runtimeadmin/SBOMix SBOM Generator

Generate CycloneDX 1.6 + SPDX 2.3 SBOMs from your project. Fast, accurate, zero-config.

Trust Signals

name	description	required	default
directory	Directory to scan (default: repo root)	no	.
format	Output format: both \| cyclonedx \| spdx	no	both
aibom-format	AI-BOM output format: json \| yaml	no	json
output-dir	Directory to write SBOM files	no	sbom
fail-on-critical	Exit with code 1 if critical vulnerabilities are found	no	true
upload-artifact	Upload SBOMs as GitHub Actions artifacts (90-day retention)	no	true
skip-vulns	Skip OSV vulnerability enrichment (faster, no network required)	no	false
profile	Report profile: crypto-agent — adds an Agent Trust Report (MCP tool surface, signing surface, known-bad match) for deployments that hold signing keys	no	""
cra	CRA readiness — set to "true" to add an EU Cyber Resilience Act evidence & gap report (cra-report.json)	no	""
api-url	SBOMix central API endpoint — push SBOMs for org-wide tracking	no	""
api-key	SBOMix API key — use secrets.SBOMIX_API_KEY	no	""

name	description
cyclonedx-path	Path to generated CycloneDX 1.6 BOM
spdx-path	Path to generated SPDX 2.3 BOM
aibom-path	Path to generated AI-BOM (only present when AI/ML components are detected)
component-count	Total components enumerated
vulnerability-count	Total known vulnerabilities (via OSV)
critical-count	Critical severity vulnerabilities (CVSS >= 9.0)
quality-score	SBOM completeness score 0-100
ai-model-count	Number of AI/ML model components detected
ai-threat-count	Number of AI/ML threats detected
agent-trust-report-json-path	Path to the Agent Trust Report JSON manifest (only present with profile: crypto-agent)
agent-trust-report-html-path	Path to the Agent Trust Report HTML (only present with profile: crypto-agent)