| command | The aibomgen-cli command to execute: download, scan, generate, validate, completeness, vuln-scan, merge | yes | scan |
| scan-input | Directory path for command=scan | no | . |
| generate-model-ids | Comma or newline-separated Hugging Face model IDs for command=generate | no | — |
| validate-input | Path or comma/newline-separated paths to existing AIBOM files for command=validate | no | — |
| validate-strict | Enable strict validation mode for command=validate | no | false |
| validate-min-score | Minimum completeness score (0..1) for command=validate | no | — |
| validate-check-model-card | Validate model card fields for command=validate | no | false |
| completeness-input | Path to an existing AIBOM file for command=completeness | no | — |
| completeness-plain-summary | Emit plain machine-readable summary for command=completeness | no | false |
| vuln-scan-input | Path or comma/newline-separated paths to existing AIBOM files for command=vuln-scan | no | — |
| vuln-scan-enrich | Inject vulnerability findings back into the AIBOM for command=vuln-scan | no | false |
| vuln-scan-no-preview | Skip save preview prompt when command=vuln-scan and enrich is enabled | no | false |
| vuln-scan-output-format | Output format for enriched AIBOM in command=vuln-scan | no | auto |
| merge-aibom-files | Comma or newline-separated AIBOM file paths for command=merge | no | — |
| merge-sbom-file | SBOM file path for command=merge | no | — |
| merge-output-file | Output merged BOM file path for command=merge | no | — |
| merge-deduplicate | Deduplicate components by bom-ref for command=merge | no | true |
| format | BOM format input for command operations: json, xml, auto | no | auto |
| output-file | Output file path for commands that support writing a single file. Not supported for command=scan, command=generate, or command=vuln-scan. | no | — |
| spec-version | CycloneDX spec version (for commands supporting --spec) | no | — |
| hf-token | Hugging Face access token for private/gated models | no | — |
| hf-mode | Hugging Face metadata mode for scan/generate: online or dummy | no | online |
| hf-timeout | Hugging Face timeout in seconds | no | 0 |
| no-security-scan | Disable HF security scan enrichment on scan/generate | no | false |
| config | Path to an aibomgen-cli configuration file (--config) | no | — |
| log-level | Log verbosity: quiet, standard, debug | no | standard |
| aibomgen-version | aibomgen-cli version to use (for example v0.2.1) | no | v0.2.1 |
| aibomgen-sha256 | Optional SHA256 checksum for downloaded release archive | no | — |
| github-token | GitHub token used for uploading artifacts and release assets | no | ${{ github.token }} |
| artifact-name | Optional label for the uploaded workflow artifact bundle; produced BOM files keep their original filenames inside the artifact | no | — |
| upload-artifact | Upload produced output files as a workflow artifact bundle while preserving each file's original filename | no | true |
| upload-artifact-retention | Retention policy in days for the uploaded workflow artifact. Minimum 1 day, maximum 90 days (repository default if 0).
| no | 0 |
| upload-release-assets | Attach produced output files to a release on release/tag events using their original filenames | no | true |
| aibom-artifact-match | Fallback pattern used to select workflow artifacts for release upload when current-run output files are not available | no | — |
| aibom-artifact-match-mode | Pattern mode for the fallback aibom-artifact-match lookup: exact or glob | no | exact |
| release-ref-prefix | Ref prefix used to detect release pushes (default: refs/tags/) | no | — |