A platform engineering team wants to answer a compliance auditor's request: they must produce a machine-readable inventory of all direct and transitive open-source components used by a repository, in a widely accepted standard format that can be ingested by the auditor's third-party tooling. The team wants to accomplish this with a built-in GitHub capability rather than a custom script. Which action satisfies this requirement?