v0.9.0 Latest release · Apache-2.0

Fail the build when scan results cross your limits.

Gatecheck reads a scanner report, compares it with the thresholds in a config file, and exits non-zero when one is crossed. One binary. Stateless. Nothing to host.

$ go install github.com/gatecheckdev/gatecheck/cmd/gatecheck@latest

Needs Go 1.26 or newer.

Read the docs View on GitHub
gatecheck validate -f gatecheck.yaml grype-report.json
critical
8 / limit 0
high
14 / limit 5
medium
limit off
low
limit off 
ERR grype severity limit exceeded severity=critical report=8 limit=0
INF vulnerability detected id=GHSA-whpj-8f3w-67p5 severity=Critical
INF vulnerability detected id=GHSA-2jcg-qqmg-46q6 severity=Critical
…
ERR grype severity limit exceeded severity=high report=14 limit=5
Error: validation failure: Grype: Severity Limit Exceeded
Grype fixture from test/, trimmed exit 1 · build blocked
reads Grype CycloneDX Semgrep Gitleaks LCOV Clover Cobertura enriches with EPSS CISA KEV

A report goes in. An exit code comes out.

No server, no database, no account. Gatecheck runs in the job, reads files, and returns 0 or 1.

01 — report

A scanner writes a report

Grype, CycloneDX, Semgrep, Gitleaks, or a coverage file. Gatecheck picks the type from the filename.

$ grype app:latest -o json > grype-report.json
02 — thresholds

You set the limits

gatecheck config init prints a config with every limit off. Turn on the ones you mean to enforce.

grype:
  severityLimit:
    critical:
      enabled: true
      limit: 0
    high:
      enabled: true
      limit: 5
03 — verdict

CI passes or fails

gatecheck validate exits 1 when a limit is crossed and 0 when the report is inside it.

inside every limitexit 0 · pass
a limit crossedexit 1 · fail

What it checks

gatecheck ls prints any report as a table. Every command takes --help.

VULNERABILITIES

Grype

Severity counts, a CVE deny list, and a list of accepted CVEs.

SBOM

CycloneDX

The same CVE checks for vulnerabilities listed in a CycloneDX SBOM.

STATIC ANALYSIS

Semgrep

Separate limits for error, warning, and info findings.

SECRETS

Gitleaks

Fail the job when the report contains any secrets.

TESTS

Coverage

Line, function, and branch thresholds for LCOV, Clover, and Cobertura.

EXPLOIT LIKELIHOOD

EPSS

FIRST scores on ls --epss for Grype and CycloneDX, and a score limit during validate.

KNOWN EXPLOITED

KEV

Fail validate when a CVE appears in the CISA known-exploited catalog.

DATASETS

Offline data

download epss and download kev print the datasets to stdout.

bundle

Keep every report from a run in one archive.

bundle create and bundle add pack scan reports into a single gzipped tarball with a manifest of what is inside, so the evidence travels with the build. 

$ gatecheck bundle create gatecheck-bundle.tar.gz grype-report.json
$ gatecheck bundle add gatecheck-bundle.tar.gz semgrep-report.json
$ gatecheck bundle add gatecheck-bundle.tar.gz gitleaks-report.json
$ gatecheck ls gatecheck-bundle.tar.gz

One step in any pipeline.

A non-zero exit fails the job, so it works with GitHub Actions, GitLab CI, or anything else that runs a shell. The report filename has to contain its type, such as grype or semgrep.

  • Single static binary for Linux, macOS, and Windows
  • Stateless: no server to provision or keep running
  • Config lives in your repo next to the pipeline
.github/workflows/security.yaml 
- name: Scan the image
  run: grype app:latest -o json > grype-report.json

- name: Validate the Grype report
  run: gatecheck validate -f gatecheck.yaml grype-report.json

Put a gate in front of your next deploy.

Start with gatecheck config init > gatecheck.yaml and turn on one limit.

Get started Download v0.9.0