Default source-change enforcement to any

Allow --deny-dependency-source-change without a value to enforce both Git and URL transitions. Retain explicit single-source selection through =git and =url, normalize and deduplicate policy values, expose any consistently through configuration and MCP guidance, and cover the behavior in unit and pinned smoke tests.

Author: bomly-guy

docs/CONFIG_REFERENCE.md

@@ -39,7 +39,7 @@ YAML files use the nested keys documented below. Unknown keys and the former fla
 | `policy.license_exempt_packages` | `BOMLY_LICENSE_EXEMPT_PACKAGES` | `[]string` | - | Package URLs exempt from license policy checks |
 | `policy.deny_packages` | `BOMLY_DENY_PACKAGES` | `[]string` | - | Package URLs to deny |
 | `policy.deny_groups` | `BOMLY_DENY_GROUPS` | `[]string` | - | Package URL namespaces to deny |
-| `policy.deny_dependency_source_changes` | `BOMLY_DENY_DEPENDENCY_SOURCE_CHANGES` | `[]string` | - | Diff-only dependency source changes that fail policy: git or url |
+| `policy.deny_dependency_source_changes` | `BOMLY_DENY_DEPENDENCY_SOURCE_CHANGES` | `[]string` | - | Diff-only dependency source changes that fail policy: any, git, or url |
 | `policy.protected_packages` | `BOMLY_PROTECTED_PACKAGES` | `[]string` | - | Canonical package names to protect from typosquatting |
 | `policy.typosquat_threshold` | `BOMLY_TYPOSQUAT_THRESHOLD` | `string` | 0.90 | Similarity threshold for typosquatting detection |
 | `policy.typosquat_mode` | `BOMLY_TYPOSQUAT_MODE` | `string` | warn | Typosquatting policy mode: warn or fail |
@@ -210,7 +210,7 @@ Flat YAML keys are no longer accepted. Move each existing key to its nested repl
 #   deny_packages: []
 #   Package URL namespaces to deny
 #   deny_groups: []
-#   Diff-only dependency source changes that fail policy: git or url
+#   Diff-only dependency source changes that fail policy: any, git, or url
 #   deny_dependency_source_changes: []
 #   Canonical package names to protect from typosquatting
 #   protected_packages: []

docs/auditors/package.md

@@ -34,7 +34,7 @@ use the dependency details already produced by an enriched diff.
 | --- | --- | --- |
 | `--deny-package <name>` | `policy.deny_packages` | Fail when this package is present. Repeatable. |
 | `--deny-group <group>` | `policy.deny_groups` | Fail on any package in this group/namespace (e.g. a Maven groupId). Repeatable. |
-| `--deny-dependency-source-change <git\|url>` | `policy.deny_dependency_source_changes` | Make a matching source change fail instead of warn. Repeatable and diff-only. |
+| `--deny-dependency-source-change[=any\|git\|url]` | `policy.deny_dependency_source_changes` | Make a matching source change fail instead of warn. Without a value, `any` covers both Git and URL. Use `=git` or `=url` to select one. Repeatable and diff-only. |
 | `--protected-package <name>` | `policy.protected_packages` | A trusted name; lookalikes within the threshold are flagged as possible typosquats. Repeatable. |
 | `--typosquat-threshold <0..1>` | `policy.typosquat_threshold` | Similarity score above which a name is treated as a lookalike. Default `0.90`. Higher = stricter (fewer matches). |
 | `--typosquat-mode <warn\|fail>` | `policy.typosquat_mode` | Policy status for a typosquat finding. `warn` (default) records a warning; `fail` makes it eligible to fail when it also matches `--fail-on`. |
@@ -56,9 +56,9 @@ bomly scan --enrich --audit \
   --typosquat-threshold 0.85 --typosquat-mode fail \
   --fail-on any
 
