dmartinochoa/pipeline-check

CI/CD pipeline security scanner. 1260+ checks across 39 providers, 18 compliance standards. SARIF output for code scanning.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jul 1, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: dmartinochoa/pipeline-check@e8b6f2de9fef91175bfbbaaa5ccd218b89763db8 # v1.17.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
pipeline	Provider to scan. ``auto`` detects the right provider from the workspace. Pass an explicit name (``github``, ``gitlab``, ``terraform``, ``kubernetes``, ``helm``, ``dockerfile``, ``aws``, ...) or a comma-separated list (``github,oci``) to activate cross-provider attack chains.	no	auto
path	Workspace path to scan. Forwarded to the matching ``--<provider>- path`` flag. Defaults to the repo root.	no	.
fail-on	Fail the build if any finding meets or exceeds this severity. One of CRITICAL, HIGH, MEDIUM, LOW. Empty string disables severity gating.	no	HIGH
min-grade	Fail if the scan grades worse than this letter (A, B, C, D). Empty disables grade gating.	no	""
max-failures	Fail if more than N effective findings are emitted. Empty disables the cap.	no	""
fail-on-check	Comma-separated list of check IDs that should always trip the gate (e.g. ``GHA-002,GL-007``). Repeats of the underlying CLI flag are emitted automatically.	no	""
severity-threshold	Minimum severity to report. INFO, LOW, MEDIUM, HIGH, CRITICAL.	no	INFO
baseline	Path to a prior JSON report. Existing findings won't gate the build; only new findings count.	no	""
baseline-from-git	``REF:PATH`` (e.g. ``origin/main:baseline.json``). Resolves the baseline via ``git show`` instead of reading from disk.	no	""
diff-base	Only scan files changed vs this git ref (e.g. ``origin/main``). Pairs naturally with PR builds.	no	""
standard	Comma-separated standards to annotate findings with (``owasp_cicd_top_10,nist_ssdf``). Empty enables all.	no	""
output	Output format. ``sarif`` is the default so findings flow into the GitHub Security tab via the upload-sarif step. Other options: ``terminal``, ``json``, ``jsonl`` (newline-delimited JSON, one finding per line for log / SIEM ingestion), ``html``, ``junit``, ``markdown``, ``codequality``, ``csv``, ``annotations`` (GitHub Actions inline ``::error`` annotations), ``cyclonedx``, ``spdx``, ``openvex`` (an OpenVEX document for the OSV advisory findings), ``both``.	no	sarif
output-file	Path to write the report. When left blank a per-format default is used: ``pipeline-check.sarif`` for SARIF (so the upload-sarif step keeps working), ``pipeline-check.json`` for JSON, ``pipeline-check.html`` for HTML, ``pipeline-check.xml`` for JUnit, ``pipeline-check.md`` for Markdown, ``gl-code-quality-report.json`` for Code Quality (the GitLab convention), ``pipeline-check-sbom.json`` for CycloneDX, ``pipeline-check.spdx.json`` for SPDX, ``pipeline-check.openvex.json`` for OpenVEX, ``pipeline-check-threatmodel.json`` for the threat-model report. Terminal / both write to stdout when this is blank.	no	""
upload-sarif	When ``true`` and ``output`` is ``sarif``, upload the SARIF file to GitHub code scanning. Requires ``security-events: write`` on the calling job.	no	true
ignore-file	Path to a ``.pipelinecheckignore`` file (flat or YAML with ``expires:`` dates).	no	""
pipeline-check-version	Pin to a specific pipeline-check release. Defaults to the latest version on PyPI.	no	""
python-version	Python version installed for running the scanner.	no	3.12
resolve-remote	Pass ``--resolve-remote`` to scan reusable workflow callees over HTTPS. Off by default.	no	false
extra-args	Free-form CLI flags appended to the scanner invocation. Useful for ``--checks``, ``--secret-pattern``, ``--custom-rules``, and similar flags not represented above. Quoted as a single string.	no	""
pr-comment	Post inline review comments on the PR diff. ``true`` enables on pull_request events; ``false`` disables. Requires ``pull-requests: write`` permission. Findings outside the diff fall back to a single PR-level summary comment.	no	true
comment-mode	``per-finding`` posts one review comment per finding location; ``summary`` posts a single PR-level comment listing every finding.	no	per-finding
gh-token	Token used to post PR review comments. Defaults to the runner- provided ``GITHUB_TOKEN``. Only needed when ``pr-comment`` is enabled.	no	${{ github.token }}

Outputs

name	description
exit-code	Scanner exit code. 0=pass, 1=gate failed, 2=scanner error, 3=config error.
findings-count	Total findings emitted by the scanner.
failed-count	Findings whose passed=false (matches --fail-on logic).
score	Severity-weighted score, 0-100.
grade	Letter grade A through D.
sarif-file	Path of the SARIF file written when output=sarif.