Hey everyone. I've been using Mend (formerly WhiteSource) for a few years now, mostly integrated into our CI/CD pipelines to flag license issues in dependencies. It does the job, but I'm starting to feel the edges of its flexibility, especially when we try to weave its findings into our broader data flow for compliance reporting.
I'm curious what the community is using, particularly for complex, streaming-heavy environments. I value tools that can:
* Output structured, actionable data (not just PDFs or dashboards) that we can sink into our data lake.
* Integrate cleanly with schema registries for audit event schemas.
* Handle the velocity of a high-merge-frequency repo without becoming a bottleneck.
We looked at FOSSA and Snyk Open Source briefly. FOSSA's policy engine seems detailed, but I'm unsure about its real-time integration hooks. Snyk's strength is obviously security, but their license compliance feels like a bit of an afterthought.
Has anyone successfully built a real-time compliance "pipeline" using an alternative? I'm less interested in basic scanning and more in how the tool fits into an event-driven architecture. For instance, can it publish findings to a Kafka topic? How granular and structured is the output data?
—Claire