Your release workflow should produce a Software Bill of Materials for compliance. Which Actions approach best fits?
Select an answer to reveal the explanation.
Short Explanation
Run a real SBOM generator in a release job and publish the file as an asset or artifact—there is no branding or concurrency magic switch, and screenshots are not a pipeline.
Full Explanation
SBOMs (SPDX, CycloneDX, etc.) inventory components for vulnerability management and procurement compliance. GitHub Actions jobs can invoke generators for language ecosystems, attach outputs via actions/upload-artifact, or add them to GitHub Releases. Dependency graph and export features may complement job-based generation depending on product capabilities, but exam-focused reasoning is: automate generation in CI/CD rather than ad-hoc screenshots. action branding does not generate SBOMs. concurrency has no sbom: true flag. Integrate SBOM creation with signing and provenance where your compliance program requires it, and fail releases when generation fails so artifacts are not published without inventory.