Start here
Supported stacks and git hosts
What Garboard reads, and — the part worth more to you — where that support is deep and where it is not.
Infrastructure languages
| Stack | Status |
|---|---|
| Terraform / OpenTofu (HCL) | Deepest support. Every built-in rule, the full convention deriver set, plan-aware gating. |
| Terragrunt units | Supported through the same HCL frontend. |
| Crossplane — XRDs, Compositions, Claims | Gate support is strong; convention derivation is thin. See below. |
| CloudFormation and SAM | Supported, including cross-stack export and import conventions. |
Where it is thin, specifically
Crossplane convention derivation. On our benchmark corpus the gate produced 28 findings across three Crossplane repositories while deriving only 3 conventions from them. So on a Crossplane tree, Garboard currently has more to say from its rules than it has learned from your repo. The rules are good; the learning is shallow. If your evaluation is mostly about “does it learn our conventions”, weight that accordingly.
Two deriver families fire on nothing in that corpus at all. We publish that on the gauntlet page rather than quietly dropping them.
Git hosts
One host per instance. An install talks to GitHub or to GitLab, not both.
GitHub is the deep path: a GitHub App with least-privilege scopes, pull request comments, and check runs with a proper neutral state for advisories.
GitLab is code-complete behind the same provider seam and has not been run against a live GitLab project. It is documented on its own page, deliberately outside the install flow, because placement is a claim and we are not going to put an untested path next to a tested one and let the caveat do all the work.
There is also a real behavioural difference worth knowing before you evaluate it: GitLab commit statuses have no neutral state. GitHub can mark an advisory as neutral; GitLab cannot. So on GitLab an advisory posts a success status with the description prefixed advisory ·. The information is preserved; the traffic light is not, because GitLab does not have that colour.
Provider schemas
Crossplane gating is grounded in real provider CRD schemas rather than guesses, pinned in a local cache and managed with garboard schema sync and garboard schema ls. An unknown resource kind is reported as unknown rather than assumed valid.