For these projects, the practical workflow is for developers to curate component metadata by hand and generate a compliant SBOM from it deterministically, reproducibly, and at per-artifact granularity. We have seen this pattern at many organizations, we wanted to create some basic standardizations to help capture the intent.
https://github.com/interlynk-io/bomtique
If you are working in non-manifest based languages and have CRA regulations requiring you to create SBOM, give it a shot and let us know if this helps.
An overview of how it can be used
https://github.com/interlynk-io/bomtique/blob/main/docs/getting-started.md
If you use AI coding agents, use the prompt below to get started.
https://github.com/interlynk-io/bomtique/blob/main/prompts/agent-onboarding.md