CI/CD (GitHub Actions, GitLab CI…)

What the connector does

Ready-to-copy templates let your CI generate an SBOM or a Trivy report and send it to TechWatchAlert through the public API. The uploaded SBOM replaces the application's previous version, transitive dependencies included; the scan report is checked against the project's cases.

What comes into TechWatchAlert

• The CycloneDX or SPDX SBOM, or a manifest, for each application on every build
• Scan reports from Trivy, Grype, CycloneDX or a network scanner
• Components that disappeared from one version to the next, removed from the stack

Setup

1. Create an organization API key with the “SBOM upload” or “Scan upload” permission
2. Add it as the TWA_API_KEY secret in your CI
3. Copy the GitHub Actions template, GitLab CI template or generic command provided in the app