Aikido ExportSbom
CertifiedExport the SBOM/license report of an Aikido code repository
Aikido ExportSbom
Export the SBOM/license report of an Aikido code repository
Downloads the license and package overview for a code repository and stores it to internal storage. Fails with an actionable message if the repository has no completed scan yet — run Scan first.
type: io.kestra.plugin.aikido.repositories.ExportSbomExamples
Export a repository's SBOM in SPDX format
id: export_repository_sbom
namespace: company.security
inputs:
- id: repo_id
type: STRING
tasks:
- id: export_sbom
type: io.kestra.plugin.aikido.repositories.ExportSbom
clientId: "{{ secret('AIKIDO_CLIENT_ID') }}"
clientSecret: "{{ secret('AIKIDO_CLIENT_SECRET') }}"
repositoryId: "{{ inputs.repo_id }}"
format: SBOM_SPDX
Properties
clientId *string
OAuth2 client ID
Client ID of an Aikido API client with the OAuth2 scopes required by the tasks and triggers being used (for example issues: read, repositories: write). Client credentials are created in the Aikido console under Settings > API access.
clientSecret *string
OAuth2 client secret
Client secret of the Aikido API client. Exchanged for a short-lived JWT Bearer token on first use (and transparently refreshed before it expires); never logged or included in error messages.
repositoryId *string
Code repository ID
assets
Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.
io.kestra.core.models.assets.AssetsDeclaration
IGNOREFAILWARNAsset failure behavior
Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.
Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.
The assets consumed as inputs.
io.kestra.core.models.assets.AssetIdentifier
1The assets produced as outputs.
io.kestra.plugin.ee.assets.Dataset
1150{}1150io.kestra.plugin.ee.assets.File
1150{}1150io.kestra.plugin.ee.assets.Table
1150{}1150io.kestra.plugin.ee.assets.VM
1150{}1150io.kestra.core.models.assets.External
1150{}1150io.kestra.core.models.assets.Custom
11501Custom asset type
{}1150baseUrl string
https://app.aikido.devAikido API base URL
Base URL of the Aikido Security application for your account's region: https://app.aikido.dev (Europe, default), https://app.us.aikido.dev (United States), https://app.au.aikido.dev (Australia), or https://app.me.aikido.dev (Middle East). The OAuth2 token endpoint is derived from this same host, so a region override applies to both authentication and API calls.
format string
CSVCSVSBOMSBOM_SPDXExport format
CSV for a flat license/package table, SBOM for CycloneDX, SBOM_SPDX for SPDX. Defaults to CSV.
includeRiskReason booleanstring
falseInclude the reason a package was flagged as risky
Defaults to false.
includeVex booleanstring
falseInclude VEX (Vulnerability Exploitability eXchange) statements
Defaults to false.
location string
Filter by path
Only include packages found under this path.
scope string
ALLALLONLY_DEV_DEPSEXCLUDE_DEV_DEPSDependency scope to include
Defaults to ALL.
Outputs
size integer
Size of the stored file, in bytes
uri string
uriStored SBOM/license report URI
