actions/Attest SBOM

Generate SBOM attestations for build artifacts

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jul 7, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4.1.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
subject-path	Path to the artifact serving as the subject of the attestation. Must specify exactly one of "subject-path", "subject-digest", or "subject-checksums". May contain a glob pattern or list of paths (total subject count cannot exceed 1024).	no	—
subject-digest	SHA256 digest of the subject for the attestation. Must be in the form "sha256:hex_digest" (e.g. "sha256:abc123..."). Must specify exactly one of "subject-path", "subject-digest", or "subject-checksums".	no	—
subject-name	Subject name as it should appear in the attestation. Required when identifying the subject with the "subject-digest" input.	—	—
subject-checksums	Path to checksums file containing digest and name of subjects for attestation. Must specify exactly one of "subject-path", "subject-digest", or "subject-checksums".	no	—
sbom-path	Path to the JSON-formatted SBOM file to attest. File size cannot exceed 16MB.	yes	—
push-to-registry	Whether to push the provenance statement to the image registry. Requires that the "subject-name" parameter specify the fully-qualified image name and that the "subject-digest" parameter be specified. Defaults to false.	no	false
show-summary	Whether to attach a list of generated attestations to the workflow run summary page. Defaults to true.	no	true
github-token	The GitHub token used to make authenticated API requests.	no	${{ github.token }}

Outputs

name	description
bundle-path	The path to the file containing the attestation bundle.
attestation-id	The ID of the attestation.
attestation-url	The URL for the attestation summary.