TraceGuardDocs

GitHub SBOM Action

Generate a CycloneDX SBOM with Syft and upload it from CI.

The traceguard/sbom-action composite action generates a CycloneDX SBOM with Syft and uploads it to TraceGuard, which parses and scans it automatically. Because it runs in your pipeline, it's the highest-fidelity source — it can scan built artifacts and container images with fully resolved versions.

Usage

# .github/workflows/traceguard.yml
name: TraceGuard SBOM
on:
  push:
    branches: [main]

jobs:
  sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: traceguard/sbom-action@v1
        with:
          token: ${{ secrets.TRACEGUARD_DEPLOY_TOKEN }}
          organization: org_xxxxxxxxxxxxxxxx
          project: 00000000-0000-0000-0000-000000000000
          # target: image:ghcr.io/acme/app:latest   # or a built container image
          # bom-type: sbom

Inputs

InputRequiredDefaultDescription
tokenyes—Project deploy token (tgd_…). Store as an encrypted secret.
organizationyes—Organization id (org_…).
projectyes—Project id (uuid).
targetno.Directory to scan, or image:<ref> for a built container image.
bom-typenosbomBOM bucket: sbom, hbom, cbom, saas_bom, ai_bom, ml_bom, obom.
api-urlnohttps://app.traceguard.ioAPI base URL.
syft-versionnolatestPin a Syft version (e.g. 1.18.0).

How it works

  1. Installs Syft.
  2. Runs syft <target> -o cyclonedx-json to produce a CycloneDX SBOM.
  3. POSTs it to the project's sboms endpoint with the deploy token, source_type=ci, and the commit SHA as source_ref.
  4. TraceGuard dedupes by content, parses, and scans automatically — results land on the project's BOMs view, tagged with the commit.

The Action is one of several ways to get SBOMs in. For zero-config coverage, use GitHub sync; for non-GitHub CI, POST with a deploy token. See Getting SBOMs in.

On this page

UsageInputsHow it works