sbomify/sbomify
A GitHub Action to upload an SBOM CycloneDX or SPDX to sbomify
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| working-dir | Working directory, relative to repo root or absolute (must be under $GITHUB_WORKSPACE). Example: packages/my-app | no | "" |
| component-purl | Override the component PURL in the SBOM (e.g., pkg:npm/@scope/name@1.0.0) | no | — |
| bom-type | Artifact type to record on upload: sbom (default), vex, cbom or hbom. Only the sbomify destination supports non-SBOM types; other upload-destinations entries are rejected for them. Non-SBOM types are uploaded verbatim: augmentation, enrichment, overrides, additional-package injection and the SBOM-specific finalization fixups are skipped. | no | sbom |
| oidc-audience | OIDC audience for trusted publishing (default: sbomify.com; override for self-hosted) | no | — |
Outputs
no outputs