SentinelFlow

CI/CD Security Gatekeeper
Secrets · IaC · Dependencies · SAST · Policy · SBOM — one binary for the pipeline.

SentinelFlow scans your repo for leaked secrets, insecure infrastructure, vulnerable dependencies, and policy violations — then fails the build when gates trip.

See it in action

Pipeline gate	Shift-left workflow

60-second demo

# From a clone
make demo

# Or Docker (no Go toolchain)
docker run --rm -v "$PWD:/workspace" -w /workspace \
  sentinelflow/sentinelflow:latest \
  scan --secrets --iac --sast examples/demo-project

make demo scans examples/demo-project (intentional findings) and writes demo-out/report.{html,md,sarif}.

Checked-in samples: docs/assets/demo/.

Install

Method	Best for	How
Install script	Laptops	curl -fsSL …/scripts/install.sh | bash (verifies checksums)
Docker	CI & tryouts	docker build -t sentinelflow/sentinelflow:local . — Hub tags when Docker credentials are configured on release
Clone + build	Contributors	git clone … && make build
GitHub Action	Pull requests	delivery: docker (external, after Hub publish) or delivery: build (this repo)

v1.1.1 ships GitHub Release binaries + checksums.txt. Docker Hub images publish when DOCKER_USERNAME / DOCKER_PASSWORD are set (see docs/releasing.md).

Install matrix: binary / Docker / Action / make build only. go install is not supported (module path ≠ GitHub repo name).

Build from source

git clone https://github.com/cozyGarage/sentielflow
cd sentielflow
make build
./sentinelflow version

Docker

# Local image from this repo
docker build -t sentinelflow/sentinelflow:local .
docker run --rm -v "$PWD:/workspace" -w /workspace \
  sentinelflow/sentinelflow:local \
  scan --all --format sarif -o report.sarif

# After a release is published
docker pull sentinelflow/sentinelflow:latest

Compose helpers: docker-compose.yml (scan-html, scan-sarif, scan-markdown).

Release binary

curl -fsSL https://raw.githubusercontent.com/cozyGarage/sentielflow/main/scripts/install.sh | bash
# or pin: VERSION=1.1.1 ./scripts/install.sh
./bin/sentinelflow version

GitHub Action

External repos (published image):

- uses: cozyGarage/sentielflow/.github/actions/sentinelflow@main
  with:
    delivery: docker
    image: sentinelflow/sentinelflow:latest
    fail-on: high
    format: sarif
    output: report.sarif

This repository (scan PR code):

- uses: ./.github/actions/sentinelflow
  with:
    delivery: build
    fail-on: high
    format: sarif
    output: report.sarif

Features

• Secret scanning — tokens, passwords, entropy, optional git history
• Infrastructure-as-Code — Terraform, Kubernetes, Dockerfiles
• Dependencies — OSV lookup (Go/npm/PyPI/Maven/Cargo)
• SAST — OWASP-oriented static patterns
• Container — Trivy when available
• License policy — deny GPL/AGPL/SSPL-style licenses
• Policy-as-code — embedded OPA/Rego built-ins
• SBOM — CycloneDX
• Reports — text, Markdown, SARIF, JSON, HTML

AI-powered review is planned. --ai / scanners.ai.enabled are rejected in this release.

Configuration

version: "1.0"
scanners:
  secrets: { enabled: true }
  iac:
    enabled: true
    frameworks: [terraform, kubernetes, dockerfile]
  dependencies: { enabled: true, ecosystems: [auto] }
fail_on:
  severity: high
  secrets: true
  policy_violations: true

Full reference: docs/configuration.md.

CI/CD

name: Security Scan
on: [pull_request]
jobs:
  security:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: cozyGarage/sentielflow/.github/actions/sentinelflow@main
        with:
          delivery: docker
          image: sentinelflow/sentinelflow:latest
          fail-on: high
          format: sarif
          output: report.sarif
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: report.sarif

GitLab (container):

sentinelflow:
  image: sentinelflow/sentinelflow:latest
  script:
    - sentinelflow scan --all --format sarif -o gl-security-report.sarif
  artifacts:
    reports:
      sast: gl-security-report.sarif

More: docs/cicd-integration.md.

Documentation

• Usage · Configuration · Scanners
• Policies · CI/CD · Architecture

Development

go test ./...
make build
make demo
make scan-self

Security

• Findings are redacted; secrets are not stored or exfiltrated
• Scanning is local by default (OSV receives package names/versions only)
• Container image runs as a non-root user

License

MIT — see LICENSE.