Automate SBOM Generation With Syft in CI Pipelines

Your CI pipeline ships code daily. Do you know exactly what is inside the container image? Most teams cannot answer that question without manual digging. An SBOM answers it automatically.

Why SBOMs Belong in the Pipeline

A Software Bill of Materials (SBOM) is a structured inventory of every package, library, and dependency in your artifact. It transforms vague assumptions into verifiable data. Regulators agree: the 2026 CISA attestation requirements and the EU Cyber Resilience Act both mandate SBOMs for critical software. Generating them at build time is the only scalable way to comply.

ℹ️

NoteSyft creates SBOMs in SPDX, CycloneDX, or Syft-native JSON. It scans container images, directories, and archives without installing into the target.

Add Syft to GitHub Actions

Install the Syft CLI in a workflow step, point it at your built image, and upload the result as an artifact. The following workflow runs on every push to main and tags the SBOM with the git SHA for traceability.

yaml

name: SBOM Generation
on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  sbom:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@v4
      - name: Build image
        run: docker build -t ghcr.io/${{ github.repository }}:${{ github.sha }} .
      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          image: ghcr.io/${{ github.repository }}:${{ github.sha }}
          format: cyclonedx-json
          output-file: sbom.cdx.json
      - name: Upload SBOM artifact
        uses: actions/upload-artifact@v4
        with:
          name: sbom-${{ github.sha }}
          path: sbom.cdx.json
          retention-days: 90
      - name: Attest SBOM
        uses: actions/attest-build-provenance@v1
        with:
          subject-path: sbom.cdx.json
          predicate-type: https://in-toto.io/attestation/sbom/v1

Sign and Verify the SBOM

An unsigned SBOM is a claim, not evidence. Use cosign to sign the generated file with keyless OIDC tokens. The attestation step above publishes a signed in-toto statement to the GitHub Actions transparency log. Downstream consumers verify it with cosign verify-attestation before admitting the image to staging.

bash

# Verify locally after download
cosign verify-attestation \
  --type https://in-toto.io/attestation/sbom/v1 \
  --certificate-identity-regexp '.*' \
  --certificate-oidc-issuer-regexp '.*' \
  ghcr.io/owner/repo@sha256:...

Feed the SBOM to Grype

Generation is half the job. Scanning the SBOM for vulnerabilities closes the loop. Grype reads CycloneDX or SPDX directly, so you skip re-scanning the filesystem. Add a second job that downloads the artifact and fails the build on critical findings.

yaml

scan:
    needs: sbom
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: sbom-${{ github.sha }}
      - name: Scan SBOM
        uses: anchore/grype-action@v1
        with:
          sbom: sbom.cdx.json
          fail-build: true
          severity-cutoff: critical

💡

TipStore SBOMs in Dependency-Track or a private OCI registry for long-term querying across fleets.

Automate Policy Enforcement

Hard failures on critical CVEs are a start. Mature teams define policy-as-code: allowlist specific CVE IDs with expiration dates, require fix versions for high-severity findings, and block licenses incompatible with distribution. Tools like Kyverno or OPA Gatekeeper enforce these policies at admission time in Kubernetes, using the same SBOM Grype just scanned.

✦

Next Steps

1. Add the workflow above to .github/workflows/sbom.yml.
2. Enable attestations: write permission on the repository.
3. Configure Grype severity thresholds to match your risk appetite.
4. Publish SBOMs to a central catalog for incident response teams.

"
An SBOM generated at build time is the only artifact that travels with the software from developer laptop to production cluster.
— Supply Chain Security Practitioner

Automate SBOM Generation With Syft in CI Pipelines

Why SBOMs Belong in the Pipeline

Add Syft to GitHub Actions

Sign and Verify the SBOM

Feed the SBOM to Grype

Automate Policy Enforcement

Next Steps

More Posts

GitHub Copilot Workspace Cuts PR Cycle Time 40 Percent

eBPF XDP Load Balancing Cuts Tail Latency 40 Percent

Apache Iceberg Time Travel Cuts Debug Cycles by 80%

Running WasmEdge on Raspberry Pi 5 for Edge AI

How Rustls Replaces OpenSSL in the Linux Kernel TLS Path

Run WASI 0.2 Components on Spin 3.0 for 40% Cold-Start Drop

YOLOv10 Reduces Edge Inference Latency by 40 Percent

Run AWS Lambda Functions on Kubernetes With KEDA Autoscaling

Reduce Zig Build Times 40% with Incremental Compilation

Vapor Smoothing ABS Parts With Desktop Acetone Chamber