feat: retrieve git metadata from local repo

README.md

@@ -2,7 +2,9 @@
 
 A command-line tool for uploading SBOM (Software Bill of Materials) files to bifrost.
 
-This repository contains the `bifrost-cli`, which lets you submit SBOMs for a specific service and version to your bifrost organization. It is intended for local automation and CI/CD workflows where you already produce SBOMs as part of your build pipeline.
+This repository contains the `bifrost-cli`, which lets you submit SBOMs for a specific service and version to your
+bifrost organization. It is intended for local automation and CI/CD workflows where you already produce SBOMs as part of
+your build pipeline.
 
 ## What is bifrost?
 
@@ -21,59 +23,62 @@ To use the CLI, you first need a bifrost account and an API token.
 2. Create an API token for your organization in the organization settings.
 3. Choose how you want to install the CLI.
 
-    ### Install with Homebrew (macOS and Linux):
+   ### Install with Homebrew (macOS and Linux):
 
     ```bash
     brew install bifrostsec/tap/bifrost-cli
     ```
 
-    This installs the `bifrost` command from the [bifrostsec/homebrew-tap](https://github.com/bifrostsec/homebrew-tap) tap. To update later:
+   This installs the `bifrost` command from the [bifrostsec/homebrew-tap](https://github.com/bifrostsec/homebrew-tap)
+   tap. To update later:
 
     ```bash
     brew update
     brew upgrade bifrost-cli
     ```
 
-    *(Windows is not covered by Homebrew — use one of the options below.)*
+   *(Windows is not covered by Homebrew — use one of the options below.)*
+
+   ### Download the released executable:
 
-    ### Download the released executable:
-
     ```bash
     # Example for macOS on Apple Silicon
     curl -L -o bifrost https://github.com/bifrostsec/bifrost-cli/releases/latest/download/bifrost-darwin-arm64
     chmod +x ./bifrost
     ```
-
-    *macOS note: the current macOS release binaries are not signed with an Apple Developer certificate. When you first run `./bifrost`, macOS may block it with a warning such as:*
-
-    > **“bifrost” Not Opened**  
-    > Apple could not verify “bifrost” is free of malware that may harm your Mac or compromise your privacy
-
-    To allow the binary to run on macOS:
-
+
+   *macOS note: the current macOS release binaries are not signed with an Apple Developer certificate. When you first
+   run `./bifrost`, macOS may block it with a warning such as:*
+
+   > **“bifrost” Not Opened**  
+   > Apple could not verify “bifrost” is free of malware that may harm your Mac or compromise your privacy
+
+   To allow the binary to run on macOS:
+
     1. Try to run `./bifrost` once so macOS registers the blocked executable.
     2. Open `System Settings` > `Privacy & Security`.
     3. Scroll down to the `Security` section and click `Allow Anyway` for `bifrost`.
     4. Confirm with your login password if prompted.
     5. Run `./bifrost` again.
-
-    *The `Allow Anyway` button is only shown for a limited time after the blocked launch attempt, so if you do not see it, run `./bifrost` again and return to `Privacy & Security`.*
-
-    Release assets are published at:
-
+
+   *The `Allow Anyway` button is only shown for a limited time after the blocked launch attempt, so if you do not see
+   it, run `./bifrost` again and return to `Privacy & Security`.*
+
+   Release assets are published at:
+
     - [github.com/bifrostsec/bifrost-cli/releases/latest](https://github.com/bifrostsec/bifrost-cli/releases/latest)
-    
-    Available executable names include:
-    
+
+   Available executable names include:
+
     - `bifrost-darwin-amd64`
     - `bifrost-darwin-arm64`
     - `bifrost-linux-amd64`
     - `bifrost-linux-arm64`
     - `bifrost-windows-386`
     - `bifrost-windows-amd64`
-    
-    ### Or build the CLI from source:
-    
+
+   ### Or build the CLI from source:
+
     ```bash
     make build
     ```
@@ -106,12 +111,30 @@ You can control retry behavior for transient upload failures:
 ./bifrost --service=my-service --service-version=1.2.3 --image=registry.example.com/team/app:1.2.3 --retry-attempts=5 --retry-delay=5s sbom upload /path/to/sbom.json
 ```
 
-You can attach Git metadata to the upload request:
+Git metadata is optional. You can attach it manually:
 
