uv-sbom: Skill for Claude Code

/sync-config - CLI-Config Sync Skill

Audits src/cli.rs against src/config.rs and src/main.rs to detect CLI options that are not exposed through the config file layer, and guides fixing any gaps found.

Trigger Examples

• /sync-config
• "Check that all CLI options are reflected in the config file"
• "Verify CLI options are synced with config"

Background: The Five-Location Rule

Every CLI option intended to be user-configurable must appear in five places:

Location	What to add
src/config.rs — ConfigFile struct	pub <field>: Option<T>
src/config.rs — CONFIG_TEMPLATE	Commented-out YAML entry with description
src/main.rs — MergedConfig struct	<field>: T
src/main.rs — merge_config()	CLI > config > default priority logic
src/main.rs — request builder	Pass merged value to SbomRequest

Reference Implementation: check_cve

Use check_cve as the canonical pattern when adding a new boolean flag:

src/config.rs — ConfigFile:

pub check_cve: Option<bool>,

src/config.rs — CONFIG_TEMPLATE:

# Enable CVE vulnerability checking
# check_cve: false

src/main.rs — MergedConfig:

check_cve: bool,

src/main.rs — merge_config():

// check_cve: CLI flag || config value
let check_cve = args.check_cve || config.check_cve.unwrap_or(false);

src/main.rs — request builder:

.check_cve(merged.check_cve)

Workflow

Step 1: Audit — Extract CLI Options

Read src/cli.rs and list all pub fields in the Args struct.

Exclude from audit (infrastructure, not user-configurable features):

• config (-c / --config) — selects the config file itself
• init (--init) — generates the config template
• path (-p) — project path
• output (-o) — output file path

Step 2: Audit — Check ConfigFile Coverage

Read src/config.rs and list all fields in the ConfigFile struct (excluding unknown_fields).