Integrations

Wire Chainsaw into your CI and package managers in ten lines

One token and one URL per package manager.

CI providers

Copy-paste snippets for your pipeline

  1. 01 · CI runner

    npm ci

    Credentials from your CI secret store

  2. 02 · Chainsaw proxy

    Policy on every fetch

    /chainproxy/repository/@default/npmjs/

  3. 03 · Audit record

    One audit row per fetch

    Splunk HEC, Sentinel, QRadar or a webhook (table below)

GitHub Actions

- name: Configure Chainsaw
  env:
    CHAINSAW_CLIENT_ID: ${{ secrets.CHAINSAW_CLIENT_ID }}
    CHAINSAW_CLIENT_SECRET: ${{ secrets.CHAINSAW_CLIENT_SECRET }}
  run: |
    echo "registry=https://chain305.com/chainproxy/repository/@default/npmjs/" >> .npmrc
    echo "//chain305.com/chainproxy/repository/@default/npmjs/:_authToken=$CHAINSAW_CLIENT_ID:$CHAINSAW_CLIENT_SECRET" >> .npmrc
    echo "//chain305.com/chainproxy/repository/@default/npmjs/:always-auth=true" >> .npmrc
- name: Install
  run: npm ci
GitLab CI
install:
  script:
    - echo "registry=https://chain305.com/chainproxy/repository/@default/npmjs/" >> ~/.npmrc
    - echo "//chain305.com/chainproxy/repository/@default/npmjs/:_authToken=$CHAINSAW_CLIENT_ID:$CHAINSAW_CLIENT_SECRET" >> ~/.npmrc
    - echo "//chain305.com/chainproxy/repository/@default/npmjs/:always-auth=true" >> ~/.npmrc
    - npm ci
Jenkins
withCredentials([usernamePassword(credentialsId: 'chainsaw',
  usernameVariable: 'CHAINSAW_CLIENT_ID', passwordVariable: 'CHAINSAW_CLIENT_SECRET')]) {
  sh '''
    echo "registry=https://chain305.com/chainproxy/repository/@default/npmjs/" > .npmrc
    echo "//chain305.com/chainproxy/repository/@default/npmjs/:_authToken=$CHAINSAW_CLIENT_ID:$CHAINSAW_CLIENT_SECRET" >> .npmrc
    echo "//chain305.com/chainproxy/repository/@default/npmjs/:always-auth=true" >> .npmrc
    npm ci
  '''
}
CircleCI
- run:
    name: Configure Chainsaw
    command: |
      echo "registry=https://chain305.com/chainproxy/repository/@default/npmjs/" >> ~/.npmrc
      echo "//chain305.com/chainproxy/repository/@default/npmjs/:_authToken=$CHAINSAW_CLIENT_ID:$CHAINSAW_CLIENT_SECRET" >> ~/.npmrc
      echo "//chain305.com/chainproxy/repository/@default/npmjs/:always-auth=true" >> ~/.npmrc
- run: npm ci
Azure Pipelines
- script: |
    echo "registry=https://chain305.com/chainproxy/repository/@default/npmjs/" >> ~/.npmrc
    echo "//chain305.com/chainproxy/repository/@default/npmjs/:_authToken=$(CHAINSAW_CLIENT_ID):$(CHAINSAW_CLIENT_SECRET)" >> ~/.npmrc
    echo "//chain305.com/chainproxy/repository/@default/npmjs/:always-auth=true" >> ~/.npmrc
    npm ci
  displayName: Install via Chainsaw
Buildkite
steps:
  - label: "Install"
    command: |
      echo "registry=https://chain305.com/chainproxy/repository/@default/npmjs/" >> .npmrc
      echo "//chain305.com/chainproxy/repository/@default/npmjs/:_authToken=$CHAINSAW_CLIENT_ID:$CHAINSAW_CLIENT_SECRET" >> .npmrc
      echo "//chain305.com/chainproxy/repository/@default/npmjs/:always-auth=true" >> .npmrc
      npm ci
Drone CI
kind: pipeline
type: docker
name: default

steps:
  - name: install
    image: node:20
    environment:
      CHAINSAW_CLIENT_ID:
        from_secret: chainsaw_client_id
      CHAINSAW_CLIENT_SECRET:
        from_secret: chainsaw_client_secret
    commands:
      - echo "registry=https://chain305.com/chainproxy/repository/@default/npmjs/" >> .npmrc
      - echo "//chain305.com/chainproxy/repository/@default/npmjs/:_authToken=$CHAINSAW_CLIENT_ID:$CHAINSAW_CLIENT_SECRET" >> .npmrc
      - echo "//chain305.com/chainproxy/repository/@default/npmjs/:always-auth=true" >> .npmrc
      - npm ci

Swap @default for your org slug. The _authToken is the plain id:secret pair; do not base64-encode it. Self-hosted: use your own base URL, ingress path included. Full CI/CD guide →

Package ecosystems

Sixteen ecosystems, one proxy

No lockfile changes, no wrapper scripts.

EcosystemCoversGuide
npm Node.js · npm, pnpm, yarn, bun Configure your package manager
PyPI Python · pip, poetry, uv
Maven JVM
Gradle JVM
Cargo Rust
Go modules Go
Composer PHP
NuGet .NET
RubyGems Ruby
Swift iOS / macOS
CocoaPods iOS / macOS
Docker / OCI Containers
Hugging Face AI / ML models Secure Hugging Face downloads
APT OS packages · CVE + hash-chain provenance only OS package provenance
Yum OS packages · CVE + hash-chain provenance only
DNF OS packages · CVE + hash-chain provenance only

Cargo 1.74+: chainsaw cargo-credentials reads the token from the OS keyring.

Outbound destinations

SIEM and webhook sinks

Splunk HECStructured audit events. Enterprise.
Microsoft SentinelCEF over TLS syslog. Enterprise.
IBM QRadarCEF over TLS syslog. Enterprise.
Prometheus / Grafana50+ metrics at /metrics. All plans.
Slack / MS Teams / PagerDutyAny webhook receiver. Five per user, every plan.
Generic SIEMJSON over webhook or syslog.

Identity providers

SSO and SCIM on Team and up

OktaSAML 2.0 · OIDC · SCIM 2.0
Microsoft EntraSAML 2.0 · OIDC · SCIM 2.0
Google WorkspaceOIDC · SCIM 2.0
Auth0OIDC
KeycloakOIDC
Any SAML 2.0 / OIDC IdPCompliant providers

Missing an integration you need?

Tell us what you need to connect

Tell us the CI provider or SIEM you need. We scope it with you and agree a delivery date before we start.