SBOM generation in CI/CD
Wire CycloneDX generation into the pipeline so every build emits a current SBOM that feeds monitoring.
| Component | Version | Severity | VEX |
|---|---|---|---|
| libparse | 2.3.1 | Critical | Not affected |
| netcore | 5.0.4 | High | Affected |
| imagekit | 1.9.0 | High | Fixed |
| yaml-lite | 0.4.2 | Medium | Investigating |
| cryptobox | 3.1.0 | Critical | Affected |
Wire SBOM generation into the pipeline so every build emits a current CycloneDX inventory that feeds monitoring on its own.
Generate on every build
A build-stage step produces a CycloneDX SBOM from the actual dependency graph — not a spreadsheet someone updates by hand once a quarter.
Attach it to the release
The SBOM is versioned and pinned to the exact artifact it describes, so each release carries the inventory that matches it.
Feed monitoring automatically
Each new SBOM registers with OSV monitoring on publish, so a freshly added dependency is watched from the moment it ships.
Fail the build on policy
A gate blocks a release that adds a banned licence or a known-critical component — the SBOM becomes a control, not just a document.
It's live.
See the real thing at Proofwright.