SBOM in 10 minutes

Generate a CycloneDX JSON file in CI and upload it with the workspace's existing bearer token.

Store the bearer token as a protected CI secret and rotate it from workspace settings if it may have been exposed.

npx --yes @cyclonedx/cdxgen@12.8.4 -o sbom.cdx.json .

The starter template runs the pinned cdxgen generator; check that it supports the repository's package ecosystem before relying on its output.

curl --fail --show-error --silent \
  -X POST \
  -H "Authorization: Bearer $CRA_SCOPE_CHECK_SBOM_TOKEN" \
  -H "Content-Type: application/json" \
  --data-binary @sbom.cdx.json \
  "${CRA_APP_ORIGIN%/}/api/workspace/${CRA_WORKSPACE_ID}/sbom"

Tag an SBOM upload with a release version

CRA_RELEASE_VERSION="v1.0.0"
curl --fail --show-error --silent \
  -X POST \
  -H "Authorization: Bearer $CRA_SCOPE_CHECK_SBOM_TOKEN" \
  -H "Content-Type: application/json" \
  -H "X-CRA-Release-Version: $CRA_RELEASE_VERSION" \
  --data-binary @sbom.cdx.json \
  "${CRA_APP_ORIGIN%/}/api/workspace/${CRA_WORKSPACE_ID}/sbom"

An active subscription is required for versioned uploads. Set CRA_RELEASE_VERSION to the exact release label.

The upload accepts CycloneDX JSON up to 5 MB and 10,000 components.

The template fails when generation, validation, or upload fails, so a missing SBOM is not reported as success.

Open workspaces