chant for security review

For someone who signs off on what chant runs and what it produces: where it reaches the network, what it signs, and what it checks.

Works

• Network Egress lists every module that can reach the network and the command that reaches it, and a guard test holds the offline phases to that list
• SBOM, SLSA provenance and keyless signing attached to a component's artifact, with a verify gate before apply
• chant audit runs the security rules over a repository chant did not generate: pipelines, manifests, templates and likely secrets
• Lint rules that check meaning, such as whether a resource is encrypted, across lexicons

Differs

By forge

GitHub

• --generate github writes the pull-request workflow under .github/workflows/, run on pull_request and on push to the target branch.
• Both jobs use the job's own github.token. On a pull request from a fork that token is read-only, so the plan note and the status are not posted.

GitLab

• --generate gitlab writes .gitlab-ci.yml, and apply runs one at a time per environment through resource_group.
• A CI job token cannot write merge request notes, so set a project access token with the api scope as the masked variable CHANT_FORGE_TOKEN.

Forgejo

• --generate forgejo writes the GitHub workflow in the Forgejo dialect under .forgejo/workflows/: the runner label, action references by URL, and no permissions block.
• Forgejo workflows are GitHub-dialect, so chant audit applies its GitHub rules to them.

First step

npx @intentius/chant audit .

chant audit

Or hand this step to your coding agentIt stops at a pull request or a report.

Read https://intentius.io/chant/for/security/.
Run `npx @intentius/chant audit . --tier merge-worthy` in this repository, and report each finding with its file, its rule and the fix it suggests.
Read only: change no file and open no pull request.
Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.

Show the whole prompt

Read https://intentius.io/chant/for/security/.
Run `npx @intentius/chant audit . --tier merge-worthy` in this repository, and report each finding with its file, its rule and the fix it suggests.
Read only: change no file and open no pull request.
Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.

Copy promptCopy link

Proof

Example projects in the chant repository for this room, each with a README that has the commands to run it.

Example	Where
supply-chain	examples/supply-chain

Then read

Tasks

Linting & Type-CheckingOrganizational Policy

Background

Supply-Chain AttestationsState and Governance

Reference

Network EgressAudit rules referenceAttestation ReferenceSandboxed Execution