Skip to main content

​
Scan from the CLI

1

Install the CLI

Grab the latest archive for your platform from github.com/raphabot/pipefort/releases, extract it, and put pipefort on your PATH:
See Installation for the per-platform archive names.
2

Scan a local repo

The default -p flag scans .github/workflows/*.yml in the given directory.
3

Scan a remote GitHub repo

The CLI shallow-clones the repo to a temp directory, scans it, and cleans up.
4

Apply automatic fixes

Rewrites workflow YAML in place for the categories with a known safe fix (missing permissions, missing timeouts, dangerous pull_request_target triggers, and untrusted-input shell injection). See Auto-fix.

​
Use the web dashboard

1

Sign in

Open your Pipefort dashboard and click Sign in with GitHub. Identity comes from GitHub via OAuth.
2

Connect a GitHub account or org

Click Connect to install the Pipefort GitHub App on an account or organization. The app needs only read-only access to repo contents and metadata. See GitHub setup for the exact permissions.
3

Scan all repos

On the dashboard, click Scan all. Pipefort fetches each repo’s workflow YAML through the GitHub API, scans it, and updates the posture donut + trend line live.
4

Drill into a finding

Click a repo to see its per-finding list. Each finding links directly to the offending file:line on GitHub.

​
Next steps

CLI reference

Every flag, output format, and exit-code behavior.

Rules reference

The eight checks the scanner runs — what they catch and how to fix them.