sbomlyze
v0.5.3 GitHub ★ 24
Reference

SBOMlyze GitHub Action

Compares an SBOM in the checked-out pull request or commit with a baseline from git, the latest GitHub release, a successful default-branch workflow artifact, an explicit HTTPS URL, or a local workspace file. It does not run an SBOM generator or execute repository-provided commands.

Recommended workflow

Pin all Actions to full commit SHAs. The SHA below is the published v0.5.3 Action; the binary version defaults to the same release.

.github/workflows/sbom-review.yml
name: SBOM review

on:
  pull_request:

permissions:
  contents: read
  security-events: write

jobs:
  sbom-diff:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      # Generate or commit the head SBOM in a separate, reviewed step.
      # SBOMlyze deliberately does not accept or execute generator commands.
      - id: sbomlyze
        uses: rezmoss/sbomlyze@db9182a06acbc58a66143978765f096a576f1f9c # v0.5.3
        with:
          sbom-path: build/sbom.cdx.json
          policy: .github/sbom-policy.json
          fail-on: policy
          sarif: true

      - uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
        if: always() && steps.sbomlyze.outputs.report-sarif != ''
        with:
          sarif_file: ${{ steps.sbomlyze.outputs.report-sarif }}

Remove security-events: write, sarif: true, and the upload step if SARIF is not required. Forked pull requests may not receive permission to upload SARIF; the Job Summary remains available.

Inputs

InputRequiredDefaultMeaning
sbom-pathyes—Repository-relative head SBOM path.
base-sbom-pathnosbom-pathDifferent repository-relative path at the baseline revision.
baselinenogitgit, release, workflow-artifact, url, or file.
baseline-repositorynocurrent repoOWNER/REPO for release or artifact lookup.
baseline-assetfor release—Exact asset name in the latest non-draft, non-prerelease release.
baseline-artifactfor artifact—Exact artifact name from the newest successful default-branch run containing it.
baseline-artifact-pathnobase-sbom-pathExact SBOM path inside the artifact ZIP.
baseline-urlfor url—Public HTTPS URL; credentials and the GitHub token are never forwarded.
baseline-pathnobase-sbom-pathRepository-relative workspace file used by baseline: file.
policyno—Repository-relative SBOMlyze JSON policy.
commentnofalseCreate or update one pull-request comment.
github-tokennogithub.tokenToken used for provenance, comments, release assets, and workflow artifacts.
sarifnofalseGenerate report-sarif.
fail-onnopolicypolicy, integrity-drift, any-change, or never.
versionnov0.5.3Exact binary release; floating values such as latest are rejected.

Baseline providers

Five ways to answer “what should this build be compared against?”

baseline: git
Pull-request base
The default. Reads base-sbom-path directly from the pull request base SHA without checking out or executing base-branch code. Use fetch-depth: 0.
baseline: release
Latest GitHub release
Excludes drafts and prereleases. No release is treated as a visible first run; a latest release missing the exact asset name fails as a configuration error.
baseline: workflow-artifact
Default-branch artifact
Newest successful default-branch run, pull-request runs excluded, expired artifacts ignored, and only the exact requested file extracted. Unsafe ZIP entries fail closed.
baseline: url
Explicit HTTPS URL
Rejects HTTP, credentials, non-default ports, private addresses, unsafe redirects, and responses above 50 MiB.
baseline: file
Local workspace file
A file produced or downloaded by an earlier reviewed step, with the same traversal, symlink-escape, and size checks.

Outputs

verdict
pass or fail.
added-count · removed-count · changed-count
Decimal string counts from the diff.
integrity-drift-count
Components whose hash changed without a version change.
report-json · report-markdown · report-sarif
Absolute runner paths, so later steps upload full reports without hitting workflow-output size limits. report-sarif is empty unless sarif: true.

Outputs and the Job Summary are written before a configured gate fails, so use if: always() when consuming reports from a later step.

Security behaviour

SBOM, policy, and baseline paths must stay inside the repository; absolute paths, traversal, symlink escape, and unsafe archive entries are rejected.
Head, baseline, and policy files are limited to 50 MiB, with separate bounded limits on output, downloads, comments, and summaries.
The release archive and checksums.txt are downloaded only over HTTPS from GitHub release hosts. SHA-256 is mandatory before extraction.
When gh attestation verify is available, provenance from the release workflow is mandatory; without gh, the Action warns after checksum verification.
Inputs are passed to git, tar, gh, and SBOMlyze as process argument arrays. No input is interpolated into a shell command.
Git baselines are read with git cat-file and git show; the Action never checks out baseline code.
GitHub tokens are sent only to api.github.com and are removed on redirects. URL baselines never receive the token.
Parsing uses strict mode. Malformed and oversized inputs fail closed.