Using the upload portal
Every workflow that starts with a Local Upload node gets its own upload page: a link you can hand to whoever needs to submit SBOMs. They open it, drop in a file, and a run starts.
This is the simplest way to get data into Workflows, and the one to reach for when the people supplying files are not the people who built the workflow.
Setting up the page
Add a Local Upload node as the first node of your workflow and configure it:
| Setting | What it does |
|---|---|
| Headline | The heading on the page. Say what you want. |
| Message | Supporting text — accepted formats, what happens next, who to ask. |
| Require Authentication | Whether visitors must sign in before uploading. |
| Notify when Page Available | Notify users associated with the workflow when the page becomes available. |
The headline and message are the only instructions a submitter gets, so it is worth spending a moment on them. "Upload the CycloneDX SBOM for your latest release — we will check it against EU CRA requirements and send you the results" tells someone everything they need.
Who can upload
Leave Require Authentication off and anyone with the link can submit. That is convenient for external suppliers who do not have accounts, but the link is the only thing standing between the workflow and the open internet — treat it accordingly.
Turn it on when submissions should be limited to people who can sign in.
Publishing and sharing
The page only works once the workflow is published. A draft has no live upload page.
After publishing, open the workflow and share its upload link.
What submitters see
A short page with your headline and message, and somewhere to drop a file. On submission the file is accepted and a run starts immediately — the submitter does not need an account, access to the workflow, or any knowledge of what happens next.
If the workflow has several nodes that take uploads, the page walks the submitter through providing a file for each.
Getting results back
Each execution has a download page listing what every node produced, with the option to download individual outputs or everything at once.
This is where the PDF from a reporting node, or the converted SBOM from a writer node, comes out.
Execution files are retained for a limited period and then removed. If results need to be kept, download them, or add a Database Update or Send Email Report node so the workflow delivers them somewhere permanent.
Related
- Triggers — the other ways to start a workflow.
- Build your first workflow.