GitHub Actions

Gate is most useful in CI. A local scan tells you what your agent can do today; CI tells you the moment that changes.

The workflow

.github/workflows/gate.yml

name: Gate

on:
  pull_request:
  push:
    branches: [main]

jobs:
  gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: usegate/gate-action@v1
        with:
          severity: high

Or write it for yourself:

gate init --workflow

The action needs no permissions block and no token. It reads the checked-out workspace and writes a job summary.

Adopting on an existing repository

A repository that has been running agents for a while will have findings on day one. Failing every build over them is how a security check gets disabled in week two.

Record a baseline and fail only on what the pull request adds:

gate scan --write-baseline
git add .gate/baseline.json
git commit -m "Record Gate baseline"

- uses: usegate/gate-action@v1
  with:
    severity: high
    fail-on-new-only: true

The build now fails only when a change gives the agent something it did not have before:

This PR increases the agent's blast radius.

Inputs

Name
severity
Type
default: high
Description
Fail the job at this severity or above.
Name
path
Type
default: .
Description
Directory to scan, relative to the workspace.
Name
config
Type
default: auto
Description
Path to a Gate config file.
Name
baseline
Type
default: .gate/baseline.json
Description
Baseline to compare against. Set to an empty string to disable.
Name
fail-on-new-only
Type
default: false
Description
Fail only on findings this change introduced. Requires a baseline.
Name
sarif
Type
default: none
Description
Write SARIF to this path for GitHub code scanning.
Name
version
Type
default: latest
Description
@usegate/cli version. Pin this for reproducible builds.
Name
telemetry
Type
default: true
Description
Send anonymous aggregate usage data. See privacy.
Name
summary
Type
default: true
Description
Write a job summary.

Outputs

- uses: usegate/gate-action@v1
  id: gate
  with:
    severity: critical

- name: Warn the team about a widening blast radius
  if: steps.gate.outputs.blast-radius == 'critical'
  run: echo "Blast radius is ${{ steps.gate.outputs.blast-radius }}"

Available: blast-radius, blast-radius-score, critical, high, medium, low, new-findings, servers, tools, result-file.

Code scanning

- uses: usegate/gate-action@v1
  with:
    sarif: gate.sarif

- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: gate.sarif

SARIF is additive. Gate's own JSON stays the primary format, because SARIF has no way to express a blast radius, which is the thing Gate is actually for.

Other CI systems

Gate is a plain CLI with documented exit codes. Nothing about it is GitHub-specific.

Any CI system

npx @usegate/cli@0.1.0 scan --severity high --json > gate-result.json

GitLab CI

gate:
  image: node:22-alpine
  script:
    - npx --yes @usegate/cli@0.1.0 scan --severity high
  artifacts:
    when: always
    paths: [gate-result.json]