Bomly GuardReview Dependency Drift Before It Lands.

Quick start

Drop this into .github/workflows/bomly-guard.yml. On every pull request the action installs the CLI, diffs the dependency changes, and fails the job when a high-severity finding slips in.

name: Bomly Guard

on:
  pull_request:

permissions:
  contents: read
  pull-requests: write     # post the summary comment (when opted in)
  security-events: write   # upload SARIF to the Security tab

jobs:
  dependency-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0   # full history so base and head refs resolve
      - uses: bomly-dev/bomly-guard@v1
        with:
          fail-on: high
          comment-summary-in-pr: on-failure

fetch-depth: 0 matters — the action compares the PR head against the merge base, so it needs enough history to resolve both refs. Pin to @v1 for patch and minor updates, or an exact release for fully reproducible builds.

What it reviews

Guard inspects only the dependency changes the pull request introduces:

The report

Every run posts a job summary to the Actions tab. When a PR introduces a failing finding, Guard also annotates the check with the count and exits non-zero.

How it works

Guard is a thin composite wrapper around the CLI — all analysis comes from bomly diff, so the policy you enforce locally is the policy it enforces on PRs.

1. 1

   Compares the PR head against its merge base, so review focuses only on what the PR changes — pre-existing findings are ignored.

2. 2

   Runs bomly diff with the enrich, audit, and policy flags mapped from your action inputs.

3. 3

   Writes a job summary and, when you opt in, posts (or updates) a single PR comment.

4. 4

   Uploads SARIF to the Security tab when audit is on, and fails the job when policy fails the review.