linebreak-gate

linebreak-gate — the LineBreak security gate at the git/CI boundary

A real pull request, blocked for real: the gate is arequired check, so the merge button goes gray until the CVE is fixed or a named human records an override.

See it live — a public PR you can open right now →

- Dependency CVE scan — free, no key—osv-scanneracross every ecosystem (npm, PyPI, Go, Cargo, Maven, …), with annpm auditfallback for npm projects (npm-only coverage and no installed-version data — the GitHub Action fails closed if osv-scanner can't be installed instead of degrading to it).
- AI SAST — Pro— an LLM security review of first-party source (injection, broken auth, secret exposure, SSRF, unsafe deserialization, crypto misuse) with adversarial verification, enabled byLINEBREAK_LICENSE_KEY(hosted, uses credits) orANTHROPIC_API_KEY(your own key, takes precedence). Without a key the dependency scan still runs and this pass is skipped with a notice.

Contributing & license.This repo is the published source of[linebreak-gate(Apache-2.0): every release lands here and on PyPI from our CI, and every change passed our own gate first — CVE scan and human-approved criteria, the same discipline we sell. Bug reports and feature requests: open an issue or discussion here; we read everything. Direct PRs to this repo can't be merged (releases flow through our review pipeline), so start with an issue and we'll take it from there.

# .github/workflows/security-gate.yml name: Security gate on: pull_request: permissions: contents: read pull-requests: write # for the summary comment jobs: gate: runs-on: ubuntu-latest steps: - uses: actions/checkout@v5 - uses: Baktun-Studio/linebreak-gate@v1 with: # fail-on: high # blocking floor; default: critical # Optional today; required once license enforcement is enabled. license-key: ${{ secrets.LINEBREAK_LICENSE_KEY }} # Enables the AI code review; leave unset for dependency scan only. anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}

The action runslinebreak-gate scan, always runsreport, postsonePR comment (updated in place on every push, never spammed), uploads the JSON report + audit artifacts as a workflow artifact, and fails the check per the scan's exit code.

Make it a real boundary: require the check

A CI job that can be ignored is a dashboard, not a gate. In your repo:

Settings → Branches → Branch protection rules → your default branch → "Require status checks to pass before merging"→ add thegatejob (the name of the job that runs this action). From then on a PR carrying a critical CVE cannot be merged through the GitHub UI.