syft "unable to catalog" empty or partial SBOM in CI

By Daniel Zoghalchali·Latchkey

syft opened the source but a package cataloger errored or found nothing, so the SBOM is empty or missing components. A downstream scan or attestation then has no real inventory to work with.

What this error means

syft logs "unable to catalog" for a cataloger, or finds "0 packages", producing an SBOM whose components array is empty even though the app has dependencies.

[0000] WARN unable to catalog package: error reading package files
[0000]  INFO cataloged contents ... packages=0
error: no packages discovered

Common causes

You scanned the build context, not the built artifact

Pointing syft at a source checkout before dependencies are installed (no node_modules, no site-packages, no vendored modules) leaves nothing to catalog.

A distroless or scratch image with no package metadata

Minimal images carry no OS package database, so the OS cataloger finds zero packages unless language artifacts are present.

How to fix it

Catalog the artifact that contains the dependencies

1. Scan the final built image or the directory after npm ci / pip install, not the bare repo.
2. Confirm the SBOM component count is non-zero before using it.
3. Enable the relevant catalogers for your ecosystem if you scoped them.

npm ci
syft dir:. -o cyclonedx-json=sbom.json
jq '.components | length' sbom.json

Scan language artifacts for minimal images

For distroless images, include the application layers so the language catalogers (npm, python, go) still find packages even without an OS database.

syft docker:ghcr.io/acme/app:latest --select-catalogers "+package" -o spdx-json=sbom.spdx.json

How to prevent it

• Generate the SBOM after dependencies are installed or in the final image.
• Assert a minimum component count in CI so an empty SBOM fails the job.
• Match catalogers to the ecosystems your project actually uses.

Frequently asked questions

Related guides

References

• GitHub Actions documentation