Usage

Scan a local repo

pipefort -p /path/to/your/repo

The scanner looks for .github/workflows/*.yml and *.yaml inside the given path. If that directory doesn’t exist, it falls back to walking the whole tree for any YAML file that looks like a workflow. If you omit -p, the current working directory (.) is used.

Scan a single workflow file

pipefort -f .github/workflows/deploy.yml

-f overrides -p. Useful for editor integrations or focused triage.

Scan a remote GitHub repo

pipefort -g owner/repo
pipefort -g https://github.com/owner/repo.git

The CLI runs git clone --depth 1 into a temp directory, scans it, and cleans up. Add --keep-temp to leave the clone on disk for inspection.

Scan an entire organization

pipefort --org my-org
pipefort --org my-org -o sarif > org.sarif

--org enumerates every repository owned by a GitHub organization or user and scans each one by fetching its workflow YAML over the API — no cloning, with bounded concurrency. It requires a token (--github-token, $GITHUB_TOKEN, $GH_TOKEN, or gh auth login); private repos need one with repo scope. Each repository’s own .pipefort.yml is fetched and applied to that repo’s findings, and the online supply-chain audits run automatically (the token is present). Console output leads with a per-repo severity summary, then the full findings grouped by owner/repo/path. --fail-on is evaluated against the aggregate across all repos.

JSON output

pipefort -p . -o json

Emits a JSON object on stdout with two keys: findings (the flat list of Finding objects) and toxic_combinations (the Attacker Mind correlations). Both keys are always present.

{
  "findings": [
    {
      "file": ".github/workflows/release.yml",
      "line": 12,
      "column": 5,
      "severity": "HIGH",
      "category": "CICD-SEC-4",
      "rule_id": "cicd-sec-4-ppe-shell-injection",
      "title": "Poisoned Pipeline Execution (Shell Injection)",
      "description": "...",
      "recommendation": "..."
    }
  ],
  "toxic_combinations": [
    {
      "id": "pwn-request",
      "title": "Pwn Request — untrusted PR code runs with a writable token",
      "severity": "CRITICAL",
      "scope": "file",
      "file": ".github/workflows/release.yml",
      "impact": "...",
      "break_chain": "...",
      "break_chain_rule": "cicd-sec-1-ppe-checkout",
      "stages": [{ "order": 0, "title": "...", "description": "...", "rule_id": "..." }],
      "components": [{ "rule_id": "cicd-sec-1-ppe-checkout", "finding": { "...": "..." } }]
    }
  ]
}

Breaking change. Earlier releases emitted a bare JSON array of findings. The output is now an object — read findings from the findings key (e.g. pipefort -p . -o json | jq '.findings').

Pipe to jq for filtering, or feed it into another tool. The console output (the default) is human-readable but the JSON form is the stable contract for automation.

Filter to OWASP-only

pipefort -p . -r owasp

--ruleset owasp (-r owasp) keeps only findings with category prefix CICD-SEC-. The default all includes the three best-practice checks too. See Rules reference.

Apply automatic fixes

pipefort -p . --fix

Rewrites workflow YAML in place for the fixable categories, then re-scans to show what’s left. See Auto-fix for the exact rewrite rules.

--fix is not supported with -g owner/repo. Clone the repo yourself if you want to fix and review the diff.

Get started

CLI

Editor

Web app

Concepts

Rules reference

Scan a local repo

Scan a single workflow file

Scan a remote GitHub repo

Scan an entire organization

JSON output

Filter to OWASP-only

Apply automatic fixes

​Scan a local repo

​Scan a single workflow file

​Scan a remote GitHub repo

​Scan an entire organization

​JSON output

​Filter to OWASP-only

​Apply automatic fixes

Scan a local repo

Scan a single workflow file

Scan a remote GitHub repo

Scan an entire organization

JSON output

Filter to OWASP-only

Apply automatic fixes