Scan a codebase for hardcoded secrets, known vulnerabilities, and risky infrastructure config in one pass.
Get an AI powered code review that flags logic issues before merging a pull request.
Generate a standalone HTML report showing code quality, coverage gaps, and duplication.
Install ciforge as a GitHub Action to replace several separate paid CI tools.
| tahiram32/ciforge | 0marildo/imago | 100/geotwitter | |
|---|---|---|---|
| Stars | 3 | 3 | 3 |
| Language | Python | Python | Python |
| Last pushed | — | — | 2015-09-10 |
| Maintenance | — | — | Dormant |
| Setup difficulty | easy | easy | moderate |
| Complexity | 3/5 | 2/5 | 3/5 |
| Audience | developer | general | general |
Figures from each repo's GitHub metadata at analysis time.
AI code review features require configuring an API key for OpenAI, Anthropic, or a local Ollama model.
ciforge is a single command line tool for Python projects that aims to replace many separate paid continuous integration services with one free, dependency free program. It can run entirely on a developer's own machine or inside GitHub Actions, and its goal is to save solo developers the monthly cost of subscribing to multiple commercial code quality and security tools. The tool bundles a wide range of checks into one program: it looks for code quality issues using linting and complexity analysis, checks how much of the code is covered by tests, scans for hardcoded secrets and credentials, validates configuration files in formats like JSON, YAML, and TOML, and tracks metrics about pull request size and change speed. It can also call out to AI models such as OpenAI, Anthropic, or a locally run Ollama model to review code for logic problems it might otherwise miss. Beyond those core checks, ciforge includes security focused features such as scanning dependency files for known vulnerabilities without needing internet access, checking Dockerfiles and infrastructure config for risky patterns, and detecting duplicated code structures across a project. It can also generate visual dependency diagrams, produce changelogs from commit history, estimate how a cloud infrastructure change might affect a monthly bill, and send summary reports to a Discord channel through a webhook. For everyday use, the project offers several friendlier entry points beyond the command line: an interactive menu that walks a user through options without needing to memorize flags, a simple desktop window for scanning a folder and viewing an HTML report, and a chat style interface for asking questions about a codebase in plain language. It can also act as a server for the Model Context Protocol, letting AI coding assistants call its checks directly, and can be installed as a GitHub App for one click setup. The project is installed through pip as ciforge-cli and is distributed under the AGPL version 3 license, which requires that modified versions used to provide a network service also be shared under the same license.
A single dependency free CLI that bundles many CI checks like linting, secret scanning, vulnerability detection, and AI code review.
Mainly Python. The stack also includes Python, GitHub Actions, pip.
AGPL version 3: free to use and modify, but if you run a modified version as a network service, you must share your changes under the same license.
Setup difficulty is rated easy, with roughly 5min to a first successful run.
Mainly developer.
This repo across BitVibe Labs
double-check against the repo, no cap.