Repository: google/go-github
File: github/dependency_graph.go (Go)

Code before:
// license that can be found in the LICENSE file.

package github

import (
	"context"
	"fmt"
	"time"
)

type DependencyGraphService service

// Sbom represents software bill of materials, which descibes the
// packages/libraries that a repository depends on.
type Sbom struct {
	Sbom *SbomInfo `json:"sbom,omitempty"`
}

// When was the SBOM created and who created it
type CreationInfo struct {
	Created  *time.Time `json:"created,omitempty"`
	Creators []*string  `json:"creators,omitempty"`
}

type RepoDependencies struct {
	Spdxid *string `json:"SPDXID,omitempty"`
	// Package name
	Name             *string `json:"name,omitempty"`
	VersionInfo      *string `json:"versionInfo,omitempty"`
	DownloadLocation *string `json:"downloadLocation,omitempty"`
	FilesAnalyzed    *bool   `json:"filesAnalyzed,omitempty"`
	LicenseConcluded *string `json:"licenseConcluded,omitempty"`
	LicenseDeclared  *string `json:"licenseDeclared,omitempty"`
}

// SPDX is an open standard for software bill of materials (SBOM) that
// identifies and catalogs components, licenses, copyrights, security
// references, and other metadata relating to software
type SbomInfo struct {
	Spdxid       *string       `json:"SPDXID,omitempty"`
	SpdxVersion  *string       `json:"spdxVersion,omitempty"`
	CreationInfo *CreationInfo `json:"creationInfo,omitempty"`

	// Repo name
	Name              *string   `json:"name,omitempty"`
	DataLicense       *string   `json:"dataLicense,omitempty"`
	DocumentDescribes []*string `json:"documentDescribes,omitempty"`
	DocumentNamespace *string   `json:"documentNamespace,omitempty"`

	// List of packages dependencies
	Packages []*RepoDependencies `json:"packages,omitempty"`

Review comment (suggestion):
```suggestion
	SPDXID *string `json:"SPDXID,omitempty"`
```

Code after:
// license that can be found in the LICENSE file.

package github

import (
	"context"
	"fmt"
)

type DependencyGraphService service

// SBOM represents a software bill of materials, which describes the
// packages/libraries that a repository depends on.
type SBOM struct {
	SBOM *SBOMInfo `json:"sbom,omitempty"`
}

// CreationInfo represents when the SBOM was created and who created it.
type CreationInfo struct {
	Created  *Timestamp `json:"created,omitempty"`
	Creators []string   `json:"creators,omitempty"`
}

// RepoDependencies represents the dependencies of a repo.
type RepoDependencies struct {
	SPDXID *string `json:"SPDXID,omitempty"`
	// Package name
	Name             *string `json:"name,omitempty"`
	VersionInfo      *string `json:"versionInfo,omitempty"`
	DownloadLocation *string `json:"downloadLocation,omitempty"`
	FilesAnalyzed    *bool   `json:"filesAnalyzed,omitempty"`
	LicenseConcluded *string `json:"licenseConcluded,omitempty"`
	LicenseDeclared  *string `json:"licenseDeclared,omitempty"`
}

// SBOMInfo represents a software bill of materials (SBOM) using SPDX.
// SPDX is an open standard for SBOMs that
// identifies and catalogs components, licenses, copyrights, security
// references, and other metadata relating to software.
type SBOMInfo struct {
	SPDXID       *string       `json:"SPDXID,omitempty"`
	SPDXVersion  *string       `json:"spdxVersion,omitempty"`
	CreationInfo *CreationInfo `json:"creationInfo,omitempty"`

	// Repo name
	Name              *string  `json:"name,omitempty"`
	DataLicense       *string  `json:"dataLicense,omitempty"`
	DocumentDescribes []string `json:"documentDescribes,omitempty"`
	DocumentNamespace *string  `json:"documentNamespace,omitempty"`

	// List of packages dependencies