sbomify action icon
sbomify action icon

sbomify action

Generates software bills of materials in CI by extracting package data from lockfiles, containers, and source directories with native tooling across fourteen ecosystems, supports CycloneDX and SPDX formats, adds metadata, enables trusted OIDC publishing, and build provenance with diverse export options.

sbomify action screenshot 1

Cost / License

Platforms

  • Linux
  • Docker
Alternatives  
0likes
1alternative
0articles
Save

Features

No features, maybe you want to suggest one?

 Tags

sbomify action News & Activities

Highlights All activities

Recent activities

sbomify action information

GitHub repository

  •  25 Stars
  •  10 Forks
  •  35 Open Issues
  •   Updated  
View on GitHub

Popular alternatives

View all
sbomify action was added to AlternativeTo by Viktor Petersson on and this page was last updated .

No comments or reviews, maybe you want to be first?

Official Links

AppStores & Other Links

What is sbomify action?

sbomify-action generates a Software Bill of Materials as part of your build, from what your build actually resolved.

Point it at a lockfile and it uses that ecosystem's own tooling, because a native resolver knows things a generic scanner has to guess. Python, JavaScript, Java, Go, Rust, Ruby, PHP, .NET, Swift, Dart, Elixir, Scala, C++ and Terraform are supported, along with container images and source directories. Output is CycloneDX or SPDX.

The result is enriched before it leaves your pipeline. Licence, supplier and lifecycle metadata are pulled from package registries, and your own organisational metadata is added, so what arrives is a document someone can act on rather than a list of names and versions.

Publish it to your sbomify trust center, send it to Dependency-Track, or write it to a file and do as you like. Trusted publishing over OIDC means no long lived API tokens in CI, and build provenance is attested with GitHub Artifact Attestations.

It runs as a GitHub Action, a Docker image, or a Python package from PyPI.