Skip to content
play

GitHub Action

CycloneDX Node.js Generate SBOM

v1.0.3 Latest version

CycloneDX Node.js Generate SBOM

play

CycloneDX Node.js Generate SBOM

Github action to generate a CycloneDX BOM for Node.js projects

Installation

Copy and paste the following snippet into your .yml file.

 
              
- name: CycloneDX Node.js Generate SBOM

              
  uses: CycloneDX/[email protected]
Learn more about this action in CycloneDX/gh-node-module-generatebom

Choose a version

Note

This GitHub Action is considered deprecated.
Instead, you may use one of the following tools in your github workflow:

  • for NPM projects: @yclonedx/cyclonedx-npm 
    - name: Create SBOM step
  # see for usage: https://www.npmjs.com/package/%40cyclonedx/cyclonedx-npm
  run: npx @cyclonedx/cyclonedx-npm --help
  • for YARN projects: @cyclonedx/yarn-plugin-cyclonedx 
    - name: Create SBOM step
  # see for usage: https://www.npmjs.com/package/%40cyclonedx/yarn-plugin-cyclonedx
  run: yarn dlx -q @cyclonedx/yarn-plugin-cyclonedx --help
  • for PNPM projects: to be announced

For other Node.js related CycloneDX SBOM generators, see also: https://github.com/CycloneDX/cyclonedx-node-module/blob/master/README.md#out-of-scope

Website Slack Invite Group Discussion Twitter

GitHub action to generate a CycloneDX SBOM for Node.js

This GitHub action will create a a valid CycloneDX Software Bill-of-Materials (SBOM) containing an aggregate of all project dependencies. CycloneDX is a lightweight SBOM specification that is easily created, human and machine readable, and simple to parse.

This GitHub action requires a node_modules directory so this action will typically need to run after an npm build.

Inputs

path

The path to a Node.js project, default is "./"

Be sure to quote paths with spaces.

output

Output filename, default is "./bom.xml"

Be sure to quote paths with spaces.

Example simple usage

uses: CycloneDX/gh-node-module-generatebom@v1

Example step that defines the output and path (both are optional)

- name: Create SBOM step
  uses: CycloneDX/gh-node-module-generatebom@v1
  with:
    path: './node_project/'
    output: './bom_directory/test.app.bom.xml'

Complete Action with npm build and SBOM creation

name: Build javascript project
on: push
jobs:
  build:
    runs-on: ubuntu-latest
    name: Install and build javascript
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version: '16'
      - run: npm install
      - name: Create SBOM with CycloneDX
        uses: CycloneDX/gh-node-module-generatebom@v1
        with: 
          output: './test.app.bom.xml'

Internals

This action uses @cyclonedx/bom@<4. See @cyclonedx/bom in NPMjs.