Pipewatch Pro

pip install cognis-pipewatch-pro
pipewatch-pro audit .          # → prioritized OWASP CI/CD findings in seconds
pipewatch-pro enrich .         # → match pinned components against 262k offline CVEs

pipewatch-pro is a passive, offline auditor. It reads your pipeline files and component pins — it never performs network scanning or active probing.

🔎 Example output

Real, reproducible output from the tool — runs offline:

$ pipewatch-pro-emit --version
PIPEWATCH-PRO 0.3.4

$ pipewatch-pro-emit --help
usage: pipewatch-pro [-h] [--version] {audit,enrich,feeds} ...

Audit CI/CD pipelines against the OWASP CI/CD Top 10 (passive, offline).

positional arguments:
  {audit,enrich,feeds}
    audit               Audit pipeline files / directories.
    enrich              Match pipeline components against the bundled offline
                        OSV vulnerability database.
    feeds               Edge/air-gap data-feed manager (offline cache +
                        snapshot import/export). See `feeds -h`.

options:
  -h, --help            show this help message and exit
  --version             show program's version number and exit

Blocks above are real pipewatch-pro output — reproduce them from a clone.

Sample result format (illustrative values — run on your own data for real findings):

{
"Findings": [
    {
        "id": "1234567890",
        "title": "Suspicious Network Traffic",
        "description": "Potential malicious activity detected on port 443.",
        "severity": "medium",
        "created_at": "2023-02-15T14:30:00Z"
    },
    {
        "id": "2345678901",
        "title": "Unusual System Login",
        "description": "Unauthorized access attempt from IP address 192.168.1.100.",
        "severity": "high",
        "created_at": "2023-02-15T14:31:00Z"
    }
]
}

Contents

• What it actually does · Quick start · The audit command · The enrich command · The feeds command · Output formats · Edge / air-gap · Detectors · Architecture · Use from any AI stack · Polyglot ports · Install anywhere · Scope & safety · Related · Contributing

What it actually does

PIPEWATCH-PRO parses CI/CD pipeline definitions — GitHub Actions (.github/workflows/*.yml) and GitLab CI (.gitlab-ci.yml) — and flags supply-chain weaknesses mapped to the OWASP CI/CD Top 10. The engine is pure standard library: a line-accurate text + light-structural pass, no third-party YAML dependency.

It also ships a bundled, fully-offline vulnerability database — a consolidated OSV corpus of 262,351 real records across PyPI / npm / Go / Maven / RubyGems / crates.io / NuGet — so the enrich command can match the components your pipeline pulls (actions, container images, pinned pip/npm installs, CVE references) against known vulnerabilities with no network and no API key.

Two single-purpose commands, both passive:

Command	What it answers
audit	"Is my pipeline configured insecurely?" (unpinned actions, curl|bash, hard-coded secrets, broad token scope, pull_request_target)
enrich	"Do the components my pipeline pulls have known CVEs?" (offline OSV match)
feeds	Edge/air-gap manager to refresh the intel cache from NVD/OSV/GHSA and sneakernet it into a disconnected enclave

Quick start

pip install cognis-pipewatch-pro            # or: pipx install cognis-pipewatch-pro
pipewatch-pro --version                     # PIPEWATCH-PRO 0.3.4

pipewatch-pro audit .                       # audit the current repo's pipelines
pipewatch-pro audit . --format json | jq .  # machine-readable
pipewatch-pro audit . --format sarif        # GitHub code-scanning
pipewatch-pro audit . --fail-on critical    # CI gate (non-zero exit)

pipewatch-pro enrich .                       # offline CVE match on pulled components
pipewatch-pro enrich . --fail-on-match       # fail CI if any component is vulnerable

No clone? Run straight from git:

pip install "git+https://github.com/cognis-digital/pipewatch-pro.git"
python -m pipewatch_pro audit .

The audit command — worked example

Given a deliberately risky workflow .github/workflows/ci.yml:

name: ci
on:
  pull_request_target:          # exposes secrets to fork PRs
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4                 # not pinned to a SHA
      - run: curl https://get.example.sh | bash   # remote code into a shell
      - run: echo ${{ secrets.TOKEN }}            # secret interpolated into a script

$ pipewatch-pro audit .
PIPEWATCH-PRO 0.3.4 - CI/CD supply-chain audit
================================================================
[HIGH] CICD-SEC-01  `pull_request_target` trigger exposes secrets to fork PRs
        at .github/workflows/ci.yml
        evidence: on: pull_request_target
        fix: pull_request_target runs with repo secrets in the PR context. Avoid
             checking out / executing untrusted PR head code, or use pull_request.

