CycloneDX Gradle Plugin Integration Guide

Integrate the CycloneDX Gradle Plugin with Vulnetix. Generate a CycloneDX SBOM from your Gradle project, then upload to Vulnetix.

Install & scan

$ # Add to build.gradle (Groovy) or build.gradle.kts (Kotlin):
# plugins { id 'org.cyclonedx.bom' version '1.10.0' }
$ ./gradlew cyclonedxBom

Run CycloneDX Gradle Plugin in CI

Scan on every push and upload the report as a workflow artifact:

- name: Generate CycloneDX SBOM
  run: ./gradlew cyclonedxBom

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: cyclonedx-gradle
    path: build/reports/bom.json
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under CycloneDX Gradle Plugin's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace CycloneDX Gradle Plugin. Keep running it. Vulnetix sits on top of CycloneDX Gradle Plugin (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

CycloneDX Gradle Plugin is strongest at its core category and also carries features in License Compliance, SCA, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What CycloneDX Gradle Plugin does well

• Official CycloneDX generator for Gradle/JVM builds, resolves the full direct + transitive dependency graph from Gradle's own resolution engine, so package URLs, hashes and versions match what actually builds
• Emits valid CycloneDX 1.6 in both JSON and XML, and can produce per-project SBOMs or a single consolidated SBOM across a multi-project Gradle build
• Enriches components with license, hash and organizational/build-system metadata captured straight from POM/Gradle metadata
• Zero-config drop-in for the Gradle ecosystem (Java, Kotlin, Groovy, Scala) that fits naturally into existing build pipelines

Where Vulnetix adds to it: Vulnetix ingests the CycloneDX 1.6 SBOM this plugin produces and layers on what it does not do: vulnerability matching, cross-scanner dedup into one queue, exploit-intel prioritisation (EPSS/KEV/ESS/LEV), reachability, license-policy enforcement, immutable versioned VEX and Safe Harbour autofix. It also normalises to CycloneDX 1.7 / SPDX 2.3. Better together, the plugin generates the JVM inventory, Vulnetix turns it into a prioritised, actionable risk queue.

No migration, no rip-and-replace. CycloneDX Gradle Plugin keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise CycloneDX Gradle Plugin results in Vulnetix

Upload CycloneDX Gradle Plugin CycloneDX output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

CycloneDX Gradle Plugin documentation ↗  ·  Source repository ↗

Wire CycloneDX Gradle Plugin into your CI/CD pipeline →