Getting Started

Some evidence is written by a person; the rest is produced by commands that already run in your pipeline. The devguard CLI is the courier for the second kind. It runs the collectors you declare in a devguard.yml, scans their output for stray credentials, and files each report into the evidence record it belongs to, replacing the previous file so the record stays current instead of growing.

Install it with npm, or run it without installing:

npx @devguardch/cli --help        # run it once, nothing to install
npm install -g @devguardch/cli    # global install, provides `devguard`

The npm package needs Node 20 or newer. Standalone Linux binaries (x64 and arm64, no Node required) are attached to each GitHub release, together with a SHA256SUMS file to verify the download.

If you are setting the CLI up for the first time, start with the setup guide: it walks from an empty repository to a scheduled job. The pages here are the map of the machinery itself. Commands describes every command, flag, and resolution rule; Configuration describes every field of devguard.yml.