Generate an SBOM in the Build Pipeline

Produce a Software Bill of Materials on every build so downstream consumers can audit transitive dependencies.

~15 mincisecuritysbom

Task

Automate npx @cyclonedx/cyclonedx-npm --output-file sbom.json --output-format JSON so pipeline failures are caught before merge and never reach production.

When to use this

A pull request merges with a broken npx @cyclonedx/cyclonedx-npm --output-file sbom.json --output-format JSON step because the workflow did not gate on it, causing a failed deploy.

Prerequisites

Node.js 22 and pnpm available
A CI workflow file in .github/workflows

Steps

1. Configure npx @cyclonedx/cyclonedx-npm --output-file sbom.json --output-format JSON in the project configuration file with the recommended defaults.

npx @cyclonedx/cyclonedx-npm --output-file sbom.json --output-format JSON

Expected output: The configuration is accepted and npx @cyclonedx/cyclonedx-npm --output-file sbom.json --output-format JSON runs without errors on the first invocation.

2. Run the check locally to verify npx @cyclonedx/cyclonedx-npm --output-file sbom.json --output-format JSON produces the expected result before pushing.

act -j build  # or: pnpm test

Expected output: Local run matches CI behavior; no surprises after push.

3. Add the gate to the CI pipeline so npx @cyclonedx/cyclonedx-npm --output-file sbom.json --output-format JSON blocks merge on failure.

- name: Run add sbom generation step
  run: pnpm test

Expected output: Pull requests with failing npx @cyclonedx/cyclonedx-npm --output-file sbom.json --output-format JSON are blocked from merging.

Troubleshooting

Problem

The check passes locally but fails in CI

Solution

Pin dependency versions and the runtime to match CI exactly; reproduce with the same Docker image or act.

Problem

Configuration is rejected with a schema error

Solution

Check the tool version matches the config schema; older versions may not support newer fields.

Limitations

The gate only runs on events that trigger the workflow; locally pushed commits bypass it.
Configuration drift is possible if someone edits settings outside version control.

Gate the pipeline before merge

Start by measuring the problem. Produce a Software Bill of Materials on every build so downstream consumers can audit transitive dependencies. The most common mistake is adding the gate without first confirming it catches the issue you care about. Run npx @cyclonedx/cyclonedx-npm –output-file sbom.json –output-format JSON against the current codebase and inspect the output before wiring it into CI.

npx @cyclonedx/cyclonedx-npm --output-file sbom.json --output-format JSON

Make failures actionable

Once the gate is in place, make failures actionable. A failing npx @cyclonedx/cyclonedx-npm –output-file sbom.json –output-format JSON should point to the exact file and line, not a generic error. Pin the tool version in the lockfile so a upstream release does not silently change behavior. Review the gate output in every pull request just like a test result.