skills.rest
harness
harnessOFFICIAL
Explore all skills by this author →
WebsiteGitHub

create-sbom

Automate SBOM generation and attestation for Harness pipelines using SscaOrchestration.

80|16|Updated Mar 11, 2026
Search Tags:#orchestration#pipeline#cd#harness#sbom#attestation
One-click install
npx skills add https://github.com/harness/harness-skills --skill create-sbom
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: create-sbom
Source: https://github.com/harness/harness-skills/tree/main/skills/create-sbom
Command: npx skills add https://github.com/harness/harness-skills --skill create-sbom

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Existing Harness pipelines require manual SBOM integration and attestation steps; this skill automates and orchestrates SBOM generation to ensure consistency and compliance across builds and deploys.

Core Features & Use Cases

  • Integrates SBOM Orchestration into existing CI/CD pipelines for artifacts and containers.
  • Supports containerized step groups in Deployment stages, repository sources, and Harness Local stages.
  • Guides users through a phase-based wizard to place the SBOM step in the correct stage and order, with attestation options.

Quick Start

Invoke /create-sbom for an existing pipeline and follow the interactive wizard to insert an SBOM step.

Frequently Asked Questions about create-sbom

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate SBOM generation in a Harness pipeline?▼

Automate SBOM generation by invoking the skill for an existing pipeline, which inserts a SscaOrchestration step to generate and attest SBOMs for containerized or repository sources.

Can I add SBOM attestation to both CI and Deployment stages in Harness?▼

Yes, SBOM attestation applies to CI, Deployment (CD), and Security stages. The interactive wizard guides correct stage placement, positioning the SBOM step before deploy or at the end of the stage.

What sources are supported for SBOM orchestration in Harness?▼

SBOM orchestration supports containerized step groups in Deployment stages, repository sources, and Harness Local stages, providing flexibility across different artifact and container build workflows.

How do I configure the default generation path and connector for SBOM steps?▼

The wizard guides YAML generation for the SBOM step, handling default generation path configuration and connector resolution to ensure proper integration within your existing pipeline structure.

Does Harness SBOM generation work with containerized step groups?▼

Yes, the skill provides specific CD containerized guidance, ensuring SBOM generation and attestation steps are correctly configured within containerized step groups in Deployment stages.

Why do I need to place the SBOM step before deploy in a Harness CD pipeline?▼

Placing the SBOM step before deploy ensures the software bill of materials is generated and attested prior to release, satisfying compliance requirements and ensuring consistency across builds and deploys.

Related Skills

Explore More Software Engineering Skills→
harnessharness
80

enforce-slsa

Add an SLSA Verification step to Harness pipelines for provenance attestations.

Official
Advanced
Hack23Hack23
23

open-source-governance

Enforce Hack23 Open Source Policy governance, security, and compliance standards.

Official
Advanced
harnessharness
80

enforce-sbom

Insert SBOM Policy Enforcement steps into existing Harness pipelines.

Official
Advanced
nist0nist0

supply-chain

Automate software supply chain hardening with dependency pinning, SBOM generation, and artifact signing.

Community
Advanced