Documentation
Bomly docs
These pages are synced from the bomly-cli repository. If this is your first time, start with Getting started.
Getting started
Install Bomly and run your first scan.
Getting started
First scan, enrich, audit, diff — all in five minutes.
Installation
Install methods, `bomly` vs `bomly-lite`, checksum verification, upgrade, uninstall.
Use cases
Recipes for PR gates, SBOMs, triage, and license and offline scans.
Scan targets
Local directories, Git repositories, container images, and existing SBOMs.
Output formats
Text, JSON, SARIF, and SBOM artifacts — when to use each and how to combine them.
SBOM formats
SPDX 2.3 vs. CycloneDX 1.6, when to pick which, ingest and conversion recipes.
How it works
What Bomly does, and why each piece exists.
Architecture
How the scan pipeline is structured: targets, detectors, matchers, auditors.
Detectors
How Bomly discovers projects and turns evidence into a dependency graph.
Matchers
How Bomly enriches packages with vulnerability, license, and lifecycle data.
Auditors
How Bomly turns vulnerability data into actionable findings.
Glossary
Every Bomly term, one sentence each.
Reference
Generated specifications and supported matrices.
Support matrix
Every ecosystem and package manager Bomly can identify today.
Config reference
All config keys, environment variables, and defaults.
Exit codes
Process exit values and what each one means for scripts and CI.
Interactive TUI
Keybindings, tabs, and filters for the --interactive terminal UI.
Domain models
The SDK types behind detection, matching, and audit, and how they connect.
Operations
Running Bomly in CI and extending it with plugins.
CI integration
Drop-in recipes for GitHub Actions, GitLab, Jenkins, Azure DevOps, and CircleCI.
Bomly Guard
The turnkey GitHub Action that gates pull requests on dependency changes via `bomly diff`.
Troubleshooting
Common errors and how to fix them, organized by exit code and symptom.
Plugins
Install, enable, verify, and build external detectors, matchers, and auditors.
Experimental
Features that are still maturing.