TraceGuardDocs

Getting SBOMs in

How TraceGuard gets a Bill of Materials — GitHub-first, with CI and manual paths.

TraceGuard is import-first: the main way to add a project is to import a GitHub repository, and TraceGuard keeps its SBOM in sync automatically. Other paths exist for non-GitHub CI, built artifacts, and one-off files.

However a BOM arrives, it enters the same pipeline — ingest → parse → scan → findings — and TraceGuard accepts CycloneDX and SPDX across seven BOM types.

Connect GitHub once, then import repos

Install the TraceGuard GitHub App from Integrations → Connect GitHub (once per organization; you choose which repos it can see). Then importing a repo creates a project and links it — 1 project ↔ 1 repo. For a monorepo, import the same repo once per service, each with its own Root directory.

When you import, you pick an SBOM source:

Zero setup. TraceGuard reads the repository's GitHub dependency graph and refreshes it on push. Great default for getting coverage across many repos fast.

TraceGuard runs Syft against the repository for you (server-side) to generate a CycloneDX SBOM, refreshed on push. Use it when you want Syft's view without touching your CI.

Highest fidelity — runs in your pipeline, so it can scan built artifacts and container images with fully resolved versions. Create the project with source CI Action (or Start blank), generate a deploy token (Project settings → Integrations → Deploy tokens), and push from CI:

# .github/workflows/traceguard.yml
- uses: traceguard/sbom-action@v1
  with:
    token: ${{ secrets.TRACEGUARD_DEPLOY_TOKEN }}
    organization: org_xxxxxxxxxxxxxxxx
    project: 00000000-0000-0000-0000-000000000000
    # target: image:ghcr.io/acme/app:latest

Any CI works via a curl upload. See the GitHub SBOM Action reference.

Choose Start blank when creating a project, then upload a BOM file from the project's BOMs view. Useful for one-off analysis or BOMs produced outside CI (hardware, cryptography, AI/ML).

TraceGuard dedupes by content hash, so re-fetching or re-uploading an identical BOM is a no-op. Each version is tracked (tagged with the commit for Git sources), so you can diff versions over time.

What happens next

Parsing and scanning are automatic. Watch progress on the project's BOMs view, then head to Vulnerabilities & scanning.

On this page

Connect GitHub once, then import reposWhat happens next