PBOM stands for Pipeline Bill of Materials. It is an inventory of the CI/CD pipeline itself: the jobs, tools, runners, scripts, plugins, and configuration changes that shape how software is built, tested, signed, and released. Unlike an SBOM, which describes application components, a PBOM focuses on the delivery pipeline as the system of record.
PBOMs matter because attackers often target the build path, not just the code. A changed workflow file, a new build dependency, or a modified release step can alter what gets shipped without changing the source in obvious ways. In defense, PBOM-style tracking helps teams spot unauthorized pipeline changes, compare trusted pipeline states over time, and support provenance and audit work when a release looks suspicious.