{"id":15099307,"url":"https://github.com/actions/attest-sbom","last_synced_at":"2025-10-19T17:30:37.892Z","repository":{"id":236372252,"uuid":"760703431","full_name":"actions/attest-sbom","owner":"actions","description":"Action for generating SBOM attestations for workflow artifacts","archived":false,"fork":false,"pushed_at":"2024-09-30T15:40:28.000Z","size":1928,"stargazers_count":19,"open_issues_count":3,"forks_count":4,"subscribers_count":2,"default_branch":"main","last_synced_at":"2024-10-02T06:43:16.196Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/actions.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-02-20T19:28:16.000Z","updated_at":"2024-09-23T15:55:39.000Z","dependencies_parsed_at":"2024-05-20T20:56:49.229Z","dependency_job_id":"f7f22f89-e840-43f6-8c4f-120d4a6c5bc3","html_url":"https://github.com/actions/attest-sbom","commit_stats":null,"previous_names":["actions/attest-sbom"],"tags_count":16,"template":false,"template_full_name":"actions/typescript-action","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Fattest-sbom","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Fattest-sbom/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Fattest-sbom/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Fattest-sbom/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/actions","download_url":"https://codeload.github.com/actions/attest-sbom/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":219869264,"owners_count":16555575,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-09-25T17:09:56.083Z","updated_at":"2025-10-19T17:30:37.885Z","avatar_url":"https://github.com/actions.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# `actions/attest-sbom`\n\nGenerate signed SBOM attestations for workflow artifacts. Internally powered by\nthe [@actions/attest][1] package.\n\nAttestations bind some subject (a named artifact along with its digest) to a a\nSoftware Bill of Materials (SBOM) using the [in-toto][2] format. The action\naccepts SBOMs which have been generated by external tools. Provided SBOMs must\nbe in either the [SPDX][4] or [CycloneDX][5] JSON-serialized format.\n\nA verifiable signature is generated for the attestation using a short-lived\n[Sigstore][6]-issued signing certificate. If the repository initiating the\nGitHub Actions workflow is public, the public-good instance of Sigstore will be\nused to generate the attestation signature. If the repository is\nprivate/internal, it will use the GitHub private Sigstore instance.\n\nOnce the attestation has been created and signed, it will be uploaded to the GH\nattestations API and associated with the repository from which the workflow was\ninitiated.\n\nAttestations can be verified using the [`attestation` command in the GitHub\nCLI][7].\n\nSee [Using artifact attestations to establish provenance for builds][11] for\nmore information on artifact attestations.\n\n\u003c!-- prettier-ignore-start --\u003e\n\u003e [!NOTE]\n\u003e Artifact attestations are available in public repositories for all\n\u003e current GitHub plans. They are not available on legacy plans, such as Bronze,\n\u003e Silver, or Gold. If you are on a GitHub Free, GitHub Pro, or GitHub Team plan,\n\u003e artifact attestations are only available for public repositories. To use\n\u003e artifact attestations in private or internal repositories, you must be on a\n\u003e GitHub Enterprise Cloud plan.\n\u003c!-- prettier-ignore-end --\u003e\n\n## Usage\n\nWithin the GitHub Actions workflow which builds some artifact you would like to\nattest:\n\n1. Ensure that the following permissions are set:\n\n   ```yaml\n   permissions:\n     id-token: write\n     attestations: write\n   ```\n\n   The `id-token` permission gives the action the ability to mint the OIDC token\n   necessary to request a Sigstore signing certificate. The `attestations`\n   permission is necessary to persist the attestation.\n\n1. Add the following to your workflow after your artifact has been built and\n   your SBOM has been generated:\n\n   ```yaml\n   - uses: actions/attest-sbom@v3\n     with:\n       subject-path: '\u003cPATH TO ARTIFACT\u003e'\n       sbom-path: '\u003cPATH TO SBOM\u003e'\n   ```\n\n   The `subject-path` parameter should identify the artifact for which you want\n   to generate an SBOM attestation. The `sbom-path` parameter should identify\n   the SBOM document to be associated with the subject.