jason-doyle/Generate operational AIBOM

Generate an evidence-classified, deployment-aware AI Bill of Materials.

Trust Signals

name	description	required	default
path	Project directory to inspect, relative to GITHUB_WORKSPACE.	no	.
manifest	Optional manifest path relative to path. Leave empty to use aibom.yaml when present.	no	""
output	Canonical operational AIBOM output path.	no	aibom.json
public-output	Optional public projection output path. The system must be marked public.	no	""
cyclonedx-output	Optional CycloneDX 1.7 compatibility output path.	no	""
spdx-output	Optional SPDX 3.0.1 JSON-LD compatibility output path.	no	""
baseline	Optional baseline operational AIBOM used for semantic diffing.	no	""
diff-output	Diff output path when baseline is configured.	no	aibom.diff.json
discovery	Enable conservative repository discovery.	no	true
environment-context	Include GitHub and AIBOM context environment variables.	no	true
generated-at	Optional ISO 8601 timestamp override for reproducible generation.	no	""
build-id	Optional build identifier.	no	""
release	Optional release identifier.	no	""
deployment-id	Optional deployment identifier.	no	""
environment	Optional deployment environment.	no	""
region	Optional deployment region.	no	""
fail-on-unknowns	Fail when any explicit unknown exists.	no	false
fail-on-new-unknowns	Fail when the record introduces unknowns relative to baseline.	no	false
fail-on-changes	Fail when the material record differs from baseline.	no	false

name	description
document-id	Canonical operational AIBOM document identifier.
output	Absolute path to the canonical output.
public-output	Absolute path to the public projection when requested.
cyclonedx-output	Absolute path to the CycloneDX output when requested.
spdx-output	Absolute path to the SPDX output when requested.
diff-output	Absolute path to the semantic diff when a baseline is configured.
unknown-count	Number of explicit unknown records.
review-required	Whether the semantic diff indicates that review is required.