What GitHub compliance feature allows generating a Software Bill of Materials (SBOM)?
Select an answer to reveal the explanation.
Short Explanation and Infographic
GitHub can generate an SBOM directly from the Dependency Graph. Export in SPDX format (the most common standard) from the repository's 'Dependency graph' tab. This gives you a machine-readable inventory of everything your software depends on — increasingly required by government and enterprise customers.
Full explanation below image
Full Explanation
GitHub enables Software Bill of Materials (SBOM) generation from a repository's Dependency Graph. The SBOM provides a complete inventory of a software component's dependencies. GitHub supports: (1) SPDX format (Software Package Data Exchange) — the ISO/IEC standard for SBOMs. (2) CycloneDX format — an alternative SBOM standard popular in security contexts. Access methods: (a) GitHub UI — Dependency Graph tab > Export SBOM button. (b) REST API — GET /repos/{owner}/{repo}/dependency-graph/sbom. (c) GitHub CLI. The SBOM export: requires the Dependency Graph to be enabled (not GHAS). Includes direct and transitive dependencies, license information, and package identifiers. Use cases: supply chain transparency, regulatory compliance (US Executive Order 14028), customer security requirements, vulnerability management.