bact/Pitloom - SPDX 3 SBOM Generator
Generate an SPDX 3 SBOM for a Python project or AI model file using Pitloom.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| project-path | Directory to scan for a Python project (containing pyproject.toml, setup.cfg, or setup.py). Ignored when "model" is set. | no | . |
| model | Path to a local AI model file, or a Hugging Face URL / model ID. When set, runs analyze mode ("loom analyze <model>") instead of project mode. | no | "" |
| output | SBOM output file path. | no | sbom.spdx3.json |
| extras | Comma-separated pip extras to install alongside Pitloom, e.g. "aimodel,huggingface". | no | "" |
| pretty | Pretty-print the SBOM output with 2-space indentation. | no | false |
| args | Extra raw flags passed through to the loom command. | no | "" |
| pitloom-version | Pitloom version or version specifier to install, e.g. "0.12.0" or ">=0.12,<1.0". Empty installs the latest release from PyPI. | no | "" |
| python-version | Python version passed to actions/setup-python. | no | 3.x |
| install | When "false", skip installing Python and Pitloom, and assume Pitloom is already available on PATH (used by Pitloom's own self-test to dogfood the local checkout via "uses: ./"). | no | true |
| upload-artifact | Upload the generated SBOM using actions/upload-artifact. | no | true |
| artifact-name | Artifact name used when upload-artifact is true. | no | sbom |
Outputs
| name | description |
|---|---|
| sbom-path | Path to the generated SBOM file. |