{"repo":"cbomkit/cbomkit-action","free":true,"listed":false,"github":"https://github.com/cbomkit/cbomkit-action","clone":"git clone https://github.com/cbomkit/cbomkit-action.git","description":"GitHub Action to generate Cryptography Bill of Materials (CBOM)","language":"Java","stars":16,"topics":["cbom","cbom-tool","cbomkit","cryptographic-inventory","github-actions","post-quantum-cryptography","quantum-safe"],"license":"Apache-2.0","category":"workflow-automation","readme_excerpt":"CBOMkit-action GitHub Action to generate CBOMs. CBOMkit-action identifies all project modules contained in a github repository, scans the corresponding source code and produces a CBOM object per module. A project module is a part of a repo that can be used independently of other modules and may be published as a separate package. CBOMkit-action also generates a consolidated CBOM file that contains all crypto findings for the entire repository. All CBOM objects can be uploaded as json files in a github workflow artifact. This artifact is a zip file ( CBOM.zip ) that contains all CBOMs. For a particular package module the CBOM file is cbom- .json. The overall CBOM is named cbom.json . Usage Create a yaml file with a name of your choice in .github/workflows . The following example specifies the CBOM generation for a Java repository built with maven. [!NOTE] For java repositories, the precision and the quality of generated CBOM depends on the scanner's ability to resolve symbols defined in the dependencies. We therefore recommend to build all java code prior to scanning as shown in above example. cbomkit-action auto-constructs a list of directories used by the scanner to search for java dependencies (jar/zip files). By default, this list contains the project directory (cloning target) and the maven/gradle default repository path. The scanning option CBOMKIT JAVA JAR DIR allows to append an additional path expression to the default list. This expression may contain wildcards ( ) t","default_branch":null,"files":null,"tree":[],"storefront":"/r/cbomkit","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/cbomkit/cbomkit-action/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}