Exporting a software bill of materials for your repository

You can export a software bill of materials or SBOM for your repository from the dependency graph. SBOMs allow transparency into your open source usage and help expose supply chain vulnerabilities, reducing supply chain risks.

Who can use this feature?

Anyone on GitHub

In this article

You can export the current state of the dependency graph for your repository as a software bill of materials (SBOM) using the industry standard SPDX format.

SBOMs include an inventory of a project's dependencies and associated information such as versions, package identifiers, licenses, transitive paths, and copyright information. SBOMs do not include dependents (other projects that rely on your project).

Exporting a software bill of materials for your repository from the UI

  1. On GitHub, navigate to the main page of the repository.

  2. Under your repository name, click Insights.

    Screenshot of the main page of a repository. In the horizontal navigation bar, a tab, labeled with a graph icon and "Insights," is outlined in orange.

  3. In the left sidebar, click Dependency graph.

  4. On the top right side of the Dependencies tab, click Export SBOM to generate an SBOM file for download from your browser.

Exporting a software bill of materials for your repository using the REST API

To export an SBOM for your repository using the REST API:

  1. Request generation of the SBOM. See REST API endpoints for software bill of materials (SBOM).
  2. Poll the returned sbom_url while the response is 202. When the response is 302, follow the redirect to download the completed SBOM. See REST API endpoints for software bill of materials (SBOM).

Generating a software bill of materials from GitHub Actions

The following actions will generate an SBOM for your repository and attach it as a workflow artifact which you can download and use in other applications. For more information about downloading workflow artifacts, see Downloading workflow artifacts.

ActionDetails
SPDX Dependency Submission ActionUses Microsoft's SBOM Tool to create SPDX 2.2 compatible SBOMs with the supported ecosystems
Anchore SBOM ActionUses Syft to create SPDX 2.2 compatible SBOMs with the supported ecosystems
SBOM Dependency Submission ActionUploads a CycloneDX SBOM to the dependency submission API