##  Example
The following example demonstrates how to generate and store an SBOM using [Syft![Information published on non-SAP site](https://help.sap.com/doc/72d375467c1e4dcb872dfa2998b6328d/CLOUD/en-US/themes/sap-light/img/3rd_link.png)](https://help.sap.com/docs/link-disclaimer?site=https%3A%2F%2Fgithub.com%2Fanchore%2Fsyft "https://github.com/anchore/syft") within a GitHub Actions workflow after containerizing a service. You can replace Syft with any SBOM tool of your choice.
The image below shows an SBOM file generated by a GitHub Actions workflow.
![SBOM File Generated by a GitHub Actions Workflow](https://help.sap.com/doc/72d375467c1e4dcb872dfa2998b6328d/CLOUD/en-US/loio274546317a441014bde394f29514093d_LowRes.png)
SBOM File Generated by a GitHub Actions Workflow
Sample workflow:

```
name: Generate SBOM for Container Image
description: 'Generate a Software Bill of Materials (SBOM) for a container image using Syft'

inputs:
  image:
    description: 'The image to generate the SBOM for'
    required: true
  package_name:
    description: 'The name of the package'
    required: true
  package_version:
    description: 'The version of the package'
    required: true
  sbom_format:
    description: 'The file format of the SBOM [default: cyclonedx-json] (available formats: https://github.com/anchore/syft?tab=readme-ov-file#output-formats)'
    required: false
    default: 'cyclonedx-json'

runs:
  using: 'composite'
  steps:
    - name: Pull the Container Image
      shell: bash
      run: docker pull ${{ inputs.image }}

    - name: Derive SBOM artifact name
      id: derive-artifact-name
      shell: bash
      run: |
        echo "SBOM_ARTIFACT_NAME=$(echo "${{ inputs.package_name }}-sbom" | sed 's/\//_/g')" >> $GITHUB_OUTPUT
        echo "SBOM_DIR=./sbom" >> $GITHUB_OUTPUT

    - name: Download Syft and generate the SBOM
      shell: bash
      env:
       SYFT_FORMAT_SPDX_JSON_PRETTY: "true"
       SYFT_JAVASCRIPT_INCLUDE_DEV_DEPENDENCIES: "false"
      run: |
        curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s --
        ./bin/syft --version
        ./bin/syft ${{ inputs.image }} \
          --scope "all-layers" \
          --source-name "${{ inputs.package_name }}" \
          --source-version "${{ inputs.package_version }}" \
          --output "${{ inputs.sbom_format }}=${{ steps.derive-artifact-name.outputs.SBOM_DIR }}/${{ steps.derive-artifact-name.outputs.SBOM_ARTIFACT_NAME }}"

    - name: Upload SBOM
      uses: actions/upload-artifact@v4
      with:
        name: ${{ steps.derive-artifact-name.outputs.SBOM_ARTIFACT_NAME }}
        path: ${{ steps.derive-artifact-name.outputs.SBOM_DIR }}


```



YesNo
Send
