Does your CI actually block?

zanadir reads a repository's CI configuration and reports which security and quality controls are missing, or wired so they cannot fail a build.

zanadir scan --dir .
zanadir scan --repo github.com/owner/name
zanadir fix --dir .

GitHub Install GitHub Action llms.txt State of CI security 2026

Present is not protected

A scanner with continue-on-error, --exit-code 0, || true or a push-only trigger is in the pipeline but cannot stop a merge. zanadir grades every control it finds:

enforcingcan fail a merge

partialruns, but not on every change

advisorycannot fail a build

unknownbehind a condition the file cannot settle

What it checks

Twelve categories: SCA, secrets detection, SAST, linting, unit tests, coverage, licences, end-of-life, IaC, supply chain, workflow security and performance testing.
Six CI platforms: GitHub Actions, GitLab CI, CircleCI, Bitbucket Pipelines, Azure Pipelines and Jenkins.
Into what the jobs call: Makefiles, Taskfiles, tox, goreleaser, reusable workflows, composite actions and CI templates.
With --required-checks, whether branch protection requires the check at all.

State of CI security 2026

We scanned 1,000 of the most-starred GitHub repositories with CI. 511 declare no dependency, secret or code scanning anywhere in the repository, and 1 in 6 of those that do run a scanner in CI have one that cannot fail the build. Read the report.

With OpenSSF Scorecard

Scorecard rates a project's security practices across the repository. zanadir reads the CI configuration and tells you whether the controls you have would stop a bad change, and what to add. Use both.