CLI Tools Installation

Quick reference for installing every external CLI tool used by SnakeFlow’s Quality Hub.

gh — GitHub CLI

Required for GitHub Issues, PRs, and CI features.

bash winget install GitHub.cli gh auth login

bash brew install gh gh auth login

bash sudo apt install gh # Debian/Ubuntu sudo dnf install gh # Fedora gh auth login

act — GitHub Actions locally

bash winget install nektos.act

bash brew install act

bash curl -s https://raw.githubusercontent.com/nektos/act/master/install.sh | sudo bash

Docker Desktop

Required for container management and Bearer scan (Linux/macOS).

Windows / macOS
Linux

Download from docker.com/products/docker-desktop and run the installer.

bash curl -fsSL https://get.docker.com | sh sudo usermod -aG docker $USER newgrp docker

Semgrep — SAST

pip install semgrep
# or
pip3 install semgrep

# Verify
semgrep --version

Trivy — CVE Scanner

bash winget install AquaSecurity.Trivy

bash brew install trivy

bash curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

Hadolint — Dockerfile Linter

bash winget install hadolint

bash brew install hadolint

bash curl -sL https://github.com/hadolint/hadolint/releases/latest/download/hadolint-Linux-x86_64 -o /usr/local/bin/hadolint && chmod +x /usr/local/bin/hadolint

ShellCheck — Shell Script Linter

bash winget install koalaman.shellcheck

bash brew install shellcheck

bash sudo apt install shellcheck # Debian/Ubuntu sudo dnf install ShellCheck # Fedora

golangci-lint — Go Linter

bash winget install golangci-lint

bash brew install golangci-lint

bash go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest

Bandit — Python Security

pip install bandit
# or
pip3 install bandit

bandit --version

Bearer — SAST (macOS/Linux only)

# macOS
brew install bearer/tap/bearer

# Linux
curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh

bearer version

Windows: Bearer has no native Windows binary. Use WSL2:

Install WSL2: wsl --install
Inside WSL: curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh
Set in settings: "devManager.quality.builtin.bearer.path": "wsl bearer"

ESLint Security Plugin

npm i -D eslint eslint-plugin-security

jscpd — Copy-Paste Detection

npm i -D jscpd
# or globally
npm i -g jscpd

Stryker — Mutation Testing

npm i -D @stryker-mutator/core @stryker-mutator/jest-runner

TypeScript — project compiler

Used by the TypeScript Check built-in (npx tsc --noEmit). Install in the repo you scan:

npm i -D typescript

YAMLlint — YAML linter

pip install yamllint
yamllint --version

Spectral — OpenAPI / AsyncAPI

npm i -g @stoplight/spectral-cli
spectral --version

Checkov — IaC security

pip install checkov
checkov --version

SQLFluff — SQL linter

pip install sqlfluff
sqlfluff --version

Markdownlint CLI2 — Markdown linter

npm i -g markdownlint-cli2
markdownlint-cli2 --version