Reuse a file in another tool

Take a report from one run and upload it as input to the next.

Example: create an SBOM, then check vulnerabilities

Run Syft to create sbom.json and include that path in its requested outputs. Wait for completion and download the file.

1. Verify and upload the result

Check the downloaded file against the SHA-256 returned by the first run. Use the upload helper to upload those bytes and get a sealed artifact ID.

2. Start the next tool

Use that ID as sbom.json in a Grype invocation. The example shows the request shape; replace the illustrative artifact ID with the ID returned by your upload.

3. Keep the relationship

Store both run IDs and the intermediate file hash in your application. Each run is independent, so filenames and processes do not carry over automatically. You can reuse the same sealed input in several checks.

When you are finished

Delete retained runs and artifacts explicitly if you no longer need them. An artifact referenced by a retained run cannot be deleted until that reference is removed.