334  cdxgen - configuration reference

335 cdxgen — configuration reference

Configuration surfaces for cdxgen (safety class: safe; category: d-04-provenance-signing-trust) — detected from the upstream documentation at generation time (6 config-surface markers). The invocation reference stays on the main tool page.

335.1 Configuration files

Path	Context
pnpm-lock.yaml	ly limited to: - package-lock.json - yarn.lock - pnpm-lock.yaml - Maven (pom.xml) - Gradle - Scala SBT - Python (requir

335.2 Environment variables

Variable	Upstream context
SPDX

Names extracted heuristically from upstream docs — verify each against the tool’s own docs before use.

335.3 Sample configuration (upstream)

permissions:
  contents: read

steps:
  - name: Download cdx-audit release binary
    env:
      GH_TOKEN: ${{ github.token }}
    run: |
      gh release download v13.4.0 \
        --repo cdxgen/cdxgen \
        --pattern 'cdx-audit-linux-amd64' \
        --pattern 'cdx-audit-linux-amd64.sha256'
      sha256sum -c cdx-audit-linux-amd64.sha256
      chmod +x cdx-audit-linux-amd64
      ./cdx-audit-linux-amd64 --help

deno install --allow-read --allow-env --allow-run --allow-sys=uid,systemMemoryInfo,gid,homedir --allow-write --allow-net -n cdxgen "npm:@cdxgen/cdxgen/cdxgen"

---

ref: pin - verified 2026-10-14