gatecheck

Fail the build when security scan results cross your thresholds.

Gatecheck reads a scanner report, compares it with the limits in a config file, and exits non-zero when a limit is crossed. One binary. Nothing to host.

$ go install github.com/gatecheckdev/gatecheck/cmd/gatecheck@latest
Docs GitHub

Needs Go 1.23 or newer. Prebuilt binaries for Linux, macOS, and Windows are on the releases page.

shell
$ gatecheck list grype-report.json
+----------------+-----------------------+------------------+--------------------------------------------------------------+
| GRYPE SEVERITY |        PACKAGE        |     VERSION      |                             LINK                             |
+----------------+-----------------------+------------------+--------------------------------------------------------------+
| Critical       | vm2                   | 3.9.17           | https://github.com/advisories/GHSA-cchq-frgv-rjh5            |
| Critical       | vm2                   | 3.9.17           | https://github.com/advisories/GHSA-whpj-8f3w-67p5            |
| Critical       | marsdb                | 0.6.11           | https://github.com/advisories/GHSA-5mrr-rgp6-x4gr            |
| Critical       | jsonwebtoken          | 0.1.0            | https://github.com/advisories/GHSA-c7hr-j4mj-j2w6            |
…
$ gatecheck validate -f gatecheck.yaml grype-report.json
01:38:49 ERR grype severity limit exceeded severity=critical report=8 limit=0
01:38:49 INF vulnerability detected id=GHSA-whpj-8f3w-67p5 severity=Critical
01:38:49 INF vulnerability detected id=GHSA-2jcg-qqmg-46q6 severity=Critical
01:38:49 INF vulnerability detected id=GHSA-g644-9gfx-q4q4 severity=Critical
…
01:38:49 ERR grype severity limit exceeded severity=high report=14 limit=5
Error: validation failure: Grype: Severity Limit Exceeded
The table is the top of gatecheck list on the Grype fixture in test/. The log is a trimmed gatecheck validate -f of that same file, with the critical limit at 0 and the high limit at 5. The command exits 1.

How it works

  1. 01

    A scanner writes a report

    Grype, CycloneDX, Semgrep, Gitleaks, or a coverage file. Gatecheck picks the type from the filename.

  2. 02

    You set the thresholds

    gatecheck config init prints a config with the limits off. Turn on the ones you mean to enforce. 

    grype:
  severityLimit:
    critical:
      enabled: true
      limit: 0
    high:
      enabled: true
      limit: 5

  3. 03

    CI passes or fails

    gatecheck validate -f gatecheck.yaml grype-report.json exits 1 when a limit is crossed, and 0 when the report is inside it.

What it checks

list (alias ls) prints a table. download epss and download kev print the datasets to stdout. Command details are in the docs.

  • Grype

    Severity counts, a CVE deny list, and a list of accepted CVEs.

  • CycloneDX

    The same CVE checks for vulnerabilities in a CycloneDX SBOM.

  • Semgrep

    Limits for error, warning, and info findings.

  • Gitleaks

    Fail when the report contains secrets.

  • Coverage

    Line, function, and branch thresholds for LCOV, Clover, and Cobertura.

  • Bundles

    bundle create and bundle add pack reports into one gzipped archive with a manifest.

  • EPSS

    FIRST scores on list --epss for Grype and CycloneDX, and a score limit during validate.

  • KEV

    Fail validate when a CVE is in the CISA known-exploited catalog.

In CI

A non-zero exit fails the job. The report filename has to contain the type, such as grype or semgrep. 

- name: Validate the Grype report
  run: gatecheck validate -f gatecheck.yaml grype-report.json