Introducing the ABOM: Why Your CI/CD Pipelines Need a Bill of Materials

An ABOM (Actions Bill of Materials) is a complete inventory of every GitHub Action your CI/CD pipelines depend on — including transitive dependencies buried inside composite actions, reusable workflows, and tool wrappers that your workflow files never mention directly. If you know what an SBOM is, you already get it. SBOMs catalog your application dependencies. ABOMs catalog your pipeline dependencies. And right now, most organizations have no idea what's actually running in their CI. The problem Take this workflow: - name: Scan for vulnerabilities uses: crazy-max/ghaction-container-scan@v3 No mention of Trivy anywhere. But ghaction-container-scan downloads and runs Trivy internally. When 76 of 77 Trivy release tags were poisoned with credential-stealing malware in March 2026, organizations that grepped their workflows for trivy-action found nothing — and assumed they were safe. They weren't. This isn't a Trivy-specific problem. It's a structural one. GitHub Actions have a dependency t