[HIGH] CICD-SEC-04  Action not pinned to a full commit SHA
        at .github/workflows/ci.yml:8
        evidence: actions/checkout@v4
        fix: Pin to a full 40-char commit SHA instead of a mutable tag/branch.

[HIGH] CICD-SEC-07  Remote script piped directly into a shell
        at .github/workflows/ci.yml:9
        evidence: curl https://get.example.sh | bash
        fix: Download to a file, verify a checksum/signature, then execute.

[MED ] CICD-SEC-05  No explicit `permissions:` block (token defaults to broad scope)
        at .github/workflows/ci.yml

[MED ] CICD-SEC-06  Secret interpolated directly into run script
        at .github/workflows/ci.yml:10
        evidence: echo ${{ secrets.TOKEN }}
----------------------------------------------------------------
Total: 5  (high=3, medium=2)
Gating (critical+high): 3
$ echo $?
1

A hard-coded secret like API_KEY: AKIA… (rather than a ${{ secrets.* }} reference) raises an additional critical CICD-SEC-06 finding, redacted in the output.

The exit code is 1 because findings at/above --fail-on (default high) exist — drop that into a CI step and insecure changes block the merge. Use --fail-on never to always exit 0 (report-only).

The enrich command — offline OSV match

enrich extracts the named software components a pipeline pulls and matches each against the bundled 262k-record OSV database — fully offline.

jobs:
  build:
    container:
      image: log4j-core:2.14.1            # vulnerable container component
    steps:
      - run: pip install requests==2.5.0
      - run: echo "remediate CVE-2021-44228"

$ pipewatch-pro enrich .
PIPEWATCH-PRO 0.3.4 - offline OSV enrichment
================================================================
components extracted: 3   vulnerability matches: 42
----------------------------------------------------------------
[CRITICAL] CVE-2021-44228  (Maven)
        component: [email protected]  [image]  at .github/workflows/ci.yml:4
        Remote code injection in Log4j
[CRITICAL] CVE-2021-45046  (Maven)
        component: [email protected]  [image]  at .github/workflows/ci.yml:4
        Incomplete fix for Apache Log4j vulnerability
[HIGH    ] CVE-2021-44832  (Maven)
        component: [email protected]  [image]  at .github/workflows/ci.yml:4
        Improper Input Validation and Injection in Apache Log4j2
        ...

What gets extracted:

Source in the pipeline	kind	Example
uses: owner/repo@ref	action	actions/checkout
image: name:tag	image	log4j-core:2.14.1
pip install pkg==ver	pip	requests==2.5.0
npm install pkg@ver	npm	[email protected]
bare CVE-… / GHSA-… in text/comments	cve-ref	CVE-2021-44228

pipewatch-pro enrich . --fail-on-match exits non-zero if any component matches a known vulnerability — a one-line offline gate for air-gapped pipelines.

The feeds command — keep the intel fresh

The bundled OSV corpus is the offline baseline so the tool has 262k vulns the moment it's cloned. To refresh or extend it, pipewatch-pro feeds wraps a keyless, stdlib-only data-feed manager over 35 real, recent intelligence sources (CISA KEV, EPSS, OSV, NVD, GHSA, MITRE ATT&CK, NIST OSCAL 800-53, abuse.ch, and more):

pipewatch-pro feeds list --domain vuln      # what's available
pipewatch-pro feeds update cisa-kev epss     # fetch + cache (online)
pipewatch-pro feeds get osv --offline        # serve from cache only

Output formats

• table (default) — human-readable, severity-sorted, with evidence + remediation.
• json — pipewatch-pro audit . --format json → {tool, version, summary, findings[]} for dashboards/agents.
• sarif — pipewatch-pro audit . --format sarif → SARIF 2.1.0, directly consumable by GitHub code-scanning (upload via github/codeql-action/upload-sarif).

Edge / air-gap

PIPEWATCH-PRO is built to run on disconnected, classified, or edge gear:

• Core is stdlib-only — audit and enrich have zero pip dependencies and never touch the network.
• The vuln DB ships in the repo (pipewatch_pro/cognis_vulndb.jsonl.gz) — clone once, enrich forever, offline.
• Refresh on the connected side, sneakernet to the air gap:

  # connected enclave
  pipewatch-pro feeds update cisa-kev epss osv nvd-cve
  python -m pipewatch_pro.datafeeds snapshot-export feeds.tar.gz
  # ── carry feeds.tar.gz across the air gap ──
  # disconnected enclave
  python -m pipewatch_pro.datafeeds snapshot-import feeds.tar.gz
  pipewatch-pro feeds get cisa-kev --offline
  

• Cache location is configurable with COGNIS_FEEDS_CACHE.

