Skip to main content

What is FossID Workflows?

FossID Workflows automates what happens to a Software Bill of Materials (SBOM) after it has been generated.

Most tooling in this space focuses on producing SBOMs: scan a codebase, emit an SPDX or CycloneDX file. Workflows starts where that ends. It ingests SBOMs from any source, then validates, normalizes, enriches, merges, checks, and reports on them — automatically, on every delivery, according to rules you define.

You build those rules visually. Drag processing steps onto a canvas, connect them, publish, and the platform runs them for you every time new data arrives.

The problem it solves​

An SBOM you receive is rarely the SBOM you can act on. In practice:

ChallengeWhat it looks like
InconsistencyTwo suppliers describe the same library with different names, versions, and license strings.
Missing dataThe file omits suppliers, licenses, or identifiers a regulation requires.
Multiple sourcesOne product ships components described across several SBOMs that must be reconciled.
ComplianceSomeone has to prove the SBOM meets EU CRA, NTIA, or CISA minimum elements.
RepetitionAll of the above has to happen again for every release, from every supplier, forever.

Doing this by hand does not scale. Workflows turns it into a pipeline that runs unattended.

How it works​

A workflow is a diagram of processing steps. Each step is a node that takes data in, does one job, and passes its result to whatever you connected next.

The built-in Can I trust this SBOM? template looks like this:

Upload → Read SPDX → Verify Licenses → Regulatory Compliance
       → Generate PDF Report

Reading it left to right: a file arrives, it is parsed into the canonical internal format, its licenses are verified against the FossID Knowledge Base, the result is checked against the regulations you selected, and a PDF of the findings is produced.

You assemble that chain once — or start from a template that already has it. From then on, every SBOM that enters the workflow takes the same journey, and every run is recorded with its inputs, outputs, and status.

What makes it different​

  • No code. Pipelines are built by connecting nodes on a canvas, not by writing scripts.
  • Format-agnostic. SPDX and CycloneDX go in and out; internally everything is converted to one canonical representation so processing steps do not care which format you started with.
  • Regulation-aware. Compliance checks for the EU Cyber Resilience Act, NTIA Minimum Elements, and CISA 2025 Minimum Elements are built in.
  • Automated first, human where it matters. Runs are unattended by default, but you can insert an approval gate that pauses a workflow until a person signs off.
  • Connected to FossID. Nodes talk to the FossID Knowledge Base and FossID Workbench directly, so existing FossID data enriches every pipeline.

Where it fits​

Workflows is not a scanner and does not generate SBOMs. It sits downstream of whatever produces them — a scanner, a build pipeline, a supplier — and upstream of wherever the results need to land: a compliance dashboard, an audit archive, a database, or an inbox.

Next steps​