-# Reject a registry dependency that changes to a Git source
+# Reject a registry dependency that changes to Git or a URL
 bomly diff --base main --head HEAD --enrich --audit \
-  --deny-dependency-source-change git
+  --deny-dependency-source-change
 ```
 
 ## Diff and baselines

internal/cli/opts/flag_options.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/bomly-dev/bomly-cli/internal/config"
 	"github.com/bomly-dev/bomly-cli/internal/engine"
+	"github.com/bomly-dev/bomly-cli/sdk"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 	"go.uber.org/zap"
@@ -64,12 +65,14 @@ func BindCommandFlagGroups(cmd *cobra.Command, cfg *config.Resolved, groups ...F
 }
 
 func bindDiffPolicyFlags(flags *pflag.FlagSet, cfg *config.Resolved) {
+	const flagName = "deny-dependency-source-change"
 	flags.StringArrayVar(
 		&cfg.DenyDependencySourceChanges,
-		"deny-dependency-source-change",
+		flagName,
 		nil,
-		"Dependency source change that fails diff policy: git or url. Repeatable (requires --audit)",
+		"Dependency source change that fails diff policy. Without a value, both Git and URL are denied; use =git or =url to select one. Repeatable (requires --audit)",
 	)
+	flags.Lookup(flagName).NoOptDefVal = sdk.DependencySourceChangePolicyAny
 }
 
 func bindTargetFlags(flags *pflag.FlagSet, cfg *config.Resolved) {

internal/cli/opts/flag_options_test.go

@@ -101,22 +101,67 @@ func TestApplyFlagOverridesJSONShortcut(t *testing.T) {
 }
 
 func TestBindDiffPolicyFlags(t *testing.T) {
+	tests := []struct {
+		name string
+		args []string
+		want []string
+	}{
+		{
+			name: "explicit repeated values",
+			args: []string{
+				"--deny-dependency-source-change=git",
+				"--deny-dependency-source-change=url",
+			},
+			want: []string{"git", "url"},
+		},
+		{
+			name: "omitted value means any",
+			args: []string{"--deny-dependency-source-change"},
+			want: []string{"any"},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			root := newTestRootCommand(t)
+			var resolved config.Resolved
+			if err := BindCommandFlagGroups(root, &resolved, FlagGroupDiffPolicy); err != nil {
+				t.Fatal(err)
+			}
+			if err := root.ParseFlags(test.args); err != nil {
+				t.Fatal(err)
+			}
+			var merged config.Resolved
+			applyFlagOverrides(&merged, resolved, root)
+			if len(merged.DenyDependencySourceChanges) != len(test.want) {
+				t.Fatalf("source-change flags = %#v, want %#v", merged.DenyDependencySourceChanges, test.want)
+			}
+			for i := range test.want {
+				if merged.DenyDependencySourceChanges[i] != test.want[i] {
+					t.Fatalf("source-change flags = %#v, want %#v", merged.DenyDependencySourceChanges, test.want)
+				}
+			}
+		})
+	}
+}
+
+func TestBindValuelessDiffPolicyFlagBeforeOtherFlags(t *testing.T) {
 	root := newTestRootCommand(t)
 	var resolved config.Resolved
-	if err := BindCommandFlagGroups(root, &resolved, FlagGroupDiffPolicy); err != nil {
+	if err := BindCommandFlagGroups(root, &resolved, FlagGroupDiffPolicy, FlagGroupAnalysis); err != nil {
 		t.Fatal(err)
 	}
 	if err := root.ParseFlags([]string{
-		"--deny-dependency-source-change", "git",
-		"--deny-dependency-source-change", "url",
+		"--deny-dependency-source-change",
+		"--enrich",
+		"--audit",
 	}); err != nil {
 		t.Fatal(err)
 	}
-	var merged config.Resolved
-	applyFlagOverrides(&merged, resolved, root)
-	if len(merged.DenyDependencySourceChanges) != 2 ||
-		merged.DenyDependencySourceChanges[0] != "git" ||
-		merged.DenyDependencySourceChanges[1] != "url" {
-		t.Fatalf("source-change flags = %#v", merged.DenyDependencySourceChanges)
+	if len(resolved.DenyDependencySourceChanges) != 1 ||
+		resolved.DenyDependencySourceChanges[0] != "any" {
+		t.Fatalf("source-change flags = %#v, want any", resolved.DenyDependencySourceChanges)
+	}
+	if !resolved.Enrich || !resolved.Audit {
+		t.Fatalf("following flags were not parsed: enrich=%t audit=%t", resolved.Enrich, resolved.Audit)
 	}
 }

internal/config/config.go

@@ -38,7 +38,7 @@ type Resolved struct {
 	LicenseExemptPackages       []string `doc:"Package URLs exempt from license policy checks" env:"BOMLY_LICENSE_EXEMPT_PACKAGES"`
 	DenyPackages                []string `doc:"Package URLs to deny" env:"BOMLY_DENY_PACKAGES"`
 	DenyGroups                  []string `doc:"Package URL namespaces to deny" env:"BOMLY_DENY_GROUPS"`
