The action auto-detects format (CycloneDX or SPDX) and spec version from the file. It exits non-zero if validation fails.