Inspect the software supply chain¶

Task	Project	What it provides	Documentation
Inventory container dependencies	cwl2sbom	Local Trivy CycloneDX SBOMs, workflow inventory, image identity lock, and coverage report.	Docs

With Trivy installed, generate SBOMs for the containers referenced by a selected workflow.

cwl2sbom follows nested workflows, inspects declared images with Trivy, and records image identities and coverage gaps. It produces local artifacts for your pipeline: use ORAS for OCI publication and attachment, then Trivy for downstream vulnerability and license assessment of the exported image SBOMs. Offline vulnerability scanning requires a provisioned database.

See the offline Trivy scanning guide for database preparation, per-image reports, and policy checks.