\n\n### Inputs\n\nSee [action.yml](action.yml)\n\n```yaml\n- uses: actions/attest-sbom@v3\n  with:\n    # Path to the artifact serving as the subject of the attestation. Must\n    # specify exactly one of \"subject-path\", \"subject-digest\", or\n    # \"subject-checksums\". May contain a glob pattern or list of paths\n    # (total subject count cannot exceed 1024).\n    subject-path:\n\n    # SHA256 digest of the subject for the attestation. Must be in the form\n    # \"sha256:hex_digest\" (e.g. \"sha256:abc123...\"). Must specify exactly one\n    # of \"subject-path\", \"subject-digest\", or \"subject-checksums\".\n    subject-digest:\n\n    # Subject name as it should appear in the attestation. Required when\n    # identifying the subject with the \"subject-digest\" input.\n    subject-name:\n\n    # Path to checksums file containing digest and name of subjects for\n    # attestation. Must specify exactly one of \"subject-path\", \"subject-digest\",\n    # or \"subject-checksums\".\n    subject-checksums:\n\n    # Path to the JSON-formatted SBOM file to attest. File size cannot exceed\n    # 16MB.\n    sbom-path:\n\n    # Whether to push the attestation to the image registry. Requires that the\n    # \"subject-name\" parameter specify the fully-qualified image name and that\n    # the \"subject-digest\" parameter be specified. Defaults to false.\n    push-to-registry:\n\n    # Whether to attach a list of generated attestations to the workflow run\n    # summary page. Defaults to true.\n    show-summary:\n\n    # The GitHub token used to make authenticated API requests. Default is\n    # ${{ github.token }}\n    github-token:\n```\n\n### Outputs\n\n\u003c!-- markdownlint-disable MD013 --\u003e\n\n| Name              | Description                                                    | Example                                          |\n| ----------------- | -------------------------------------------------------------- | ------------------------------------------------ |\n| `attestation-id`  | GitHub ID for the attestation                                  | `123456`                                         |\n| `attestation-url` | URL for the attestation summary                                | `https://github.com/foo/bar/attestations/123456` |\n| `bundle-path`     | Absolute path to the file containing the generated attestation | `/tmp/attestation.json`                          |\n\n\u003c!-- markdownlint-enable MD013 --\u003e\n\nAttestations are saved in the JSON-serialized [Sigstore bundle][8] format.\n\nIf multiple subjects are being attested at the same time, a single attestation\nwill be created with references to each of the supplied subjects.\n\nThe absolute path to the generated attestation is appended to the file\n`${RUNNER_TEMP}/created_attestation_paths.txt`. This file will accumulate the\npaths to all attestations created over the course of a single workflow.\n\n## Attestation Limits\n\n### Subject Limits\n\nNo more than 1024 subjects can be attested at the same time.\n\n### SBOM Limits\n\nThe SBOM supplied via the `sbom-path` input cannot exceed 16MB.\n\n## Examples\n\n### Identify Subject and SBOM by Path\n\nFor the basic use case, simply add the `attest-sbom` action to your workflow and\nsupply the path to the artifact and SBOM for which you want to generate\nattestation.\n\n```yaml\nname: build-attest\n\non:\n  workflow_dispatch:\n\njobs:\n  build:\n    runs-on: ubuntu-latest\n    permissions:\n      id-token: write\n      contents: read\n      attestations: write\n\n    steps:\n      - name: Checkout\n        uses: actions/checkout@v4\n      - name: Build artifact\n        run: make my-app\n      - name: Generate SBOM\n        uses: anchore/sbom-action@v0\n        with:\n          format: 'spdx-json'\n          output-file: 'sbom.spdx.json'\n      - name: Attest\n        uses: actions/attest-sbom@v3\n        with:\n          subject-path: '${{ github.workspace }}/my-app'\n          sbom-path: 'sbom.spdx.json'\n```\n\n### Identify Multiple Subjects\n\nIf you are generating multiple artifacts, you can attest all of them at the same\ntime by using a wildcard in the `subject-path` input.\n\n```yaml\n- uses: actions/attest-sbom@v3\n  with:\n    subject-path: 'dist/**/my-bin-*'\n    sbom-path: '${{ github.workspace }}/my-bin.sbom.spdx.json'\n```\n\nFor supported wildcards along with behavior and documentation, see\n[@actions/glob][10] which is used internally to search for files.