CycloneDX Ruby Gem Integration Guide

Integrate the CycloneDX Ruby gem with Vulnetix. Generate a CycloneDX SBOM from your Ruby Bundler project and upload to Vulnetix.

Install & scan

$ gem install cyclonedx-ruby
$ cyclonedx-ruby --path . --output bom.json --format JSON

Run CycloneDX Ruby Gem in CI

Scan on every push and upload the report as a workflow artifact:

- name: Set up Ruby
  uses: ruby/setup-ruby@v1
  with:
    ruby-version: '3.3'
    bundler-cache: true

- name: Install CycloneDX Ruby gem
  run: gem install cyclonedx-ruby

- name: Generate CycloneDX SBOM
  run: cyclonedx-ruby --path . --output bom.json --format JSON

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: cyclonedx-ruby
    path: bom.json
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under CycloneDX Ruby Gem's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace CycloneDX Ruby Gem. Keep running it. Vulnetix sits on top of CycloneDX Ruby Gem (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

CycloneDX Ruby Gem is strongest at its core category and also carries features in License Compliance, SCA, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What CycloneDX Ruby Gem does well

• Official CycloneDX SBOM generator for Ruby/Bundler, reading Gemfile.lock as the authoritative record of resolved gems including transitive dependencies
• Broad current CycloneDX spec coverage (1.1 through 1.7, default 1.7) in both XML and JSON, keeping output aligned with the latest spec
• Actively maintained Apache-2.0 project (release 1.1.0 dated June 2026) fitting cleanly into Ruby CI pipelines

Where Vulnetix adds to it: Vulnetix ingests cyclonedx-ruby output (or generates its own CycloneDX 1.7 + SPDX 2.3 for Ruby) and adds cross-scanner dedup into one prioritised queue, exploit-intel prioritisation (EPSS/KEV/ESS/CWSS/LEV), reachability, immutable versioned VEX + audit, EOL and SSVC policy, and Safe Harbour autofix PRs. Better together: the gem supplies the authoritative Bundler inventory, Vulnetix turns it into prioritised, remediable risk - it does not replace the generator.

No migration, no rip-and-replace. CycloneDX Ruby Gem keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise CycloneDX Ruby Gem results in Vulnetix

Upload CycloneDX Ruby Gem CycloneDX output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

CycloneDX Ruby Gem documentation ↗  ·  Source repository ↗

Wire CycloneDX Ruby Gem into your CI/CD pipeline →