A GitHub Action for creating a software bill of materials (SBOM) using Syft.

- uses: anchore/sbom-action@v0

By default, this action will execute a Syft scan in the workspace directory and upload a workflow artifact SBOM in SPDX format. It will also detect if being run during a GitHub release and upload the SBOM as a release asset.

To scan a container image, use the image parameter:

- uses: anchore/sbom-action@v0
  with:
    image: ghcr.io/example/image_name:tag

The image will be fetched using the Docker daemon if available, which will use any authentication available to the daemon.

If the Docker daemon is not available, the action will retrieve the image directly from the container registry.

It is also possible to directly connect to the container registry with the registry-username and registry-password parameters. This will always bypass the Docker daemon:

- uses: anchore/sbom-action@v0
  with:
    image: my-registry.com/my/image
    registry-username: mr_awesome
    registry-password: ${{ secrets.REGISTRY_PASSWORD }}

Use the path parameter, relative to the repository root:

- uses: anchore/sbom-action@v0
  with:
    path: ./build/

Use the file parameter, relative to the repository root:

- uses: anchore/sbom-action@v0
  with:
    file: ./build/file

The sbom-action will detect being run during a GitHub release and automatically upload all SBOMs as release assets. However, it may be desirable to upload SBOMs generated with other tools or using Syft outside this action. To do this, use the anchore/sbom-action/publish-sbom sub-action and specify a regular expression with the sbom-artifact-match parameter:

- uses: anchore/sbom-action/publish-sbom@v0
  with:
    sbom-artifact-match: ".*\\.spdx$"

By default, this action will upload an artifact named <repo>-<job-name>[-<step-id|step-number>].<extension>, for example:

build-sbom:
  steps:
    - uses: anchore/sbom-action@v0
    - uses: anchore/sbom-action@v0
    - uses: anchore/sbom-action@v0
      id: myid

Will create 3 artifacts:

my-repo-build-sbom.spdx.json
my-repo-build-sbom-2.spdx.json
my-repo-build-sbom-myid.spdx.json

You may need to name these artifacts differently, simply use the artifact-name parameter:

- uses: anchore/sbom-action@v0
  with:
    artifact-name: sbom.spdx

The main SBOM action, responsible for generating SBOMs and uploading them as workflow artifacts and release assets.

A sub-action to upload multiple SBOMs to GitHub releases.

A sub-action to download Syft.

Output parameters:

cmd can be referenced in a workflow like other output parameters: ${{ steps.<step-id>.outputs.cmd }}

This action is tested on Windows, and should work natively on Windows hosts without WSL. (Note that it previously required WSL, but should now be run natively on Windows.)

This action makes extensive use of GitHub Action debug logging, which can be enabled as described here by setting a secret in your repository of ACTIONS_STEP_DEBUG to true.