CycloneDX Go Module Integration Guide

Integrate cyclonedx-gomod with Vulnetix. Generate a CycloneDX SBOM from your Go module project and upload to Vulnetix.

Install & scan

$ go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest
$ cyclonedx-gomod app -json -output bom.json .

Run CycloneDX Go Module in CI

Scan on every push and upload the report as a workflow artifact:

- name: Setup Go
  uses: actions/setup-go@v6
  with:
    go-version: stable

- name: Install cyclonedx-gomod
  run: go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest

- name: Generate CycloneDX SBOM
  run: cyclonedx-gomod app -json -output bom.json .

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: cyclonedx-go
    path: bom.json
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under CycloneDX Go Module's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace CycloneDX Go Module. Keep running it. Vulnetix sits on top of CycloneDX Go Module (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

CycloneDX Go Module is strongest at its core category and also carries features in License Compliance, SCA, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What CycloneDX Go Module does well

• Official Go-module CycloneDX generator with three purpose-built modes: app (only deps in a compiled binary, honouring build constraints), mod (whole-module graph, optional test deps), and bin (SBOM from a prebuilt binary)
• Cryptographic hashes matching Go's module-authentication algorithm, giving verifiable component integrity aligned with go.sum
• License detection via go-license-detector reported as CycloneDX evidence (not assertion) by default, overridable with -assert-licenses

Where Vulnetix adds to it: Vulnetix ingests cyclonedx-gomod output (or generates its own CycloneDX 1.7 + SPDX 2.3 for Go) and layers on cross-scanner dedup, exploit-intel prioritisation (EPSS/KEV/ESS/CWSS/LEV), reachability (tree-sitter + CVEAffected), versioned VEX + audit, EOL and SSVC policy, and Safe Harbour autofix. Better together: cyclonedx-gomod's binary-accurate Go inventory feeds Vulnetix's prioritised remediation queue; Vulnetix does not replace it.

No migration, no rip-and-replace. CycloneDX Go Module keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise CycloneDX Go Module results in Vulnetix

Upload CycloneDX Go Module CycloneDX output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

CycloneDX Go Module documentation ↗  ·  Source repository ↗

Wire CycloneDX Go Module into your CI/CD pipeline →