Question

A compliance officer at your company needs a machine-readable inventory of all dependencies for a specific repository to submit to an external auditor. They ask you, the repository maintainer, how to produce this artifact directly from the GitHub UI without writing any custom code or configuring a CI workflow. What should you tell them?

Accepted Answer

Open the repository's dependency graph under the Insights tab and use the 'Export SBOM' button to download an SPDX JSON document

Answer

Enable Dependabot alerts, since GitHub only produces an SBOM after the first vulnerability alert is generated

Answer

Configure the Dependency Review action in a workflow, which writes an SBOM file to the repository root on every pull request

Answer

Use the Dependency submission API to POST the manifest data, which returns a downloadable CycloneDX file in the HTTP response