Magma Moose
Magma Moose
Chargate mark Chargate

Gate pull requests on the findings this PR introduced, not your whole backlog. A security and lint gate built on MegaLinter.

● v2 ● Marketplace ● MIT ● MegaLinter core
Get it on the Marketplace Install the GitHub App Read the docs
a Magma Moose product · MIT open source
// the problem

A full scan blocks every PR on last year's debt.

Point a whole-repo scanner at a real codebase and it returns hundreds of findings, almost none of them from the pull request in front of you. Block on all of them and nobody ships; wave them through and the gate is theatre. Chargate gates on what the PR introduced and ships the rest where your security system can see it.

what a whole-repo gate does
— fails the PR on findings nobody in it wrote
— hundreds of pre-existing findings, every run
— reviewers mute the whole gate to ship
— a separate SARIF upload step to maintain
— one linter's action, then the next, then the next
what you run instead
magmamoose/chargate@v2
one gate · net-new only
// what it does

Gate the change. Ship the whole picture.

A whole-repo scan on a large codebase reports hundreds of pre-existing findings. Blocking on all of them is noise; ignoring them loses signal. Chargate splits the difference.

Net-new gating

The PR passes or fails based only on findings it introduces relative to the merge-base. Pre-existing findings never block.

MegaLinter does the scanning

v2 is a ground-up re-platform: MegaLinter runs the scanners; Chargate adds the gating layer. No hand-rolled 12-tool orchestration.

Full SARIF, always

The complete unfiltered SARIF is always emitted, so your security system still sees everything, including inherited debt and trends.

First-class sinks

Ship findings to DefectDojo and Dependency-Track, or the GitHub Security tab, straight from the same run.

Two surfaces, one CLI

A composite action for CI and a pre-commit hook for local runs, both driving the same chargate CLI (Python 3.11+).

PR comments, GHAS style

Net-new findings land as review comments on the PR, where the developer is already looking. Tunable severity with fail_on.

// quickstart

One action. Net-new findings only.

On PRs it runs MegaLinter whole-repo, gates on net-new findings, and ships the full SARIF. On push to the default branch it runs a non-gating baseline scan.

1. Add the action 2. Pick fail_on severity 3. Open a PR
.github/workflows/security.yml
steps:
  - uses: magmamoose/chargate@v2
    with:
      fail_on: high  # block only on net-new high/critical
      # defectdojo_url: https://dd.example.com
      # dependency_track_url: https://dtrack.example.com
// compared to alternatives

The scanners find it. Chargate decides what blocks.

A best-effort comparison against the ways teams gate security on a PR today. Corrections welcome via PR.

approach Net-new PR gate Every linter Full SARIF DefectDojo / D-Track PR inline comments No GHAS needed
magmamoose/chargate
MegaLinter alone
GitHub code scanning
a single SAST action
hand-rolled linter CI
// core inputs

Configured by a handful of inputs.

inputtypedefaultdescription
modeenumautoRun mode: auto · pr (net-new gate) · baseline (full scan, no gate).
fail_onenumanySeverity that blocks the PR: any · critical · high · medium · low · none.
precisionenumlineHow net-new is matched against the merge-base: line · file.
flavorenumallMegaLinter image: all · security · python · go, and more.
disable_linterscsv(none)MegaLinter keys to turn off; enable_linters allowlists instead.
pr_commentbooleantruePost net-new findings as GHAS-style review comments on the PR.
defectdojo_urlurl(none)Ship the full SARIF to DefectDojo; dependency_track_url for the CycloneDX BOM.
outputs › gate_result pass net_new_count 0 total_count 137 mode pr

↳ full input & output reference: the docs.

Actionable gates. Zero backlog noise.

Free and open source. Also on Homebrew: brew install MagmaMoose/tap/chargate

Get it on the Marketplace Read the docs