shiftleftcyber/Secure SBOM Action
Sign and verify SBOMs & Digests using the SecureSBOM API
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| secure_sbom_signing_key_id | Preferred. Key ID used for signing or verifying. | yes | — |
| key_id | Deprecated. Use secure_sbom_signing_key_id instead. | no | — |
| secure_sbom_api_key | Preferred. API key for authenticating with the Secure SBOM API. | yes | — |
| api_key | Deprecated. Use secure_sbom_api_key instead. | no | — |
| secure_sbom_action | Action to perform. Supported values: sign_sbom - Sign an SBOM verify_sbom - Verify a signed SBOM sign_digest - Sign a base64-encoded SHA256 digest Aliases supported for backwards compatibility: sign verify | no | sign_sbom |
| action | Deprecated. Use secure_sbom_action instead. | no | — |
| sbom_file | Path to the SBOM file to sign or verify. Required for: sign_sbom verify_sbom sign verify | no | — |
| digest | Base64 encoded SHA256 digest of the raw hash. Required for: sign_digest Example: digest=$(openssl dgst -sha256 -binary sbom.json | base64) | no | — |
| digest_hash_algorithm | The hashing algorithm used to generate the digest. Required for: sign_digest Example: sha256 | — | — |
| secure_sbom_api_url | Optional Secure SBOM API base URL. Defaults to production. | no | — |
| api_url | Deprecated. Use secure_sbom_api_url instead. | no | — |
| secure_sbom_use_v1_api | Set to true to use v1 APIs instead of v2. | no | false |
Outputs
no outputs