A software bill of materials (SBOM) is a structured inventory of the components and dependencies contained in a software product. It supports delivery integrity by making the files and artifacts used in a workflow traceable and resistant to unnoticed alteration. section 8.5.2
Use an SBOM to strengthen artifact preparation and release workflows:
- Generate it during the workflow that prepares software artifacts, rather than relying only on a manual or user-interface operation. section 8.5.2
- Create it with a GitHub Action or an available marketplace action, then retain it with the release as an artifact. section 8.5.2
- Choose and recognize the interchange format: SPDX is used by Microsoft and GitHub, while CycloneDX is another competing standard. section 8.5.2
- Treat the SBOM as one layer in broader supply-chain security alongside dependency vulnerability alerts, secret scanning, and code analysis. section 1.1
Generate an SBOM before deployment
A workflow can download and run Microsoft's SBOM tool against the build output, supplying package name, version, publisher, namespace, and verbose output settings. The resulting SPDX-compatible inventory can then be uploaded as part of the release. section 8.5.2
Listing 8.7 Generating an SBOM using the Microsoft SBOM tool
name: Generate SBOM
run: |
curl -Lo $RUNNER_TEMP/sbom-tool https://github.com/microsoft/sbom-tool/releases/latest/download/sbom-tool-linux-x64
chmod +x $RUNNER_TEMP/sbom-tool
$RUNNER_TEMP/sbom-tool generate -b ./buildOutput -bc . -pn Test -pv 1.0.0 -ps mycompany -nsb https://sbom.mycompany.com -V Verbose
Inspect the complete command sequence for downloading Microsoft's SBOM tool and generating an inventory from buildOutput. section 8.5.2
