From 7f62d261d6956244e317b6f84510cf6e36ef9bbd Mon Sep 17 00:00:00 2001 From: Ahmed ElMallah Date: Thu, 11 Jun 2026 19:24:31 -0700 Subject: [PATCH 1/6] Add Bomly Guard workflow --- .github/workflows/bomly-guard.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 .github/workflows/bomly-guard.yml diff --git a/.github/workflows/bomly-guard.yml b/.github/workflows/bomly-guard.yml new file mode 100644 index 0000000..ba4e362 --- /dev/null +++ b/.github/workflows/bomly-guard.yml @@ -0,0 +1,26 @@ +name: Bomly Guard + +on: + pull_request: + +permissions: + contents: read + pull-requests: write + issues: write + security-events: write + +jobs: + guard: + runs-on: ubuntu-latest + timeout-minutes: 15 + steps: + - name: Check out repository + uses: actions/checkout@v5 + with: + fetch-depth: 0 + + - name: Guard dependency changes + uses: bomly-dev/bomly-review-action@v1 + with: + fail-on-severity: high + comment-summary-in-pr: always From c873a6f346e21b978dbf99a485e1ef593bf54fe3 Mon Sep 17 00:00:00 2001 From: Ahmed ElMallah Date: Thu, 11 Jun 2026 19:26:48 -0700 Subject: [PATCH 2/6] Add dependency change fixture --- package-lock.json | 8 +++++--- package.json | 7 ++++--- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index 153f3f1..a9dfa9d 100644 --- a/package-lock.json +++ b/package-lock.json @@ -17,6 +17,7 @@ "larvitutils": "2.3.0", "lodash": "4.17.15", "marked": "0.3.19", + "minimist": "0.0.8", "node-yaml-config": "0.0.5", "semver": "5.7.1", "to": "0.2.9", @@ -846,9 +847,10 @@ } }, "node_modules/minimist": { - "version": "0.0.10", - "resolved": "https://registry.npmjs.org/minimist/-/minimist-0.0.10.tgz", - "integrity": "sha1-3j+YVD2/lggr5IrRoMfNqDYwHc8=" + "version": "0.0.8", + "resolved": "https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz", + "integrity": "sha512-miQKw5Hv4NS1Psg2517mV4e4dYNaO3++hjAvLOAzKqZ61rH8NS1SK+vbfBWZ5PY/Me/bEWhUwqMghEW5Fb9T7Q==", + "license": "MIT" }, "node_modules/mkdirp": { "version": "0.5.5", diff --git a/package.json b/package.json index 98349f5..02f2301 100644 --- a/package.json +++ b/package.json @@ -16,12 +16,13 @@ "larvitreqparser": "0.2.1", "larvitrouter": "3.0.2", "larvitutils": "2.3.0", + "lodash": "4.17.15", + "marked": "0.3.19", + "minimist": "0.0.8", "node-yaml-config": "0.0.5", "semver": "5.7.1", "to": "0.2.9", - "url": "0.11.0", - "lodash": "4.17.15", - "marked": "0.3.19" + "url": "0.11.0" }, "devDependencies": { "mocha": "^7.0.1" From bf6c618df7745cde7959ec19d40d20816d676ffe Mon Sep 17 00:00:00 2001 From: Ahmed ElMallah Date: Thu, 11 Jun 2026 20:34:36 -0700 Subject: [PATCH 3/6] Update bomly review action to bomly guard --- .github/workflows/bomly-guard.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/bomly-guard.yml b/.github/workflows/bomly-guard.yml index ba4e362..cf4d997 100644 --- a/.github/workflows/bomly-guard.yml +++ b/.github/workflows/bomly-guard.yml @@ -20,7 +20,7 @@ jobs: fetch-depth: 0 - name: Guard dependency changes - uses: bomly-dev/bomly-review-action@v1 + uses: bomly-dev/bomly-guard@v1 with: - fail-on-severity: high + fail-on: high comment-summary-in-pr: always From b35e80656f89462cbb200c9fff221720af760377 Mon Sep 17 00:00:00 2001 From: Ahmed ElMallah Date: Thu, 11 Jun 2026 20:38:27 -0700 Subject: [PATCH 4/6] Add auditors option to bomly-guard workflow --- .github/workflows/bomly-guard.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/bomly-guard.yml b/.github/workflows/bomly-guard.yml index cf4d997..2dc7b76 100644 --- a/.github/workflows/bomly-guard.yml +++ b/.github/workflows/bomly-guard.yml @@ -24,3 +24,4 @@ jobs: with: fail-on: high comment-summary-in-pr: always + auditors: -license From d1b4bfc5abc1710a148026870b2f04999472568d Mon Sep 17 00:00:00 2001 From: Ahmed ElMallah Date: Thu, 18 Jun 2026 17:25:20 -0700 Subject: [PATCH 5/6] Dogfood Bomly Guard --- .github/workflows/bomly-guard.yml | 5 +++++ README.md | 28 +++++++++++++++++++--------- 2 files changed, 24 insertions(+), 9 deletions(-) diff --git a/.github/workflows/bomly-guard.yml b/.github/workflows/bomly-guard.yml index 2dc7b76..2f5565b 100644 --- a/.github/workflows/bomly-guard.yml +++ b/.github/workflows/bomly-guard.yml @@ -19,9 +19,14 @@ jobs: with: fetch-depth: 0 + - uses: actions/setup-node@v6 + with: + node-version: "22" + cache: npm - name: Guard dependency changes uses: bomly-dev/bomly-guard@v1 with: + ecosystems: npm fail-on: high comment-summary-in-pr: always auditors: -license diff --git a/README.md b/README.md index 654e009..e701ae7 100644 --- a/README.md +++ b/README.md @@ -65,19 +65,29 @@ bomly diff \ Fail your pipeline automatically when high-severity vulnerabilities are introduced: ```yaml -# .github/workflows/bomly.yml -name: Bomly Security Scan -on: [push, pull_request] +# .github/workflows/bomly-guard.yml +name: Bomly Guard +on: + pull_request: + +permissions: + contents: read + pull-requests: write + issues: write + security-events: write jobs: - scan: + guard: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - name: Scan with Bomly - run: | - curl -sSfL https://bomly.dev/install.sh | sh - bomly scan --enrich --audit --fail-on high + - uses: actions/checkout@v5 + with: + fetch-depth: 0 + # Add the package-manager setup steps this ecosystem needs before Bomly Guard. + - uses: bomly-dev/bomly-guard@v1 + with: + fail-on: high + comment-summary-in-pr: always ``` Made with [Bomly](https://bomly.dev) — open-source SCA for every ecosystem. From 4b29d91896155be303d5a6be70d80c8733196281 Mon Sep 17 00:00:00 2001 From: Ahmed ElMallah Date: Fri, 19 Jun 2026 00:34:31 -0700 Subject: [PATCH 6/6] Run Bomly Guard in debug mode --- .github/workflows/bomly-guard.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/bomly-guard.yml b/.github/workflows/bomly-guard.yml index 2f5565b..b97a7f5 100644 --- a/.github/workflows/bomly-guard.yml +++ b/.github/workflows/bomly-guard.yml @@ -26,6 +26,7 @@ jobs: - name: Guard dependency changes uses: bomly-dev/bomly-guard@v1 with: + log-level: debug ecosystems: npm fail-on: high comment-summary-in-pr: always