Эта версия GitHub Enterprise Server была прекращена 2024-07-09. Исправления выпускаться не будут даже при критических проблемах безопасности. Для повышения производительности, повышения безопасности и новых функций выполните обновление до последней версии GitHub Enterprise Server. Чтобы получить справку по обновлению, обратитесь в службу поддержки GitHub Enterprise.

Экспорт программного счета за материалы для репозитория

Вы можете экспортировать счет за программное обеспечение материалов или SBOM для репозитория из граф зависимостей. SBOMs позволяют прозрачность использования открытый код и помогают предоставлять уязвимости в цепочке поставок, уменьшая риски цепочки поставок.

Кто может использовать эту функцию?

Anyone can export the dependency graph of a repository as a software bill of materials. The SBOM export will contain a list of the dependencies that are used in the repository.

В этой статье

About the dependency graph and SBOM exports

The dependency graph is a summary of the manifest and lock files stored in a repository and any dependencies that are submitted for the repository using the dependency submission API (beta). For each repository, it shows dependencies, the ecosystems and packages it depends on.

GitHub Enterprise Server does not retrieve license information for dependencies, and does not calculate information about dependents, the repositories and packages that depend on a repository.

You can export the current state of the dependency graph for your repository as a Software Bill of Materials (SBOM) using the industry standard SPDX format:

  • Via the GitHub UI
  • Using the REST API

An SBOM is a formal, machine-readable inventory of a project's dependencies and associated information (such as versions and package identifiers). SBOMs help reduced supply chain risks by:

  • providing transparency about the dependencies used by your repository
  • allowing vulnerabilities to be identified early in the process
  • providing insights in the license compliance, security, or quality issues that may exist in your codebase
  • enabling you to better comply with various data protection standards

If your company provides software to the US federal government per Executive Order 14028, you will need to provide an SBOM for your product. You can also use SBOMs as part of your audit process and use them to comply with regulatory and legal requirements.

Exporting a software bill of materials for your repository from the UI

  1. On your GitHub Enterprise Server instance, navigate to the main page of the repository.

  2. Under your repository name, click Insights.

    Screenshot of the main page of a repository. In the horizontal navigation bar, a tab, labeled with a graph icon and "Insights," is outlined in dark orange.

  3. In the left sidebar, click Dependency graph.

  4. On the top right side of the Dependencies tab, click Export SBOM to generate an SBOM file for download from your browser.

Exporting a software bill of materials for your repository using the REST API

If you want to use the REST API to export an SBOM for your repository, see "REST API endpoints for software bill of materials (SBOM)."