Getting Started

Every public and private GitHub repository can run the free tier without an account or license key. You get the 12 commodity SAST / quality checks plus the supply-chain "dangerous files" and "repo hygiene" analyzers.

1. Drop this workflow file at .github/workflows/pullguard.yml:

name: PullGuard

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

permissions:
  contents: read
  pull-requests: write
  checks: write

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0          # Required for git-history analyzers

      - uses: pullguard-dev/pullguard-action@v1

2. Open a pull request.

PullGuard runs on every PR push, posts a comment with findings, writes a Step Summary to the Actions tab, and uploads the JSON / Markdown report as a workflow artifact.

Pro unlocks 42 of 44 analyzers for one private repository — the full deep-analysis catalogue except enterprise custom rules. Team adds custom rules + up to 10 private repositories with unlimited contributors. Both bind to your organisation/repo at first scan; re-binding requires a support email.

1. Buy at pullguard.dev/#pricing via Stripe checkout.

Pro is $29/month, Team is $99/month. Stripe handles billing, invoicing, and tax. Cancel from your Stripe customer portal.

2. Receive your pg_live_* license token by email (instant).

3. Add the token as a repository secret named PULLGUARD_LICENSE_KEY:

GitHub repo → Settings → Secrets and variables → Actions → New repository secret. Or for organisation-wide use: Settings → Secrets at the org level.

4. Reference it in your workflow:

      - uses: pullguard-dev/pullguard-action@v1
        with:
          license-key: ${{ secrets.PULLGUARD_LICENSE_KEY }}

On the next PR scan, all 42/44 analyzers run, multi-framework compliance evidence appears, and the cost-estimation dollar amounts populate.

Enterprise adds the GitHub Marketplace pullguard-code-scanner App (which provisions the workflow file automatically), native Check Run annotations on the PR Files-changed view, a 4 business-hour response SLA, and an annual contract with a master service agreement and data-processing addendum. SSO (SAML / OIDC) and RBAC are included; tamper-proof audit logs & export are on the roadmap, available as contracted deliverables.

1. Contact sales:

hello@pullguard.dev — book a 30-minute call. We'll discuss repo count, contributor count, compliance frameworks in scope, and procurement requirements.

2. Install the GitHub App:

After contract signature, install pullguard-code-scanner on your GitHub organisation. The App auto-opens a provisioning pull request with the four-line workflow file ready to merge.

3. Enable native Check Run rendering:

      - uses: pullguard-dev/pullguard-action@v1
        with:
          license-key: ${{ secrets.PULLGUARD_LICENSE_KEY }}
          report-to-app: true

With report-to-app: true the PR-comment + Step-Summary surfaces continue to work AND findings appear as native Check Run annotations on the Files-changed view (line-level red flags, inline severity badges).