sbomify

Version updated for https://github.com/sbomify/sbomify-action to version v26.7.0.

  • This action is used across all versions by 26 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The GitHub Action sbomify-action is designed to automate the creation, enrichment, and management of Software Bill of Materials (SBOMs) in CI/CD pipelines. It supports various ecosystems including Python, Node.js, Rust, Go, Ruby, Dart, C++, and Docker images, and can generate CycloneDX or SPDX SBOM formats. The action can also leverage Chainguard base images for efficient SBOM creation, enhancing the process with additional metadata from package registries.

What’s Changed

Highlights

  • Interactive setup wizard: a new Textual TUI (sbomify-action wizard, bundled in the Docker image) that scans your repo for lockfiles, signs you in to sbomify, registers matching components, and writes a release-ready .github/workflows/sboms.yml — with --dry-run support (#238, #240). Follow-ups add responsive terminal layouts, truecolor in Docker, per-ecosystem lockfile discovery, SHA-pinned action refs, and CalVer-aware tag dispatch (#247–#283).
  • OIDC trusted publishing: authenticate uploads to sbomify with GitHub OIDC instead of long-lived tokens, and let the wizard auto-register the trusted publisher during apply (#235, #242).
  • VEX, CBOM, and HBOM uploads: new BOM_TYPE setting uploads non-SBOM artifacts verbatim, accepting CycloneDX VEX, OpenVEX, and CSAF documents (#255, #265).
  • Multi-arch Docker images: amd64 + arm64 images built natively per architecture, with ghcr.io as the primary registry and Docker Hub as the mirror (#226, #248, #275).
  • Stricter failure semantics: post-upload processor errors and partial product-release tagging failures now fail the run instead of passing silently (#261, #272).
  • Dependency-Track: expose the missing upload options (#230) — thanks @Erik-Hoffmann for the first-time contribution!
  • Enrichment & generation fixes: preserve versionless PURLs during enrichment (#229), drop --required-only for Go in cdxgen (#234), and get-or-create components on duplicate names (#236).
  • Supply-chain hygiene: OpenGrep SAST in CI (#246), security patches for idna/urllib3/pip (#241), and bumped bundled SBOM tools (#274).

What’s Changed

New Contributors

Full Changelog: https://github.com/sbomify/sbomify-action/compare/v26.2.0...v26.7.0