adracea/SBOM merge
Merge SBOMs of CycloneDX v1.3/v1.4 XML format. Does not support signatures.
View on GitHubTrust Signals
- Scorecard Score
- Scorecard 2–4scored Jul 13, 2026
- Maintenance Recency
- Stalelast commit Apr 7, 2022
- License
- None
Pinned Snippet
uses: adracea/gha-sbomb-merge@3e093e3a68b63ee8ec20ad42c3fc5b49cd0ba7ac # no releases — HEAD as of 2026-07-13tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| files | Pattern to find input sbom files: ./bom*.xml | yes | ./bom*.xml |
| cdxversion | CyclondeDX version of the sboms, supports versions `1.3` and `1.4` | yes | ./bom*.xml |
| ofile | Output file | no | ./finalSbom.xml |
Outputs
no outputs