Deployment Reference

1. Download prebuilt binary from GitHub Releases
   - Verify SHA-256 checksum
   - Extract to ~/.panguard/
   |
   v (if binary unavailable or checksum fails)
2. npm install -g @panguard-ai/panguard
   - Requires npm on PATH
   - Installs to npm global prefix
   |
   v (if npm unavailable or install fails)
3. Source build
   - git clone → pnpm install → pnpm build
   - Requires git, pnpm, Node.js 20+

name: Security Scan
on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install Panguard
        run: npm install -g @panguard-ai/panguard

      - name: Run security scan
        run: panguard scan --quick --json > scan-results.json

      - name: Upload results
        uses: actions/upload-artifact@v4
        with:
          name: panguard-scan
          path: scan-results.json

security-scan:
  image: node:20-slim
  script:
    - npm install -g @panguard-ai/panguard
    - panguard scan --quick --json > scan-results.json
  artifacts:
    paths:
      - scan-results.json
    expire_in: 30 days

pipeline {
    agent { docker { image 'node:20' } }
    stages {
        stage('Security Scan') {
            steps {
                sh 'npm install -g @panguard-ai/panguard'
                sh 'panguard scan --quick --json > scan-results.json'
            }
            post {
                always {
                    archiveArtifacts artifacts: 'scan-results.json'
                }
            }
        }
    }
}

FROM node:20-slim
RUN npm install -g @panguard-ai/panguard
ENTRYPOINT ["panguard"]

docker build -t panguard .
docker run --rm panguard scan --quick --json

# docker-compose.yml
services:
  app:
    image: your-app:latest

  panguard-guard:
    image: node:20-slim
    command: >
      sh -c "npm install -g @panguard-ai/panguard &&
             panguard guard start --daemon"
    restart: unless-stopped
    network_mode: host
    volumes:
      - /var/log:/var/log:ro

# Alpine Dockerfile
FROM node:20-alpine
RUN npm install -g @panguard-ai/panguard

# Option 1: npm (recommended)
npm install -g @panguard-ai/panguard

# Option 2: Enable Rosetta 2 and use the ARM64 binary
softwareupdate --install-rosetta
curl -fsSL https://get.panguard.ai | bash

panguard login --no-browser
# Prints a URL to open on another device
# Paste the returned code back into the terminal

# On connected machine
git clone https://github.com/panguard-ai/panguard-ai.git
cd panguard-ai && pnpm install && pnpm build
tar -czf panguard-offline.tar.gz .

# Transfer panguard-offline.tar.gz to air-gapped machine

# On air-gapped machine
tar -xzf panguard-offline.tar.gz
./bin/panguard --version

panguard guard install-service

# /etc/systemd/system/panguard-guard.service
[Unit]
Description=Panguard Guard - Real-time Security Monitor
After=network.target

[Service]
Type=simple
User=root
ExecStart=/usr/local/bin/panguard guard start --daemon
Restart=on-failure
RestartSec=10

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now panguard-guard

# CLI version
panguard --version
# Expected: 0.3.1

# System diagnostics
panguard doctor
# Checks: Node.js, connectivity, permissions, rule files

# Quick scan (functional test)
panguard scan --quick
# Expected: risk score output within 30 seconds

# Guard start (real-time protection)
panguard guard start
# Expected: "Guard engine starting..." with rule count