sbomify

Version updated for https://github.com/sbomify/sbomify-action to version v26.2.0.

  • This action is used across all versions by 26 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The sbomify-action GitHub Action automates the generation, enrichment, and management of Software Bill of Materials (SBOMs) within CI/CD pipelines. It supports multiple SBOM formats (CycloneDX, SPDX) and sources (e.g., lockfiles, Docker images), while also enhancing SBOMs with metadata such as licenses, authors, and dependencies. By enabling cryptographic signing, attestation, and integration with tools like sbomify, the action helps ensure a secure and verifiable software supply chain.

What’s Changed

Highlights

  • BSI TR-03183-2 compliance: derive §5.2.2 boolean properties, declared licences, CI lifecycle phase, and add manufacturer/filename/compositions for BSI-aligned SBOMs (#210, #220).
  • PyPI enrichment: per-component hashes plus release-date and yanked CLE enrichment (#220).
  • Chainguard base image detection: reuse SBOMs published by Chainguard when building container images (#221, #224).
  • NTIA minimum-elements fixes: add PURL to root component when missing, and correct SPDX 2.x root package detection via documentDescribes (#207, #217).
  • License expression handling: move compound SPDX expressions from license.id to the expression field, unblocking validators that reject compound IDs (#213).
  • Dependency graph integrity: update bom-ref via value mutation and sync dependencies when component versions are overridden (#206).
  • Security: bump lxml, cryptography, pytest, pygments for vulnerability fixes (#223).

What’s Changed

Full Changelog: https://github.com/sbomify/sbomify-action/compare/v26.1.0...v26.2.0