Implement SBOM generation in release pipelines
Implementation Effort: Medium – Choosing an SBOM format, adding generation to every release pipeline, and defining storage and verification policy takes several steps across build teams.
User Impact: Low – SBOMs are produced and published by the pipeline; end users are not affected.
Lifecycle Stage: Build
Overview
Generate a Software Bill of Materials (SBOM) in every release pipeline so each artifact is published with a machine-readable inventory of its components and dependencies. Follow the organization's software supply chain standard before choosing formats, storage locations, signing requirements, verification policy, and exception handling. This gives your organization an auditable record for incident response, procurement, and downstream verification.
This task implements NIST SSDF PS.3.2 (collect, safeguard, maintain, and share provenance data for all components of each software release) and RV.1.1 (gather information necessary to respond to vulnerabilities). Choose an SBOM format — SPDX or CycloneDX — aligned to your organization's supply chain standard, then automate generation in every release pipeline.
GitHub can export a repository SBOM from the dependency graph in SPDX JSON format. That repository export is useful source inventory, but it does not replace per-release SBOM generation from the built artifact. For release artifacts, use Microsoft SBOM Tool for SPDX output, or use Syft, CycloneDX CLI, or another approved generator when CycloneDX output is required.
In Azure Pipelines, generate an SBOM during the build or release, publish the SBOM as a pipeline artifact, and where applicable attach it to the release package or container image.
Without automated SBOM generation, organizations cannot answer basic questions during a security incident: which products use the compromised library, which versions are affected, and which environments are at risk. Automated SBOM generation in CI/CD pipelines eliminates this blind spot by producing a consistent, timestamped record for every release.
SBOM generation strengthens Verify explicitly because downstream consumers, deployment gates, and security teams can inspect the inventory before promoting an artifact. It also supports Assume breach by giving incident responders a pre-built index they can query the moment a supply chain compromise is detected.