chore: pass processed files out of plugin

Author: thomasschafer

internal/uv/uv.go

@@ -8,7 +8,11 @@ import (
 	"github.com/rs/zerolog"
 )
 
-const UvLockFileName = "uv.lock"
+const (
+	UvLockFileName          = "uv.lock"
+	requirementsTxtFileName = "requirements.txt"
+	pyprojectTomlFileName   = "pyproject.toml"
+)
 
 // This is copied from cli-extension-os-flows. We could export from here via GAF config and re-use if this duplication
 // becomes a problem, but this duplication is only temporary.

internal/uv/uvclient.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"os/exec"
+	"path"
 	"regexp"
 	"strconv"
 	"strings"
@@ -52,9 +53,12 @@ func (c client) ExportSBOM(inputDir string) (*scaplugin.Finding, error) {
 	}
 
 	return &scaplugin.Finding{
-		Sbom:           output,
-		FilesProcessed: []string{},
-		TargetFile:     UvLockFileName,
+		Sbom: output,
+		FilesProcessed: []string{
+			path.Join(inputDir, requirementsTxtFileName),
+			path.Join(inputDir, pyprojectTomlFileName),
+		},
+		TargetFile: UvLockFileName,
 	}, nil
 }