manifest-cyber/Manifest Cyber SBOM Transmitter
Transmit an SBOM to your Manifest Cyber account
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| apiKey | An API key generated in the Manifest app | no | — |
| bomFilePath | The location of a generated SBOM file. Accepts CycloneDX or SPDX SBOMs in JSON. If a file is not provided, an SBOM will be generated using the parameters below. | no | ./bom.json |
| path | Path of the target repository to generate an SBOM for | no | — |
| relationship | Sets the relationship of the SBOM. Must be either "first" or "third" with most cases being "first" for SBOMs generated using the GitHub action. | no | first |
| source | The source of the uploaded SBOM. | no | github-action |
| sbomName | The SBOM name, defaults to repository name | no | — |
| sbomVersion | The SBOM version, defaults to environment variable tag, or commit hash | no | — |
| sbomOutput | The SBOM output format, Supports: spdx-json | cyclonedx-json | no | cyclonedx-json |
| sbomGenerator | The SBOM generator, defaults to syft. Supports: syft | trivy | cdxgen | sigstore-bom | spdx-sbom-generator | docker-sbom | csbom | no | — |
| sbomArtifact | Boolean to store the generated SBOM as an artifact. An artifact will not be created when set to anything other than `true`. | no | true |
| sbomPublish | Boolean to publish the SBOM to the Manifest Cyber platform. Expects either `true` or `false`. When unset, the action will upload if an API Key is present. | no | — |
| sbomLabels | A comma separated list of labels to apply to the SBOM. | no | — |
| sbomGeneratorFlags | ADVANCED USERS: Flags the Manifest CLI passes through to the generator | no | — |
| generator | The SBOM generator, defaults to syft. Supports: syft | trivy | cdxgen | sigstore-bom | spdx-sbom-generator | docker-sbom | csbom | no | syft |
| generator-version | The version of the SBOM generator to use. Defaults to the latest version. | no | — |
| generator-flags | flags passes through to the generator | no | — |
| generator-preset | The preset to use for the generator. Defaults to the "recommended" preset. | no | recommended |
| generator-config | The path to the generator configuration file. | no | — |
| asset-labels | A comma separated list of labels to apply to the SBOM asset. | no | — |
| product-id | The product ID to associate the SBOM with. | no | — |
| product-labels | A comma separated list of labels to apply to the SBOM product, will only be applied if the product-id is set. | no | — |
| active | set the SBOM as active. Expects either `true` or `false`. | no | — |
| deactivate-older | Mark previous versions of this asset as inactive when publishing this SBOM. Expects either `true` or `false`. | no | — |
| deactivate-label | A comma separated list of labels that scopes `deactivate-older`. When set, only previous versions of this asset carrying one of these labels are deactivated. Requires `deactivate-older` to be `true`. | no | — |
| replace-in-product | After upload, replace the asset's prior version in the product inventory with this version. Requires `product-id` to be set. Expects either `true` or `false`. | no | — |
| apiUri | set the Manifest API endpoint URI. | no | — |
| manifest-cli-version | Version of manifest-cli to install (e.g. v1.2.3) | no | — |
| manifestCLIVersion | Version of manifest-cli to install (e.g. v1.2.3) | no | — |
| detect-ai | Enable AI detection for AIBOM generation. Requires cyclonedx-json output format. Expects either `true` or `false`. | no | false |
| detectAI | Enable AI detection for AIBOM generation. Requires cyclonedx-json output format. Expects either `true` or `false`. | no | false |
| install-dependencies | Allow manifest-cli to auto-install required dependencies (e.g. opengrep for --detect-ai). Expects either `true` or `false`. | no | false |
| installDependencies | Allow manifest-cli to auto-install required dependencies (e.g. opengrep for --detect-ai). Expects either `true` or `false`. | no | false |
| verbose | Enable verbose logging. Expects either `true` or `false`. | no | false |
| sbomArtifactName | The name of the SBOM artifact. Defaults to the 'sbom' | no | — |
| bomArtifactName | The name of the SBOM artifact. Defaults to the 'sbom' | no | — |
Outputs
no outputs