CycloneDX Rust Cargo Integration Guide

Integrate cargo-cyclonedx with Vulnetix. Generate a CycloneDX SBOM from your Rust Cargo project and upload to Vulnetix.

Install & scan

$ cargo install cargo-cyclonedx
$ cargo cyclonedx --format json --output-cdx bom.json

Run CycloneDX Rust Cargo in CI

Scan on every push and upload the report as a workflow artifact:

- name: Install cargo-cyclonedx
  run: cargo install cargo-cyclonedx

- name: Generate CycloneDX SBOM
  run: cargo cyclonedx --format json --output-cdx bom.json

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: cyclonedx-rust
    path: bom.json
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under CycloneDX Rust Cargo's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace CycloneDX Rust Cargo. Keep running it. Vulnetix sits on top of CycloneDX Rust Cargo (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

CycloneDX Rust Cargo is strongest at its core category and also carries features in License Compliance, SCA, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What CycloneDX Rust Cargo does well

• Official CycloneDX generator for Rust, calling into Cargo internally to produce authoritative, accurate Cargo workspace component inventories
• Uses pkg:cargo PURLs and evaluates feature flags so the SBOM reflects the real dependency graph including transitive crates
• Ships both a reusable cyclonedx-bom Rust library (read/write CycloneDX to/from structs) and the cargo-cyclonedx CLI, so it embeds cleanly into Rust toolchains and CI

Where Vulnetix adds to it: Vulnetix ingests cargo-cyclonedx CycloneDX output (or generates its own CycloneDX 1.7 + SPDX 2.3 for Rust) and layers on cross-scanner dedup into one prioritised queue, exploit-intel (EPSS, CISA KEV, ESS, CWSS, LEV), reachability, versioned VEX, EOL and SSVC policy, and Safe Harbour autofix. Better together: cargo-cyclonedx gives the authoritative Cargo inventory, Vulnetix turns it into prioritised, actionable risk - it does not replace the generator.

No migration, no rip-and-replace. CycloneDX Rust Cargo keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise CycloneDX Rust Cargo results in Vulnetix

Upload CycloneDX Rust Cargo CycloneDX output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

CycloneDX Rust Cargo documentation ↗  ·  Source repository ↗

Wire CycloneDX Rust Cargo into your CI/CD pipeline →