GitHub action to generate a CycloneDX SBOM for Go modules.

This action uses cyclonedx-gomod to generate SBOMs.

Include Go standard library as component and dependency of the module. Default false.

Include test dependencies. Default false.

Output in JSON format. Default false.

Path to Go module. Default '.'.

Omit serial number. Default false.

Omit "v" version prefix. Default false.

Output path. Default '-' (stdout).

Make the SBOM reproducible by omitting dynamic content. Default false.

Resolve module licenses. Default false.

Type of the main component. Default 'application'.

Required The version of cyclonedx-gomod to use.

- name: Generate SBOM JSON
  uses: CycloneDX/gh-gomod-generate-sbom@main
    with:
      json: true
      output: bom.json
      resolve-licenses: true
      version: 0.8.1

- name: Generate SBOM XML
  uses: CycloneDX/gh-gomod-generate-sbom@main
    with:
      output: bom.xml
      resolve-licenses: true
      version: 0.8.1