Most recommendations treat SBOM as the “ingredients” and are he build dependencies such as GitHub Actions as the recipe.

However, I think the GitHub SBOM features include GitHub Actions as dependencies, but that is merely a side-effect of their Dependabot heritage.