Step-by-step guides for generating SBOMs across all major programming languages and platforms. New to SBOMs? Start with What is an SBOM? to learn the basics. For a complete list of SBOM tools, see our SBOM Resources page.
Language Guides
- Python - pip, Poetry, Pipenv, uv
- JavaScript - npm, yarn, pnpm, Bun
- Java - Maven, Gradle
- Go (Golang) - Go Modules
- Rust - Cargo
- Ruby - Bundler
- PHP - Composer
- .NET/C# - NuGet
- Swift - Swift Package Manager
- Dart/Flutter - pub
- Elixir - Mix
- Scala - sbt
- C/C++ - Conan
Platform Guides
- Docker/Containers
- Terraform
- Yocto - Embedded Linux
- Raspberry Pi - rpi-image-gen
- CI/CD Integration - Why SBOMs belong in your build pipeline
The sbomify Action
The sbomify action generates an SBOM from any of the lock files above, enriches it, and publishes it - in one step, on any CI platform.
- Full documentation - complete reference for generating SBOMs in any pipeline
- Quick start - Setup wizard and your first run
- Why SBOM quality matters - scanners versus pipelines, and signing at origin
- Configuration reference - Every option
- Runtimes - GitHub Actions, GitLab CI, Bitbucket, Jenkins, CircleCI, Travis CI, Azure DevOps, TeamCity and more
General Guides
Additional Resources
Looking for more tools and resources? Check out our SBOM Resources page for:
- SBOM generation tools (generic and language-specific)
- Assembly and enrichment tools
- Distribution and transportation solutions
- Analysis and vulnerability scanning tools
- Official SBOM documentation from CISA and NTIA