CLI Installation

Tip

This page installs the Plumber CLI on your machine, to run it locally. In CI/CD you install nothing: the drop-in GitHub Action and GitLab CI component bundle Plumber and run the same engine.

Info

Requires git on PATH for local-clone auto-detection. Already present in GitHub Actions runners, GitLab Runner, the Docker image, and standard macOS / Linux installs.

brew tap getplumber/plumber
brew install plumber

Install a specific version:

brew install getplumber/plumber/plumber@0.5.24 # pinned plumber version

Info

Versioned formulas are keg-only. Use the full path (e.g., /usr/local/opt/plumber@0.5.24/bin/plumber) or run brew link plumber@0.5.24 to add it to your PATH.

Verify:

plumber version

Note: it is plumber version (a subcommand); plumber --version is not a flag and exits with an error.

mise use -g github:getplumber/plumber

Info

Requires mise activation in your shell, or run with mise exec -- plumber.

Verify:

plumber version

Linux (amd64)

curl -LO https://github.com/getplumber/plumber/releases/latest/download/plumber-linux-amd64
chmod +x plumber-linux-amd64
sudo mv plumber-linux-amd64 /usr/local/bin/plumber

Linux (arm64)

curl -LO https://github.com/getplumber/plumber/releases/latest/download/plumber-linux-arm64
chmod +x plumber-linux-arm64
sudo mv plumber-linux-arm64 /usr/local/bin/plumber

macOS (Apple Silicon)

curl -LO https://github.com/getplumber/plumber/releases/latest/download/plumber-darwin-arm64
chmod +x plumber-darwin-arm64
sudo mv plumber-darwin-arm64 /usr/local/bin/plumber

macOS (Intel)

curl -LO https://github.com/getplumber/plumber/releases/latest/download/plumber-darwin-amd64
chmod +x plumber-darwin-amd64
sudo mv plumber-darwin-amd64 /usr/local/bin/plumber

Windows (PowerShell)

Invoke-WebRequest -Uri https://github.com/getplumber/plumber/releases/latest/download/plumber-windows-amd64.exe -OutFile plumber.exe

Verify checksum (optional):

curl -LO https://github.com/getplumber/plumber/releases/latest/download/checksums.txt
sha256sum -c checksums.txt --ignore-missing

Verify:

plumber version

docker pull getplumber/plumber:latest

Run an analysis directly with Docker:

GitLab:

docker run --rm \
  -e GITLAB_TOKEN=glpat-xxxx \
  getplumber/plumber:latest analyze \
  --gitlab-url https://gitlab.com \
  --project mygroup/myproject

GitHub:

docker run --rm \
  -e GH_TOKEN=ghp_xxxx \
  getplumber/plumber:latest analyze \
  --github-url github.com \
  --project myorg/myrepo

Verify:

docker run --rm getplumber/plumber:latest version

git clone https://github.com/getplumber/plumber.git
cd plumber
make build
# or: make install (builds and copies to /usr/local/bin/)

Info

Requires Go 1.26+ and Make (see go.mod in the release you build).

Verify:

plumber version

Verify release binaries

Every release binary ships with a SLSA build-provenance attestation. Before you run a downloaded binary in production or CI, verify it against the upstream repository. The commands below always resolve to the latest release:

# Downloads the latest release asset, then verifies its provenance
gh release download --repo getplumber/plumber --pattern 'plumber-linux-amd64'
gh attestation verify plumber-linux-amd64 --repo getplumber/plumber

Info

The GitHub Action runs this check for you (verify-attestation: true by default); disable it only for air-gapped or GHES runners that cannot reach the sigstore transparency log.