baseliner — repository governance, as code

Scan the whole fleet

Discover repositories from local checkouts and entire GitHub orgs or users in a single pass, then normalize filesystem and git metadata into one model.

Your baseline, as code

README, LICENSE, CODEOWNERS, CI, branch protection and more — declare the standard every repo should meet as policy-as-code. The policy is the product.

Severity-weighted scoring

Every repo gets a single 0–1 score from critical/high/medium/low weighted checks, so a fleet of 0.96s reads as "almost there", not a wall of red.

Built for CI

Console and JSON output (SARIF on the way), meaningful exit codes, and --fail-under to gate pipelines on a score threshold for gradual rollout.

Findings issues & drift

Optionally open a findings issue per repo and auto-close it when the repo becomes compliant. Run continuously from a control repo to catch drift.

One dependency-free binary

A single statically-linked Go binary — no runtime, no daemon. Download one file and run it. Install via script, Homebrew, or go install.

Make your implicit baseline explicit

Every org has an unwritten standard — "all our repos should have a README, a LICENSE, CI, branch protection…". baseliner turns that implicit baseline into something explicit (policy-as-code), measurable (scored), and monitored (drift detection). It's security-and-governance plumbing for your fleet, not a linter for your code.

Neighbors place it quickly: OSSF Scorecard is security-specific with a fixed check set; GitHub rulesets are GitHub-native with limited check types and no fleet scoring. baseliner's niche is configurable-baseline-first + fleet + scored + control-repo.

Install

install scriptHomebrewgo install

bash

curl -fsSL https://raw.githubusercontent.com/baselinerhq/baseliner/main/scripts/install.sh | bash

bash

brew install baselinerhq/tap/baseliner

bash

go install github.com/baselinerhq/baseliner/cmd/baseliner@latest

The install script drops a statically-linked binary into ~/.local/bin — no runtime required. See Install for prebuilt archives and version pinning.

Scan in two steps

yaml

# baseliner.yaml — a minimal local policy
scope:
  local:
    paths:
      - .
policy:
  base: default

bash

# score every repo and print a console summary
baseliner scan --config baseliner.yaml --format table

# gate CI on a fleet-wide score threshold
baseliner scan --config baseliner.yaml --fail-under 0.8

Ten built-in checks ship in the default policy out of the box. Point policy.base at your own YAML to choose which checks run, at what severity. See Policies for the schema and scoring model, and the Roadmap for where baseliner is headed — SARIF, a Marketplace Action, a full declarative policy engine, and auto-remediation fix-PRs.

baselinerRepository governance, as code.

Scan the whole fleet

Your baseline, as code

Severity-weighted scoring

Built for CI

Findings issues & drift

One dependency-free binary

Make your implicit baseline explicit ​

Install ​

Scan in two steps ​

Make your implicit baseline explicit

Install

Scan in two steps