{"id":26187757,"url":"https://github.com/shiftleftcyber/cyclonedx-bitbucket-pipe","last_synced_at":"2026-04-21T15:32:32.555Z","repository":{"id":222109322,"uuid":"755070872","full_name":"shiftleftcyber/cyclonedx-bitbucket-pipe","owner":"shiftleftcyber","description":"Bitbucket pipe to generate a CycloneDX sBOM for Java, Go, Python \u0026 Node projects","archived":false,"fork":false,"pushed_at":"2024-02-09T12:05:02.000Z","size":21,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-08-20T13:27:15.178Z","etag":null,"topics":["cyclonedx","cyclonedx-sbom","open-source-security","oss","sbom","supply-chain-security"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/shiftleftcyber.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2024-02-09T11:35:20.000Z","updated_at":"2025-06-15T11:35:58.000Z","dependencies_parsed_at":"2024-02-12T12:31:13.015Z","dependency_job_id":"98793fd9-7c56-48b7-8023-4a89c993cc42","html_url":"https://github.com/shiftleftcyber/cyclonedx-bitbucket-pipe","commit_stats":null,"previous_names":["ccideas/cyclonedx-bitbucket-pipe","shiftleftcyber/cyclonedx-bitbucket-pipe"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/shiftleftcyber/cyclonedx-bitbucket-pipe","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shiftleftcyber%2Fcyclonedx-bitbucket-pipe","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shiftleftcyber%2Fcyclonedx-bitbucket-pipe/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shiftleftcyber%2Fcyclonedx-bitbucket-pipe/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shiftleftcyber%2Fcyclonedx-bitbucket-pipe/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/shiftleftcyber","download_url":"https://codeload.github.com/shiftleftcyber/cyclonedx-bitbucket-pipe/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shiftleftcyber%2Fcyclonedx-bitbucket-pipe/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32097884,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-21T11:25:29.218Z","status":"ssl_error","status_checked_at":"2026-04-21T11:25:28.499Z","response_time":128,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cyclonedx","cyclonedx-sbom","open-source-security","oss","sbom","supply-chain-security"],"created_at":"2025-03-11T23:51:28.227Z","updated_at":"2026-04-21T15:32:32.504Z","avatar_url":"https://github.com/shiftleftcyber.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Bitbucket Pipelines Pipe:  CycloneDX Cdxgen sBOM Generator\n\nA lightweight wrapper acount the popular @cyclonedx/cdxgen tool which will allow you to\ngenerates a CycloneDX compliant Software Bill of Materials directely from a Bitbucket Pipe.\nIn order to keep the image size reasonalble, only node/npm, java, python and go is currently\nsupported. To request new support be added file an issue in GitHub. Other languages/frameworks may\nwork but they have not been formally tested.\n\nThe official copy this project is hosted on [Bitbucket]\n(https://bitbucket.org/ccideas1/cyclonedx-pipe/src/main/).\nIn order to reach a diverse audience a copy of the repo also exists in [GitHub]\n(https://github.com/ccideas/cyclonedx-cdxgen-bitbucket-pipe).\nPull Requests and issues should be opened in the GitHub copy and they will be synced back to Bitbucket.\n\n## YAML Definition\n\nThe following is an example of a bitbucket pipeline which installs npm dependencies and caches those\ndependencies in one step then uses those cached depdencies in the next step to build a CycloneDX\nsBOM. The following code snip would need to be added to the `bitbucket-pipelines.yml` file\n\n```yaml\npipelines:\n  default:\n    - step:\n        name: Build and Test\n        caches:\n          - node\n        script:\n          - npm install\n          - npm test\n    - step:\n        name: Gen CycloneDX sBom\n        caches:\n          - node\n        script:\n          - pipe: docker://ccideas/cyclonedx-bitbucket-pipe:1.0.0\n            variables:\n              CDXGEN_PROJECT_TYPE: 'node'\n              CDXGEN_PATH_TO_SCAN: 'samples/node'\n              CDXGEN_SPEC_VERSION: '1.4'\n              CDXGEN_PRINT_AS_TABLE: 'true'\n              CDXGEN_DEBUG_MODE: 'debug'\n              DEBUG_BASH: 'false'\n              OUTPUT_DIRECTORY: 'build'\n        artifacts:\n          - build/*\n```\n\nAnother example without specifying the project type or a directory to scan. This will just recursively\nscan your directory, identify components and write them to the sBOM\n\n```yaml\npipelines:\n  default:\n    - step:\n        name: Gen CycloneDX sBom\n        script:\n          - pipe: docker://ccideas/cyclonedx-cdxgen-bitbucket-pipe:1.0.0\n            variables:\n              CDXGEN_PATH_TO_SCAN: '.'