How to generate a SBOM (CycloneDX/SPDX) from Azure DevOps repositories (if possible) without cloning the source code?

Question

I am working on a project that needs to manage multiple applications hosted in different organizations. One of my main requirements is to generate a Software Bill of Materials (SBOM), preferably in CycloneDX or SPDX format, based on the dependencies of each application repository located in Azure DevOps.

However, there are some constraints in my use case:

• I do not want to clone or store the source code locally (for both security and scalability reasons).

I will not have full access to the organization where the repositories are hosted. I am acting as an external manager who only needs dependency and vulnerability information, not the source code itself.

My backend is built with Django, and it should either generate or consume the SBOMs.

My questions are:

Is there any native support in Azure DevOps (e.g., REST API, extension, or pipeline task) that can generate SBOMs directly from a repository?

If not, is there a way to access dependency manifest files only (like requirements.txt, package.json, pom.xml, etc.) through the Azure DevOps API, without needing to perform a full clone?

Has anyone implemented a solution where external systems can trigger SBOM generation (CycloneDX/SPDX) in Azure DevOps pipelines and retrieve the result as an artifact?

Any guidance, best practices, or examples would be very helpful.I am working on a project that needs to manage multiple applications hosted in different organizations. One of my main requirements is to generate a Software Bill of Materials (SBOM), preferably in CycloneDX or SPDX format, based on the dependencies of each application repository located in Azure DevOps.

However, there are some constraints in my use case:

I do not want to clone or store the source code locally (for both security and scalability reasons).

I will not have full access to the organization where the repositories are hosted. I am acting as an external manager who only needs dependency and vulnerability information, not the source code itself.

My backend is built with Django, and it should either generate or consume the SBOMs.

My questions are:

1. Is there any native support in Azure DevOps (e.g., REST API, extension) that can generate SBOMs directly from a repository?

If not, is there a way to access dependency manifest files only (like requirements.txt, package.json, pom.xml, etc.) through the Azure DevOps API, without needing to perform a full clone?

Has anyone implemented a solution where external systems can trigger SBOM generation (CycloneDX/SPDX) in Azure DevOps pipelines and retrieve the result as an artifact?

Any guidance, best practices, or examples would be very helpful.

Answer 1

Hi CAROLINA PINHEIRO DOS SANTOS

As of now, Azure DevOps does not have built-in support specifically for generating SBOMs in CycloneDX or SPDX formats directly from repositories.

However, Microsoft provides an SBOM Tool that integrates well with Azure Pipelines. It supports SPDX 2.2 format and can be added as a pipeline task.

Refer to these documents:

• https://github.com/microsoft/sbom-tool
• https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft

There’s also a small unofficial ADO Marketplace task wrapping sbom-tool if you prefer a GUI task over raw script - https://marketplace.visualstudio.com/items?itemName=rhyskoedijk.sbom-tool

You can also use CycloneDX CLI tools or language-specific modules (e.g., CycloneDX for .NET, Java, Node.js) within pipelines to generate SBOMs in CycloneDX format - https://dev.to/atahanceylan/creating-sbom-with-sbom-tool-and-cyclonedx-on-azure-devops-1de

Here are answers for the above questions:

• You can use the Azure DevOps REST API to access the contents of files in a repository. Specifically, you can use the Get Item API to retrieve specific files like requirements.txt, package.json, or pom.xml without cloning the entire repository. Example - API:

    GET https://dev.azure.com/{organization}/{project}/_apis/git/repositories/{repositoryId}/items?path={filePath}&api-version=6.0
  

• You can set up a pipeline that runs a script to generate the SBOM. You can use tools like cyclonedx-python for Python projects or spdx-tools for other languages to generate the SBOM. After generating the SBOM, you can publish it as an artifact in the pipeline. Use the Publish Pipeline Artifact task to make the SBOM available for download.
• Use a webhook or an API call from your Django backend to trigger the pipeline when you need to generate an SBOM. After the pipeline runs, you can use the Azure DevOps REST API to download the published artifact containing the SBOM.

Refer to these documents for API Related:

https://learn.microsoft.com/en-us/rest/api/azure/devops/git/items?view=azure-devops-rest-7.1

https://learn.microsoft.com/en-us/rest/api/azure/devops/build/source-providers/get-file-contents?view=azure-devops-rest-7.1

https://learn.microsoft.com/en-us/rest/api/azure/devops/pipelines/runs/run-pipeline?view=azure-devops-rest-7.1

https://learn.microsoft.com/en-us/rest/api/azure/devops/pipelines/artifacts/get?view=azure-devops-rest-7.1&utm_source=chatgpt.com

Hope this helps!

Please Let me know if you have any queries.