atmos-sbom
Atmos SBOM Provenance
Purpose
Use this skill to generate, review, or publish an Atmos software bill of materials (SBOM). Atmos produces a provenance/build-input SBOM: it records evidence used to build or run the selected infrastructure scope. It is not a claim that every deployed workload has been inventoried.
Atmos-managed source receipts (vendor.lock.yaml, including OCI-sourced artifacts) are always
included, regardless of --scope. --scope additionally selects one of two adapter groups: the
default terraform adds Terraform provider locks and Terraform modules (when the configured
command exposes a stable module graph); --scope dependencies instead adds Atmos's own toolchain
(.tools/toolchain.lock.yaml) and version-track (versions.lock.yaml) evidence. Helm, Helmfile,
discovered deployed images, image package contents, and OpenTofu module graphs are outside this
initial scope and must be reported as incomplete or unavailable rather than silently treated as
absent.