bazel

Introducing a Better Way to SCA for Monorepos and Bazel

Endor Labs’ reachability-based SCA now supports Bazel so you can get fully accurate results without any of the messy workarounds usually required for monorepos.

Written by

Alexandre Wilhelm
Published on January 8, 2024
Updated on January 30, 2026

Why Bazel is a Big Deal

Time-consuming build processes often kill development productivity and directly impact the business's bottom line.

Live-action shot of me before I started using Bazel

Collaboration can be challenging in organizations operating out of monorepos, especially those with a substantial number of developers (500+). While trying to overcome these challenges, Google created Bazel, an open source build system especially tailored for monorepos. Bazel is an essential solution that ensures efficiency and prevents productivity from screeching to a halt by solving two problems:

TL;DR — Bazel makes software development faster and your dev team loves it.

Why Bazel is Hard for SCA Tools

Existing software composition analysis (SCA) solutions generally don’t cut it for monorepos and teams relying heavily on Bazel. This is because Bazel is designed to completely manage its dependencies and Bazel support for each language varies. But teams relying on Bazel can’t live without it. To meet compliance and security obligations, they create workarounds that cause their own set of problems. At Endor Labs, we understand this challenge firsthand as we are monorepo users ourselves!

Challenge 1: Lack of Bazel and Language Support

One of the challenges with Bazel is that very few vendors can analyze software built using Bazel. Even those that offer Bazel support often have limited language coverage. This doesn’t work because Bazel is designed to collaborate across multiple languages.

Challenge 2: Requirement to Build Entire Monorepo

SCA tools commonly require the entire monorepo to be built to yield results. Given the extensive size of monorepos, this approach lacks scalability. It’s also impractical for integration into a CI/CD environment, as it's unfeasible to spend hours analyzing software for every commit.

An Example Workaround with Bazel and Java

Given the lack of out-of-the-box SCA support for Bazel, monorepo teams are often forced to meet their security and compliance obligations through extensive workarounds. We faced the same issues at Endor Labs! We’ll use our Java packages to illustrate the problem.

To accommodate tools that didn’t support Bazel, we had to maintain a pom.xml file that could be referenced by those tools. Managing dependencies through both pom.xml and build.bazel files posed significant challenges. It introduced the complexity of updating library versions, as well as adding or removing libraries in multiple places.

How Endor Labs Helps Monorepo Teams Using Bazel

In large monorepos, the number of software packages can be enormous. For example, we’ve worked with customers where a single monorepo had 1000+ packages. Scanning each package on every pull request could bring development productivity to a halt! For this reason, we prioritized supporting the ability to scan targets using Bazel queries or by explicitly defining the Bazel targets.

Taking a page from the Bazel philosophy, we use Bazel targets so that you can scan only what matters to you, scan in parallel, and scan only when something has changed.

Get Started with Endor Labs

With Bazel-native support, you can use Endor Labs to analyze your software in a way that's compatible with Bazel, more accurate, and more closely aligned with the Bazel philosophy than traditional SCA tools. If you want to learn more, we’d love to chat.

What's next?

When you're ready to take the next step in securing your software supply chain, here are 3 ways Endor Labs can help: