actions-marketplace-validations/Anchore SBOM Action
Creates an SBOM (Software Bill Of Materials) from your code and container images
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Apr 2, 2026
- License
- Apache 2.0
Pinned Snippet
uses: actions-marketplace-validations/anchore_sbom-action@f0d33c151c04af6fcbf4363834e838fcc7c87783 # no releases — HEAD as of 2026-07-10tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | A path to a directory on the filesystem to scan | no | . |
| file | A file on the filesystem to scan | no | — |
| image | A container image to scan | no | — |
| registry-username | The registry username | no | — |
| registry-password | The registry password | no | — |
| format | The SBOM format to export | no | spdx-json |
| github-token | Authorized secret GitHub Personal Access Token. Defaults to github.token | no | ${{ github.token }} |
| artifact-name | The name to use for the SBOM file generated by this action | no | — |
| output-file | A file location to output the SBOM | no | — |
| syft-version | The version of Syft to use | no | — |
| dependency-snapshot | Upload to GitHub dependency snapshot API | no | false |
| upload-artifact | Upload artifact to workflow | no | true |
| upload-artifact-retention | Retention policy for uploaded artifact to workflow. Minimum 1 day. Maximum 90 days unless changed from the repository settings page. An input of 0 assumes default retention value. | no | 0 |
| upload-release-assets | Upload release assets | no | true |
| config | Configuration file to use | no | — |
Outputs
no outputs