Everything you need to run PullGuard — add it to a repo in five minutes, tune it to your team's policies, and get browsable, air-gapped reports.
Install paths (Free, Pro/Team, Enterprise), what PullGuard scans, and your first scan in five minutes.
Every knob — workflow inputs, the complete annotated .driftrc.yml with all options, .pullguardignore, and air-gapped mode.
Self-contained HTML report, the over-time dashboard with drill-down to file:line, finding dates, and CI artifacts — all offline.
Show only new findings on PRs and beyond — the .drift-baseline.json format, the three scoping modes (full / baseline-diff / PR-delta), and off-PR usage.
Every command (scan, baseline, dashboard, ignore, …) and the full scan flag list.
Click a finding straight to source in VS Code, Visual Studio, JetBrains or Eclipse — via the SARIF output and free IDE viewers, no PullGuard plugin needed.
Run a live, access-controlled multi-repo dashboard inside your own boundary — results-only ingestion, SSO + RBAC, and your code never leaves your runners.
Where your code goes (nowhere), fully air-gapped operation, and supply-chain verifiability — SLSA build provenance + SBOM on every published image. For EU / government / regulated reviews.
Every advisory banner explained, scan-coverage caps, "why didn't this finding fire?", offline mode, CI outputs — and pullguard doctor, the one-command environment check.
Serve scan results to Claude Code, Cursor, or any MCP-capable agent — read-only, local, deterministic. The agent that writes the code can read, prioritise, and fix the findings.
Every finding type PullGuard can report — remediation guidance with code examples, CWE and OWASP Agentic Top-10 mappings, and triage options. Generated from the shipped catalog, so it can't drift.
- uses: pullguard-dev/pullguard-action@v1
with:
license-key: ${{ secrets.PULLGUARD_LICENSE_KEY }} # omit for the free tierFree tier (14 analyzers) needs no key. Pro/Team/Enterprise unlock the rest. See Getting Started.