GitHub SBOM Export Integration Guide

Export SPDX SBOMs from any GitHub repository's dependency graph using the REST API or gh CLI. No build required: GitHub generates SBOMs from your existing Dependabot dependency graph.

Run GitHub SBOM Export in CI

Scan on every push and upload the report as a workflow artifact:

- name: Export GitHub dependency SBOM
  run: |
    gh api "/repos/${{ github.repository }}/dependency-graph/sbom"       > sbom.spdx.json
  env:
    GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: github-sbom
    path: sbom.spdx.json
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under GitHub SBOM Export's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace GitHub SBOM Export. Keep running it. Vulnetix sits on top of GitHub SBOM Export (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

GitHub SBOM Export is strongest at its core category and also carries features in SCA, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What GitHub SBOM Export does well

• Zero-configuration SPDX SBOM export via REST API for any repo with Dependency Graph enabled, no scanner to run or install
• Sourced from GitHub's Dependency Graph (manifests + Dependabot + Dependency Submission API), so build-time and transitive deps can be captured across many ecosystems
• SPDX JSON schema includes license fields (licenseConcluded, licenseDeclared, copyrightText) and versionInfo, giving license and version data in one export
• Tightly integrated with the GitHub platform, so SBOMs stay in sync with the repo and feed the same graph that powers Dependabot alerts

Where Vulnetix adds to it: Vulnetix ingests the GitHub SPDX SBOM as one input to its cross-scanner dedup layer and enriches it with CycloneDX 1.7 output, exploit-intel prioritisation, reachability, versioned VEX, EOL and SSVC policy that the export itself does not provide. GitHub remains the source-of-truth dependency inventory; Vulnetix consumes it rather than replacing the Dependency Graph.

No migration, no rip-and-replace. GitHub SBOM Export keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise GitHub SBOM Export results in Vulnetix

Upload GitHub SBOM Export SPDX output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

GitHub SBOM Export documentation ↗

Wire GitHub SBOM Export into your CI/CD pipeline →