Installation

Homebrew

brew install starhaven-io/tap/pinprick

crates.io

cargo install pinprick

From source (unreleased HEAD)

cargo install --git https://github.com/starhaven-io/pinprick

From releases

Download a prebuilt binary from GitHub Releases. Binaries are available for:

• Linux amd64, glibc — x86_64-unknown-linux-gnu
• Linux arm64, glibc — aarch64-unknown-linux-gnu
• Linux amd64, musl (static) — x86_64-unknown-linux-musl
• Linux arm64, musl (static) — aarch64-unknown-linux-musl
• macOS Apple Silicon — aarch64-apple-darwin

The gnu builds link against the system glibc. They are built on Ubuntu 24.04, so they require glibc 2.39 or newer (Ubuntu 24.04+, Debian 13+, Fedora 40+). On older releases — Ubuntu 22.04, Debian 12, RHEL 9 and the like — use the statically linked musl builds instead. The musl builds carry no glibc requirement and also run on musl-based distributions such as Alpine, as well as minimal or distroless containers.

musl binaries still need CA certificates

The musl binaries are statically linked, but pinprick makes HTTPS calls to the GitHub API and reads the host’s trusted CA certificates at runtime. On Alpine, install them with apk add ca-certificates.

GitHub Action

For CI audit runs without hand-rolling the install step, use starhaven-io/pinprick-action. The action installs a pinned pinprick release, verifies the downloaded archive checksum and GitHub build provenance, runs pinprick audit, and can upload SARIF to GitHub code scanning.

See GitHub Action for a SHA-pinned workflow example and input reference.

Shell completions

Generate completions for your shell:

See the completions command for shell-specific installation paths and setup.

GitHub authentication

pinprick uses the GitHub API to resolve tags, check releases, and fetch action source code.

It looks for a token in this order:

1. GITHUB_TOKEN environment variable
2. GH_TOKEN environment variable
3. gh auth token CLI fallback

The pin and update commands require a token. The audit command can still scan workflow run: blocks and local ./ or $/ actions without one. External actions without an audited-actions catalog verdict make token-less coverage incomplete and exit 2.