Bazel rules for advisory indexing, dependency policy checks and third-party notices. Metadata, license policy and advisory inputs belong to the caller.
Use Bazel 9.2 with Bzlmod. Until the module is registered in the Bazel Central Registry, pin a source revision in your root MODULE.bazel:
bazel_dep(name = "latticebuild_supply_chain", version = "0.1.1")
git_override(
module_name = "latticebuild_supply_chain",
remote = "https://github.com/latticebuild/rules_supply_chain.git",
commit = "FULL_COMMIT_SHA",
)Replace FULL_COMMIT_SHA with the full commit hash of that revision.
load("@latticebuild_supply_chain//supply_chain:defs.bzl", "advisory_index", "supply_chain_test", "third_party_notices")
advisory_index(name = "advisories", sources = {":pinned_osv_files": "crates.io"})
supply_chain_test(name = "policy_test", packages = [":package_metadata"], policy = "policy.json", advisories = ":advisories")
third_party_notices(name = "notices", package = "my-program", title = "My program", program = ":program", policy = "policy.json")
filegroup(name = "program_license", srcs = [":notices"], output_group = "license")
filegroup(name = "dependency_notices", srcs = [":notices"], output_group = "notices")See docs/usage.md for attributes, required tool inputs and consumer setup. The public API lives in supply_chain/; implementation files under its private/ directory are repository-local.
Policy and notice producers support Linux and macOS. Portable algorithm tests and verdict replay also run on Windows. Policies select allowed licenses, reviewed license texts, advisory exceptions and allowed source URLs. The notice aspect follows Rust dependencies and proc-macro edges while excluding Cargo build-script dependencies. Bundled SPDX data retains its upstream licensing under the checker’s assets.
Repository map
| Area | Location |
|---|---|
| Public API | supply_chain/defs.bzl |
| Implementation | supply_chain/private/ |
| Examples and fixtures | testdata/ |
| Owning checks | tests/ |
| Consumer guide | docs/usage.md |
See the generated API reference and runnable examples.
Install Mise, then prepare this checkout:
mise trust
mise run bootstrap
hk validate
hk test
hk check --all --slow
bazel build //:artifacts
bazel test //:testTools and dependency versions are pinned in mise.toml and MODULE.bazel. CI runs these gates on native Linux, macOS and Windows runners. Repositories with a race suite also run it on Linux and macOS. See docs/development.md for owning checks and platform constraints, and ARCHITECTURE.md for implementation decisions.
Sponsor us · Discuss questions and ideas
Pull requests are limited to repository collaborators. Use Discussions for bugs, feature requests and support. Changes merge as squash commits.