systemslibrarian/dotnet-cbom
Generate a Cryptographic Bill of Materials (CBOM) for .NET code, upload SARIF, and gate on quantum risk.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| target | Path to a .sln/.slnx/.csproj, directory, or .cs file to scan. | no | . |
| formats | Comma-separated output formats: cyclonedx,sarif,markdown,html,summary. | no | cyclonedx,sarif,summary |
| output | Output directory for reports. | no | cbom-out |
| profile | Policy posture: general | federal | cnsa2 | audit | developer. | no | general |
| fail-on | Minimum risk level that fails the job: critical | high | medium | low | none. | no | high |
| baseline | Optional prior CBOM (cbom.cbom.json) to diff against; sets remediation status. | no | "" |
| config | Optional path to cbom.config.json. | no | "" |
| tool-version | Version of the PostQuantum.CryptographicBillOfMaterials.Cli global tool to install. | no | latest |
| upload-sarif | Upload the generated SARIF to GitHub code scanning. | no | true |
Outputs
| name | description |
|---|---|
| exit-code | The dotnet-cbom exit code (0 ok, 1 at/above fail-on, 2 partial, 3 usage, 4 internal). |