GitHub Dependency Graph SBOM Export

Freemium#13 of 33 in SBOM Generation Tools

GitHub Dependency Graph SBOM Export: A convenient SPDX export for GitHub repositories, limited to the graph’s current state. Ranked #13 of 33 in SBOM Generation Tools by our editors (7.3/10); pricing: Free plan; best for repositories already using GitHub Dependency Graph.

7.3/10Editor score

Visit GitHub

GitHub Dependency Graph SBOM Export7.3 Visit GitHub

At a glance

Editor score
7.3 / 10
Pricing
Free plan
Best for
Repositories already using GitHub Dependency Graph
Free plan
Yes
Paid from
$4/user/mo
Source code input
No
Facts checked
14 Nov 2026

Where it wins
- Exports SPDX SBOMs from the repository interface or REST API.
- Can generate an SBOM as a GitHub Actions workflow artifact.
- Includes versions, licenses, identifiers, transitive paths, and copyright.
Where it doesn't
- Exports only the current dependency graph state.
- Does not list projects that depend on the repository.
- Built-in export is SPDX, not CycloneDX.

Our verdict on GitHub Dependency Graph SBOM Export

GitHub Dependency Graph SBOM Export creates a software bill of materials from a repository’s dependency graph. It suits teams already tracking dependencies in GitHub that need an SPDX inventory without a separate export fee. The output can include package versions and identifiers, licenses, transitive paths, and copyright information. It describes the repository’s dependencies, not projects that depend on that repository, so it is aimed at documenting what a project uses rather than mapping downstream use of its code.

The export is available through the GitHub repository interface and REST API, and GitHub Actions can generate an SBOM as a workflow artifact. That makes it relevant to both manual repository review and build workflows. The built-in dependency graph export is SPDX; the separately documented Actions options should not be treated as changing the format of that built-in export. The tool’s input is the current GitHub dependency graph, rather than source code, container images, or binaries, so teams needing SBOMs from those artifacts should consider a tool that accepts them.

Pricing is attached to GitHub plans, not a separate charge for this export feature. The Free plan lists SBOM export at $0 per month; Team lists it at $4 per user per month, and Enterprise at $21 per user per month. For repositories already using Dependency Graph, the feature is a direct way to obtain an SPDX snapshot through GitHub’s UI, API, or Actions. It is less suitable when you need a historical or broader inventory beyond the graph’s current state, or need the built-in export in CycloneDX format.

Your product? Our editors can test GitHub Dependency Graph SBOM Export in depth and publish a review, labelled as paid · from $149/mo →

GitHub Dependency Graph SBOM Export pricing

Plans Free planFreemium A usable free plan; paid tiers unlock the limits above. Prices checked 14 Nov 2026.

See plans on docs.github.com

All 3 GitHub Dependency Graph SBOM Export plans and prices →

GitHub Dependency Graph SBOM Export fact sheet

Free plan	Yes
Paid from	$4/user/mo
SPDX output	Yes
CycloneDX output	No
Source code input	No
Container image input	No
Binary input	No
Build-pipeline support	Yes
Deployment	Cloud
Platforms	Web
Compliance & security	SOC 2, SSO/SAML, 2FA
Support	Community, Docs
Built for	Solo, Small business, Mid-market, Enterprise (editorial estimate)
Integrations	2 integrations: GitHub Actions, GitHub REST API
Pricing	Free plan (source)
Website	docs.github.com
Facts checked	14 Nov 2026

GitHub Dependency Graph SBOM Export integrations

GitHub Dependency Graph SBOM Export lists 2 integrations on its own site.

GitHub Actions
GitHub REST API

Alternatives to GitHub Dependency Graph SBOM Export

See all GitHub Dependency Graph SBOM Export alternatives →

Used GitHub Dependency Graph SBOM Export? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used GitHub Dependency Graph SBOM Export for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Title

Your review

0 characters · at least 80, up to 3,000

Pros (optional · one per line)

Cons (optional · one per line)

Your name (shown with your review)

Role (optional)

Company (optional)

How long have you used it?

I've used GitHub Dependency Graph SBOM Export myself and this is my honest opinion — nobody paid or asked me to write it.

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

GitHub Dependency Graph SBOM Export is listed in our SBOM Generation Tools directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/github-dependency-graph-sbom-export/"><img src="https://www.itechguides.com/best/badge/github-dependency-graph-sbom-export.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 14 Nov 2026 · How we research and update