sbom

name	sbom
description	Generate a CycloneDX SBOM for the repository via `git-pkgs sbom`. Stored verbatim on the scan.
license	MIT
compatibility	Requires the `git-pkgs` CLI on PATH.
metadata	{"scrutineer.model":"mid","scrutineer.version":1,"scrutineer.output_file":"report.json","scrutineer.output_kind":"freeform","scrutineer.paths":["**"],"scrutineer.ignore_paths":["**/node_modules/**","**/dist/**","**/generated/**","**/__generated__/**","**/*.min.js","**/*.min.css"]}

sbom

Workspace

• ./src — the cloned repository
• ./scripts/generate.sh — the wrapper script
• ./report.json — write the SBOM here

Available scripts

• scripts/generate.sh — runs git-pkgs sbom --format json inside ./src and emits the CycloneDX JSON document to stdout.

What to do

bash scripts/generate.sh > ./report.json

If the script exits non-zero, write {"error": "<stderr message>"} to ./report.json so the failure is visible on the scan page.

The output is consumed as freeform (stored verbatim; no post-processing) so the CycloneDX document is preserved exactly as git-pkgs produced it.