lfreleng-actions/📋 SBOM Generator
Generates CycloneDX SBOM reports for projects in any language/ecosystem
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 10, 2026
- License
- None
Pinned Snippet
uses: lfreleng-actions/sbom-action@df0b04bb49f19c0dca5e6e08a0c9080bf55d261e # v0.0.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| backend | SBOM generation backend; currently supports 'syft' | no | syft |
| path_prefix | Project directory; must resolve within the workspace | no | . |
| sbom_format | SBOM output format: 'json', 'xml', or 'both' | no | both |
| sbom_spec_version | CycloneDX specification version to use | no | 1.5 |
| filename_prefix | Base filename for SBOM output (without extension) | no | sbom-cyclonedx |
| output_directory | SBOM report directory, within workspace or runner temp | no | . |
| include_dev | Include development dependencies in SBOM | no | false |
| fail_on_error | Fail the action if SBOM generation encounters errors | no | true |
| syft_version | Syft version to download (defaults to the installer's pinned version) | no | "" |
Outputs
| name | description |
|---|---|
| sbom_json_path | Path to generated JSON SBOM file |
| sbom_xml_path | Path to generated XML SBOM file |
| component_count | Number of components in the generated SBOM |
| backend | SBOM generation backend used |