Skip to main content

Starting from a template

When you create a workflow you are offered a set of templates — ready-made graphs for the things people most often need. Picking one drops a complete pipeline onto the canvas, which you can then adjust.

Starting from a template is usually faster than building from scratch, and it is the quickest way to see what a working pipeline looks like.

What you get​

A template is a starting point, not a finished workflow. After picking one you still need to:

  • Fill in the blanks. Steps that reach outside the platform need a connection — verifying licenses needs FossID Knowledge Base access, for instance.
  • Adjust the steps. Add, remove, or reorder nodes to match what you actually need.
  • Publish it. Templates arrive as drafts.

Changing a workflow you created from a template does not affect the template or any other workflow made from it.

Can I trust this SBOM?​

Verify the actual content of an SBOM, including license information and regulatory compliance.

Upload → Read SPDX → Verify Licenses → Regulatory Compliance
       → Generate PDF Report

The best template to start with, and the one the rest of these guides use as their example. It answers a question most people actually have about an SBOM they have been handed: is what it says true, and does it contain what the regulations require?

You will need a FossID Knowledge Base connection for the license verification step.

Walked through node by node in Build your first workflow.

Convert CycloneDX to SPDX​

Transform CycloneDX SBOMs to SPDX format with validation and compliance checks.

Reads CycloneDX, canonicalizes the component data, and writes SPDX back out. Use it when you receive SBOMs in one format but need to supply another.

Because it includes Normalize Data, it also cleans up component names, versions, and identifiers on the way through — worth having when the two formats are being reconciled.

Other templates​

The template list also includes starting points for validating an SBOM, verifying licenses on their own, and producing a security report. What each contains is shown on the canvas as soon as you pick it.

Create My Own Workflow is the empty canvas, for when you would rather start from nothing.

note

Templates may include steps that are still being built out. A node with no configuration options and no description of what it produces is likely one of these — it will pass data through unchanged rather than fail. The node reference documents the nodes that are ready to rely on.