artifact-sbom-publisher

To generate CycloneDX SBOMs in CI/CD pipelines, run the SBOM publisher in your automated workflow to produce the bills of materials and attach them directly to your published build artifacts.

Automating provenance attestation requires capturing build metadata during the release process. This Skill records provenance data and attaches it to artifacts within CI/CD workflows to establish verifiable audit trails.

Yes, the SBOM publisher supports SPDX formats alongside CycloneDX. You can configure your CI/CD workflow to generate either standard for your artifacts to meet specific compliance requirements.

Yes, you can use this to capture build metadata for security reviews. It generates provenance attestation and artifact metadata within automated workflows, providing the necessary audit trails for compliance.

You publish artifacts with supply-chain provenance by integrating the SBOM publisher into your CI/CD pipeline. It automatically generates the provenance metadata and publishes the artifacts across your releases.

Attaching an SBOM to build artifacts helps teams demonstrate security and compliance. It provides a software bill of materials that details components, enabling accurate tracking for security reviews and supply-chain audits.