PolicyForge

What PolicyForge is

PolicyForge is an open-source scanner that checks infrastructure-as-code against policy rules. It accepts Terraform, Bicep, Kubernetes manifests, and Helm charts through one resource model, with OPA/Rego policies evaluated by OPA. The policy engine is embedded at build time, so scans do not require a network connection. Teams can provide additional .rego files at scan time with --policy-dir, avoiding a fork or rebuild. The project lists 11 built-in rules covering Azure CIS Foundations, AWS, and Kubernetes Pod Security. Every scan generates a software bill of materials, and the project supports SLSA provenance predicates plus cosign signing and attestations. For Azure, drift checks compare declared code with live Resource Graph state, limited to resource types and attributes understood by its rules. CI/CD integrations include a GitHub Action that uploads SARIF to GitHub code scanning and an Azure DevOps task that publishes SARIF as a build artifact. An optional self-hosted portal adds dashboards, audit trails, organization-wide policy management, and SOC2/PCI rollups. Portal ingestion uses HTTP Basic Auth, with per-user OIDC or Entra ID SSO when configured. The scanner, rule packs, and integrations are Apache 2.0; the portal is source-available under that license.

Who it suits

It is aimed at teams enforcing policy across infrastructure-as-code, especially organizations using Azure and Bicep alongside Terraform, Kubernetes, or Helm. Security and platform teams can integrate scans into GitHub or Azure DevOps pipelines and optionally run the self-hosted portal.

Limits

Helm charts are warned about and skipped when the local Helm executable is unavailable. Azure drift detection is limited to resource types and attributes covered by the rules, while the portal lists retention, attestation verification, and real multi-tenancy as unresolved.

Getting started

1. Clone or install the PolicyForge project from GitHub
2. Prepare Terraform, Bicep, Kubernetes, or Helm files
3. Install Helm locally if charts need rendering
4. Run scans with the built-in policies
5. Add extra .rego files through --policy-dir when needed
6. Connect the GitHub Action or Azure DevOps task
7. Deploy the optional self-hosted portal if required

Verdict

Pick PolicyForge when you need an open scanner for several infrastructure-as-code formats, custom Rego rules, supply-chain outputs, and CI/CD reporting. Plan for a local Helm installation when scanning charts, and assess the portal's unresolved questions before relying on it for enterprise governance.