Your standards, on every GitHub Actions workflow.
Write your rules in plain language. CodeCargo scores every workflow against them on every change, checks every pull request before it merges, and opens the fix as a pull request. Compliance becomes continuous, not a quarterly fire drill.
- Third-party actions pinned to a commit SHA1,838 / 1,890
- OIDC to the cloud, no stored keys1,802 / 1,890
- GITHUB_TOKEN least privilege1,771 / 1,890
- Only approved actions1,890 / 1,890
- Builds use a shared building block1,742 / 1,890
Trusted by teams managing GitHub at scale
Why it breaks at scale
Policy on paper rarely makes it into the pipeline.
Policy lives in documents
Pipeline security policy is written in corporate documents that developers rarely read.
With Standards: Policies become executable rules, checked on every workflow automatically.
Fixing it takes deep skills
Knowing a workflow fails a rule is not the same as knowing how to fix it in GitHub Actions.
With Standards: Fix pull requests arrive with the change already written: review, approve, merge.
Nobody can see the whole estate
Repository by repository, nobody can say what is fixed, what is drifting or where the exposure is.
With Standards: One view of scores, drift and fixes across every repository, team and rule.
How it works
From rule to enforcement, without a war room.
- 01
Write your rules
Start from built-in best practices (SHA pinning, OIDC, approved actions, least-privilege tokens) and add your own in plain language.
- 02
Score every workflow
Every workflow in every repository gets a 0 to 100 score on enable, then again on every change, so drift shows up the day it happens.
- 03
Fix as pull requests
Failing workflows get a fix pull request with the change already written, one repository or a thousand at a time.
Prevent, then repair
Problems stopped in the pull request that brings them in.
Every pull request that touches a workflow gets a CodeCargo standards check, in plain words, with an Apply fix button. Once a repository has met a standard for 30 days, CodeCargo proposes locking it in with a ruleset, so cleaned-up repositories stay clean.
- Advisory by default; blocking only where you choose
- Never blocks a merge if CodeCargo can't grade it
- actions/setup-node is pinned to a tag, not a commitApply fix
- GITHUB_TOKEN has write-all permissionsApply fix
- Uses the node-package building block
- No long-lived cloud credentials
Actions Advisor
Fewer workflows to hold to standard.
Actions Advisor inventories every action and workflow, finds the copies that drifted apart, and converges them onto shared reusable workflows your platform team owns, delivered as pull requests. Fix a standard once in the building block and every caller inherits it.
Migrate lands you on standard building blocks. Secure holds you to them.
- 340 copies of a Maven buildjava-service.yml
- 212 hand-rolled Node pipelinesnode-package.yml
- 61 Docker build variantscontainer-build.yml
Standards questions.
What platform, security and audit teams ask first. We're happy to go deeper.
What rules does Standards support?
A built-in set covers common controls: SHA pinning, OIDC to the cloud, approved actions, least-privilege tokens and secret handling. You can add fully custom rules in plain language, against anything in workflow YAML: action versions, permissions, environments, secret references and runner types.
How does scoring work?
Every workflow is evaluated against your rules and scored from 0 to 100. Scores are tracked over time, and when a workflow that passed drops below your threshold, you get an alert and a fix pull request.
Will it block our developers?
Only where you choose. Checks run on every pull request that touches a workflow, in advisory mode (report, don’t block) or enforcement mode (block non-compliant merges). Most teams start advisory and enforce once a repository has met a standard.
How do fixes get made?
CodeCargo opens a pull request with the fix already written. When a rule changes or a violation is widespread, it can open fixes across every affected repository in one operation.
How do we produce audit evidence?
CodeCargo keeps the history of every rule, score, fix and enforcement event, exportable for whatever framework or internal review your auditors need.
What is the impact on CI?
The check runs as a GitHub check on pull requests that change workflow files, typically finishes in under 10 seconds and runs in parallel with your other checks.
Does it support GitHub Enterprise Server?
Yes. Standards works on GitHub Enterprise Cloud and GitHub Enterprise Server.
How does Standards relate to Secure and Manage?
Standards is the guardrails part of Secure, alongside CargoWall, GHAS alert triage and compromised-action response. Manage includes Secure and adds cost, hygiene and self-service.