GitHub SBOM Action

At a glance

• Editor score
  5.8 / 10
• Pricing
  Pricing on request
• Best for
  GitHub Actions users needing signed SBOM attestations
• Source code input
  Yes
• Facts checked
  14 Nov 2026

• Where it wins

  • Generates SBOMs from container images, local artifacts, or repositories
  • Supports SPDX JSON and CycloneDX JSON using Syft or cdxgen
  • Can attest SBOMs and push signed attestations to a configured registry

• Where it doesn't

  • Requires a Harness account with an SCS license to save SBOMs
  • Relies on Syft or cdxgen for SBOM generation
  • Fits GitHub Actions workflows rather than a standalone SBOM workflow

Our verdict on GitHub SBOM Action

GitHub SBOM Action is a Harness sub-action for generating software bills of materials within GitHub workflows. It accepts container images, local artifacts, and repositories, then uses Syft or cdxgen to produce SPDX JSON or CycloneDX JSON. The workflow focus suits teams already using GitHub Actions that need SBOM generation and optional signed attestations as part of their build process. It is available as a cloud product and is positioned for small, mid-market, and enterprise organizations.

The action connects with Harness Software Supply Chain Security, where generated SBOMs are saved; using that destination requires a Harness account with an SCS license. It can optionally attest generated SBOMs and push signed attestation files to a configured container registry. Its listed integrations also include HashiCorp Vault and Cosign, alongside GitHub Actions, Syft, and cdxgen. This makes the most sense for teams that want SBOM work connected to GitHub workflows and Harness supply-chain security, rather than teams looking for a generation tool independent of those systems.

Generation depends on the selected external tool, Syft or cdxgen, so the action is an orchestration option rather than a self-contained SBOM engine. The product uses a contact-sales pricing model. Choose it if your workflow is GitHub Actions-based and you need SPDX or CycloneDX output with optional attestation and registry delivery. Teams that do not use GitHub Actions, or that want SBOM generation without a Harness SCS account for saving results, should consider a different fit.

Your product? Our editors can test GitHub SBOM Action in depth and publish a review, labelled as paid · from $149/mo →

GitHub SBOM Action pricing

GitHub SBOM Action fact sheet

GitHub SBOM Action integrations

GitHub SBOM Action lists 6 integrations on its own site.

• GitHub Actions
• Harness Software Supply Chain Security
• Syft
• cdxgen
• HashiCorp Vault
• Cosign

Alternatives to GitHub SBOM Action

• Docker ScoutGenerates and displays SBOMs alongside vulnerability analysis for container images.8.7
• Amazon InspectorA managed AWS security service that pairs continuous scanning with SBOM exports.8.6
• TrivyA free, self-hosted SBOM generator that also scans code, containers, Kubernetes, and AWS.8.5

See all GitHub SBOM Action alternatives →

Featured on iTechGuides

GitHub SBOM Action is listed in our SBOM Generation Tools directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/github-sbom-action/"><img src="https://www.itechguides.com/best/badge/github-sbom-action.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 14 Nov 2026 · How we research and update