opensecdevops/OSDO SBOM
Generate Software Bill of Materials (SBOM) in SPDX and CycloneDX formats using Syft
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to generate SBOM from (directory or container image) | no | . |
| source-type | Source type (directory, image, archive) | no | directory |
| format | SBOM format (spdx-json, cyclonedx-json, spdx-tag-value, both) | no | both |
| output-prefix | Output file prefix | no | sbom |
| include-dev-deps | Include development dependencies | no | false |
| validate | Validate generated SBOM | no | true |
| upload-artifact | Upload SBOM as GitHub artifact | no | true |
| results-dir | Directory to store results | no | .osdo/results |
Outputs
| name | description |
|---|---|
| sbom-spdx-file | Path to SPDX SBOM file |
| sbom-cyclonedx-file | Path to CycloneDX SBOM file |
| sbom-hash | SHA256 hash of the primary SBOM |
| packages-count | Number of packages in SBOM |
| valid | Whether SBOM passed validation |