artifact-sbom-publisher

You can generate a CycloneDX SBOM for your build artifacts by running an automated CI workflow that produces build outputs and automatically creates the security metadata. This Skill packages the artifacts and attaches the sbom.json file for auditability during the release process.

Build provenance is metadata that verifies the integrity and origin of your software releases. You need to attach provenance data when your release pipelines require strict compliance documentation and clear auditability for supply chain security.

Yes, you can use Syft to generate SBOMs and publish artifacts within the same automated workflow. This Skill supports Syft SBOM generation, artifact packaging, and publishing build outputs to release systems with attached provenance metadata.

The best way to automate SBOM generation and artifact publishing for compliance is to integrate a release pipeline that automatically builds artifacts, generates the SBOM, and publishes the dist/ outputs with provenance data attached for verification.

Artifact publishing with this method requires no external dependencies, as it operates independently. You only need a CI workflow environment capable of building artifacts and triggering the automated release process to generate the SBOM and provenance metadata.