Bomly builds open source tools for understanding dependency risk before it lands in production.
- Bomly CLI scans source trees, SBOMs, Git refs, and container images; generates SPDX and CycloneDX SBOMs; enriches packages with vulnerability and license data; evaluates policy; and diffs dependency state across refs.
- Bomly Guard is the official
GitHub Action for pull request dependency review. It wraps
bomly diff, writes job summaries, can comment on pull requests, uploads SARIF when supported, and fails checks when policy is not met. - Example plugin repositories show how to extend Bomly with external detectors, matchers, and auditors without forking the CLI.
Install the CLI:
go install github.com/bomly-dev/bomly-cli/cmd/bomly@latestScan a project:
bomly scan --path . --enrich --auditAdd Bomly Guard to a workflow:
- uses: bomly-dev/bomly-guard@v1
with:
fail-on: high- CLI docs: github.com/bomly-dev/bomly-cli/tree/main/docs
- Guard action: github.com/marketplace/actions/bomly-guard
- Project site and docs: bomly.dev
Issues, feature requests, and contributions are welcome. Please read the shared contributing guide and report security issues privately through the affected repository's Security tab.