-	DenyDependencySourceChanges []string `doc:"Diff-only dependency source changes that fail policy: git or url" env:"BOMLY_DENY_DEPENDENCY_SOURCE_CHANGES"`
+	DenyDependencySourceChanges []string `doc:"Diff-only dependency source changes that fail policy: any, git, or url" env:"BOMLY_DENY_DEPENDENCY_SOURCE_CHANGES"`
 	ProtectedPackages           []string `doc:"Canonical package names to protect from typosquatting" env:"BOMLY_PROTECTED_PACKAGES"`
 	TyposquatThreshold          string   `doc:"Similarity threshold for typosquatting detection" env:"BOMLY_TYPOSQUAT_THRESHOLD" default:"0.90"`
 	TyposquatMode               string   `doc:"Typosquatting policy mode: warn or fail" env:"BOMLY_TYPOSQUAT_MODE" default:"warn"`

internal/config/validate_test.go

@@ -49,7 +49,7 @@ func TestValidateDependencySourceChangePolicy(t *testing.T) {
 	if err := Validate(Resolved{
 		Enrich:                      true,
 		Audit:                       true,
-		DenyDependencySourceChanges: []string{"git", "url"},
+		DenyDependencySourceChanges: []string{"any"},
 	}); err != nil {
 		t.Fatalf("valid source-change policy rejected: %v", err)
 	}
@@ -63,7 +63,7 @@ func TestValidateDependencySourceChangePolicy(t *testing.T) {
 		Enrich:                      true,
 		Audit:                       true,
 		DenyDependencySourceChanges: []string{"workspace"},
-	}); err == nil || !strings.Contains(err.Error(), "accepted: git, url") {
+	}); err == nil || !strings.Contains(err.Error(), "accepted: any, git, url") {
 		t.Fatalf("invalid source error = %v", err)
 	}
 }

internal/mcp/tool_diff.go

@@ -32,7 +32,7 @@ func registerDiffTool(s *server.MCPServer, mcpCtx Context) {
 		mcplib.WithString("license_exempt_packages", mcplib.Description("Comma-separated package URLs exempt from license checks")),
 		mcplib.WithString("deny_packages", mcplib.Description("Comma-separated package URLs to deny")),
 		mcplib.WithString("deny_groups", mcplib.Description("Comma-separated package URL namespaces to deny")),
-		mcplib.WithString("deny_dependency_source_changes", mcplib.Description("Comma-separated dependency source changes that fail diff policy: git or url (requires audit)")),
+		mcplib.WithString("deny_dependency_source_changes", mcplib.Description("Comma-separated dependency source changes that fail diff policy: any, git, or url (requires audit)")),
 		mcplib.WithString("protected_packages", mcplib.Description("Comma-separated package names to protect from typosquatting")),
 		mcplib.WithString("typosquat_threshold", mcplib.Description("Typosquatting similarity threshold")),
 		mcplib.WithString("typosquat_mode", mcplib.Description("Typosquatting mode: warn or fail")),

internal/support/prose/auditors/package.md

@@ -15,7 +15,7 @@ use the dependency details already produced by an enriched diff.
 | --- | --- | --- |
 | `--deny-package <name>` | `policy.deny_packages` | Fail when this package is present. Repeatable. |
 | `--deny-group <group>` | `policy.deny_groups` | Fail on any package in this group/namespace (e.g. a Maven groupId). Repeatable. |
-| `--deny-dependency-source-change <git\|url>` | `policy.deny_dependency_source_changes` | Make a matching source change fail instead of warn. Repeatable and diff-only. |
+| `--deny-dependency-source-change[=any\|git\|url]` | `policy.deny_dependency_source_changes` | Make a matching source change fail instead of warn. Without a value, `any` covers both Git and URL. Use `=git` or `=url` to select one. Repeatable and diff-only. |
 | `--protected-package <name>` | `policy.protected_packages` | A trusted name; lookalikes within the threshold are flagged as possible typosquats. Repeatable. |
 | `--typosquat-threshold <0..1>` | `policy.typosquat_threshold` | Similarity score above which a name is treated as a lookalike. Default `0.90`. Higher = stricter (fewer matches). |
 | `--typosquat-mode <warn\|fail>` | `policy.typosquat_mode` | Policy status for a typosquat finding. `warn` (default) records a warning; `fail` makes it eligible to fail when it also matches `--fail-on`. |
@@ -37,9 +37,9 @@ bomly scan --enrich --audit \
   --typosquat-threshold 0.85 --typosquat-mode fail \
   --fail-on any
 
-# Reject a registry dependency that changes to a Git source
+# Reject a registry dependency that changes to Git or a URL
 bomly diff --base main --head HEAD --enrich --audit \
-  --deny-dependency-source-change git
+  --deny-dependency-source-change
 ```
 
