common utilities for file handling, hashing, and dates |
157 | | - - **extractcode**: Universal archive extraction |
158 | | - |
159 | | - :ref:`license-expression-project` |
160 | | - |
161 | | -Working with Package URLs (PURLs) |
162 | | -================================== |
163 | | - |
164 | | -Package URLs (PURLs) are a universal way to identify software packages across all |
165 | | -ecosystems. AboutCode tools use PURLs extensively. |
166 | | - |
167 | | -**Format:** |
168 | | - |
169 | | -.. code-block:: text |
170 | | -
|
171 | | - pkg:type/namespace/name@version?qualifiers#subpath |
172 | | -
|
173 | | -**Examples:** |
174 | | - |
175 | | -.. code-block:: text |
176 | | -
|
177 | | - pkg:npm/express@4.18.2 |
178 | | - pkg:pypi/django@4.2.0 |
179 | | - pkg:maven/org.apache.commons/commons-lang3@3.12.0 |
180 | | - pkg:docker/library/nginx@1.25.0 |
181 | | -
|
182 | | -**Python usage:** |
183 | | - |
184 | | -.. code-block:: python |
185 | | -
|
186 | | - from packageurl import PackageURL |
187 | | -
|
188 | | - purl = PackageURL.from_string('pkg:npm/express@4.18.2') |
189 | | - print(purl.type) # 'npm' |
190 | | - print(purl.name) # 'express' |
191 | | - print(purl.version) # '4.18.2' |
192 | | -
|
193 | | -Output Formats |
194 | | -============== |
195 | | - |
196 | | -AboutCode tools support multiple output formats: |
197 | | - |
198 | | -- **JSON**: Structured data for programmatic processing |
199 | | -- **YAML**: Human-readable structured data |
200 | | -- **SPDX**: Industry-standard SBOM format (JSON, YAML, RDF, tag-value) |
201 | | -- **CycloneDX**: OWASP SBOM standard (JSON, XML) |
202 | | -- **CSV**: Tabular data for spreadsheet analysis |
203 | | -- **HTML**: Human-readable reports |
204 | | - |
205 | | -Next Steps |
206 | | -========== |
207 | | - |
208 | | -**New to AboutCode?** |
209 | | - Start with :ref:`start-scanning-code` to understand the basics. |
210 | | - |
211 | | -**Ready to automate?** |
212 | | - Check out the ScanCode Toolkit CLI documentation for command-line options. |
213 | | - |
214 | | -**Building an integration?** |
215 | | - Review the ScanCode.io API documentation for REST endpoints. |
216 | | - |
217 | | -**Need to understand the data model?** |
218 | | - See :ref:`aboutcode_data` for AboutCode data structures. |
| 64 | + - ``packageurl-python`` - Work with PURLs |
| 65 | + - ``license-expression`` - Parse SPDX license expressions |
219 | 66 |
|
220 | | -**Also need compliance workflows?** |
221 | | - Visit :ref:`persona-legal-compliance` for policy management and reporting. |
| 67 | +Also Explore |
| 68 | +============ |
222 | 69 |
|
223 | | -**Interested in security analysis?** |
224 | | - Check out :ref:`persona-security-researcher` for vulnerability scanning. |
| 70 | +- :ref:`aboutcode_data` - AboutCode data structures |
| 71 | +- :ref:`persona-legal-compliance` - For compliance workflows |
| 72 | +- :ref:`persona-security-researcher` - For vulnerability analysis |
0 commit comments