scf-public-goods-maintenance/PG Atlas SBOM Submission
Fetches the repo's SBOM from the GitHub Dependency Graph API and submits it to the PG Atlas ingestion endpoint, authenticated via GitHub OIDC. No secrets are shared.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| api-url | Base URL of the PG Atlas ingestion API. | no | https://api.pgatlas.xyz |
| submission-path | API endpoint for SBOM ingestion. | no | /ingest/sbom |
| dry-run | If true, fetch the SBOM and obtain the OIDC token, but skip the final submission. Useful for testing action setup without sending data. | no | false |
Outputs
| name | description |
|---|---|
| sbom-path | Path to the SBOM file that was fetched (SPDX 2.3 JSON). |