Written by Nelson Koning
on 

Stop shipping AI blind: bring Model BOMs into your DevSecOps pipeline

If your app now includes a model, you’re not just “deploying code” anymore—you’re releasing a band plus the album, liner notes, and a stack of instruments. Yet many CI/CD pipelines still ship AI features without basic liner notes for the model itself: where it came from, what data it learned from, how it was evaluated, and which knobs were turned along the way. That’s a problem.

Two trends make this urgent:

This piece is a practical guide to using CycloneDX ML‑BOM and MBOM inside DevSecOps, and how to pair that with AI-powered remediation (like GitHub Copilot Autofix) without sacrificing control.

The short version: what is a Model BOM?

CycloneDX’s ML‑BOM extends the familiar SBOM concept to AI systems. You inventory:

It also introduces modelCard fields so you can embed transparent, auditable facts (e.g., task, architecture, datasets, metrics). In CycloneDX 1.6, “machine-learning-model” and “data” are first-class component types, and modelCard is part of the schema. (cyclonedx.org)

Separately, CycloneDX MBOM captures how something was “manufactured” (declared recipe vs. observed run), which is perfect for training pipelines: workflows, tasks, steps, and parameters become reproducible artifacts rather than tribal knowledge. (cyclonedx.org)

Why this matters for security:

A minimal ML‑BOM snippet

Here’s a tiny, illustrative JSON fragment you can attach to a release artifact. It declares one model plus a dataset it references. The names/fields follow CycloneDX 1.6 terminology (abbreviated for readability):

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:2d3b5a9b-1c25-4e9c-a9a2-6e3f99d00111",
  "components": [
    {
      "type": "machine-learning-model",
      "name": "incident-summarizer",
      "version": "2.3.1",
      "modelCard": {
        "modelParameters": {
          "task": "text-summarization",
          "architectureFamily": "transformer",
          "modelArchitecture": "Llama-3.1-8B",
          "datasets": [{ "ref": "urn:uuid:dataset-2024Q4" }]
        },
        "quantitativeAnalysis": {
          "performanceMetrics": [
            { "type": "ROUGE-L", "value": "0.42" }
          ]
        }
      }
    },
    {
      "type": "data",
      "bom-ref": "urn:uuid:dataset-2024Q4",
      "name": "internal-incidents-2024Q4",
      "properties": [{ "name": "provenance", "value": "curated" }]
    }
  ]
}

CycloneDX defines the machine-learning-model and data component types as well as the modelCard structure; you’re not inventing a one-off schema. (cyclonedx.org)

Tip: You can generate ML‑BOM JSON with your own scripts or use helper tooling (for documentation, not generation) like mlbomdoc to produce human-readable docs for reviews. (pypi.org)

Where ML‑BOM fits in your DevSecOps loop

Think “SBOM, but for models,” and wire it into the same gates:

If you already manage SBOMs, this will feel familiar—CycloneDX 1.6 was ratified as ECMA‑424 specifically to serve as a cross-domain xBOM standard (software, hardware, services, cryptography, and AI/ML). (cyclonedx.org)

“Found means fixed” meets “provenance or it doesn’t ship”

AI-powered autofix is here—and useful—if you keep humans in the loop. GitHub Copilot Autofix is generally available, covers major languages for CodeQL alerts, and is free for public repos; you can disable it if you prefer a slower rollout. Pair it with automated tests and code review. (github.blog)

Other platforms now propose fixes too (for example, GitLab Duo’s vulnerability explanations and one‑click merge requests; and Snyk’s AI‑powered Agent Fix). These tools accelerate remediation, but don’t replace governance or threat modeling—especially for model-centric apps. (about.gitlab.com)

Pragmatic stance: let AI suggest, let CI validate, and let ML‑BOM/MBOM prove what you’re actually shipping.

A starter runbook (incremental and boring-on-purpose)

1) Inventory your AI assets

2) Generate ML‑BOM at training time

3) Capture formulation (MBOM)

4) Sign and attest

5) Gate on policy

6) Wire in autofix—and tests

7) Monitor for supply chain drift

A thin GitHub Actions example

This shows the spirit, not a full implementation:

name: build-train-package
on: [push]
jobs:
  ml_pipeline:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Train model
        run: python train.py --config configs/train.yaml --out artifacts/

      - name: Generate ML-BOM
        run: |
          python scripts/build_mlbom.py \
            --model artifacts/model.bin \
            --datasets data/registry.json \
            --metrics artifacts/metrics.json \
            --out artifacts/ml-bom.json

      - name: Add MBOM (formulation)
        run: python scripts/build_mbom.py --workflow .github/workflows/train.yml --out artifacts/mbom.json

      - name: Attach attestations
        run: python scripts/sign_boms.py artifacts/*.json

      - name: CodeQL scan + Copilot Autofix comments
        uses: github/codeql-action/init@v3
        with:
          languages: javascript,python,java
      # Code scanning runs; Copilot Autofix suggestions will appear on PRs if enabled

      - name: Policy gate
        run: python scripts/policy_check.py --bom artifacts/ml-bom.json --mbom artifacts/mbom.json

Behind the scenes, your build_mlbom.py simply writes CycloneDX-conformant JSON and includes modelCard fields; policy_check.py enforces your “no modelCard, no ship” rule. (cyclonedx.org)

Governance anchors you can point to

Common snags (and how to dodge them)

The payoff

When the next AI supply chain wobble hits—an upstream token leak, a tainted dataset, a model backdoor—you’ll be able to answer simple but high-stakes questions fast:

That’s the difference between pausing a service for hours versus minutes. Bring ML‑BOM and MBOM into your DevSecOps loop, sign them, and gate on them. Then let AI help you fix the code while you keep your hands firmly on the wheel.

Further reading and tools:

Ship AI with liner notes. Your future self—and your incident commander—will thank you.