\n\nAlternatively, you can explicitly list multiple subjects with either a comma or\nnewline delimited list:\n\n```yaml\n- uses: actions/attest-sbom@v3\n  with:\n    subject-path: 'dist/foo, dist/bar'\n```\n\n```yaml\n- uses: actions/attest-sbom@v3\n  with:\n    subject-path: |\n      dist/foo\n      dist/bar\n```\n\n### Identify Subjects with Checksums File\n\nIf you are using tools like\n[goreleaser](https://goreleaser.com/customization/checksum/) or\n[jreleaser](https://jreleaser.org/guide/latest/reference/checksum.html) which\ngenerate a checksums file you can identify the attestation subjects by passing\nthe path of the checksums file to the `subject-checksums` input. Each of the\nartifacts identified in the checksums file will be listed as a subject for the\nattestation.\n\n```yaml\n- name: Calculate artifact digests\n  run: |\n    shasum -a 256 foo_0.0.1_* \u003e subject.checksums.txt\n- uses: actions/attest-sbom@v3\n  with:\n    subject-checksums: subject.checksums.txt\n    sbom-path: sbom.spdx.json\n```\n\n\u003c!-- markdownlint-disable MD038 --\u003e\n\nThe file referenced by the `subject-checksums` input must conform to the same\nformat used by the shasum tools. Each subject should be listed on a separate\nline including the hex-encoded digest (either SHA256 or SHA512), a space, a\nsingle character flag indicating either binary (`*`) or text (` `) input mode,\nand the filename.\n\n\u003c!-- markdownlint-enable MD038 --\u003e\n\n```text\nb569bf992b287f55d78bf8ee476497e9b7e9d2bf1c338860bfb905016218c740  foo_0.0.1_darwin_amd64\na54fc515e616cac7fcf11a49d5c5ec9ec315948a5935c1e11dd610b834b14dde  foo_0.0.1_darwin_arm64\n```\n\n### Container Image\n\nWhen working with container images you can invoke the action with the\n`subject-name` and `subject-digest` inputs.\n\nIf you want to publish the attestation to the container registry with the\n`push-to-registry` option, it is important that the `subject-name` specify the\nfully-qualified image name (e.g. \"ghcr.io/user/app\" or\n\"acme.azurecr.io/user/app\"). Do NOT include a tag as part of the image name --\nthe specific image being attested is identified by the supplied digest.\n\n\u003e **NOTE**: When pushing to Docker Hub, please use \"index.docker.io\" as the\n\u003e registry portion of the image name.\n\n```yaml\nname: build-attested-image\n\non:\n  push:\n    branches: [main]\n\njobs:\n  build:\n    runs-on: ubuntu-latest\n    permissions:\n      id-token: write\n      packages: write\n      contents: read\n      attestations: write\n    env:\n      REGISTRY: ghcr.io\n      IMAGE_NAME: ${{ github.repository }}\n\n    steps:\n      - name: Checkout\n        uses: actions/checkout@v4\n      - name: Login to GitHub Container Registry\n        uses: docker/login-action@v3\n        with:\n          registry: ${{ env.REGISTRY }}\n          username: ${{ github.actor }}\n          password: ${{ secrets.GITHUB_TOKEN }}\n      - name: Build and push image\n        id: push\n        uses: docker/build-push-action@v5.0.0\n        with:\n          context: .\n          push: true\n          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest\n      - name: Generate SBOM\n        uses: anchore/sbom-action@v0\n        with:\n          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest\n          format: 'cyclonedx-json'\n          output-file: 'sbom.cyclonedx.json'\n      - name: Attest\n        uses: actions/attest-sbom@v3\n        id: attest\n        with:\n          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}\n          subject-digest: ${{ steps.push.outputs.digest }}\n          sbom-path: 'sbom.cyclonedx.json'\n          push-to-registry: true\n```\n\n[1]: https://github.com/actions/toolkit/tree/main/packages/attest\n[2]: https://github.com/in-toto/attestation/tree/main/spec/v1\n[4]: https://spdx.dev/\n[5]: https://cyclonedx.org/\n[6]: https://www.sigstore.dev/\n[7]: https://cli.github.com/manual/gh_attestation_verify\n[8]:\n  https://github.com/sigstore/protobuf-specs/blob/main/protos/sigstore_bundle.proto\n[10]: https://github.com/actions/toolkit/tree/main/packages/glob#patterns\n[11]:\n  https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Factions%2Fattest-sbom","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Factions%2Fattest-sbom","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Factions%2Fattest-sbom/lists"}