 ```bash
 ./bifrost --service=my-service --service-version=1.2.3 --image=registry.example.com/team/app:1.2.3 --git-branch=main --git-commit-sha=abc123 --git-origin=https://github.com/example/project.git sbom upload /path/to/sbom.json
 ```
 
+You can also enable automatic Git metadata detection. When enabled, bifrost fills in missing Git metadata from the
+current Git repository when those values are available:
+
+```bash
+./bifrost --service=my-service --service-version=1.2.3 --git-auto-detect sbom upload /path/to/sbom.json
+```
+
+To detect metadata from a specific path:
+
+```bash
+./bifrost --service=my-service --service-version=1.2.3 --git-auto-detect --git-repo-path=/path/to/repo sbom upload /path/to/sbom.json
+```
+
+You can enable automatic Git metadata detection with:
+
+- The `BIFROST_GIT_AUTO_DETECT=true` environment variable
+- The `--git-auto-detect` flag
+
 Example with Trivy generating a CycloneDX SBOM for a container image and piping it directly to bifrost:
 
 ```bash
@@ -130,19 +153,21 @@ gh api \
 
 ## Options
 
-| Option | Required | Environment variable(s) | Description |
-| --- | --- | --- | --- |
-| `--api-key` | Yes | `BIFROST_API_KEY` | Bifrost API key used for authentication. |
-| `--service` | Yes | `SERVICE` | Name of the service. |
-| `--service-version` | Conditional | `SERVICE_VERSION` | Service version for the uploaded SBOM. Required unless an image is provided. |
-| `--image` | Conditional | `IMAGE` | Container image reference for the uploaded SBOM. Required unless a service version is provided. |
-| `--server-url` | No | `SERVER_URL`, `BIFROST_SERVER_URL` | URL to the bifrost server. |
-| `--retry-attempts` | No |  | Number of retry attempts for transient upload failures. |
-| `--retry-delay` | No |  | Delay between upload retry attempts. |
-| `--git-branch` | No |  | Git branch name to attach to the upload. |
-| `--git-commit-sha` | No |  | Git commit SHA to attach to the upload. |
-| `--git-origin` | No |  | Git origin URL to attach to the upload. |
-| `--help` | No |  | Show help and exit. |
+| Option                       | Required    | Environment variable(s)            | Description                                                                                       |
+|------------------------------|-------------|------------------------------------|---------------------------------------------------------------------------------------------------|
+| `--api-key`                  | Yes         | `BIFROST_API_KEY`                  | Bifrost API key used for authentication.                                                          |
+| `--service`                  | Yes         | `SERVICE`                          | Name of the service.                                                                              |
+| `--service-version`          | Conditional | `SERVICE_VERSION`                  | Service version for the uploaded SBOM. Required unless an image is provided.                      |
+| `--image`                    | Conditional | `IMAGE`                            | Container image reference for the uploaded SBOM. Required unless a service version is provided.   |
+| `--server-url`               | No          | `SERVER_URL`, `BIFROST_SERVER_URL` | URL to the bifrost server.                                                                        |
+| `--retry-attempts`           | No          |                                    | Number of retry attempts for transient upload failures.                                           |
+| `--retry-delay`              | No          |                                    | Delay between upload retry attempts.                                                              |
+| `--git-branch`               | No          |                                    | Git branch name to attach to the upload.                                                          |
+| `--git-commit-sha`           | No          |                                    | Git commit SHA to attach to the upload.                                                           |
+| `--git-origin`               | No          |                                    | Git origin URL to attach to the upload.                                                           |
+| `--git-repo-path`            | No          |                                    | Git repository path used for automatic Git metadata detection. Defaults to the current directory. |
+| `--git-auto-detect`          | No          | `BIFROST_GIT_AUTO_DETECT`          | Automatically fill missing Git metadata from the current Git repository when available.           |
+| `--help`                     | No          |                                    | Show help and exit.                                                                               |
 
 ## Useful Links
 

internal/bifrost/api.go

@@ -35,7 +35,7 @@ type APIConfig struct {
 	GitCommitSHA  string
 	GitOrigin     string
 	Image         string
-	CliVersion	  string
+	CliVersion    string
 }
 
 type api struct {

internal/bifrost/cli.go

@@ -32,7 +32,7 @@ func CLI(version, gitCommit string, args []string) int {
 		printUsage(fl)
 		return 2
 	}
-	err = ValidateBaseOptions(&options)
+	err = ValidateBaseOptions(fl, &options)
 	if err != nil {
 		_, _ = fmt.Fprintf(os.Stderr, "Error: %v\n\n", err)
 		printUsage(fl)