Repository security scanner, local CI runner, scheduled monitor

commitwork

commitwork runs a repository's security checks and its GitHub Actions CI on your own machine, and keeps running them on a schedule. Every lane writes its evidence to disk where you can re-read it: the scanner's own output, the command that produced it, and the exit code it returned.

82 checks 11 groups 49 declared tools Node 22.18 or newer Zero runtime dependencies AGPL-3.0-or-later

What it runs

Each row is a family of lanes from manifests/security-baseline.json. A lane declares the binary it needs; 40 of the 82 are in the all group the scheduled sweep runs.

Family	Lanes draw on
Secrets	TruffleHog git history, Gitleaks and Betterleaks over a declared scope file
Code analysis	Semgrep or Opengrep, CodeQL, Joern, PMD, Psalm, Bandit, gosec, flawfinder, cppcheck
Dependencies	OSV, dep-scan reachability, govulncheck, npm and yarn audit, retire.js, bundler-audit, cargo-audit, JVM and Gradle, provenance, Renovate
Supply chain	Socket, GuardDog, CycloneDX and Syft SBOMs, vendored assets, model artefacts and dataset loader configs
Infrastructure and CI	Trivy config, Hadolint, actionlint, zizmor, Actions gaps, shellcheck, gradle-wrapper
Agent configuration	agent instruction files, MCP servers, hooks and permission grants
Runtime	Nuclei, BOLA and authorisation probes, TLS and security headers, API fuzzing
Posture	Prowler for GitHub cloud posture, OpenSSF Scorecard, WCAG accessibility
Mainframe	cobolwork, optional: COBOL, CICS and JCL data flow, mainframe credential rules

Three properties worth knowing before you trust a run. A lane whose binary is absent records a skip that names the binary, rather than a pass. Each result carries the depth it ran at and whether the host sandbox confined it. Nothing is uploaded: the artefacts stay in the report directory you name.

Install

The installer copies one tree into a prefix, refuses a Node below the floor that tree declares, and writes a commitwork launcher. It downloads nothing itself.

git clone https://github.com/Portll/commitwork
sh commitwork/bin/install.sh                      # or: npm install && npm link
commitwork init --root ~/Repositories             # the private store and a fleet registry
commitwork setup                                  # install the scanners the lanes need
commitwork run fast --manifest security-baseline  # the fast pre-commit set

On Linux, setup reports each package manager as usable, present but needing root, or absent, and prints one administrator block naming what it cannot install itself. Re-running the installer keeps your configuration: operator-written paths are carried into the new tree and the replaced one is kept beside it.

Latest additions

Recent changes on main, newest first, by commit. This is the repository's history rather than a release's notes.

Commit	Change
`83c29d6f`	install pinned scanner releases first on every platform
`415653f7`	verify a release asset's cosign signature before install
`7d48b16b`	hold build lanes on scan and brief behind `--allow-build`
`97787612`	require authority for TLS findings from testssl
`a8dad4cb`	bound digest delivery with a timer that holds the process

Release

v0.5.0 is the first release, tagged 2026-10-08 on the public repository, whose history starts with its own root commit rather than the private one. Development carries 0.5.95 after 2,839 commits. The releases page and the feed report what exists rather than what is planned, and the source is at github.com/Portll/commitwork.

Read as of 2026-10-10. A tag naming the version package.json carries at that commit is what makes a release.

Elsewhere on this site

Roadmap: features by target release, through 1.0.0
Releases: what has shipped, and the history behind it
Release feed: Atom, no token needed
Domain model: subdomains, bounded contexts, context map and ubiquitous language
Source on GitHub: issues, the licence and the security policy