What's a good tool for creating a software bill of materials (SBOM) from our CI/CD pipeline to meet compliance?

For most CI/CD pipelines, Syft is a strong starting point. It’s an open-source SBOM generator that can scan source trees and container images and emit both CycloneDX and SPDX, making it practical for compliance-oriented pipelines.Endor Labs+1

A practical setup

• Generate: Syft during the build, ideally from the artifact/container that will actually ship—not just dependency manifests. CycloneDX’s guidance specifically recommends integrating SBOM generation into the build process for cybersecurity use cases.CycloneDX
• Format: Produce CycloneDX if your downstream security tooling favors it; produce SPDX as well if customers, auditors, or contractual requirements call for it. Both are widely supported.Endor Labs
• Scan: Use Grype or Trivy against the resulting SBOM for vulnerability gates. Trivy can also generate SBOMs itself, so it can be a simpler all-in-one choice.CycloneDX+1
• Retain: Store the SBOM as a versioned build artifact alongside the exact release/container digest. That gives auditors evidence of what was actually shipped.
• Manage: If you need ongoing tracking across many applications/releases, OWASP Dependency-Track is worth adding; generation and long-term SBOM management are separate problems.Endor Labs

If I were designing a new pipeline: build → Syft → CycloneDX + SPDX → vulnerability scan → sign/store SBOM with release artifact.

If you tell me whether you're using GitHub Actions, GitLab CI, Jenkins, Azure DevOps, or another CI/CD system, I can give you a concrete pipeline configuration.

For a CI/CD-driven compliance program, Syft + OWASP Dependency-Track is a strong open-source combination.

• anchore.com — generates SBOMs during the build. It supports CycloneDX and SPDX, and can inspect containers, source projects, filesystems, and archives.Anchore Open Source+1
• dependencytrack.org — centrally stores and continuously analyzes those SBOMs for vulnerabilities, license issues, and policy violations. It integrates directly with CI/CD via APIs and plugins.Dependency-Track+1

A typical pipeline looks like:

Code → Build → Syft → CycloneDX/SPDX SBOM
                    ↓
             Dependency-Track
                    ↓
       vulnerability/license/policy checks
                    ↓
             pass / fail release

Why I'd pick this for compliance: you get an SBOM artifact for every build, standardized formats, centralized historical inventory, and auditable policy enforcement. Dependency-Track specifically supports CycloneDX and positions its SBOM workflow around NIST/CISA guidance.Dependency-Track+1

If you're primarily container-focused, Syft + Grype is an especially lightweight option: Syft generates the SBOM and Grype scans it for known vulnerabilities.Anchore

If you tell me whether you're using GitHub Actions, GitLab CI, Jenkins, Azure DevOps, or another CI/CD system, I can give you a concrete pipeline configuration.

When choosing a tool to generate a Software Bill of Materials (SBOM) directly inside your CI/CD pipeline for compliance (such as executive orders, CISA guidelines, or SLSA frameworks), the best choice depends on whether you prefer open-source flexibility or a commercial enterprise platform.

The top tools used to automate SBOM generation in CI/CD pipelines include:

• Syft (by Anchore) : An open-source, lightning-fast CLI tool and Go library specifically designed for generating a Bill of Materials from container images and filesystems. It integrates effortlessly into GitHub Actions, GitLab CI, or Jenkins and outputs standard formats like CycloneDX and SPDX.youtube.com+1
• Trivy (by Aqua Security) : A comprehensive, widely adopted open-source security scanner that handles vulnerability detection, misconfigurations, and native SBOM generation in both CycloneDX and SPDX formats. It’s easy to drop into a pipeline stage for a dual-purpose scan and SBOM output.youtube.com+1
• cdxgen (by OWASP) : An exceptional polyglot SBOM generator that excels at deep dependency tree extraction across various source code languages (Node.js, Python, Java, Go, Rust, etc.). If your compliance needs require deeply accurate source-level dependency mapping, cdxgen is a powerhouse.endorlabs.com+1
• Snyk : A commercial developer-first security platform that provides automated SCA (Software Composition Analysis) and compliance-ready SBOM generation out-of-the-box. It’s ideal if you need enterprise reporting, continuous policy enforcement, and remediation advice alongside the raw SBOM.arnica.io+2
• Dependency-Track (by OWASP) : While not a generator itself, this is the gold standard open-source component for managing and consuming SBOMs once they are spit out by your CI/CD pipeline. It continuously analyzes uploaded CycloneDX/SPDX files for real-time risk and compliance tracking.endorlabs.com+1

To help narrow down the ideal fit, tell me:

• What languages or package ecosystems (e.g., Java, Node.js, Python, Go, Docker containers) make up your primary stack?
• Which CI/CD orchestration platform (GitHub Actions, GitLab, Jenkins, Azure DevOps) are you using?
• Do you need just generation , or a full vulnerability/policy management layer downstream?

If your main goal is generating SBOMs automatically in CI/CD for compliance, I’d start with Syft.

