Gatecheck

Gatecheck automates report validation in a CI/CD Pipeline by comparing security findings to pre-determined thresholds. It also provides report aggregation, artifact integrity, and deployment validation. Gatecheck is stateless so self-hosting and provisioning servers is not required.

Getting Started

The fastest way to get started with Gatecheck is to download the pre-built binaries for your target system.

cd <target install dir>
curl -L <OS Specific Release>.tar.gz | tar xz
./gatecheck --help

The Gatecheck CLI supports --help for every command.

Update a release binary in place. --check only prints the current and latest versions.

gatecheck update --check
gatecheck update

Generate a configuration file with the default thresholds. Every rule starts disabled, and coverage thresholds start at 0.

gatecheck config init > gatecheck.yaml

Validate a report. The config is a flag. The report type comes from the file contents. The filename is used when the contents are ambiguous, so a Grype report can still be named grype-report.json.

gatecheck validate --config gatecheck.yaml grype-report.json

gatecheck agent-guide (alias llm) prints a markdown guide for coding agents. The same text is docs/agent-guide.md.

gatecheck bootstrap installs pinned Grype, Syft, Gitleaks, semgrep's experimental osemgrep CLI, Trivy, and osv-scanner. gatecheck grype, gatecheck syft, gatecheck gitleaks, gatecheck semgrep, gatecheck osemgrep, gatecheck trivy, and gatecheck osv-scanner run them.

Summarize Reports with List

gatecheck ls --help

List with EPSS scores is supported for Grype, CycloneDX, Trivy, and osv-scanner reports.

Validation

gatecheck validate --help

Bundling Artifacts

Bundling artifacts produces a gzipped tarball and a manifest. list and validate recognize a bundle from that manifest. A name that contains bundle still works when the contents are ambiguous.

gatecheck bundle create gatecheck-bundle.tar.gz grype-report.json