Docs · Tools

Shift-left Scanning (SBOM + CI gate)

Catch vulnerable dependencies before they ship. Nexus reads your lockfiles, builds a CycloneDX-lite SBOM, surfaces dependency-risk findings, and gates your pipeline — all offline-first, with a GitHub Action and pre-commit hook ready to drop in.

Category: Supply-chain / DevSecOps
Module: python -m nexus_tools sbom · scan
Mode: Offline-first
Ships: GitHub Action · pre-commit hook

What it does

Two commands cover the workflow. sbom inventories your dependencies and writes a CycloneDX-lite SBOM alongside dependency-risk findings; scan is the CI gate — it runs the same analysis and exits non-zero when it finds a high or critical issue, failing the build.

commands

# Emit an SBOM + dependency-risk findings
python -m nexus_tools sbom --path . --emit-sbom

# CI gate: exits non-zero on high/critical findings
python -m nexus_tools scan --path .

What it parses

It understands the lockfiles and manifests of the major ecosystems:

Python — requirements.txt, pyproject.toml
Node — package.json + package-lock.json
Go — go.mod
Rust — Cargo.lock
Java — pom.xml

Offline-first. The scanner works without reaching out to the internet — so it runs in air-gapped CI and on a laptop on a plane just the same.

Wire it into CI

GitHub Actions

A ready-made action lives at .github/actions/nexus-scan. Run the gate on every push and pull request:

.github/workflows/nexus-scan.yml

name: Nexus Scan
on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Nexus dependency scan
        uses: ./.github/actions/nexus-scan

pre-commit hook

Stop risky dependencies from ever being committed. Add the nexus-sbom hook:

.pre-commit-config.yaml

repos:
  - repo: local
    hooks:
      - id: nexus-sbom
        name: Nexus SBOM + dependency scan
        entry: python -m nexus_tools scan --path .
        language: system
        pass_filenames: false

What you get

A CycloneDX-lite SBOM that documents exactly what your project depends on, plus a prioritized list of dependency-risk findings. In CI, the scan gate turns those findings into a pass/fail signal so high and critical issues block the merge instead of reaching production.

Tips

Commit the generated SBOM — it is your point-in-time record of what shipped.
Run scan in CI and sbom --emit-sbom on release builds.
Because it is offline-first, no secrets or registry tokens are needed to run the gate.

Shift the cost left. The cheapest vulnerability to fix is the one you never merge. This gate moves dependency risk to the start of the pipeline, where it is fast and quiet to resolve.

PreviousSecurity Score Next Defense Monitor