Start here
What Garboard is
Garboard is a review gate for infrastructure pull requests. It reads the repository you already have, works out how that repository does things, and then reviews every infrastructure change against those conventions plus a set of security and reliability rules.
The one thing worth understanding
The gate is deterministic. The language model never produces a verdict.
A finding comes from a parser and a rule. The same commit produces the same findings on Monday and on Friday, on your laptop and in CI, with an API key and without one. Nothing about the decision depends on a model’s mood.
The model has exactly two jobs, and neither of them is judging:
- it writes prose — the sentence explaining a finding a human reads;
- it writes fixes — a proposed diff.
And a fix it proposes is put through the same gate an external pull request goes through. A model cannot talk its way past the rules by having written the code itself.
This is the difference between “an AI reviews your Terraform” and what this does. An AI reviewer that hallucinates a finding costs you an afternoon and some trust. A parser that finds 0.0.0.0/0 on line 42 either found it or did not.
What it actually does
- Parses your infrastructure code into facts — resources, attributes, module sources, each with a file and a line.
- Derives conventions from those facts. Not rules we invented: patterns your repo already follows, each backed by the evidence that supports it. If eleven of your twelve buckets set encryption, that is a convention, and the twelfth is a finding.
- Reviews each pull request against those conventions, the built-in security and reliability rules, any catalog rules your organisation adopted, and any custom rules you wrote.
- Says something, or says nothing. A pull request with nothing worth saying gets no comment at all. This is the property most worth understanding, and it has its own page.
One binary
Everything is one Go program with several entrypoints:
| Entrypoint | What it is for |
|---|---|
garboard scan |
Parse a repo, derive conventions, write the RCD. Fully offline. |
garboard gate |
Run the same checks a pull request gets, over a working tree, in CI. |
garboard serve |
The API server and the git-host webhook. |
garboard mcp |
Expose the conventions to coding agents over MCP. |
garboard export |
Render the conventions to CLAUDE.md / AGENTS.md / cursor rules. |
garboard library |
Browse the curated rule catalog offline. |
garboard receipt |
Governance receipts: sign and verify. |
garboard schema |
Manage the pinned provider CRD schema cache. |
Every flag of every one of these is in the CLI reference, which is generated from the binary itself rather than written by hand.
What it runs on
Terraform and OpenTofu (HCL), Terragrunt units, Crossplane XRDs, Compositions and Claims, and CloudFormation and SAM templates. One git host per instance: a GitHub App, or GitLab. The supported stacks page is honest about where that support is deep and where it is thin.
What it never does
No terraform apply. No cloud credentials. No merge. That claim is narrower and more precise than “it only ever writes a comment”, which is what our own README used to say and which was not true — see what Garboard writes for exactly which paths write what.