Skip to content

carabiner v0.1.0

Choose a tag to compare

View all tags
@MaXiMo000 MaXiMo000 released this 22 Aug 18:16
· 39 commits to main since this release
v0.1.0
ba7dcf0

First release. Four engines, the ratchet, the drill, and three ways to install it.

What it does

  • The ratchet — carabiner init accepts every existing finding into a baseline, so CI goes green immediately and only new findings fail it. Adoptable in a ten-year-old repo without a cleanup sprint. Findings are fingerprinted on content, never line numbers, so reformatting a file doesn't resurrect the backlog. --expires 90 puts a deadline on accepted debt.
  • The drill — carabiner drill doesn't read config. It plants a private key and runs your installed pre-commit hooks against it, then asks GitHub whether push protection is on and whether your default branch actually requires a status check. A drill that couldn't run never reports as passing.
  • One normalized model — SARIF into the PR Security tab, deduplicated across engines, most-severe-wins.

Engines

Engine Needs
ci — GitHub Actions: pull_request_target + PR-head checkout, github.event script injection, unpinned actions, token blast radius, self-hosted runners nothing
ci — GitLab CI: merge-request-title script injection, unpinned remote include:, mutable image tags nothing
repo — .gitignore gaps, committed key material, credentials in git remotes nothing
secrets gitleaks
deps — PyPI, npm, Go, Maven, crates.io… ids normalized to CVE osv-scanner

Install

- uses: MaXiMo000/carabiner@v0.1.0
docker run --rm -v "$PWD:/repo:ro" ghcr.io/maximo000/carabiner:v0.1.0 scan --all

The image bundles both scanners, pins its base by digest, checksum-verifies every binary it downloads, runs as a non-root user, and ships with a build-provenance attestation. linux/amd64 only for now.

Known limits — Jenkins, CircleCI and Bitbucket get every engine except ci. Windows is untested. Only top-level dependency manifests are read.

Site: https://maximo000.github.io/carabiner/

Assets 2
Loading