Fail the build when scan results cross your limits.
Gatecheck reads a scanner report, compares it with the thresholds in a config file, and exits non-zero when one is crossed. One binary. Stateless. Nothing to host.
$ go install github.com/gatecheckdev/gatecheck/cmd/gatecheck@latest
Needs Go 1.26 or newer.
Downloads the macOS arm64 archive for v0.11.0. Linux, macOS, and Windows archives are on the releases page.
ERR grype severity limit exceeded severity=critical report=8 limit=0 INF vulnerability detected id=GHSA-whpj-8f3w-67p5 severity=Critical INF vulnerability detected id=GHSA-2jcg-qqmg-46q6 severity=Critical … ERR grype severity limit exceeded severity=high report=14 limit=5 Error: validation failure: Grype: Severity Limit Exceeded
test/, trimmed
exit 1 · build blocked
A report goes in. An exit code comes out.
No server, no database, no account. Gatecheck runs in the job, reads files, and returns an exit code.
A scanner writes a report
Grype, Trivy, a SARIF tool, an SBOM, a secrets scan, or a coverage file. Gatecheck reads the type from the contents. gatecheck bootstrap installs pinned, checksum-verified scanners.
You set the limits
gatecheck config init prints a config with every limit off. Turn on the ones you mean to enforce.
grype:
severityLimit:
critical:
enabled: true
limit: 0
high:
enabled: true
limit: 5
CI passes or fails
gatecheck validate exits 1 when a limit is crossed and 0 when the report is inside it. A bad input exits 2, and missing EPSS or KEV data exits 3, even with --audit.
What it checks
gatecheck ls prints any report as a table. Every command takes --help.
Grype, Trivy, osv‑scanner
Severity counts, a CVE deny list, and a list of accepted CVEs.
CycloneDX and Syft
The same CVE checks for CycloneDX vulnerabilities, and license gating for SBOM packages: deny GPL, require an allow list, or fail unknown licenses.
Semgrep and SARIF
Severity limits and rule allow and deny lists for any SARIF tool, such as gosec, hadolint, zizmor, KICS, or Checkov.
Gitleaks and trufflehog
Fail the job when a report contains a secret, or only when trufflehog verified it is live.
OpenSSF Scorecard
A minimum aggregate score, and minimums for single checks such as Token-Permissions.
Coverage
Line, function, and branch thresholds for LCOV, Clover, and Cobertura.
EPSS and KEV
FIRST EPSS scores on ls --epss and as a limit, and a fail on any CVE in the CISA known-exploited catalog. download epss and download kev save the data for offline runs.
VEX
Skip findings an OpenVEX or CycloneDX VEX document marks not affected, so risk decisions live in a file other tools read too.
Keep every report from a run in one archive.
bundle create and bundle add pack scan reports into a
single gzipped tarball with a manifest of what is inside, so the evidence travels with the build.
$ gatecheck bundle create gatecheck-bundle.tar.gz grype-report.json $ gatecheck bundle add gatecheck-bundle.tar.gz semgrep-report.json $ gatecheck bundle add gatecheck-bundle.tar.gz gitleaks-report.json $ gatecheck ls gatecheck-bundle.tar.gz
One step in any pipeline.
A non-zero exit fails the job, so it works with GitHub Actions, GitLab CI, or anything else that runs a
shell. The report type comes from its contents, and --format json gives
the result to the next step.
- Single static binary for Linux, macOS, and Windows
- Stateless: no server to provision or keep running
- Config lives in your repo next to the pipeline
- name: Install pinned scanners run: gatecheck bootstrap --tools grype - name: Scan the image run: gatecheck grype app:latest -o json > grype-report.json - name: Validate the Grype report run: gatecheck validate -f gatecheck.yaml grype-report.json
Put a gate in front of your next deploy.
Start with gatecheck config init > gatecheck.yaml and turn on one limit.