sbomify Action Configuration Reference

Configuration is done through environment variables, and they behave identically on every runtime. The GitHub Action declares only a handful of native inputs; everything else is passed via env: there, variables: in GitLab, and -e flags with plain Docker.

Action inputs (GitHub Actions only)

These are the only values passed with with: rather than env:. Each maps to the environment variable of the same name.

Monorepo gotcha: the workflow-level working-directory: setting has no effect on this action, because it runs in a container. Use the working-dir input instead.

Input source

Exactly one of these is required.

Output

Non-SBOM BOM_TYPE values are uploaded verbatim to sbomify: augmentation, enrichment, overrides, package injection and finalization fixups are all skipped, and Dependency Track and PRODUCT_RELEASE are rejected.

Processing

Uploading

Credential precedence is the --token flag, then SBOMIFY_TOKEN, then TOKEN. If no token is present on GitHub Actions and the workflow grants id-token: write, OIDC trusted publishing is used automatically.

Dependency Track

Required when dependency-track is in UPLOAD_DESTINATIONS. CycloneDX only - Dependency Track does not accept SPDX.

Caching and performance

GITHUB_TOKEN is worth calling out. License databases are downloaded from GitHub Releases, and unauthenticated requests are limited to 60 per hour per IP address. On shared CI runners that limit is often already exhausted, and when it is, enrichment degrades silently - you get an SBOM with fewer licenses populated and no hard error. This applies on every runtime, not just GitHub Actions. See license database rate limits.

Diagnostics and privacy

The action reports unhandled errors to Sentry unless you opt out. If your policy prohibits outbound diagnostics, set TELEMETRY=false or pass --no-telemetry. See telemetry and privacy.

Advanced

Deprecated

Still honoured, but they log a warning. Use the replacement.

Set automatically by CI

You do not set these. They are read from the environment to detect VCS information and, on GitHub Actions, to perform the OIDC exchange.

• GitHub Actions - GITHUB_REPOSITORY, GITHUB_SERVER_URL, GITHUB_SHA, GITHUB_REF, GITHUB_REF_NAME, GITHUB_WORKSPACE, GITHUB_RUN_ID, GITHUB_REPOSITORY_VISIBILITY, ACTIONS_ID_TOKEN_REQUEST_URL, ACTIONS_ID_TOKEN_REQUEST_TOKEN
• GitLab CI - CI_PROJECT_URL, CI_PROJECT_PATH, CI_SERVER_URL, CI_COMMIT_SHA, CI_COMMIT_REF_NAME, CI_PIPELINE_ID, CI_PROJECT_VISIBILITY
• Bitbucket - BITBUCKET_WORKSPACE, BITBUCKET_REPO_SLUG, BITBUCKET_COMMIT, BITBUCKET_BRANCH, BITBUCKET_TAG, BITBUCKET_GIT_HTTP_ORIGIN

The two OIDC request variables only exist when the workflow grants permissions: id-token: write.

CLI flags

Every variable has a matching flag when you invoke the CLI directly. Flags win over environment variables.

sbomify-action --lock-file requirements.txt --enrich --no-upload -o sbom.cdx.json

Subcommands