Detectors (OWASP CI/CD Top 10 coverage)

Rule	Maps to	Severity	What it catches
CICD-SEC-01	Insufficient Flow Control	high	pull_request_target exposes repo secrets to fork PRs
CICD-SEC-04	Poisoned Pipeline Execution	high / critical	Action not pinned to a 40-char commit SHA (critical for @main/@master/@latest floating refs)
CICD-SEC-05	Insufficient PBAC	medium	No explicit permissions: block — GITHUB_TOKEN defaults to broad scope
CICD-SEC-06	Insufficient Credential Hygiene	critical / medium	Hard-coded credential (redacted in output); secret interpolated directly into a run: script
CICD-SEC-07	Insecure System Configuration	high	Remote script piped straight into a shell (curl|bash)

SHA-pinned actions, local (./) and docker:// refs, ${{ secrets.* }} references mapped through env:, and obvious placeholders (changeme, xxxxxxxx, <token>) are not flagged — designed to be low-noise.

Architecture

flowchart LR
  IN[".github/workflows/*.yml<br/>.gitlab-ci.yml"] --> AUD[audit<br/>OWASP CI/CD detectors]
  IN --> EXT[extract_components<br/>actions / images / pins / CVE refs]
  EXT --> DB[(bundled OSV DB<br/>262k real vulns)]
  DB --> ENR[enrich<br/>offline CVE match]
  AUD --> OUT["table · JSON · SARIF"]
  ENR --> OUT
  FEED[feeds / datafeeds] -. refresh + air-gap snapshot .-> DB

Use it from any AI stack

• JSON — pipe pipewatch-pro audit . --format json (or enrich … --format json) into any agent or LLM.
• cognis-connect — pipewatch-pro-emit --to stix|misp|sigma|splunk|elastic|slack|webhook forwards findings to your platform (soft dependency: pip install "git+https://github.com/cognis-digital/cognis-connect.git").
• MCP — pipewatch_pro/mcp_server.py exposes the scan over MCP when cognis-core is installed (pip install '.[mcp]').
• CI / scripts — exit codes + SARIF for non-AI pipelines.

Polyglot ports

The primary audit command (the OWASP CI/CD detectors) is mirrored in three additional languages under ports/, each a single zero-dependency binary with its own smoke test, built and tested on every push by the ports.yml workflow:

Language	Path	Run	Test
Go	ports/go	go run . <path>	go test ./...
Rust	ports/rust	cargo run -- <path>	cargo test
Node.js	ports/javascript	node index.js <path>	node --test

All ports accept --format json and --version, and exit non-zero when a critical/high finding exists — drop the right binary into any CI runner without a Python toolchain.

Install — every way, every platform

pip install cognis-pipewatch-pro                                          # PyPI
pip install "git+https://github.com/cognis-digital/pipewatch-pro.git"     # pip from git
pipx install "git+https://github.com/cognis-digital/pipewatch-pro.git"    # isolated CLI
uv tool install "git+https://github.com/cognis-digital/pipewatch-pro.git" # uv
docker run --rm ghcr.io/cognis-digital/pipewatch-pro:latest --help        # Docker

Linux	macOS	Windows	Docker	Cloud
scripts/setup-linux.sh	scripts/setup-macos.sh	scripts/setup-windows.ps1	docker run ghcr.io/cognis-digital/pipewatch-pro	DEPLOY.md (AWS/Azure/GCP/k8s)

Scope, authorization & safety

PIPEWATCH-PRO is a defensive, authorized-use tool:

• Passive and offline. It reads pipeline files and component pins. It performs no network scanning, no active probing, and no exploitation of any kind.
• No fabricated intelligence. Enrichment matches only against the bundled, real OSV corpus (262k records) and the keyless public feed catalog — never invented CVEs or fingerprints.
• Run it on repositories you own or are authorized to audit.

Related Cognis tools

• depgraph — Dependency risk visualizer — Scorecard + OSV + typosquat + maintainer signals
• secretsweep — Repo secret scanner + auto-rotator across providers
• ossaudit — OSS license compliance auditor — AGPL contamination + NOTICE generation

Explore the suite → 🗂️ all tools · 🔗 cognis-connect

Contributing

PRs, new detectors, and demo scenarios are welcome — see CONTRIBUTING.md and SECURITY.md.

⭐ If pipewatch-pro saved you time, star it — it genuinely helps others find it.

Interoperability

pipewatch-pro composes with the Cognis suite — JSON in/out and a shared findings contract via cognis-connect. See INTEROP.md.

License

Source-available under the Cognis Open Collaboration License (COCL) v1.0 — free for personal, internal-evaluation, research, and educational use; commercial / production use requires a license ([email protected]). See LICENSE.

---