\n              CDXGEN_SPEC_VERSION: '1.4'\n              CDXGEN_PRINT_AS_TABLE: 'true'\n              CDXGEN_DEBUG_MODE: 'debug'\n              DEBUG_BASH: 'false'\n              OUTPUT_DIRECTORY: 'build'\n        artifacts:\n          - build/*\n```\n\nIn both examples above the sBOM is written to the build directory. This directory will be archived.\n\n## Variables\n\n| Variable                  | Usage                                                               | Options                                           | Default               |\n| ---------------------     | -----------------------------------------------------------         | -----------                                       | -------               |\n| CDXGEN_SPEC_VERSION       | CycloneDX Specification version to use                              | 1.4, 1.5                                          | 1.5                   |\n| CDXGEN_PROJECT_TYPE       | Used to specify the project type                                    | [See Docs](https://github.com/CycloneDX/cdxgen)   | none                  |\n| CDXGEN_PATH_TO_SCAN       | Used to specify the path to scan                                    | \u003cpath to directory\u003e                               | none                  |\n| CDXGEN_PRINT_AS_TABLE     | Print the SBOM as a table with tree                                 | true, false                                       | false                 |\n| CDXGEN_DEBUG_MODE         | Set to debug to enable debug messages                               | debug                                             | none                  |\n| DEBUG_BASH                | Set to true to enable debug mode in bash                            | true, false                                       | false                 |\n| OUTPUT_DIRECTORY          | Used to specify the directory to place all output in                | \u003cdirectory name\u003e                                  | build                 |\n| SBOM_FILENAME             | Used to specify the name of the sbom file                           | \u003cfilename\u003e                                        | ${bitbucket-repo-name-sbom   |\n\n## Details\n\nGenerates a CycloneDX compliant Software Bill of Materials\nfor a various project types. The generated sBOM will be created in the\nbuild directory and be named `${BITBUCKET_REPO_SLUG}-sbom.json`\n\n## Example\n\nA working pipeline for the popular [auditjs](https://www.npmjs.com/package/auditjs)\ntool has been created as an example. The pipeline in\nthis fork of the [auditjs](https://www.npmjs.com/package/auditjs) tool will install the required\ndependencies then generate a CycloneDX sBOM containing all the ingredients which make up the\nproduct.\n\n* [Repository Link](https://bitbucket.org/ccideas1/fork-auditjs/src/main/)\n* [Link to bitbucket-pipelines.yml](https://bitbucket.org/ccideas1/fork-auditjs/src/main/bitbucket-pipelines.yml)\n* [Link to pipeline](https://bitbucket.org/ccideas1/fork-auditjs/pipelines/results/4)\n\n## Support\n\nIf you'd like help with this pipe, or you have an issue, or a feature request, [let us know](https://github.com/ccideas/cyclonedx-cdxgen-bitbucket-pipe).\n\nIf you are reporting an issue, please include:\n\nthe version of the pipe\nrelevant logs and error messages\nsteps to reproduce\n\n## Credits\n\nThis Bitbucket pipe is a collection and integration of the following open source tools\n\n* [@cyclonedx/cdxgen](https://github.com/CycloneDX/cdxgen)\n\nA big thank-you to the teams and volunteers who make these amazing tools available\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fshiftleftcyber%2Fcyclonedx-bitbucket-pipe","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fshiftleftcyber%2Fcyclonedx-bitbucket-pipe","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fshiftleftcyber%2Fcyclonedx-bitbucket-pipe/lists"}