Declara
⌘K
engineerP0Updated
Was this page helpful?

Declara publishes a real GitHub Action that generates a CycloneDX SBOM with Syft and pushes it to a product version, so your inventory reflects what actually shipped rather than what you remembered to re-export.

Before you start

  • You need an API key scoped sboms:write. See API v1 reference for how keys are created and stored.
  • You need the product's ID, which you can copy from the product page.
  • Store the API key as a repository secret — never commit it to the workflow file.

Steps

  1. Add the API key as a repository secret, for example DECLARA_API_KEY.

  2. Add a step using the action to your workflow:

    - name: Upload SBOM to Declara
  uses: declara/github-action@v1
  with:
    api-key: ${{ secrets.DECLARA_API_KEY }}
    product-id: your-product-id
    api-url: https://your-declara-host

  3. Leave sbom-path unset if you want the action to generate the SBOM itself — it installs Syft (pinned by digest) and scans the repository. Set sbom-path if you already produce an SBOM elsewhere in your pipeline and want to upload that instead.

  4. version defaults to the tag name when the workflow is triggered by a tag, and to the short commit SHA otherwise. Set it explicitly if you want a different scheme.

What you should see

The action's upload-id output on success. The upload is accepted immediately and parses in the background — a large SBOM won't block your workflow waiting on matching to finish. Once parsing completes, check the product page in Declara for an updated component count, and Alerts for anything Tier A.

Limits

The upload endpoint accepts documents up to 4 MB from CI. A larger SBOM needs to go through the browser upload flow instead, which writes straight to storage.

Related