tigergate/tigergate-cli — run every TigerGate scanner in your pipeline, upload results, gate the build, and link findings code → cloud.
The TigerGate CLI runs every code scanner (SAST, SCA, secrets, quality, IaC, and
container image), uploads the results, evaluates your quality gate, and exits
with a meaningful status code. It’s the same tool the CI snippets
call.
The CLI is distributed as the Docker image tigergate/tigergate-cli,
published multi-arch (linux/amd64, linux/arm64) to Docker Hub. The image
ships with every scan engine pre-baked, so there’s nothing to provision on
your runners. Its entrypoint is tigergate, so the command after the image
name (scan, gate, …) is a subcommand.
Create a CI/CD key under Settings → Organization → API Keys → CI/CD Keys
(prefix tgci_) — see API keys. Pass it as an env var
(preferred — keeps it out of ps and shell history) or with --api-key:
The CLI talks to one TigerGate region, and tgci_ keys are
region-scoped — a key issued in one region is rejected by every other.--region is a persistent flag, so it works on every subcommand and on either
side of it:
docker run --rm -e TIGERGATE_API_KEY \ -v "$PWD:/workspace" -w /workspace \ tigergate/tigergate-cli:latest \ --region <code> scan --type all --upload
Equivalently, set TIGERGATE_REGION in the runner’s environment, or commit
region: <code> to .tigergate.yml so the whole repo agrees. Run
tigergate regions to list the codes.Resolution order is --api-url / TIGERGATE_API_URL, then --region, then
TIGERGATE_REGION, then .tigergate.yml, then us1. An explicit URL always
wins — that’s the self-hosted and staging path — and pairing it with a region
just logs one line saying the region was ignored. An unknown region code
fails the run instead of falling back.
Omit all of it and you get us1, silently. Nothing changes for pipelines that
never mentioned a region.
SCOPE & TYPE --type sast | sca | secrets | quality | iac | image | all (default all) "all" = SAST + SCA + secrets + quality + IaC, plus the image scan when --image is set --scan-scope diff (changed code) | full (whole repo) | auto (default auto) --exclude comma-separated paths to skip, e.g. "node_modules,dist,vendor"MONOREPO COMPONENTS (see Quality gates -> Monorepos) --component component this build owns, e.g. "web" [env TG_COMPONENT] resolves that component's quality gate and posts its own "TigerGate Security (web)" status check --component-path comma-separated paths the component owns, [env TG_COMPONENT_PATH] e.g. "apps/web,libs/shared" - findings outside are dropped --skip-untouched on a PR build, exit 0 without scanning when the PR changes no file the component owns (default true; =false to always scan, for nightly / post-merge jobs)QUALITY GATE (exit non-zero to block the merge) --quality-gate run the gate check (default true; =false to never block) --fail-on severities that fail the build (default critical,high) --max-critical max new critical allowed (-1 = use org default) --max-high max new high allowed (-1 = use org default)SCA / SAST --sca-ignore-unfixed skip vulnerabilities with no fix available --sast-rules override the SAST rule packs (empty = dashboard config)COVERAGE & QUALITY --coverage-report lcov | cobertura | jacoco | go-cover report path --coverage-html HTML coverage report (uploaded as a downloadable artifact)SDLC COMPLIANCE (supply-chain / repo hygiene) --compliance run the SDLC posture scan + upload scores --compliance-local filesystem-only SDLC scan (no GitHub API/token)CONTAINER / CODE → CLOUD --image image to scan (also runs inside --type all when set) --image-digest sha256 digest of the built image (code → cloud join key; auto-resolved from --image when omitted) [env TG_IMAGE_DIGEST] --deploy-target cluster / service / region being deployed [env TG_DEPLOY_TARGET] --environment production | staging | dev [env TG_ENVIRONMENT]PLUMBING --upload send results to TigerGate (default true) --no-auto-install do not auto-install scanner tools (expect them on PATH) --api-key defaults to $TIGERGATE_API_KEY --region TigerGate region owning your org [env TIGERGATE_REGION] persistent flag; omit for us1 --api-url explicit platform API base — overrides --region; self-hosted / staging only [env TIGERGATE_API_URL]
See Code → cloud tracking for the build/deploy
metadata flags and how findings link to the running cloud asset.
--component selects which quality gate applies and names the PR status check
(TigerGate Security (web)). --component-path decides which findings count and whether the
component cares about the PR at all.Paths resolve from the first source that supplies them:
--component-path (or TG_COMPONENT_PATH)
component_paths in .tigergate.yml
Component paths stored on that component’s quality gate in the dashboard
the --component value itself, when it names an existing directory
--component on its own does not scope findings and does not enable the
untouched-component skip — both require resolved paths. Always supply paths too.
With --skip-untouched (on by default), a PR that changes no file the component owns ends the
run early: exit 0, no scan run created, nothing uploaded, and a passing status posted for
that component so a required check never hangs. Detection fails open — when the base-branch diff
can’t be computed the component is scanned rather than skipped.Full behaviour: Monorepos.
