AIsbom Security Scanner

Deep binary introspection of ML model artifacts in your PRs. Scans .pt, .safetensors, and .gguf files for pickle-bomb malware, license risk, and silent drift, then posts a single idempotent comment to your PR with the findings.

Marketplace · CLI on PyPI · Docs

---

Quick start

name: AIsbom Security Scan
on:
  pull_request:
    paths:
      - 'models/**'
      - 'requirements.txt'

permissions:
  contents: read
  pull-requests: write    # required for the PR comment

jobs:
  aisbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: Lab700xOrg/aisbom@v1
        with:
          directory: models/

That's it. The Action will:

1. Scan the models/ directory in your PR head.
2. Upload the resulting SBOM to aisbom.io (via the existing --share flow) for a hosted viewer URL.
3. Post or update a markdown comment on the PR summarizing findings and linking to the viewer.
4. Fail the job (exit 2) if any CRITICAL findings were detected, unless you set fail-on-risk: false.

What the PR comment looks like

A two-section panel with the highest-risk artifacts and a viewer link:

🛡️ AIsbom Security Scan

Summary: 2 CRITICAL, 1 HIGH, 4 MEDIUM across 7 model artifact(s).

Findings
| Risk          | Artifact            | Format       | License    | Issue              |
| 🔴 CRITICAL   | `models/cls.pt`     | PyTorch      | MIT        | Pickle: os.system  |
| 🔴 CRITICAL   | `models/seg.pt`     | PyTorch      | MIT        | Pickle: subprocess |
| 🟠 HIGH       | `models/bert.st`    | SafeTensors  | Apache-2.0 | Unknown metadata   |

[View full SBOM in viewer →](https://aisbom.io/viewer?h=Kx9pQ2v3mLnB&ref=action)

📦 Generated by AIsbom · scanned `models/` · 7 artifact(s) total

When there are no CRITICAL or HIGH findings, the comment collapses to a one-line ✅ confirmation. To suppress the comment entirely on clean PRs, set comment-on-clean: false.

Inputs

Name	Default	Description
directory	.	Directory to scan recursively for AI model artifacts.
output-file	sbom.json	Where to save the generated SBOM JSON in the workspace.
github-token	${{ github.token }}	Token used to post the PR comment. The workflow needs pull-requests: write.
max-rows	10	Maximum rows shown in the findings table; overflow collapses into a "+ N more" line.
comment-on-clean	true	Post a comment when no CRITICAL/HIGH findings detected. Set to "false" for silence on clean PRs.
fail-on-risk	true	Exit non-zero on CRITICAL findings. Set to "false" to make scans informational.
token	(empty)	Optional. Per-repo API token for posting the generated SBOM to your hosted inventory dashboard at app.aisbom.io. Leave unset for purely local PR-comment behavior. Get a token at https://app.aisbom.io/connect.
platform-url	https://app.aisbom.io	Override for the platform webhook URL. Only meaningful when token is set.
fail-on-platform-error	false	Default false. When true, a failed upload fails the CI job.

Outputs

Name	Description
sbom-path	Path to the generated SBOM (default sbom.json).
share-url	Hosted viewer URL for the SBOM (empty if upload was skipped or failed).

Example downstream usage:

- uses: Lab700xOrg/aisbom@v1
  id: aisbom
  with:
    directory: models/
- name: Echo viewer link
  run: echo "SBOM at ${{ steps.aisbom.outputs.share-url }}"

Permissions

The minimum needed by the consuming workflow:

permissions:
  contents: read         # to read the PR head
  pull-requests: write   # to post / update the comment

If you omit pull-requests: write, the scan still runs and the SBOM is still produced — the Action just logs the permission error and skips the comment. Your workflow won't fail over a configuration issue.

Comment idempotency

The Action embeds a hidden <!-- aisbom-action --> marker in the comment body. On every re-run, it finds the existing comment by that marker and updates it in place — you'll never see stacked AIsbom comments on the same PR. Only the first post triggers a PR notification; subsequent updates are silent (GitHub's API treats edit differently from create).

Privacy

Scans run inside the Action container; the model files themselves never leave the GitHub runner. Three things can be sent over the wire:

1. SBOM upload (--share): the rendered CycloneDX JSON is POSTed to aisbom.io/api/sbom-share so the comment can link to a hosted viewer. The SBOM is publicly viewable to anyone with the URL and expires after 30 days. The unguessable 12-char URL token is the only access control.
2. Hosted dashboard upload (opt-in via token): when you set the token input, the same CycloneDX JSON is POSTed to https://app.aisbom.io/v1/scan-result (or your platform-url override) along with the branch/tag name (GITHUB_REF_NAME), so your dashboard at app.aisbom.io can track the repo's SBOM history. Data is stored in the EU. The upload is logged loudly in your CI output every time it happens. Remove the token (or the input) to stop. Without a token, nothing is sent to the dashboard.
3. Anonymous telemetry: two events (github_action_run and github_action_comment_posted) are POSTed to api.aisbom.io/v1/telemetry. No repo identifier, no file paths, no findings content — just severity buckets and whether the comment was created vs updated.

To disable 1 and 3, set AISBOM_NO_TELEMETRY=1 in your workflow's env: block. The Action still posts the comment and produces the SBOM; the share upload and telemetry pings are skipped. The dashboard upload (2) is controlled solely by whether token is set.

Troubleshooting

Why isn't the Action posting comments on my PRs?

Three known causes, all distinguishable from the Action's own log output:

1. The workflow isn't triggered on pull_request. On push / schedule / workflow_dispatch triggers there is no PR to comment on — the SBOM artifact is still produced, but commenting is impossible. The log shows Cannot post PR comment — missing: pr_number … (reported as no_pr_context). Fix: add a pull_request: trigger to the workflow.

2. The PR comes from a fork. GitHub restricts ${{ github.token }} to read-only on pull_request events from forked repositories, regardless of what your permissions: block requests. The scan runs and the SBOM is produced; the comment post fails with a permission error in the log. This is a GitHub security policy, not a configuration issue — there is no safe way around it with the default token.

3. The workflow is missing permissions: pull-requests: write. The log shows Could not post PR comment … Check the workflow has pull-requests: write permission (you may also see GitHub's "Resource not accessible by integration"). Fix: add the Permissions block shown above. The job still succeeds — the Action never fails your CI over a comment-permission issue.

Re-runs create duplicate comments — please file an issue. The marker-based idempotency is meant to be unbreakable, but if you're seeing duplicates we want to know.

See also

• aisbom-cli on PyPI — the same scanner as a standalone CLI.
• AIsbom Advisories — rolling list of risky models we've found in the wild.