{"$schema":"http://cyclonedx.org/schema/bom-1.7.schema.json","bomFormat":"CycloneDX","specVersion":"1.7","serialNumber":"urn:uuid:b5a5badd-26db-4de8-a93a-1d564e1dd0ab","version":1,"metadata":{"timestamp":"2026-11-02T03:07:10Z","tools":{"components":[{"type":"application","author":"anchore","name":"syft","version":"1.55.0"}]},"component":{"bom-ref":"763baa5c58edae2c","type":"file","name":"docker/docker-bench-security","version":"v1.6.1"}},"components":[{"bom-ref":"pkg:github/actions/checkout@27135e314dd1818f797af1db9dae03a9f045786b?package-id=13c256c4a87dce06","type":"library","name":"actions/checkout","version":"27135e314dd1818f797af1db9dae03a9f045786b","cpe":"cpe:2.3:a:actions\\/checkout:actions\\/checkout:27135e314dd1818f797af1db9dae03a9f045786b:*:*:*:*:*:*:*","purl":"pkg:github/actions/checkout@27135e314dd1818f797af1db9dae03a9f045786b","properties":[{"name":"syft:package:foundBy","value":"github-actions-usage-cataloger"},{"name":"syft:package:type","value":"github-action"},{"name":"syft:package:metadataType","value":"github-actions-use-statement"},{"name":"syft:location:0:path","value":"/.github/workflows/slsa.yml"}]},{"bom-ref":"pkg:github/actions/download-artifact@v2.1.1?package-id=1079349f40a0c227","type":"library","name":"actions/download-artifact","version":"v2.1.1","cpe":"cpe:2.3:a:actions\\/download-artifact:actions\\/download-artifact:v2.1.1:*:*:*:*:*:*:*","purl":"pkg:github/actions/download-artifact@v2.1.1","properties":[{"name":"syft:package:foundBy","value":"github-actions-usage-cataloger"},{"name":"syft:package:type","value":"github-action"},{"name":"syft:package:metadataType","value":"github-actions-use-statement"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/download-artifact:actions\\/download_artifact:v2.1.1:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/download_artifact:actions\\/download-artifact:v2.1.1:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/download_artifact:actions\\/download_artifact:v2.1.1:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/download:actions\\/download-artifact:v2.1.1:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/download:actions\\/download_artifact:v2.1.1:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/.github/workflows/slsa.yml"}]},{"bom-ref":"pkg:github/actions/upload-artifact@v3.1.2?package-id=a4b74e6c1aa0c665","type":"library","name":"actions/upload-artifact","version":"v3.1.2","cpe":"cpe:2.3:a:actions\\/upload-artifact:actions\\/upload-artifact:v3.1.2:*:*:*:*:*:*:*","purl":"pkg:github/actions/upload-artifact@v3.1.2","properties":[{"name":"syft:package:foundBy","value":"github-actions-usage-cataloger"},{"name":"syft:package:type","value":"github-action"},{"name":"syft:package:metadataType","value":"github-actions-use-statement"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/upload-artifact:actions\\/upload_artifact:v3.1.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/upload_artifact:actions\\/upload-artifact:v3.1.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/upload_artifact:actions\\/upload_artifact:v3.1.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/upload:actions\\/upload-artifact:v3.1.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/upload:actions\\/upload_artifact:v3.1.2:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/.github/workflows/slsa.yml"}]},{"bom-ref":"pkg:github/pozil/auto-assign-issue@v1.11.0?package-id=fbc0e651c231870a","type":"library","name":"pozil/auto-assign-issue","version":"v1.11.0","cpe":"cpe:2.3:a:pozil\\/auto-assign-issue:pozil\\/auto-assign-issue:v1.11.0:*:*:*:*:*:*:*","purl":"pkg:github/pozil/auto-assign-issue@v1.11.0","properties":[{"name":"syft:package:foundBy","value":"github-actions-usage-cataloger"},{"name":"syft:package:type","value":"github-action"},{"name":"syft:package:metadataType","value":"github-actions-use-statement"},{"name":"syft:cpe23","value":"cpe:2.3:a:pozil\\/auto-assign-issue:pozil\\/auto_assign_issue:v1.11.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:pozil\\/auto_assign_issue:pozil\\/auto-assign-issue:v1.11.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:pozil\\/auto_assign_issue:pozil\\/auto_assign_issue:v1.11.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:pozil\\/auto-assign:pozil\\/auto-assign-issue:v1.11.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:pozil\\/auto-assign:pozil\\/auto_assign_issue:v1.11.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:pozil\\/auto_assign:pozil\\/auto-assign-issue:v1.11.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:pozil\\/auto_assign:pozil\\/auto_assign_issue:v1.11.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:pozil\\/auto:pozil\\/auto-assign-issue:v1.11.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:pozil\\/auto:pozil\\/auto_assign_issue:v1.11.0:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/.github/workflows/issues.yml"}]},{"bom-ref":"pkg:github/slsa-framework/slsa-github-generator@v1.5.0?package-id=dddce56b2ea76500#.github/workflows/generator_generic_slsa3.yml","type":"library","name":"slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml","version":"v1.5.0","cpe":"cpe:2.3:a:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator-generic-slsa3.yml:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator-generic-slsa3.yml:v1.5.0:*:*:*:*:*:*:*","purl":"pkg:github/slsa-framework/slsa-github-generator@v1.5.0#.github/workflows/generator_generic_slsa3.yml","properties":[{"name":"syft:package:foundBy","value":"github-action-workflow-usage-cataloger"},{"name":"syft:package:type","value":"github-action-workflow"},{"name":"syft:package:metadataType","value":"github-actions-use-statement"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator-generic-slsa3.yml:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator-generic-slsa3.yml:slsa_framework\\/slsa_github_generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator-generic-slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:slsa_framework\\/slsa_github_generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa_framework\\/slsa_github_generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator-generic-slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa_framework\\/slsa_github_generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa_framework\\/slsa_github_generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:slsa_framework\\/slsa_github_generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator-generic:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator-generic-slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator-generic:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator-generic:slsa_framework\\/slsa_github_generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator_generic:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator-generic-slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator_generic:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator_generic:slsa_framework\\/slsa_github_generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa_framework\\/slsa_github_generator\\/.github\\/workflows\\/generator_generic:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator-generic-slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa_framework\\/slsa_github_generator\\/.github\\/workflows\\/generator_generic:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa_framework\\/slsa_github_generator\\/.github\\/workflows\\/generator_generic:slsa_framework\\/slsa_github_generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator-generic-slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator:slsa_framework\\/slsa_github_generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa_framework\\/slsa_github_generator\\/.github\\/workflows\\/generator:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator-generic-slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa_framework\\/slsa_github_generator\\/.github\\/workflows\\/generator:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa_framework\\/slsa_github_generator\\/.github\\/workflows\\/generator:slsa_framework\\/slsa_github_generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa-framework\\/slsa-github:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator-generic-slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa-framework\\/slsa-github:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa-framework\\/slsa-github:slsa_framework\\/slsa_github_generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa_framework\\/slsa_github:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator-generic-slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa_framework\\/slsa_github:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa_framework\\/slsa_github:slsa_framework\\/slsa_github_generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa-framework\\/slsa:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator-generic-slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa-framework\\/slsa:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa-framework\\/slsa:slsa_framework\\/slsa_github_generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa_framework\\/slsa:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator-generic-slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa_framework\\/slsa:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa_framework\\/slsa:slsa_framework\\/slsa_github_generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator-generic-slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa:slsa-framework\\/slsa-github-generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:slsa:slsa_framework\\/slsa_github_generator\\/.github\\/workflows\\/generator_generic_slsa3.yml:v1.5.0:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/.github/workflows/slsa.yml"}]},{"bom-ref":"pkg:github/softprops/action-gh-release@v0.1.15?package-id=9f656506fae40668","type":"library","name":"softprops/action-gh-release","version":"v0.1.15","cpe":"cpe:2.3:a:softprops\\/action-gh-release:softprops\\/action-gh-release:v0.1.15:*:*:*:*:*:*:*","purl":"pkg:github/softprops/action-gh-release@v0.1.15","properties":[{"name":"syft:package:foundBy","value":"github-actions-usage-cataloger"},{"name":"syft:package:type","value":"github-action"},{"name":"syft:package:metadataType","value":"github-actions-use-statement"},{"name":"syft:cpe23","value":"cpe:2.3:a:softprops\\/action-gh-release:softprops\\/action_gh_release:v0.1.15:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:softprops\\/action_gh_release:softprops\\/action-gh-release:v0.1.15:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:softprops\\/action_gh_release:softprops\\/action_gh_release:v0.1.15:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:softprops\\/action-gh:softprops\\/action-gh-release:v0.1.15:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:softprops\\/action-gh:softprops\\/action_gh_release:v0.1.15:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:softprops\\/action_gh:softprops\\/action-gh-release:v0.1.15:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:softprops\\/action_gh:softprops\\/action_gh_release:v0.1.15:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:softprops\\/action:softprops\\/action-gh-release:v0.1.15:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:softprops\\/action:softprops\\/action_gh_release:v0.1.15:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/.github/workflows/slsa.yml"}]},{"bom-ref":"4410565bfaf4eea4","type":"file","name":"/.github/workflows/issues.yml","hashes":[{"alg":"SHA-1","content":"f2a874af7bcf79b94487c0e62ec88e52ed83271c"},{"alg":"SHA-256","content":"5f45c71a033d9362348481cc6ddb11de3a2fe562329b4b8df193139c910dc0d3"}]},{"bom-ref":"8da355626264bc8e","type":"file","name":"/.github/workflows/slsa.yml","hashes":[{"alg":"SHA-1","content":"5f7df5f4984d2e0c74416159589fd1730717db91"},{"alg":"SHA-256","content":"06ba1cf9936ca334e1eb1182bd63ded2a436f88069190f45bed0b90272db9520"}]}]}