# Chargate — net-new security and lint gating for pull requests

> A security and lint gate on MegaLinter that fails a PR only on findings it introduces. SARIF to DefectDojo, Dependency-Track or the GitHub Security tab.

Canonical: <https://www.magmamoose.com/chargate/> · Last updated: 2026-10-23

Gate pull requests on the findings this PR introduced, not your whole backlog. A security and lint gate built on MegaLinter.

v2 · Marketplace · Apache-2.0 · MegaLinter core

- [Get it on the Marketplace](https://github.com/marketplace/actions/chargate)
- [Install the GitHub App](https://github.com/apps/chargate/installations/new)
- [Read the docs](https://docs.magmamoose.com/chargate/)

a Magma Moose product · Apache-2.0 open source

*the problem*

## A full scan blocks every PR on last year's debt.

Point a whole-repo scanner at a real codebase and it returns hundreds of findings, almost none of them from the pull request in front of you. Block on all of them and nobody ships; wave them through and the gate is theatre. Chargate gates on what the PR introduced and ships the rest where your security system can see it.

**what a whole-repo gate does**

- fails the PR on findings nobody in it wrote
- hundreds of pre-existing findings, every run
- reviewers mute the whole gate to ship
- a separate SARIF upload step to maintain
- one linter's action, then the next, then the next

**what you run instead**

magmamoose/chargate@v2

one gate · net-new only

*what it does*

## Gate the change. Ship the whole picture.

A whole-repo scan on a large codebase reports hundreds of pre-existing findings. Blocking on all of them is noise; ignoring them loses signal. Chargate splits the difference.

### Net-new gating

The PR passes or fails based only on findings it introduces relative to the merge-base. Pre-existing findings never block.

### MegaLinter does the scanning

v2 is a ground-up re-platform: MegaLinter runs the scanners; Chargate adds the gating layer. No hand-rolled 12-tool orchestration.

### Full SARIF, always

The complete unfiltered SARIF is always emitted, so your security system still sees everything, including inherited debt and trends.

### First-class sinks

Ship findings to DefectDojo and Dependency-Track, or the GitHub Security tab, straight from the same run.

### Two surfaces, one CLI

A composite action for CI and a pre-commit hook for local runs, both driving the same `chargate` CLI (Python 3.11+).

### PR comments, GHAS style

Net-new findings land as review comments on the PR, where the developer is already looking. Tunable severity with `fail_on`.

Chargate is security assurance; [Brimyr](https://www.magmamoose.com/brimyr/) is quality assurance. Twins, not competitors, and the line between them is the subject rather than the tool: Chargate owns net-new security findings, Brimyr owns coverage and net-new quality. Brimyr's quality half runs this same net-new engine as a nested step rather than growing its own. A repo wants both.

*quickstart*

## One action. Net-new findings only.

On PRs it runs MegaLinter whole-repo, gates on net-new findings, and ships the full SARIF. On push to the default branch it runs a non-gating baseline scan.

1. Add the action · 2. Pick fail_on severity · 3. Open a PR

.github/workflows/security.yml:

```yaml
steps:
  - uses: magmamoose/chargate@v2
    with:
      fail_on: high  # block only on net-new high/critical
      # defectdojo_url: https://dd.example.com
      # dependency_track_url: https://dtrack.example.com
```

*compared to alternatives*

## The scanners find it. Chargate decides what blocks.

A best-effort comparison against the ways teams gate security on a PR today. Corrections welcome via PR.

| approach | Net-new PR gate | Every linter | Full SARIF | DefectDojo / D-Track | PR inline comments | No GHAS needed |
| --- | --- | --- | --- | --- | --- | --- |
| magmamoose/chargate | Yes | Yes | Yes | Yes | Yes | Yes |
| MegaLinter alone | No | Yes | Yes | No | Yes | Yes |
| GitHub code scanning | No | No | Yes | No | Yes | No |
| a single SAST action | No | No | Yes | No | No | Yes |
| hand-rolled linter CI | No | No | No | No | No | Yes |

*core inputs*

## Configured by a handful of inputs.

| input | type | default | description |
| --- | --- | --- | --- |
| `mode` | `enum` | `auto` | Run mode: auto · pr (net-new gate) · baseline (full scan, no gate). |
| `fail_on` | `enum` | `any` | Severity that blocks the PR: any · critical · high · medium · low · none. |
| `precision` | `enum` | `line` | How net-new is matched against the merge-base: line · file. |
| `flavor` | `enum` | `all` | MegaLinter image: all · security · python · go, and more. |
| `disable_linters` | `csv` | `(none)` | MegaLinter keys to turn off; enable_linters allowlists instead. |
| `pr_comment` | `boolean` | `true` | Post net-new findings as GHAS-style review comments on the PR. |
| `defectdojo_url` | `url` | `(none)` | Ship the full SARIF to DefectDojo; dependency_track_url for the CycloneDX BOM. |

outputs › gate_result pass · net_new_count 0 · total_count 137 · mode pr

full input & output reference: [the docs](https://docs.magmamoose.com/chargate/).

## Actionable gates. Zero backlog noise.

Free and open source. Also on Homebrew: `brew install MagmaMoose/tap/chargate`

- [Get it on the Marketplace](https://github.com/marketplace/actions/chargate)
- [Read the docs](https://docs.magmamoose.com/chargate/)

## Links

- [Chargate: GitHub](https://github.com/MagmaMoose/chargate)
- [Chargate: Homebrew tap](https://github.com/MagmaMoose/homebrew-tap)
- [Company: Contact](mailto:hello@magmamoose.com)
- [Company: LinkedIn](https://www.linkedin.com/company/magmamoose)