netpresenter/SBOM Scan
Generate SBOM and scan for vulnerabilities. Supports source dirs, container images, Gradle projects, and CocoaPods.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Apr 22, 2026
- License
- None
Pinned Snippet
uses: netpresenter/gha-sbom-scan@3f09ef09c066b23d1971d3144355642d1acf832c # v1.0.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| scan-type | Type of scan: "source", "image", "gradle", or "cocoapods" | yes | — |
| scan-target | Target to scan: directory path, registry reference, gradle project dir, or Podfile path | yes | — |
| sbom-filename | Filename for the generated SBOM (e.g. sbom-source.cdx.json) | yes | — |
| artifact-name | Name for the uploaded artifact | yes | — |
| summary-title | Title for the step summary section | yes | — |
| grype-fail-on | Fail on severity threshold: critical, high, medium, low, or empty string to disable | no | "" |
| retention-days | Artifact retention in days | no | 90 |
Outputs
| name | description |
|---|---|
| sbom-path | Path to the generated SBOM file |
| vuln-count | Total vulnerability count |
| critical-count | Critical vulnerability count |