The SBOM Generation plugin scans dependencies and supports component inventories in SPDX, CycloneDX, and SWID formats. By default it scans components added or changed in version by the PR. To generate a complete SBOM, set scanMode: full and publish: true. The plugin runs no risk gate.

Usage in CNB

Add the following configuration to .cnb.yml at the root of your repository to generate a complete SBOM on push and upload the report attachment:

.cnb.yml

main:
  push:
    - stages:
        - name: Generate complete SBOM
          image: cnbcool/sca-sbom:latest
          timeout: 30m
          settings:
            scanMode: full
            publish: true

This configuration generates an SPDX report attachment by default. For CycloneDX JSON, set format: cyclonedx-json.

The following example scans components added or changed in version by the PR. By default, no report attachment is generated or uploaded:

.cnb.yml

main:
  pull_request.target:
    - stages:
        - name: Scan component changes
          image: cnbcool/sca-sbom:latest
          timeout: 30m

Difference between pull_request and pull_request.target

For detailed differences, please refer to Code Version Selection.

Parameters

Plugin parameters are passed through settings:

Parameter	Description	Default
scanMode	Scan mode: diff for PR component changes, full for all components of the current CNB_COMMIT	diff
format	Report format; see the table below	spdx
publish	Whether to generate and upload report attachments; uploading requires a trusted event	false

format	Suffix	Format
spdx	.spdx	SPDX 2.3 Tag-Value
spdx-json	.spdx.json	SPDX 2.3 JSON
cyclonedx-json	.cyclonedx.json	CycloneDX JSON
cyclonedx-xml	.cyclonedx.xml	CycloneDX XML
swid	.swid.xml	SWID XML

See Scan modes and Report attachments for shared behavior.

Output

With publish: true, the plugin generates a report attachment named security-sbom-<scanMode>-<commit>.<ext>, available from the Commit details page.

• diff: added components and components whose versions changed, using their versions after the change; removed components are excluded.
• full: all components of the current Commit.

Use full when you need a complete inventory; an incremental report cannot replace a complete SBOM.

Commit metadata

The plugin writes the component count and result status to the annotations of the publish target Commit:

sca.sbom.full.reporter=https://...
sca.sbom.full.gate=pass
sca.sbom.full.total.count=128

total.count is the number of components in the scan: changed components in incremental mode, all components in full mode. gate is always pass; see Commit metadata for other fields.

Exit codes

Exit code	Description
0	Scan succeeded, including when no components changed
2	Configuration error or scan failure; with publish: true, failure to publish the attachment or metadata

Next steps

• Overview — overall configuration and gates for the three plugins
• Open-Source Component Vulnerability Scan — vulnerability gate and incremental rules
• License Scan — License risk gate

Previous pageLicense Scan