Running the gate in CI

garboard gate runs the same deterministic checks a pull request review posts — over a working tree, offline.

For a locked-down organisation this is usually the first thing that can actually be run: no App to install, no account, no API key, and no network.

What it runs

The security and reliability rules on HCL, the Crossplane gate on YAML, CloudFormation and SAM templates, and the repository’s own custom rules from .garboard/rules when that directory exists.

garboard gate .

  garboard gate · ./badtf

  ✗ [critical]  IAM policy grants wildcard action and resource  iam_egress.tf:4
  ✗ [critical]  Long-lived AWS access key committed in code     iam_egress.tf:20
  ✗ [critical]  S3 bucket has no encryption configuration       iam_egress.tf:38
  ✗ [critical]  RDS instance is not encrypted at rest           main.tf:1
  ✗ [critical]  Security group opens 0.0.0.0/0                  main.tf:12

A clean tree prints ✓ no findings — gate passed.

Exit codes

Code	Meaning
`0`	No blocking findings.
`1`	At least one blocking finding — or any finding at all with `--advisory-errors`.

Advisories do not fail a build unless you ask. --advisory-errors is the switch, and it is a per-pipeline decision: some teams want a clean tree, some want the gate to speak up only when it is serious.

Unparseable HCL fails loudly rather than passing as “no findings”. A parser that silently reports nothing on a file it could not read is worse than one that errors, because the build goes green for the wrong reason.

Formats

garboard gate . --format human    # default
garboard gate . --format json
garboard gate . --format sarif    # for code scanning

See SARIF and code scanning for the upload flow, which has one non-obvious requirement.

Selecting catalog rules

garboard gate . --profile aws-security-baseline
garboard gate . --rule lib.aws.rds_encryption --rule lib.aws.ecr_scan_on_push

Both flags are repeatable. garboard library profiles lists the bundles.

The honest limit: the CLI has no store, so it cannot know what your organisation has already adopted or declined. A rule you declined on the server still runs if you name it here. CI rule selection and organisation adoption are two separate decisions, and the CLI only knows about the one you typed.

Plan-aware gating

terraform plan -out=tf.plan && terraform show -json tf.plan > plan.json
garboard gate . --plan plan.json

You produce the plan in your own credentialed step. Garboard never runs Terraform, holds no cloud credentials, and the plan file never leaves your CI. See destructive changes.

How this relates to the App

They are independent and they are the same gate. Running garboard gate in CI requires no App; installing the App requires no CI change. Teams often run both — the Action for the merge gate, the App for the review comment and Fix.