id       = "syft"
name     = "Syft"
homepage = "https://github.com/anchore/syft"
description = "CLI tool and library for generating a Software Bill of Materials from container images and filesystems."
executables   = ["syft"]

[dotfiles]

# https://github.com/anchore/syft/wiki/configuration — Syft searches the home
# file `~/.syft.yaml` and then `<XDG_CONFIG_HOME>/syft/config.yaml`; the latter
# is [configHome] because the documentation names the XDG variable explicitly.
paths = ["~/.syft.yaml", "[configHome]/syft/config.yaml"]

# These files hold output and scanner preferences, not credentials.
secret = []

# Configuration is loaded at process startup and is not watched afterwards.
side_effect = false

[commands]
format = 1
label = "Generate an SBOM"
description = "Scan a container image, directory or archive and print or write an SBOM. Only the output format and source-type options are covered."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = false, short_attached = false, short_bundles = false }

[[commands.source]]
id = "s"
kind = "help"
url = "https://github.com/anchore/syft"
revision = "2026-10-27"
evidence = """
syft alpine:latest
syft ./my-project
syft <image> -o cyclonedx-json
syft <image> -o spdx-json=./spdx.json -o cyclonedx-json=./cdx.json
syft --from containers-storage localhost/myimage:latest
"""

[[commands.field]]
id = "source"
label = "Scan target"
description = "Image reference, directory or archive, e.g. alpine:latest or ./my-project."
type = "string"
position = 0
sources = ["s"]

[[commands.field]]
id = "output"
label = "Output format"
description = "Format, optionally with =file, e.g. spdx-json=./spdx.json."
type = "string"
option = ["-o"]
multiple = true
suggestions = [{ value = "cyclonedx-json", label = "CycloneDX JSON" }, { value = "spdx-json", label = "SPDX JSON" }]
sources = ["s"]

[[commands.field]]
id = "from"
label = "Source type"
type = "string"
option = ["--from"]
suggestions = [{ value = "containers-storage", label = "containers-storage" }]
sources = ["s"]

[[commands.task]]
id = "scan"
label = "Scan a target"
fields = ["source", "output"]
required = ["source"]

[[commands.group]]
id = "basic"
label = "Basic"
fields = ["source", "output", "from"]