artifact-sbom-publisher

Name: artifact-sbom-publisher
Availability: InStock
Author: vecear

Updated Jan 21, 2026

Search Tags:#security #sbom #cyclonedx #syft #artifact-publishing #build-provenance

Ready to run

npx skills add https://github.com/vecear/Nipponverb --skill artifact-sbom-publisher-vecear

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: artifact-sbom-publisher
Source: https://github.com/vecear/Nipponverb/tree/main/.claude/skills/artifact-sbom-publisher
Command: npx skills add https://github.com/vecear/Nipponverb --skill artifact-sbom-publisher-vecear

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill eliminates the tedious task of publishing build artifacts with complete security metadata, enabling clear provenance and compliance documentation.

Core Features & Use Cases

SBOM Generation: Produce CycloneDX or Syft SBOMs for your artifacts.
Artifact Publishing: Package and publish build outputs to release systems with attached metadata.
Provenance & Compliance: Emit and attach provenance data to verify the integrity of releases across CI pipelines.
Use Case: When releasing a new version, automatically generate an SBOM, publish dist/, and store sbom.json for auditability.

Quick Start

Run your CI workflow to build artifacts, generate the SBOM, and publish the artifacts with provenance metadata.

Frequently Asked Questions about artifact-sbom-publisher

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I generate a CycloneDX SBOM for my build artifacts in a release pipeline?▼

You can generate a CycloneDX SBOM for your build artifacts by running an automated CI workflow that produces build outputs and automatically creates the security metadata. This Skill packages the artifacts and attaches the sbom.json file for auditability during the release process.

What is build provenance and when do I need to attach it to software releases?▼

Build provenance is metadata that verifies the integrity and origin of your software releases. You need to attach provenance data when your release pipelines require strict compliance documentation and clear auditability for supply chain security.

Can I use Syft to generate SBOMs and publish artifacts in the same automated workflow?▼

Yes, you can use Syft to generate SBOMs and publish artifacts within the same automated workflow. This Skill supports Syft SBOM generation, artifact packaging, and publishing build outputs to release systems with attached provenance metadata.

What's the best way to automate SBOM generation and artifact publishing for compliance?▼

The best way to automate SBOM generation and artifact publishing for compliance is to integrate a release pipeline that automatically builds artifacts, generates the SBOM, and publishes the dist/ outputs with provenance data attached for verification.

Does artifact publishing with this method require any external dependencies or specific environments?▼

Artifact publishing with this method requires no external dependencies, as it operates independently. You only need a CI workflow environment capable of building artifacts and triggering the automated release process to generate the SBOM and provenance metadata.