Generating an SBOM for Any stack (cdxgen)

The step below writes a CycloneDX JSON file in your own pipeline. The CRA Desk scan reads that file and turns it into a readiness report - it never generates one for you.

Run in CI:

npx @cyclonedx/cdxgen -o sbom.json .

Produces:

sbom.json

Format:

CycloneDX JSON

The whole CI job

- uses: actions/checkout@v4
- run: npx @cyclonedx/cdxgen -o sbom.json .
- uses: mmalinowski/cradesk-action@v1
  with:
    sbom-path: sbom.json

generate-sbom:
  script:
    - npx @cyclonedx/cdxgen -o sbom.json .

include:
  - component: gitlab.com/cradesk/scan/readiness@1
    inputs:
      sbom_path: sbom.json

Only the first step changes with your stack - the CRA Desk step after it is identical everywhere.

What goes wrong here

cdxgen auto-detects most stacks, which is also its weakness: a repository holding several will report whatever it recognises, so check the component count matches what you expect.

What CRA Desk does with the result

cdxgen reports whatever stacks it recognises, so coverage follows the package URLs it emits: components landing in one of the nine watched ecosystems are matched against OSV, and the rest are counted as gaps rather than reported as clean.

A generator that runs is not the same as coverage. Components with no purl, no version, or from an ecosystem outside the nine we watch are counted as gaps in every report rather than reported as clean.