Thomas Steenbergen

Implement a CI/CD integration for Forgejo

5

Similar to the ORT integrations for [GitHub](https://github.com/oss-review-toolkit/ort-ci-github-action) and [GitLab](https://github.com/oss-review-toolkit/ort-ci-gitlab) we propose to implement a integration for [Forgejo Actions](https://forgejo.org/docs/latest/user/actions/basic-concepts/).

### What is the functionality you want to propose? Add a link to ORT docs point users ways how to resolve rule violations and highlighting that WebApp and Static HTML...

This could include the rewrite the documentation of VulnerableCode docs (see https://vulnerablecode.readthedocs.org/) according to Diátaxis framework to make the AboutCode docs better.

Set PURL in project settings if input is package URL

1

If the input of ScanCode.io project is a single package URL such as `pkg:github/jshttp/[email protected]` then it make sense to me that in the project settings automatically the PURL field is...

CycloneDX SBOMs do not contain dependencies

2

As part of the ScanCode ORT integration (see https://github.com/aboutcode-org/scancode.io/issues/1727) I tested analyzing [Mime Types 2.1.26](https://github.com/jshttp/mime-types/tree/2.1.26) as various inputs to ScanCode.io. v35.3.0 and to my surprise noticed that dependencies detected included...

Pipelines in 'Create Project' page are confusing

1

Several of the ScanCode.io v35.3.0 built-in pipelines are confusing - to me and others they look to be doing roughly the same thing. Talking about pipelines in below table -...

Currently if ScanCode.io is given multiple inputs (e.g. package URL, archive) the found packages and dependencies will be merged or "flatten"in the resulting CycloneDX and SPDX SBOMs. This may have...

ScanCode.io will generate a project result file as JSON after each run that includes project details like input sources, settings, package and dependencies found. Other SBOM tools such as grype...