TraceGuardDocs

Getting SBOMs in

How TraceGuard gets a Bill of Materials — GitHub-first, with CI and manual paths.

TraceGuard is import-first: the main way to add a project is to import a GitHub repository, and TraceGuard keeps its SBOM in sync automatically. Other paths exist for non-GitHub CI, built artifacts, and one-off files.

However a BOM arrives, it enters the same pipeline — ingest → parse → scan → findings — and TraceGuard accepts CycloneDX and SPDX across seven BOM types.

Connect GitHub once, then import repos

Install the TraceGuard GitHub App from Integrations → Connect GitHub (once per organization; you choose which repos it can see). Then importing a repo creates a project and links it — 1 project ↔ 1 repo. For a monorepo, import the same repo once per service, each with its own Root directory.

GitHub Enterprise. The GitHub App exists on github.com only. If your organization lives on GitHub Enterprise Cloud with data residency (yourcompany.ghe.com) or on your own GitHub Enterprise Server, register TraceGuard on that host first: Integrations → GitHub Enterprise → Register TraceGuard on this host. You are sent to your host, where an enterprise or organization owner confirms the App (read access to contents, metadata and pull requests; push, pull-request and release events). Back in TraceGuard the host shows App registered; click Install on your host to open the App's installations page on your host, install it for your organization and choose repositories, then come back and refresh: the installation appears under the host. Import repositories as usual. The host's App credentials are stored encrypted in TraceGuard; webhooks arrive on a URL dedicated to that host. Everything else — dependency graph, Syft, CI Action — works the same.

When you import, you pick an SBOM source:

Zero setup. TraceGuard reads the repository's GitHub dependency graph and refreshes it on push. Great default for getting coverage across many repos fast.

TraceGuard runs Syft against the repository for you (server-side) to generate a CycloneDX SBOM, refreshed on push. Use it when you want Syft's view without touching your CI.

Highest fidelity — runs in your pipeline, so it can scan built artifacts and container images with fully resolved versions. Create the project with source CI Action (or Start blank), generate a deploy token (Project settings → Integrations → Deploy tokens), and push from CI:

# .github/workflows/traceguard.yml
- uses: traceguard/sbom-action@v1
  with:
    token: ${{ secrets.TRACEGUARD_DEPLOY_TOKEN }}
    organization: org_xxxxxxxxxxxxxxxx
    project: 00000000-0000-0000-0000-000000000000
    # target: image:ghcr.io/acme/app:latest

Any CI works via a curl upload. See the GitHub SBOM Action reference.

Choose Start blank when creating a project, then upload a BOM file from the project's BOMs view. Useful for one-off analysis or BOMs produced outside CI (hardware, cryptography, AI/ML).

TraceGuard dedupes by content hash, so re-fetching or re-uploading an identical BOM is a no-op. Each version is tracked (tagged with the commit for Git sources), so you can diff versions over time.

What happens next

Parsing and scanning are automatic. Watch progress on the project's BOMs view, then head to Vulnerabilities & scanning.

On this page

Connect GitHub once, then import reposWhat happens next