Exporting a software bill of materials for your repository

You can export a software bill of materials or SBOM for your repository from the dependency graph. SBOMs allow transparency into your open source usage and help expose supply chain vulnerabilities, reducing supply chain risks.

You can export the current state of the dependency graph for your repository as a software bill of materials (SBOM) using the industry standard SPDX format.

SBOMs include an inventory of a project's dependencies and associated information such as versions, package identifiers, licenses, transitive paths, and copyright information. SBOMs do not include dependents (other projects that rely on your project).

Exporting a software bill of materials for your repository from the UI

1. On GitHub, navigate to the main page of the repository.

2. Under your repository name, click Insights.

   

3. In the left sidebar, click Dependency graph.

4. On the top right side of the Dependencies tab, click Export SBOM to generate an SBOM file for download from your browser.

Exporting a software bill of materials for your repository using the REST API

To export an SBOM for your repository using the REST API:

1. Request generation of the SBOM. See REST API endpoints for software bill of materials (SBOM).
2. Poll the returned sbom_url while the response is 202. When the response is 302, follow the redirect to download the completed SBOM. See REST API endpoints for software bill of materials (SBOM).

Generating a software bill of materials from GitHub Actions

The following actions will generate an SBOM for your repository and attach it as a workflow artifact which you can download and use in other applications. For more information about downloading workflow artifacts, see Downloading workflow artifacts.