create-sbom

Create SBOM

Add an SBOM Orchestration (SscaOrchestration) step to an existing Harness pipeline for a container image or code repository. This skill only works with existing pipelines — do not create standalone SBOM pipelines.

Supported stages: SBOM Orchestration runs in CI, CD (Deployment), and Security (Security) stages. Show stage type in Phase 2 and offer placement options that match the stage type (see references/interactive-wizard-flow.md).

Guide the user through a step-by-step interactive wizard (same UX as /configure-repo-scan): one decision per turn, recommended options marked, pipeline structure shown after fetch, then confirm before harness_update.

• Wizard scripts: references/interactive-wizard-flow.md
• UI ↔ YAML mapping: references/sbom-orchestration-step.md
• CD containerized step groups: references/cd-containerized-step-group.md

---

Interaction model (mandatory)

Follow this UX for every invocation. Do not dump all Pipeline Studio fields in one message.

1. One question per turn — use the AskQuestion tool when available. If unavailable, use a numbered option list with (Recommended) on the default choice (same pattern as container scan).
2. Opening message — briefly state the goal: add SBOM Orchestration to an existing pipeline.
3. Progress breadcrumb — after pipeline fetch, show on each wizard turn: Pipeline · Placement · Method · Source · Details · Attestation · Submit
4. Record answers — keep a running summary of choices; do not re-ask unless the user changes direction.
5. Fetch before configure — harness_get (URL or id) before placement/source questions.
6. Show pipeline structure — list stages and steps (Phase 2) before asking placement.
7. Infer, don’t assume — suggest connector/source from YAML; skip connector question if unambiguous.
8. Never guess image tags — always ask for image or repo+branch in Phase 8.
9. Confirm before write — Phase 10 summary + harness_update only after user confirms.
10. Stop after update — after successful harness_update, provide a configuration summary and point the user to /run-pipeline to execute. Do not call harness_execute, poll executions, or run harness_diagnose in this skill (same pattern as /configure-repo-scan).
11. “Defaults” shortcut — apply recommended wizard choices (see reference) but still ask for image/repo.
12. Phase 3 Placement is never optional — always run Phase 2 (structure) then Phase 3 (AskQuestion for stage + position) before method/source/attestation, even when:
    • The pipeline has only one CI stage
    • An SscaOrchestration step already exists in CI
    • The user said “add SBOM to the pipeline” without naming a stage
    • A prior chat configured the same pipeline (do not reuse that to skip Placement)
13. Never assume pipeline or stage from session history — confirm pipeline URL/ID in Phase 0/1 unless the user pasted it in the current message. Prior workspace context may inform suggestions, not replace the wizard.
14. CD is a different placement path — if the user chooses a Deployment stage (or asks for CD), follow references/cd-containerized-step-group.md end to end (step group, <+artifact.image>, infra). Do not place CD SBOM under execution.steps at the stage top level.
15. CI-only pipeline + CD SBOM — if Phase 2 shows no Deployment stage and the user wants CD, run the CD prerequisites sub-flow (service, environment, infrastructure, K8s connector for stepGroupInfra) before harness_update. See CD edge case below.