How to Generate a Signed CycloneDX 1.6 CBOM in GitHub Actions & GitLab CI (Zero Egress)

White House OMB M-23-02, NIST IR 8547, NSA CNSA 2.0, PCI-DSS 4.0, and EU DORA all converge on the same engineering prerequisite: teams need a machine-readable, repeatable CycloneDX 1.6 Cryptographic Bill of Materials (CBOM) generated directly from source code and build artifacts—without shipping proprietary repositories to an external SaaS scanner.

1. Separate Your Free SARIF Fail Gate from Paid CBOM Evidence

A clean CI pipeline separates pull-request gating from compliance artifact generation:

2. Reference GitHub Actions Workflow (`zero-egress`)

Install the signed CipherMap CLI binary from the offline Evaluation Pack on your runner image (verifying its SHA-256 checksum), then enforce both SARIF code scanning and CycloneDX 1.6 CBOM artifact retention:

name: PQC Gate & CycloneDX 1.6 CBOM
on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read
  security-events: write

jobs:
  cryptographic-inventory:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run offline 12-language PQC scan (SARIF + high-severity gate)
        run: |
          ciphermap scan . --offline --no-telemetry --exclude-vendored --format sarif -o results.sarif
          ciphermap scan . --offline --no-telemetry --exclude-vendored --fail-on high

      - name: Upload SARIF 2.1.0 to GitHub Code Scanning
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif

      - name: Export CycloneDX 1.6 CBOM & Signed Audit Bundle
        if: github.ref == 'refs/heads/main'
        env:
          CIPHERMAP_LICENSE: ${{ secrets.CIPHERMAP_LICENSE }}
        run: |
          ciphermap cbom . --offline --no-telemetry -o cbom.cdx.json
          ciphermap report . --offline --no-telemetry -o pqc-audit-report.html

      - name: Retain CBOM & Composite Ed25519 + ML-DSA-65 Signatures
        if: github.ref == 'refs/heads/main'
        uses: actions/upload-artifact@v4
        with:
          name: cyclonedx-1-6-cbom-evidence
          path: |
            cbom.cdx.json*
            pqc-audit-report.html*

3. Verifying Composite `Ed25519 + ML-DSA-65` Provenance Offline

Auditors and downstream procurement teams do not need a paid CipherMap seat to verify exported evidence. Tier A signed audit bundles emit composite Ed25519 + ML-DSA-65 (.pqc.sig) detachment signatures—and Tier B Enterprise Immunity emits signed CISA IBOM and 4-Gate ProofBundle receipts—all verifiable offline with Free subcommands (ciphermap verify, ciphermap immunity attest --verify). Note that cryptographic signatures authenticate artifact integrity and origin, not scan completeness—always inspect coverage_status alongside the signature.