CRACI vs Lineaje

The short answer

Lineaje is a software supply chain platform. It scans source, artifact repositories and containers, scores the risk in each component, checks integrity and origin, fixes what it can and shares SBOMs with customers through SBOM360 Hub. CRACI is a GitHub Actions runner that records the dependencies each job actually fetched and produces the SBOM from that record, with a completeness state and signed provenance.

Lineaje analyzes what exists. CRACI records what the build did and monitors it, so the CI, the SBOM and the vulnerability tracking come from one product.

At a glance

What Lineaje does well

• Depth of analysis. SCA360 scans "both the source and packaged code of every software component at every stage of software development," enumerates mandatory and optional dependency chains, and detects reachable vulnerabilities.
• Integrity and origin. Lineaje identifies "embedded malicious and tampered packages," highlights packages of dubious origin and attests to the integrity of each open-source and private component. CRACI does not analyze components this way.
• Fixing, not just finding. SBOM360 finds compatible updates for direct dependencies and auto-fixes them after approval, and it can produce compatible, more secure clones of containers. Gold Open Source offers remediated open-source packages, containers and patches.
• SBOM exchange. SBOM360 Hub links SBOMs to product SKUs, validates them against NTIA minimum elements, keeps VEX and CSAF documents mapped to each SBOM, and shares them with customers, distributors and resellers. Its upload API "is compatible with any SBOM creation tool."

If your priority is analyzing and cleaning up a large existing portfolio, including code you did not write, Lineaje covers more of that ground than CRACI.

Where CRACI is different

Two meanings of provenance

Lineaje uses provenance mostly for components: where an open-source package came from, who contributed to it and whether it shows signs of tampering. CRACI uses it for your own artifacts: which build produced a release, and what that build fetched. Signed provenance (Ed25519 over SHA-512) links each artifact, including OCI artifacts, to its build. For your own releases, the second question is the one an auditor asks.

A record of the build, not an analysis of the result

CRACI runs the job. You change runs-on to craci, and a package-aware proxy records traffic to package sources during the build: npm, PyPI, RubyGems, Cargo, Go, Nix and OCI, plus OS packages and source or download presets. Dependency evidence travels with CI caches, so a package restored from a cache is still in the record.

That record does not depend on which files happen to be present, which is where scanning is weakest: a generator reports what it recognizes in the files in front of it, so two of them pointed at one repository return different lists and neither is wrong. Lineaje cannot be compared on those terms, and neither can CRACI, which records builds and cannot scan a directory.

A completeness state on every SBOM

NTIA validation checks that an SBOM carries the required fields. CRACI adds a signal about the recording itself, per job and per cache: Complete, Complete with connections, Incomplete, Unavailable or Not recorded. The gaps in each SBOM are known.

Control at the runner

Because CRACI runs the job, it enforces a network egress policy: default deny or default allow, with 24 built-in software-source presets and typed custom sources, validated before the job starts and failing closed. Lineaje can flag a package of dubious origin; an egress policy limits which sources a build can reach in the first place.

Monitoring

CRACI re-evaluates monitored SBOMs continuously and aggregates vulnerabilities across builds and repositories, so the findings are tied to what you actually shipped.

Replacing Lineaje with CRACI

For software teams on GitHub Actions, CRACI covers the core of what Lineaje is bought for: it produces the SBOM in each build, keeps re-evaluating monitored SBOMs as new vulnerabilities are published, aggregates findings across builds and repositories, lets security teams triage them and and route each one to the team that owns the fix. There is no separate scanning and inventory platform to run.

Be clear about what you give up. Lineaje analyzes components you did not build, checks packages for tampering and dubious origin, finds reachable vulnerabilities, and offers remediated packages and containers through Gold Open Source. SBOM360 Hub shares SBOMs, VEX and CSAF documents with customers and distributors. CRACI does none of that today. If your priority is cleaning up a large existing portfolio, including third-party code, Lineaje is the better fit.

For the Cyber Resilience Act

Lineaje covers the CRA in its regulations guidance: "SBOMs must be in a machine-readable format and include the top-level dependencies of the product," and they "must be included in a product's technical documentation and provided to market surveillance authorities upon request." It points to SBOM360, SBOM360 Hub and its Third Party Risk Manager for regulatory work.

The CRA's reporting obligations apply from September 11, 2026: an early warning within 24 hours for an actively exploited vulnerability, through the CRA Single Reporting Platform. Its main provisions apply from December 11, 2027. Top-level dependencies are the minimum; a transitive package is still in your product. CRACI records the full dependency set each build used, its API takes you from an artifact to its producing build, its CycloneDX SBOM and the job network trace, and reports export in PDF, HTML, CSV, Excel and JSON.

CRACI automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process. Neither product makes a manufacturer compliant on its own. See what the CRA requires and CRA compliance with CRACI.