Show HN: Plumber, open-source CLI that scores your CI/CD pipeline security (A–E)
Category: security
Tags: ci-cd, security, cli-tool, gitlab-ci, github-actions, policy-engine, rego
Score: 7.8/10 (Innovation: 7, Technical: 8, Documentation: 8, Utility: 8)
Plumber is a CLI tool that scans GitLab CI and GitHub Actions pipeline configurations for security vulnerabilities and risky patterns, assigning an A-E score. It combines a custom policy engine using Rego, support for multiple output formats (SARIF, CycloneDX, etc.), and automated CI integrations, making CI/CD security auditing accessible and automated. Its innovative combo of pipeline-specific security scanning with a standardized scoring badge and deep integration into both CI platforms sets it apart.
Target audience: devops
Repository: https://github.com/getplumber/plumber · Go · MPL-2.0 · 738 stars
View on Hacker News