description: Stop an infected change from merging: install the SAW Guard CI gate across one repository or a whole fleet, and prove it is enforced.¶
Gate CI¶
Stop an infected change from merging. For one repository step by step, see gate a repository; this is the operational view. Flags: CLI reference.
Across a fleet¶
check fails if any repository lacks a required gate, setup clones each repository and opens a
gate PR, and drift files or closes one drift issue for each repository behind its pin.
setup installs the gate where there is none and otherwise bumps only the pinned action reference,
leaving the rest of the workflow untouched. It never pushes to a default branch, and it fails closed
if it cannot resolve the release to a SHA — offline, pass --ref <sha|tag>.
Detection only¶
The installed gate opens a rolling fix PR on an infected verdict and stays red until that PR is
merged, so the check never passes on an unreviewed change. To detect without remediating, drop the
action's remediate: input and give the job read-only permissions — see the hand-written workflow in
the project README, which also lists the action's other
inputs. To run the scanner straight from this repository rather than from PyPI, reference the in-repo
composite instead — uses: Ndevu12/stayAwakeBot/.github/actions/worm-scan@<SHA>; both forms run the
same logic.
In any other CI¶
saw scan is the whole contract — no flag, no parsing:
or with no Python at all:
The last line of the report is the verdict. Upload findings to code scanning with --sarif, and
pass --require-db when the job must not lose advisory coverage silently.
Prove the gate is enforced¶
A gate that neither branch protection nor a ruleset requires is decoration. saw guard check checks the
requirement, not just the file; saw audit --repo owner/name -f reports it alongside the rest of a
repository's posture.