Version updated for https://github.com/getplumber/plumber to version v0.4.16. This action is used across all versions by 44 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. Action Summary Plumber is an open-source CI/CD security scanner that uses a Rego policy engine to scan .gitlab-ci.yml and .github/workflows/*.{yml,yaml} files. It helps identify risky patterns and security gaps in CI/CD pipelines, providing comprehensive reports in various formats such as terminal, JSON, SARIF, GitLab SAST, PBOM, and CycloneDX.

Version updated for https://github.com/getplumber/plumber to version v0.4.0. This action is used across all versions by 22 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed 0.4.0 (2026-07-10) One grade, one gate: the Plumber Score Until now, Plumber gave you two competing verdicts: 1. The Plumber Score (A–E, severity-weighted) 2. A compliance percentage (share of passing controls, severity-blind) They could disagree: one Critical finding in a single control read as “95% compliant” while scoring an E. And only the percentage gated your CI.