One-click SBOM export for GitHub repositories
Following the pattern set by Executive Order 14028, security and compliance teams increasingly rely on software bills of materials (SBOMs) to inventory the open source components in their projects, assess exposure to newly disclosed vulnerabilities, and confirm license policy alignment. GitHub is introducing a new Export SBOM function that lets anyone with read access to a cloud repository generate an NTIA-compliant SBOM in a single click.
The export produces a JSON file in the industry-standard SPDX format, capturing project dependencies and metadata such as versions and licenses. That file can feed into existing security and compliance tooling, or be opened in Microsoft Excel (with a JSON-to-CSV conversion for Google Sheets).
On-demand generation plus workflow integration
Beyond the self-service button, developers can fold SBOM generation into their regular pipelines. If a project already has an SBOM, it can be uploaded to the dependency graph via the dependency submission API to trigger Dependabot alerts for dependencies with known vulnerabilities. For programmatic generation, GitHub offers an SBOM gh CLI extension that builds SBOMs from the repository’s dependency graph, and third-party GitHub Actions can generate them at build time. A REST API for generating SBOMs from the dependency graph is slated to arrive soon.
Self-service SBOMs are free for all cloud repositories on GitHub as part of the supply chain security offering.
How to export
Click the Export SBOM button on the repository’s dependency graph page to generate the machine-readable SPDX JSON file.
