{"id":26187759,"url":"https://github.com/shiftleftcyber/shiftsbomgen","last_synced_at":"2026-03-16T13:07:30.085Z","repository":{"id":247079657,"uuid":"824951656","full_name":"shiftleftcyber/ShiftSBOMGen","owner":"shiftleftcyber","description":"Generates a Software Bill of Materials as part of a Bitbucket Pipeline for various project types","archived":false,"fork":false,"pushed_at":"2025-01-29T11:59:53.000Z","size":16,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-01-29T12:34:42.500Z","etag":null,"topics":["bitbucket","bitbucket-pipes","cicd","cyclonedx","open-source-se","oss","sbom","spdx","supply-chain-security"],"latest_commit_sha":null,"homepage":"","language":"Makefile","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/shiftleftcyber.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-07-06T11:32:12.000Z","updated_at":"2025-01-29T12:02:06.000Z","dependencies_parsed_at":"2025-01-06T12:32:17.503Z","dependency_job_id":"499f3561-f698-4e69-9c30-94b8287f0065","html_url":"https://github.com/shiftleftcyber/ShiftSBOMGen","commit_stats":null,"previous_names":["ccideas/syft-bitbucket-pipe","shiftleftcyber/syft-bitbucket-pipe"],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shiftleftcyber%2FShiftSBOMGen","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shiftleftcyber%2FShiftSBOMGen/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shiftleftcyber%2FShiftSBOMGen/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shiftleftcyber%2FShiftSBOMGen/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/shiftleftcyber","download_url":"https://codeload.github.com/shiftleftcyber/ShiftSBOMGen/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243130980,"owners_count":20241177,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bitbucket","bitbucket-pipes","cicd","cyclonedx","open-source-se","oss","sbom","spdx","supply-chain-security"],"created_at":"2025-03-11T23:51:30.988Z","updated_at":"2025-12-24T13:50:13.605Z","avatar_url":"https://github.com/shiftleftcyber.png","language":"Makefile","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ShiftSBOMGen\n\n[![SonarQube Cloud](https://sonarcloud.io/images/project_badges/sonarcloud-highlight.svg)](https://sonarcloud.io/summary/new_code?id=ccideas1_syft-pipe)\n\n[![Bugs](https://sonarcloud.io/api/project_badges/measure?project=ccideas1_syft-pipe\u0026metric=bugs)](https://sonarcloud.io/summary/new_code?id=ccideas1_syft-pipe)\n[![Code Smells](https://sonarcloud.io/api/project_badges/measure?project=ccideas1_syft-pipe\u0026metric=code_smells)](https://sonarcloud.io/summary/new_code?id=ccideas1_syft-pipe)\n[![Duplicated Lines (%)](https://sonarcloud.io/api/project_badges/measure?project=ccideas1_syft-pipe\u0026metric=duplicated_lines_density)](https://sonarcloud.io/summary/new_code?id=ccideas1_syft-pipe)\n\n\n![Build Badge](https://img.shields.io/bitbucket/pipelines/ccideas1/syft-pipe/main)\n![GitHub release (latest by date)](https://img.shields.io/github/v/release/shiftleftcyber/syft-bitbucket-pipe)\n\nShiftSBOMGen is a pure client-side Bitbucket Pipe that generates a Software Bill of Materials (SBOM). ShiftSBOMGen\nsupports both CycloneDX \u0026 SPDX Standards and supports a wide range of ecosystems and container types. \nNo subscriptions, server access, or API keys are required to use this Pipe\n\nThe official copy this project is hosted on\n[Bitbucket](https://bitbucket.org/ccideas1/syft-pipe/src/main/). In order to reach\na diverse audience a copy of the repo also exists in\n[GitHub](https://github.com/ccideas/syft-bitbucket-pipe/). Pull Requests\nshould be submitted to the to the Bitbucket reposiotry and changes\nwill be kept in sync.\n\n## Usage\n\nBasic Usage to generate a SBOM for your current project via a Bitbucket Pipe.\nThis example will generate a spdx-json SBOM and store it in a file named\n`spdx_sbom.json`. The output will be archived to further processing.\n\n```yaml\npipelines:\n  default:\n    - step:\n        name: Build and Test\n        caches:\n          - node\n        script:\n          - npm install\n          - npm test\n    - step:\n        name: Generate SBOM\n        caches:\n          - node\n        script:\n          - pipe: docker://ccideas/syft-bitbucket-pipe:1.2.0\n            variables:\n              SYFT_CMD_ARGS: '. --output spdx-json=spdx-sbom.json'\n        artifacts:\n          - spdx-sbom.json\n```\n\n## Variables\n\n| Variable      | Usage                         | Options      | Required |\n| --------------| ----------------              | --------     | -------  |\n| SYFT_CMD_ARGS | Used to pass in any syft args | \u003cstring\u003e     | true     |\n\n## Examples\n\n### Scan your current repo and generate a CycloneDX JSON Formatted SBOM\n\n```SYFT_CMD_ARGS: '. --output cyclonedx-json=sbom-cyclonedx.json'```\n\n### Scan your current repo and generate a SPDX JSON Formatted SBOM\n\n```SYFT_CMD_ARGS: '. --output spdx-json=sbom-spdx.json'```\n\n### Scan a jar file and generate a SPDX JSON Formatted SBOM\n\n```SYFT_CMD_ARGS: '\u003cPATH_TO_JAR_FILE\u003e --output spdx-json=sbom-spdx.json'```\n\n### Scan an archived docker image and generate a SPDX JSON Formatted SBOM\n\n```SYFT_CMD_ARGS: '\u003cPATH_TO_DOCKER_IMAGE_ARCHIVE\u003e --output spdx-json=sbom-spdx.json'```\n\nYou can build your SYFT_CMD_ARGS string by reviewing the options available\nto you via the ```syft --help``` command.\n\n## Support\n\nIf you'd like help with this pipe, or you have an issue, or a feature\nrequest, [let us know](https://github.com/ccideas/syft-bitbucket-pipe/issues).\n\nIf you are reporting an issue, please include:\n\n* the version of the pipe\n* relevant logs and error messages\n* steps to reproduce\n\n## Credits\n\nThis Bitbucket pipe is a collection and integration of the following\nopen source tools\n\n* [syft](https://github.com/anchore/syft?tab=readme-ov-file)\n\nA big thank-you to the teams and volunteers who make these amazing tools available\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fshiftleftcyber%2Fshiftsbomgen","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fshiftleftcyber%2Fshiftsbomgen","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fshiftleftcyber%2Fshiftsbomgen/lists"}