Using the GitHub App

Connect your GitHub repositories to Manifest Cyber for automatic SBOM (software bill of materials) generation and management using either the GitHub App or the GitHub Action.

The GitHub App is ideal for getting up and running quickly, easily, and without technical implementation. For more control, configuration, and advanced settings, consider the Manifest GitHub Action.

Installing the Manifest GitHub App

The GitHub App provides automated SBOM generation with minimal configuration required. Follow these steps to get started.

1. Go to Settings, then select the Integrations tab.

2. Locate the GitHub integration and click Add.

   

3. Click Install on GitHub and follow the prompts to complete installation.

   1. If you are using a self-hosted instance of Manifest, or your URL for Manifest is not app.manifestcyber.com, open the Advanced section and enter the URL of your Manifest instance.
   2. By default, the Manifest GitHub App generates SBOMs across all repositories in your GitHub organization. To generate SBOMs for specific repositories only, click Only select repositories on the Authorize & Request screen.
   3. Click Authorize & Request to install the app.

Configuring SBOM Generation for the App

Once the GitHub App is installed, you can configure SBOM generation settings from within Manifest. From the GitHub Organization page, click the Repositories tab.

Generating SBOMs with the Manifest CLI

Manifest can generate SBOMs for your GitHub repositories using the Manifest CLI instead of relying on GitHub's dependency graph. This is controlled by an organization-level feature flag, rather than a per-repository toggle. Contact Manifest to have it enabled for your organization. Enabling it requires the Admin role, since it changes generation behavior across the organization.

This option is available through the GitHub App. Teams that want similar CLI-based generation through their own GitHub Actions can set that up independently using the Manifest CLI, but it is not the same managed feature as the App-based flag.

When enabled, Manifest temporarily checks out your repository source at the exact commit to generate a high-fidelity SBOM. Source code is deleted immediately after SBOM generation and is never stored. Syft is used as the default SBOM generator.

Archived repositories are excluded from generation automatically. If a repository is archived, Manifest does not generate an SBOM for it regardless of your generation settings.

Turning on the feature flag does not change or reprocess any SBOMs you already have. Existing SBOM history stays as is, and new SBOMs generated going forward reflect the CLI-based method.

Enable or disable repositories

Within the Repositories tab, you can selectively enable or disable whether SBOMs are generated for a specific repository by clicking the toggle at the far right of the table. Each repository also has its own Branch field, which determines the branch Manifest tracks for that repository.

Setting generation triggers or frequency

For each repository with SBOM generation enabled, you can select a Generation Frequency from the following options.

• On Push to Branch: Generates an SBOM whenever a developer pushes to the branch set for that repository.
• On Tag Pushed: Generates an SBOM when a new tag is pushed.
• On Release Published: Generates an SBOM when a release is published. This is a separate trigger from On Tag Pushed, so you can enable one, the other, or both.
• Daily, Weekly, or Monthly: Generates and uploads SBOMs on a fixed schedule.

To set the default SBOM generation setting across all repositories, so you do not have to set each repository individually, set the default on the Settings page.

Pre-release tags are excluded from tag based generation. Tags that follow standard pre-release naming conventions, such as those containing rc, beta, alpha, preview, nightly, dev, pre, or snapshot, do not trigger SBOM generation. Use a stable release tag to trigger generation.

How Manifest assigns the SBOM version

The version recorded on a generated SBOM depends on how generation was triggered.

• Push to the default branch, or scheduled generation on a time interval: Manifest uses the commit SHA as the version.
• On Tag Pushed or On Release Published: Manifest uses the tag name as the version.

Importing GitHub repository topics as labels in Manifest

For each GitHub organization integrated with Manifest, you can choose to import your repositories' topics as labels. To enable this functionality:

1. Navigate to your GitHub organization in Manifest: Settings then Integrations then Edit GitHub.
2. Select the GitHub organization for which you want to import topics.
3. Click the Settings tab within the organization.
4. Switch on the toggle labeled Import GitHub labels.

Labels are added to all asset versions generated after the import toggle is turned on. You can view imported labels on the Manifest Settings then Labels page once the feature is enabled.

Generating SBOMs in GitHub

Manifest provides a GitHub Action that leverages the Manifest CLI for SBOM generation.

What to expect

With the CLI based generation flag enabled, each SBOM reflects the direct dependencies detected by the Manifest CLI rather than GitHub's dependency graph. Manifest checks out your repository source at the exact commit, generates the SBOM with Syft, then deletes the checked out source immediately. It is never stored. Archived repositories never produce new SBOMs. On Tag Pushed and On Release Published runs skip pre-release tags, so you should see SBOMs generated only for stable tags and releases. Version labels correspond to a commit SHA for push and scheduled runs, and to a tag name for tag or release runs.

Troubleshooting

• Symptom: No SBOM is generated for a repository.
  • Cause: The repository is archived, or SBOM generation is disabled for that repository.
  • Fix: Confirm the repository's status in GitHub and check the toggle on the Repositories tab in Manifest.
• Symptom: Pushing a tag does not trigger SBOM generation.
  • Cause: The tag name matches a pre-release naming convention, such as beta or rc.
  • Fix: Use a stable release tag if you want that tag to trigger generation.
• Symptom: The SBOM version does not match the expected tag name.
  • Cause: Generation was triggered by a push to the branch or a scheduled interval, not by On Tag Pushed or On Release Published.
  • Fix: Confirm which trigger produced the SBOM. Only On Tag Pushed and On Release Published use the tag name as the version.
• Symptom: CLI based generation is not available for my organization.
  • Cause: The feature flag has not been enabled.
  • Fix: Have an Admin contact Manifest to request it.

Related docs

• Generating SBOMs in CI/CD Pipelines
• Using the CLI
• Generating SBOMs: Overview