richonn/SBOMForge

Automatically generates a signed SBOM using Syft and Cosign, and attaches it to your GitHub releases.

Trust Signals

name	description	required	default
github-token	GitHub token to upload the SBOM as a release asset.	yes	—
format	SBOM format(s). One or more of: spdx-json, cyclonedx-json, syft-json. Comma-separated for multiple (e.g. "spdx-json,cyclonedx-json").	no	spdx-json
artifact-name	Output filename prefix.	no	sbom
sign	Sign the SBOM with Cosign keyless	no	true
attach-to-release	Attach the SBOM to the GitHub Release.	no	true
upload-to-summary	Show a summary in the GitHub Actions Job Summary.	no	true
scan-path	Directory or directories to scan. Comma-separated for monorepos (e.g. "services/api,services/worker"). If image is set, this is ignored.	no	.
image	Docker image to scan (e.g. alpine:3.21,ghcr.io/org/app:latest). If set, scan-path is ignored.	no	""
fail-on-error	Fail the job if SBOM generation fails.	no	true
dry-run	Generate the SBOM without signing or uploading. Useful for testing.	no	false
attest	Generate a signed SLSA provenance attestation for each SBOM. Requires id-token:write permission.	no	false
oci-image	OCI image reference to attach the SBOM to (e.g. ghcr.io/org/app@sha256:...). Requires prior login with docker/login-action. If set, the SBOM is attached to the image in the registry.	no	""

name	description
sbom-path	Local path(s) of the generated SBOM file(s). Comma-separated when multiple formats are used.
sbom-url	Download URL(s) of the SBOM(s) on the GitHub Release. Comma-separated when multiple formats are used.
signature-bundle	Path(s) to the Cosign signature bundle(s). Comma-separated when multiple formats are used.