Bomly GuardReview Dependency Drift Before It Lands.

Quick start

Drop this into .github/workflows/bomly-guard.yml. On every pull request the action installs the CLI, diffs the dependency changes, and fails the job when a high-severity finding slips in.

name: Bomly Guard

on:
  pull_request:

permissions:
  contents: read
  pull-requests: write
  security-events: write

jobs:
  dependency-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - uses: bomly-dev/bomly-guard@v1
        with:
          fail-on: high
          comment-summary-in-pr: on-failure

fetch-depth: 0 matters — the action compares the PR head against the merge base, so it needs enough history to resolve both refs. Pin to @v1 for patch and minor updates, or an exact release for fully reproducible builds.

What it reviews

Guard inspects only the dependency changes the pull request introduces:

How it works

Guard is a thin composite wrapper around the CLI — all analysis comes from bomly diff, so the policy you enforce locally is the policy it enforces on PRs.

1. 1

   Compares the PR head against its merge base, so review focuses only on what the PR changes — pre-existing findings are ignored.

2. 2

   Runs bomly diff with the enrich, audit, and policy flags mapped from your action inputs.

3. 3

   Writes a job summary and, when you opt in, posts (or updates) a single PR comment.

4. 4

   Uploads SARIF to the Security tab when audit is on, and fails the job when policy fails the review.

The report

Every run posts a job summary to the Actions tab. When a PR introduces a failing finding, Guard also annotates the check with the count and exits non-zero.

Inline diff annotations

Guard writes the job summary in Markdown and uploads the same findings as SARIF. That SARIF feed drives GitHub's native code scanning UI, which surfaces each finding in three places: inline on the Files changed tab, rolled up on the Checks tab, and as a standalone alert under Security → Code scanning. First, inline — right under the line that introduced it:

…and on the Checks tab

Every alert also rolls up into a single Code scanning results check run, so reviewers get the totals at a glance without scrolling the diff:

…and as a standalone alert

Following Show more details (or View detailson the inline annotation) opens the alert's own page under Security → Code scanning — severity, the offending line, the rule that fired, and where it first appeared. Show more details

Package manager setup

Bomly Guard installs the Bomly CLI — not project package managers. Add ecosystem setup steps before the Guard action when your project needs them.

Many repositories can be reviewed from committed lockfiles alone. Build-tool-backed detectors (Dart pub, SwiftPM, SBT) produce richer graphs when their build tool is present; any detector may also need its package manager when install-first is enabled. Note that install-first tells CLI detectors to install project dependencies before resolving graphs — it does not install the package-manager binary itself.

steps:
  - uses: actions/checkout@v5
    with:
      fetch-depth: 0

  - uses: actions/setup-node@v6
    with:
      node-version: 22
      cache: npm

  - uses: bomly-dev/bomly-guard@v1
    with:
      fail-on: high
      install-first: true

See the Bomly Guard README for the full per-ecosystem setup reference.