sbom-diff

Git diff for SBOMs—compare CycloneDX, SPDX, and Syft documents, detect tampering, and gate CI.

GitHub Action for installing and running sbom-tools — semantic SBOM diff, validation, and quality scoring

SBOM diff gate: compares CycloneDX 1.4-1.6 / SPDX 2.3 SBOMs or git refs, reports added, removed, upgraded and downgraded components plus license, supplier and hash changes, checks OSV.dev for new vs fixed vulns, and enforces policy. Text/JSON/SARIF/Markdown, GitHub Action.

Homebrew tap for sbomlyze, the fast SBOM diff tool for CycloneDX, SPDX, and Syft—install macOS and Linux releases with brew.