Installation

Tip

This page covers installing the Plumber CLI on your machine to run it locally. In CI/CD you don’t install anything. Use the drop-in GitHub Action or GitLab CI component, which bundle Plumber and run the same engine.

Info

Requires git on PATH for local-clone auto-detection. Already present in GitHub Actions runners, GitLab Runner, the Docker image, and standard macOS / Linux installs.

brew tap getplumber/plumber
brew install plumber

Install a specific version:

brew install getplumber/plumber/plumber@v0.4.13

Info

Versioned formulas are keg-only. Use the full path (e.g., /usr/local/opt/plumber@v0.4.13/bin/plumber) or run brew link plumber@v0.4.13 to add it to your PATH.

mise use -g github:getplumber/plumber

Info

Requires mise activation in your shell, or run with mise exec -- plumber.

Linux (amd64)

curl -LO https://github.com/getplumber/plumber/releases/latest/download/plumber-linux-amd64
chmod +x plumber-linux-amd64
sudo mv plumber-linux-amd64 /usr/local/bin/plumber

Linux (arm64)

curl -LO https://github.com/getplumber/plumber/releases/latest/download/plumber-linux-arm64
chmod +x plumber-linux-arm64
sudo mv plumber-linux-arm64 /usr/local/bin/plumber

macOS (Apple Silicon)

curl -LO https://github.com/getplumber/plumber/releases/latest/download/plumber-darwin-arm64
chmod +x plumber-darwin-arm64
sudo mv plumber-darwin-arm64 /usr/local/bin/plumber

macOS (Intel)

curl -LO https://github.com/getplumber/plumber/releases/latest/download/plumber-darwin-amd64
chmod +x plumber-darwin-amd64
sudo mv plumber-darwin-amd64 /usr/local/bin/plumber

Windows (PowerShell)

Invoke-WebRequest -Uri https://github.com/getplumber/plumber/releases/latest/download/plumber-windows-amd64.exe -OutFile plumber.exe

Verify checksum (optional):

curl -LO https://github.com/getplumber/plumber/releases/latest/download/checksums.txt
sha256sum -c checksums.txt --ignore-missing

docker pull getplumber/plumber:latest

Run analysis directly with Docker:

GitLab:

docker run --rm \
  -e GITLAB_TOKEN=glpat-xxxx \
  getplumber/plumber:latest analyze \
  --gitlab-url https://gitlab.com \
  --project mygroup/myproject

GitHub:

docker run --rm \
  -e GH_TOKEN=ghp_xxxx \
  getplumber/plumber:latest analyze \
  --github-url github.com \
  --project myorg/myrepo

git clone https://github.com/getplumber/plumber.git
cd plumber
make build
# or: make install (builds and copies to /usr/local/bin/)

Info

Requires Go 1.24+ and Make.

Verify release binaries

Every release binary is published with a SLSA build-provenance attestation. Before you run a downloaded binary in production or CI, verify it against the upstream repository. The commands below always resolve to the latest release, so you are never pinned to a stale version:

# Downloads the latest release asset, then verifies its provenance
gh release download --repo getplumber/plumber --pattern 'plumber-linux-amd64'
gh attestation verify plumber-linux-amd64 --repo getplumber/plumber

Info

The GitHub Action runs this check for you (verify-attestation: true by default); disable it only for air-gapped or GHES runners that cannot reach the sigstore transparency log.