@driftgard/cli

Governance-as-code CLI for Driftgard — manage control packs from your terminal and CI pipelines.

Install

npm install -g @driftgard/cli

Or run directly with npx:

npx @driftgard/cli help

Configure

export DRIFTGARD_API_KEY=dg_your_api_key
export DRIFTGARD_PROJECT_ID=proj_xxx

Commands

pull

Download the active control pack as YAML or JSON.

driftgard pull --format yaml
driftgard pull --pack ./control-packs/prod.json --format json

push

Upload a local control pack as a new version. Auto-increments the version number.

driftgard push --pack ./control-packs/prod.yaml

activate

Set a specific version as the active control pack.

driftgard activate --pack-id my_control_pack --version 3

validate

Check a control pack file for structural errors. Works offline.

driftgard validate --pack ./control-packs/prod.yaml

lint

Check for logical issues — contradictions, unreachable thresholds, dead patterns, and more. Works offline.

driftgard lint --pack ./control-packs/prod.yaml

Checks for:

• Duplicate clause IDs
• Unreachable block threshold (no single violation can trigger a block)
• Guaranteed block on any violation (threshold too low)
• Dead patterns (rules with no pattern_rules — judge-only)
• Duplicate patterns across rules
• Auto-block category with low severity (misleading label)
• Category multipliers on unused categories
• Auto-block categories with no matching rules

Exits with code 1 if errors are found. Warnings and info do not fail.

diff

Show a colored diff between the latest two control pack versions.

driftgard diff

benchmark

Run the benchmark suite and fail if thresholds are exceeded. CI-friendly — exits with code 1 on failure.

driftgard benchmark --max-violation-rate 0.05 --max-blocked 10

CI/CD example

# GitHub Actions
name: Governance Check
on: [push]
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Validate
        run: npx @driftgard/cli validate --pack ./control-packs/prod.yaml
      - name: Lint
        run: npx @driftgard/cli lint --pack ./control-packs/prod.yaml
      - name: Push
        run: npx @driftgard/cli push --pack ./control-packs/prod.yaml
        env:
          DRIFTGARD_API_KEY: ${{ secrets.DRIFTGARD_API_KEY }}
          DRIFTGARD_PROJECT_ID: ${{ secrets.DRIFTGARD_PROJECT_ID }}
      - name: Benchmark
        run: npx @driftgard/cli benchmark --max-violation-rate 0.05
        env:
          DRIFTGARD_API_KEY: ${{ secrets.DRIFTGARD_API_KEY }}
          DRIFTGARD_PROJECT_ID: ${{ secrets.DRIFTGARD_PROJECT_ID }}

Options

Environment variables

License

MIT