Actions

Generate an evidence-classified, deployment-aware AI Bill of Materials from a version-controlled manifest, conservative repository discovery and CI context.

This repository contains the stable 1.0.0 implementation. The source is licensed under Apache 2.0.

Canonical record Versioned JSON graph containing a system, components, relationships, evidence, assessments, observations, explicit unknowns and build or deployment context.

Manifest Optional aibom.yaml or JSON manifest validated with JSON Schema draft 2020-12.

Repository discovery Conservative detection of hosted model identifiers, prompt files, local model files, contextual dataset files and known AI-related package declarations.

Evidence boundaries Discovery claims repository presence or a source reference. It does not convert those observations into an unsupported claim of runtime use.

Determinism Stable sorting and canonical content digests. A fixed generation timestamp produces the same document identifier for the same inputs.

Validation JSON Schema validation plus relationship, subject, evidence reference, temporal and canonical digest checks.

Explicit unknowns Missing information can record its reason, owner, consequence, compensating control and next review date.

Semantic diff Separates added, removed and changed components, relationships, evidence, assessments, observations and unknowns.