Your release workflow should produce a Software Bill of Materials for compliance. Which Actions approach best fits?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Run a real SBOM generator in a release job and publish the file as an asset or artifact—there is no branding or concurrency magic switch, and screenshots are not a pipeline.
Full explanation below image
Full Explanation
SBOMs (SPDX, CycloneDX, etc.) inventory components for vulnerability management and procurement compliance. GitHub Actions jobs can invoke generators for language ecosystems, attach outputs via actions/upload-artifact, or add them to GitHub Releases. Dependency graph and export features may complement job-based generation depending on product capabilities, but exam-focused reasoning is: automate generation in CI/CD rather than ad-hoc screenshots. action branding does not generate SBOMs. concurrency has no sbom: true flag. Integrate SBOM creation with signing and provenance where your compliance program requires it, and fail releases when generation fails so artifacts are not published without inventory.