Issues

• yocto: injected purls use the unprefixed property name and invalidate the document

  sbomify/sbomify-action#415 · Filter by author aurangzaib048 opened on Sep 15, 2026

• Decide: container action vs composite action (the non-root question)

  sbomify/sbomify-action#397 · Filter by author vpetersson-bot opened on Aug 31, 2026

• Gradle projects with an Android module fail: no Android SDK in the image

  sbomify/sbomify-action#388 · Filter by author vpetersson-bot opened on Aug 25, 2026

• Kotlin Multiplatform projects cannot be scanned on aarch64

  sbomify/sbomify-action#387 · Filter by author vpetersson-bot opened on Aug 25, 2026

• Exit 0 and a valid SBOM with zero components, from a real lock file

  sbomify/sbomify-action#384 · Filter by author vpetersson-bot opened on Aug 25, 2026
  1

• No JDK is provisioned for a project's requested Gradle toolchain

  sbomify/sbomify-action#383 · Filter by author vpetersson-bot opened on Aug 25, 2026
  1

• Injected cyclonedx-gradle plugin breaks Gradle dependency verification

  sbomify/sbomify-action#382 · Filter by author vpetersson-bot opened on Aug 25, 2026
  1

• Generate SPDX 3.0.1

  sbomify/sbomify-action#335 · Filter by author aurangzaib048 opened on Aug 4, 2026

• Validate every SPDX 3 write path

  sbomify/sbomify-action#326 · Filter by author aurangzaib048 opened on Aug 4, 2026
  1

• Setup wizard emits BOM_TYPE

  sbomify/sbomify-action#324 · Filter by author aurangzaib048 opened on Aug 4, 2026

• Allow PRODUCT_RELEASE for non-SBOM bom_types

  sbomify/sbomify-action#323 · Filter by author aurangzaib048 opened on Aug 4, 2026

• README HBOM section

  sbomify/sbomify-action#322 · Filter by author aurangzaib048 opened on Aug 4, 2026

• End-to-end HBOM passthrough test

  sbomify/sbomify-action#321 · Filter by author aurangzaib048 opened on Aug 4, 2026

• cyclonedx-cargo can never run in the Docker image: two independent failures

  sbomify/sbomify-action#312 · Filter by author vpetersson-bot opened on Jul 31, 2026

• Manifest fallbacks are missing for six ecosystems, not just Rust (#310 fixes one instance)

  sbomify/sbomify-action#311 · Filter by author vpetersson-bot opened on Jul 31, 2026
  1

• docs: monorepo guidance (multiple lockfiles, per-component uploads, releases)

  sbomify/sbomify-action#299 · Filter by author aurangzaib048 opened on Jul 21, 2026

• assessment gate: fail CI when server-side assessments fail

  sbomify/sbomify-action#298 · Filter by author aurangzaib048 opened on Jul 21, 2026

• CLI read surface: components, download, vulns, status subcommands

  sbomify/sbomify-action#297 · Filter by author aurangzaib048 opened on Jul 21, 2026

• Migrate the yocto command onto the wizard's Textual framework

  sbomify/sbomify-action#294 · Filter by author vpetersson opened on Jul 18, 2026

• container-image CBOMs via cbomkit-theia (stretch)

  sbomify/sbomify-action#292 · Filter by author aurangzaib048 opened on Jul 17, 2026
  1

• optional CBOM generation via the existing cdxgen generator

  sbomify/sbomify-action#291 · Filter by author aurangzaib048 opened on Jul 17, 2026

• docs: end-to-end CBOM pipeline recipes

  sbomify/sbomify-action#290 · Filter by author aurangzaib048 opened on Jul 17, 2026

• trivy can't scan syft or cdxgen SBOMs, DT vuln issue

  sbomify/sbomify-action#264 · Filter by author nissessenap opened on Jul 3, 2026
  4

• Apply Docker Hub merge-with-Syft pattern to Chainguard images — COPYd application content currently dropped

  sbomify/sbomify-action#233 · Filter by author nissessenap opened on May 26, 2026

• Image-mode default generator cdxgen -t oci loses ecosystem metadata vs Syft — propose priority swap

  sbomify/sbomify-action#232 · Filter by author nissessenap opened on May 26, 2026