GitHub action to generate a CycloneDX SBOM for Go modules.

This action uses cyclonedx-gomod to generate SBOMs.

Required The version of cyclonedx-gomod to use. Can be a version range, in which case the latest version matching the range is chosen.

Must either be an existing semantic version (e.g. v0.8.1, 0.8.1), version range or latest.

⚠ Only versions >= v0.8.1 are supported. Specifying versions below that will cause the workflow to fail.

Using latest is generally not recommended and will produce a warning, as it may fail your workflow unexpectedly due to breaking changes in newer cyclonedx-gomod versions. As of v0.3.0, version ranges are supported. Instead of latest, consider using ^v0, ^v0.8 or similar instead.

Include Go standard library as component and dependency of the module. Default false.

Include test dependencies. Default false.

Output in JSON format. Default false.

Path to Go module. Default '.'.

Omit serial number. Default false.

Omit "v" version prefix. Default false.

Output path. Default '-' (stdout).

Make the SBOM reproducible by omitting dynamic content. Default false.

Resolve module licenses. Default false.

Type of the main component. Default 'application'.

- name: Generate SBOM JSON
  uses: CycloneDX/[email protected]
  with:
    json: true
    output: bom.json
    resolve-licenses: true
    version: ^v0

- name: Generate SBOM XML
  uses: CycloneDX/[email protected]
  with:
    output: bom.xml
    resolve-licenses: true
    version: latest