sbomify action
Generates software bills of materials in CI by extracting package data from lockfiles, containers, and source directories with native tooling across fourteen ecosystems, supports CycloneDX and SPDX formats, adds metadata, enables trusted OIDC publishing, and build provenance with diverse export options.
Cost / License
- Free
- Open Source (Apache-2.0)
Platforms
- Linux
- Docker
Features
sbomify action News & Activities
Recent activities
- Maoholguin updated sbomify action
- vpetersson added sbomify action
vpetersson added sbomify action as alternative to Trivy
sbomify action information
Developed by
sbomify, ltd Licensing
Open Source (Apache-2.0) and Free product.Written in
Alternatives
1 alternatives listedSupported Languages
- English
What is sbomify action?
sbomify-action generates a Software Bill of Materials as part of your build, from what your build actually resolved.
Point it at a lockfile and it uses that ecosystem's own tooling, because a native resolver knows things a generic scanner has to guess. Python, JavaScript, Java, Go, Rust, Ruby, PHP, .NET, Swift, Dart, Elixir, Scala, C++ and Terraform are supported, along with container images and source directories. Output is CycloneDX or SPDX.
The result is enriched before it leaves your pipeline. Licence, supplier and lifecycle metadata are pulled from package registries, and your own organisational metadata is added, so what arrives is a document someone can act on rather than a list of names and versions.
Publish it to your sbomify trust center, send it to Dependency-Track, or write it to a file and do as you like. Trusted publishing over OIDC means no long lived API tokens in CI, and build provenance is attested with GitHub Artifact Attestations.
It runs as a GitHub Action, a Docker image, or a Python package from PyPI.