bomly-dev/Bomly Guard
Review dependency changes in pull requests, and block risky ones
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 5, 2026
- License
- Apache 2.0
Pinned Snippet
uses: bomly-dev/bomly-guard@a03710dfd6ac3ddf2aae1f8f011815fa73a81ed1 # v1.1.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| repo-token | Token for repository API access. | no | ${{ github.token }} |
| version | Bomly CLI version to install, such as latest, v0.4.6, or 0.4.6. | no | latest |
| cli-token | Optional token for Bomly CLI release API and download requests, useful if public GitHub rate limits are hit. | no | — |
| log-level | Bomly CLI log level, one of quiet, verbose, or debug. | no | verbose |
| base-ref | Base git ref to compare. Pull requests default to the PR merge base. | no | — |
| head-ref | Head git ref to compare. | no | — |
| config-file | Local config path or owner/repo/path@ref external config reference. | no | — |
| external-repo-token | Token for reading an external config file. | no | — |
| enrich | Enrich packages with external license and vulnerability data. | no | true |
| audit | Evaluate policy and create findings from package vulnerability data. | no | true |
| analyze | Run reachability analysis for supported ecosystems. | no | false |
| fail-on | Comma-separated policy constraints that should fail review. | no | — |
| allow-licenses | Comma-separated SPDX licenses to allow. | no | — |
| deny-licenses | Comma-separated SPDX licenses to deny. | no | — |
| license-exempt-packages | Comma-separated package URLs exempt from license policy. | no | — |
| allow-vulnerability-ids | Comma-separated vulnerability IDs to allow. | no | — |
| deny-packages | Comma-separated package URLs to deny. | no | — |
| deny-groups | Comma-separated package URL namespaces to deny. | no | — |
| protected-packages | Comma-separated package names to protect from typosquatting. | no | — |
| typosquat-threshold | Similarity threshold for suspicious package names. | no | — |
| typosquat-mode | Typosquatting policy mode, warn or fail. | no | — |
| warn-only | Downgrade failing findings to warnings. | no | false |
| ecosystems | Ecosystem selectors passed to bomly diff --ecosystems. | no | — |
| detectors | Detector selectors passed to bomly diff --detectors. | no | — |
| matchers | Matcher selectors passed to bomly diff --matchers. | no | — |
| auditors | Auditor selectors passed to bomly diff --auditors. | no | — |
| analyzers | Analyzer selectors passed to bomly diff --analyzers. | no | — |
| install-first | Run detector-specific dependency installation before resolving graphs. | no | false |
| install-args | Comma-separated detector-specific install arguments. | no | — |
| comment-summary-in-pr | Comment mode: never, always, or on-failure. | no | never |
| upload-sarif | SARIF upload mode: auto, true, or false. Auto skips unsupported private repos cleanly. | no | auto |
Outputs
| name | description |
|---|---|
| comment-content | Prepared dependency review markdown summary. |
| dependency-changes | All dependency changes as JSON. |
| vulnerable-changes | Introduced vulnerability findings as JSON. |
| invalid-license-changes | Introduced license findings as JSON. |
| denied-changes | Introduced denied package findings as JSON. |
| suspicious-package-changes | Introduced suspicious package findings as JSON. |
| sarif-file | Path to the generated SARIF file. |