| file-path | Path to directory or specific file to ingest. Required when generate is false; must be empty when generate is true (the action uploads the generated SBOM). | no | "" |
| generate | Generate an SBOM with `kusari platform generate` (via waybill) and upload it, instead of uploading an existing file. | no | false |
| source-path | Source path to scan when generate is true. Passed to waybill as `--path`. Exactly one of `source-path` or `image` is required when generate is true. | no | "" |
| image | Container image reference (OCI ref or `docker save` tarball path) to scan when generate is true. Passed to waybill as `--image`. Exactly one of `source-path` or `image` is required when generate is true. | no | "" |
| output-path | Path where the generated SBOM is written (used when generate is true). Passed to waybill as `--output` and then used as the file to upload. Default matches waybill's CycloneDX default. | no | project.cdx.json |
| waybill-args | Additional flags passed verbatim to `waybill sbom scan` after `--` when generate is true. Avoid overriding `--output` here; use the `output-path` input instead. | no | "" |
| mikebom-args | DEPRECATED: mikebom was renamed to waybill; use `waybill-args` instead. Treated exactly like `waybill-args`, but ignored when `waybill-args` is also set. Will be removed in a future release. | no | "" |
| root-name | waybill `--root-name` value used when generate is true. When unset, waybill uses its own auto-derivation. | no | "" |
| root-version | waybill `--root-version` value used when generate is true. When unset, waybill uses its own auto-derivation. | no | "" |
| no-root-purl | When "true" and generate is true, pass `--no-root-purl` so waybill emits no root purl. The resulting software has an empty pkg_type (matches syft container-image rows). | no | false |
| tenant-endpoint | Kusari Platform tenant api endpoint | yes | — |
| client-id | Client id for auth token provider | yes | — |
| client-secret | Client secret for auth token provider | yes | — |
| token-endpoint | Kusari Platform auth token provider endpoint | yes | https://auth.us.kusari.cloud/oauth2/token |
| console-url | Internal use only. Console URL override for non-production (e.g. dev) environments. Leave unset for production. | no | "" |
| platform-url | Internal use only. Platform API URL override for non-production (e.g. dev) environments. Leave unset for production. | no | "" |
| alias | DEPRECATED: not used by the Kusari platform; will be removed in a future release | no | "" |
| document-type | Type of the file being uploaded | no | "" |
| open-vex | Set to true if ingesting an OpenVEX document. When true, tag is required and so is one of software-id and sbom-subject. | no | false |
| tag | Tag for the document. Currently only used for OpenVEX. Example: govulncheck | no | — |
| software-id | Kusari Platform software ID that the document applies to. Currently only used for OpenVEX. Example: 1234 | no | — |
| sbom-subject | Kusari Platform software SBOM subject substring value that uniquely indicates which software that the document applies to. Currently only used for OpenVex. Example: kusari-ingest | no | — |
| check-blocked-packages | Check SBOM dependencies against the Blocked Package list in the Kusari Platform. | no | false |
| sbom-subject-name-override | SBOM Subject Name override (optional, for SBOMs only) | no | "" |
| sbom-subject-version-override | SBOM Subject Version override (optional, for SBOMs only) | no | "" |
| commit-sha | Commit SHA to associate with the uploaded document (optional) | no | ${{ github.sha }} |
| wait | Wait for ingestion status (default: true) | no | true |
| results-file | Path to write the machine-readable JSON ingestion results to (software and component IDs per ingested SBOM). Setting this (or map-components) also populates the `results` output; when neither is set the ID lookups are skipped entirely. Requires wait: true. | no | "" |
| map-components | When "true", passes --map-components to the kusari CLI: after ingestion, each ingested software not already mapped to a Kusari component gets mapped automatically — create (or reuse) a component named after the software and assign the software to it. Requires wait: true (the default). | no | false |