from pathlib import Path
from xelo import AiSbomConfig, AiSbomExtractor, AiSbomSerializer
from xelo.toolbox.plugins.vulnerability import VulnerabilityScannerPlugin

# Extract
config = AiSbomConfig()
doc    = AiSbomExtractor().extract_from_path(
    path=Path("./my-ai-app"),
    config=config,
)
print(f"nodes={len(doc.nodes)}, edges={len(doc.edges)}")

# Serialize
json_str = AiSbomSerializer.to_json(doc)

# Vulnerability scan
sbom   = doc.model_dump(mode="json")
result = VulnerabilityScannerPlugin().run(sbom, {})
print(result.status, result.message)

# .github/workflows/sbom.yml
name: AI SBOM scan
on: [push, pull_request]

jobs:
  xelo:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install xelo
        run: pip install xelo
      - name: Scan
        run: xelo scan . --output sbom.json
      - name: Security check
        run: |
          xelo plugin run vulnerability sbom.json \
            --output findings.json
          python3 -c "
          import json, sys
          d = json.load(open('findings.json'))
          s = d['details']['summary']
          sys.exit(1 if s['critical']+s['high'] > 0 else 0)
          "
      - name: Upload SARIF
        run: |
          xelo plugin run sarif sbom.json --output results.sarif
          xelo plugin run ghas  sbom.json \
            --config token=${{ secrets.GITHUB_TOKEN }} \
            --config github_repo=${{ github.repository }}