How does GauntletCI compare to SonarQube?

SonarQube analyzes the entire codebase on a schedule and requires a server, account, and network access. GauntletCI analyzes only the lines that changed in the current diff, runs entirely on the developer's machine in under one second, requires no account or cloud connection, and installs as a pre-commit hook. SonarQube is a full codebase quality platform; GauntletCI is a focused change-risk detector that runs before a commit is ever created.

How does GauntletCI compare to Semgrep?

Semgrep is a pattern-matching engine that scans files or the full codebase. GauntletCI scopes every rule to the changed diff, meaning it only flags risks introduced by the current change, not pre-existing issues in unchanged files. GauntletCI also includes incident correlation, local LLM enrichment, and baseline delta mode, which Semgrep does not offer. GauntletCI's free tier includes all rules with no account required.

How does GauntletCI compare to Snyk?

Snyk is primarily a dependency and container vulnerability scanner that requires cloud connectivity and a Snyk account. GauntletCI detects behavioral, structural, and security risks in first-party code changes, not dependency vulnerabilities, and runs 100% locally with no data transmitted. GauntletCI is suitable for air-gapped environments and organizations with strict data residency requirements; Snyk is not.

How does GauntletCI compare to CodeQL / GitHub Advanced Security?

CodeQL performs deep semantic analysis of the full codebase and requires compilation and significant compute time, typically minutes per run. GauntletCI analyzes only the changed diff in under one second with no compilation step, making it suitable as a pre-commit hook in the developer's local workflow. CodeQL is better for periodic deep security audits; GauntletCI is better for fast, continuous feedback on every commit.

How does GauntletCI compare to Code Climate?

Code Climate is a SaaS platform that analyzes full repositories for maintainability and test coverage trends over time. It requires uploading code to a cloud service. GauntletCI is fully local, diff-scoped, and focused on change risk rather than codebase health metrics. GauntletCI does not require a cloud account, never transmits code, and produces results in under one second, making it a complement to, not a replacement for, Code Climate's longitudinal reporting.

Does GauntletCI work in air-gapped or offline environments?

Yes. GauntletCI runs entirely on the local machine. No diff, finding, file path, or telemetry is transmitted. The optional local LLM enrichment feature (--with-llm) uses a locally hosted Ollama model, with no network call. This makes GauntletCI suitable for classified, regulated, or air-gapped environments where cloud-based analysis tools are prohibited.

What is baseline delta mode and do other tools offer it?

Baseline delta mode (gauntletci baseline capture) snapshots all current findings and suppresses them from future runs. Only net-new findings (risks introduced after the baseline) are reported. This eliminates alert fatigue from pre-existing issues in legacy codebases. SonarQube offers a similar 'new code' concept but requires server setup. Semgrep, Snyk, CodeQL, and Code Climate do not offer equivalent pre-commit baseline suppression.

Which pre-commit tool should I use with GauntletCI?

For pure .NET repos, use dotnet-husky or Lefthook - both have no Node.js dependency. For full-stack or Node.js repos that already use husky, add GauntletCI to the existing hook. Lefthook is the fastest option and supports parallel hook execution.

How does GauntletCI block a commit from a pre-commit hook?

GauntletCI exits with code 1 when Block-severity findings are detected. All git hook managers (husky, dotnet-husky, Lefthook) abort the commit when the hook exits non-zero.

How do I skip the GauntletCI hook for a single commit?

With husky: HUSKY=0 git commit. With dotnet-husky: HUSKY=0 git commit or git commit --no-verify. With Lefthook: LEFTHOOK=0 git commit or git commit --no-verify.

Can I use GauntletCI as a pre-commit hook without husky or Lefthook?

Yes. Run gauntletci init inside your repository. This installs a .git/hooks/pre-commit script directly, with no dependency on any hook manager.

Pre-commit

Pre-commit Hooks

Run GauntletCI before every commit to catch risky changes before they reach CI. Choose the hook manager that fits your toolchain - or skip them all with gauntletci init.

No hook manager required

The fastest setup. Run this once inside your repository to install a native git hook:

$ cd your-repo

$ gauntletci init

This writes a .git/hooks/pre-commit script that runs gauntletci analyze --staged before every commit. No Node.js or Gradle required.

dotnet-husky

dotnet-husky is a .NET-native hook manager with no Node.js dependency. Best for pure .NET repositories.

1. Install dotnet-husky

$ dotnet tool install -g Husky

$ dotnet husky install

2. Create .husky/task-runner.json

{
  "tasks": [
    {
      "name": "GauntletCI",
      "command": "gauntletci",
      "args": ["analyze", "--sensitivity", "balanced"],
      "pathFilter": ["**/*.cs", "**/*.csproj", "**/*.sln", "**/*.slnx"],
      "output": "always"
    }
  ]
}

3. Create .husky/pre-commit

#!/bin/sh
. "$(dirname "$0")/_/husky.sh"
dotnet husky run --name GauntletCI

4. Automate for the team

Add to your CI setup step so every developer gets the hook after cloning:

- run: dotnet tool restore
- run: dotnet husky install

husky

husky is the most popular git hooks manager for JavaScript and TypeScript projects. Use it for monorepos or full-stack apps that already have a Node.js toolchain.

1. Install and initialize

$ npm install --save-dev husky

$ npx husky init

2. Replace .husky/pre-commit

#!/bin/sh
SENSITIVITY="${GAUNTLETCI_SENSITIVITY:-balanced}"
gauntletci analyze --sensitivity "$SENSITIVITY"

3. Share with the team via package.json

{
  "scripts": {
    "prepare": "husky"
  }
}

Skip the hook for one commit

$ HUSKY=0 git commit -m "..."

Lefthook

Lefthook is a fast, cross-platform hook manager with no Node.js dependency and native support for parallel hook execution. Ideal for pure .NET repositories.

Install

# macOS/Linux

$ brew install lefthook

# Windows

PS> scoop install lefthook

# npm

$ npm install --save-dev lefthook

Configure lefthook.yml

pre-commit:
  commands:
    gauntletci:
      run: gauntletci analyze --sensitivity balanced
      glob: "*.cs"

The glob filter only triggers GauntletCI when .cs files are staged.

Parallel hooks

Run GauntletCI alongside formatters without blocking on each other:

pre-commit:
  parallel: true
  commands:
    gauntletci:
      run: gauntletci analyze --sensitivity balanced
      glob: "*.cs"
    dotnet-format:
      run: dotnet format --verify-no-changes
      glob: "*.cs"

Install hooks and verify

$ lefthook install

$ lefthook run pre-commit

Choosing a tool

Tool	Requires	Best for
gauntletci init	Nothing extra	Solo devs, quick setup
dotnet-husky	.NET SDK	Pure .NET teams, task runner
husky	Node.js	Monorepos already using npm
Lefthook	Nothing extra	Fast parallel hooks, any stack

Also see: GitHub Action and Azure DevOps for CI/CD pipeline integration.