Skip to content
Slipwaydocs

Syft (SBOM)

Generate SBOMs and attach them as attestations.

At a glance

Section titled “At a glance”
Category Security scanning
Authentication None (runs in the job)
Provider id syft

What it does

Section titled “What it does”
  • SPDX and CycloneDX SBOMs
  • Attestation storage

Set up

Section titled “Set up”
  1. Add the scanner step to your pipeline (a uses: step or a container image).
  2. Upload the report (SARIF, JSON or SBOM) through the scan-report ingest API so Slipway can show findings on the run.
  3. Add a CEL policy gate on the environment, for example scan.critical == 0.
Section titled “Related”