pipechecker 0.3.1

CI/CD Pipeline Auditor - Catch errors before you push
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108

# Getting Started with Pipechecker

Pipechecker validates your CI/CD pipeline configuration **before** you push — catching circular dependencies, missing secrets, unpinned actions, and other issues early.

## Quick Start

```bash
# Auto-detect and check your workflow
pipechecker

# Check all workflows
pipechecker --all

# Detailed output
pipechecker --verbose
```

## Installation

```bash
# Via Cargo (recommended)
cargo install pipechecker

# Via npm
npm install -g pipechecker
```

## What It Checks

| Auditor | Rules | Description |
|---------|-------|-------------|
| Syntax | PC002-PC005 | Empty pipelines, duplicate jobs, missing deps |
| DAG | PC001 | Circular job dependencies |
| Secrets | PC006-PC008 | Hardcoded secrets in env vars |
| Pinning | PC009-PC010 | Unpinned actions, Docker :latest |
| Timeout | PC011 | Missing job timeout-minutes |
| Permissions | PC014 | Missing permissions block (GitHub) |
| Schema | PC012-PC013, PC015 | Missing keys, invalid structure |
| Concurrency | PC016 | Missing cancel-in-progress |
| Artifacts | PC017 | Missing artifact retention config |

## Examples

```bash
# Auto-detect and audit
pipechecker

# Check specific file
pipechecker .github/workflows/ci.yml

# Check all workflows with strict rules
pipechecker --all --strict

# Check only files changed since main
pipechecker --diff --diff-branch main

# Interactive terminal UI
pipechecker --tui

# Auto-fix unpinned actions
pipechecker --fix

# CI integration
pipechecker --ci

# Explain a rule
pipechecker --explain PC005

# Watch for changes
pipechecker --watch
```

## Configuration

Create `.pipecheckerrc.yml` in your project root to customize checks:

```yaml
ignore:
  - .github/workflows/old-*.yml

rules:
  circular_dependencies: true
  missing_secrets: true
  docker_latest_tag: true
  timeout_validation: true
  permissions_check: true
  schema_validation: true
  concurrency_validation: true
  artifacts_check: true
```

## Pre-commit Hook

```bash
pipechecker --install-hook
```

Runs `pipechecker --all --strict` before every commit.

## Supported Platforms

- GitHub Actions (`.github/workflows/*.yml`)
- GitLab CI (`.gitlab-ci.yml`)
- CircleCI (`.circleci/config.yml`)

---

Need details? See `docs/COMPLETE_GUIDE.md` or `pipechecker --help`.