Codeward Registry

The central repository for Codeward profiles — modular, reusable policy configurations for the Codeward scanner.

Instead of writing policies from scratch, browse profiles that match your stack and security posture, copy them into your project, and customize as needed.

A profile is a named, versioned, self-contained policy configuration for a real-world use case. It defines:

• What to scan for — severity thresholds, license types, package names, file structures, PR metadata, and more
• What action to take — block, warn, or inform
• Where to report — PR comments, GitHub issues, webhooks, or files
• Why it exists — documentation, rationale, and example inputs/outputs

Each profile is a complete, working .codeward.json (or .codeward.yaml) that you can drop into your repository and use immediately.

# 1. Browse profiles and pick one that fits your stack
# 2. Copy the config into your repo
# 3. Run the scanner

# .github/workflows/codeward.yml
name: Codeward
on: pull_request
jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
      pull-requests: write
    steps:
      - uses: codeward-io/[email protected]

Pre-built binaries are available for Linux, macOS, and Windows — no Docker required:

# Download (replace OS/arch as needed: linux-amd64, linux-arm64, darwin-amd64, darwin-arm64, windows-amd64, windows-arm64)
curl -L -o codeward-scan \
  https://github.com/codeward-io/scan/releases/download/v0.4.0/codeward-scan-linux-amd64
chmod +x codeward-scan

# Run with a profile from the registry
./codeward-scan --config .codeward.yaml

docker run --rm \
  -v /path/to/your/repo:/main:rw \
  ghcr.io/codeward-io/scan:v0.4.0

Maintained by the Codeward team.

Start here → security-essentials — every project should use this as a baseline.

Then add profiles that match your stack:

Apache 2.0