SBOM Generation

SBOM generation in CI automatically creates a Software Bill of Materials as part of the build pipeline, capturing all components, libraries, and their versions at build time. Tools like Syft, Trivy, and CycloneDX generate SBOMs in standard formats (SPDX, CycloneDX) and attach them to container images as OCI attestations.

Automated SBOM generation ensures supply chain transparency at every release.