Getting license information from GitHub #148

In the pipeline we created, we enrich SBOMs with many Go packages. For these packages, parlay ecosystems enrich doesn't provide a licenseDeclared value. On the other hand, I can find that information through GitHub by invoking GET https://api.github.com/repos/{owner}/{repo}/license?ref={version}.

I'm considering writing a parlay github enrich command that would use GitHub to:

• set licenseConcluded if unset/NOASSERTION
• add an externalRef with referenceCategory: "OTHER", referenceType: "license", referenceLocator: [the URL to the license file on GitHub] if non-exitant.

Packages without a GitHub homepage would be skipped. In practice this means parlay ecosystems enrich should run first, as it populates homepages.

Does that sound like something you would be interested in?