 ## Diff and baselines

sdk/dependency_source.go

@@ -17,19 +17,36 @@ const (
 	DependencySourceURL       DependencySource = "url"
 )
 
+// DependencySourceChangePolicyAny selects every source type supported by the
+// dependency source-change policy.
+const DependencySourceChangePolicyAny = "any"
+
 // ParseDependencySourceChangePolicies parses source types accepted by the
 // dependency source-change policy.
 func ParseDependencySourceChangePolicies(values []string) ([]DependencySource, error) {
-	parsed := make([]DependencySource, 0, len(values))
+	includeGit := false
+	includeURL := false
 	for _, value := range values {
-		source := DependencySource(strings.ToLower(strings.TrimSpace(value)))
-		switch source {
-		case DependencySourceGit, DependencySourceURL:
-			parsed = append(parsed, source)
+		normalized := strings.ToLower(strings.TrimSpace(value))
+		switch normalized {
+		case DependencySourceChangePolicyAny:
+			includeGit = true
+			includeURL = true
+		case string(DependencySourceGit):
+			includeGit = true
+		case string(DependencySourceURL):
+			includeURL = true
 		default:
-			return nil, fmt.Errorf("unsupported dependency source change %q (accepted: git, url)", value)
+			return nil, fmt.Errorf("unsupported dependency source change %q (accepted: any, git, url)", value)
 		}
 	}
+	parsed := make([]DependencySource, 0, 2)
+	if includeGit {
+		parsed = append(parsed, DependencySourceGit)
+	}
+	if includeURL {
+		parsed = append(parsed, DependencySourceURL)
+	}
 	return parsed, nil
 }
 

sdk/dependency_source_test.go

@@ -30,3 +30,42 @@ func TestDependencyRegistryMatchEligible(t *testing.T) {
 		})
 	}
 }
+
+func TestParseDependencySourceChangePolicies(t *testing.T) {
+	tests := []struct {
+		name    string
+		values  []string
+		want    []DependencySource
+		wantErr bool
+	}{
+		{name: "empty"},
+		{name: "Git", values: []string{"git"}, want: []DependencySource{DependencySourceGit}},
+		{name: "URL", values: []string{"url"}, want: []DependencySource{DependencySourceURL}},
+		{name: "both", values: []string{"url", "git"}, want: []DependencySource{DependencySourceGit, DependencySourceURL}},
+		{name: "any", values: []string{"ANY"}, want: []DependencySource{DependencySourceGit, DependencySourceURL}},
+		{name: "deduplicated", values: []string{"any", "git", "url"}, want: []DependencySource{DependencySourceGit, DependencySourceURL}},
+		{name: "unsupported", values: []string{"workspace"}, wantErr: true},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			got, err := ParseDependencySourceChangePolicies(test.values)
+			if test.wantErr {
+				if err == nil {
+					t.Fatalf("ParseDependencySourceChangePolicies(%#v) expected error", test.values)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("ParseDependencySourceChangePolicies(%#v) error = %v", test.values, err)
+			}
+			if len(got) != len(test.want) {
+				t.Fatalf("ParseDependencySourceChangePolicies(%#v) = %#v, want %#v", test.values, got, test.want)
+			}
+			for i := range test.want {
+				if got[i] != test.want[i] {
+					t.Fatalf("ParseDependencySourceChangePolicies(%#v) = %#v, want %#v", test.values, got, test.want)
+				}
+			}
+		})
+	}
+}