• Syft (Anchore) — my default recommendation. It’s open source, CLI-friendly, works well in CI, scans source directories and container images, and can emit both CycloneDX and SPDX—the two formats you’re most likely to encounter in compliance/customer requirements.GitHub+1
• Trivy — a good alternative if you want one CI tool to handle SBOM generation plus vulnerability scanning and other security checks.SecureCoding
• cdxgen — particularly attractive if you standardize on CycloneDX and have a broad mix of language ecosystems.Endor Labs
• OWASP Dependency-Track — use this alongside a generator if you need centralized SBOM inventory, continuous vulnerability monitoring, and policy enforcement. It ingests CycloneDX SBOMs produced in CI/CD.Dependency-Track+1

A practical compliance pipeline

I'd implement:

Build
  ↓
Generate SBOM (Syft)
  ↓
Store SBOM alongside immutable release/artifact
  ↓
Scan SBOM (Grype or Trivy)
  ↓
Policy gate
  ↓
Publish to Dependency-Track
  ↓
Continuous monitoring / audit evidence

For example, Syft can produce both formats directly:

syft myimage:1.2.3 \
  -o spdx-json=sbom.spdx.json \
  -o cyclonedx-json=sbom.cdx.json

GitHubOne important compliance point: don't generate the SBOM only from your source manifests if what you're ultimately shipping is a container/binary. Generate it from the final build artifact/image as well, so the SBOM describes what actually went out the door. Container images can contain OS packages, vendored dependencies, and other components that aren't obvious from the application's lockfiles.Endor Labs

If you tell me whether you're using GitHub Actions, GitLab, Jenkins, Azure DevOps, or another CI/CD system, I can give you a concrete compliance-ready pipeline configuration.

For most teams, I’d start with anchore.com.

Why Syft is a strong CI/CD choice

• CI/CD-friendly: It’s a lightweight CLI designed to run during builds and can generate an SBOM for each artifact.Anchore+1
• Broad coverage: It can inspect container images, source directories, filesystems, and archives, including direct and transitive dependencies across many ecosystems.Anchore
• Compliance-friendly formats: It supports both SPDX and CycloneDX, the formats I’d prioritize for compliance workflows.Anchore Open Source
• Open source: You can deploy it without committing to a commercial platform.
• Supply-chain attestations: Syft can create signed SBOM attestations using in-toto/Sigstore, which is useful when you need stronger provenance and auditability.Anchore Open Source
• Pairs well with vulnerability scanning: github.com can consume Syft SBOMs to identify known vulnerabilities.Anchore

A typical pipeline would look like:

Code → Build → Test → Generate SBOM → Scan SBOM → Sign/Attest → Release
                         │
                         └── SPDX or CycloneDX

For example:

syft myapp:1.2.3 -o cyclonedx-json=sbom.json

If compliance is the bigger concern

If you need central SBOM storage, audit/reporting, policy enforcement, continuous vulnerability monitoring, and compliance controls across many pipelines, I'd look at anchore.com rather than using Syft alone. It builds on Syft and provides centralized SBOM management and automated compliance enforcement.Anchore Docs+1

My recommendation: use Syft + Grype if you're building this yourself; use Anchore Enterprise if you need an organization-wide compliance/SBOM management layer.

If you tell me whether you're on GitHub Actions, GitLab CI, Jenkins, Azure DevOps, or another CI/CD system, I can give you a concrete pipeline configuration.

When integrating Software Bill of Materials (SBOM) generation directly into a CI/CD pipeline for compliance (such as US Executive Order 14028 or the EU Cyber Resilience Act), the best tool depends on whether you prefer a fast, lightweight open-source CLI generator or an enterprise-grade commercial platform that handles policy and lifecycle management.appsecsanta.com+1

Top options fit into distinct categories based on your CI/CD workflow needs:

• 1. Syft (by Anchore) — The leading open-source CLI-first generator. It scans container images, filesystems, and archives in seconds, supports over 30 package ecosystems, and outputs standard Syft on GitHub formats like CycloneDX and SPDX. It is exceptionally fast and easy to plug straight into GitHub Actions, GitLab CI, or Jenkins.endorlabs.com+2
• 1. CycloneDX Generator (cdxgen) — The official OWASP tool for the CycloneDX format. It excels at deep dependency tree extraction across complex application languages (Java, JavaScript, Python, Rust, Go, etc.) and integrates smoothly into automated build pipelines.endorlabs.com+1
• 1. Microsoft SBOM Tool — Highly scalable and built specifically for complex enterprise build systems. It supports an immense variety of package managers and ensures strict manifest generation during the compilation/build phase.endorlabs.com+1
• 1. FOSSA or Snyk — Commercial choices if you need an all-in-one compliance and vulnerability management platform. Beyond just spitting out an SBOM file during CI/CD, they track license compliance, remediation, and policy guardrails across your entire software portfolio.appsecsanta.com+1
• 1. OWASP Dependency-Track — An essential companion tool. While not a build-time generator itself, it acts as a centralized dashboard to ingest, store, analyze, and continuously audit the SBOMs produced by your CI/CD pipeline.endorlabs.com+1

To help narrow down the best fit, let me know:

• What CI/CD platform are you using (GitHub Actions, GitLab, Jenkins, etc.)?
• Are you primarily building containers, source code/filesystems, or compiled binaries?
• Do you need just generation , or a full management and vulnerability tracking platform?