Can I scan a project with multiple types?

[Shortfinga]

Hi,

I have a project with various different languages. For now the most important are JS for the frontend and python for the backend. I noticed when I scan the project without the -t flag, it only finds JS dependencies. If I use -t python it only finds Python dependencies.
So the obvious workaround is to scan the project twice each time with the -t flag. But IMHO it would be cool to have one BOM with all dependencies. Have I overlooked such a option?
Thanks in advance
Max

[prabhu]

@Shortfinga This is an interesting use case. Let me think about it a bit though. There is currently a multi X Bom creator which is used in docker mode - https://github.com/AppThreat/cdxgen/blob/master/index.js#L1601 . Perhaps, we could expose this as an arg say --multi?

[sushiMix]

@prabhu
I tested with a project with both Go and a Dockerfile and it does not find the dockerfile if I don't say explicitly -t dockerfile.

go.mod and Dockerfile are at the root of the project.

[prabhu]

@setchy any thoughts?

@sushiMix if you look for a method called createMultiXBom you will see what is going on. Could you send a PR?

[sushiMix]

@prabhu
I think the method createMultiXBom (by reading the code) does not try dockerfile analysis .
For the PR, I need to look to contributions requirements but should be possible.

[sushiMix]

Yes with a try it's output dockerfile information. There is one function that I don't understand will see in PR review I think.

[sushiMix]

seems ok with -t universal is there a documentation where it is explained ? I didn't find clearly the -t possible values