GitHub Dependency Graph SBOM Export review

Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026

GitHub Dependency Graph SBOM Export creates a software bill of materials from a repository’s dependency graph. It suits teams already tracking dependencies in GitHub that need an SPDX inventory without a separate export fee. The output can include package versions and identifiers, licenses, transitive paths, and copyright information. It describes the repository’s dependencies, not projects that depend on that repository, so it is aimed at documenting what a project uses rather than mapping downstream use of its code.

The export is available through the GitHub repository interface and REST API, and GitHub Actions can generate an SBOM as a workflow artifact. That makes it relevant to both manual repository review and build workflows. The built-in dependency graph export is SPDX; the separately documented Actions options should not be treated as changing the format of that built-in export. The tool’s input is the current GitHub dependency graph, rather than source code, container images, or binaries, so teams needing SBOMs from those artifacts should consider a tool that accepts them.

Pricing is attached to GitHub plans, not a separate charge for this export feature. The Free plan lists SBOM export at $0 per month; Team lists it at $4 per user per month, and Enterprise at $21 per user per month. For repositories already using Dependency Graph, the feature is a direct way to obtain an SPDX snapshot through GitHub’s UI, API, or Actions. It is less suitable when you need a historical or broader inventory beyond the graph’s current state, or need the built-in export in CycloneDX format.

GitHub Dependency Graph SBOM Export pros and cons

• Where it wins
  • Exports SPDX SBOMs from the repository interface or REST API.
  • Can generate an SBOM as a GitHub Actions workflow artifact.
  • Includes versions, licenses, identifiers, transitive paths, and copyright.
• Where it doesn't
  • Exports only the current dependency graph state.
  • Does not list projects that depend on the repository.
  • Built-in export is SPDX, not CycloneDX.

GitHub Dependency Graph SBOM Export fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 14 Nov 2026 · How we research and update