> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safedep.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Review Package Blocks Across CI Pipelines

> See every package that PMG blocked or held back on your CI runners, across all repositories, in SafeDep Cloud.

PMG in CI blocks a malicious package and fails the job. One failed job shows one block. SafeDep Cloud shows the blocks from every pipeline in one place.

> [!NOTE]
>
> This guide needs the SafeDep Cloud Team or Enterprise plan. See [pricing](https://safedep.io/pricing).

## Prerequisites

* PMG runs in your pipelines and syncs to your tenant:
  * In GitHub Actions, set the `api-key` and `tenant-id` inputs of the PMG action. See [PMG in GitHub Actions](/package-security/pmg/github-actions).
  * In other CI systems, run `pmg cloud sync` at the end of the job. See [Package Guard](/governance/cloud/endpoint-hub/package-guard#manual-sync). To find these jobs later, set `PMG_CLOUD_ENDPOINT_ID` as shown in [Other CI systems](#other-ci-systems).

## Review one pipeline

**1. Open the endpoint list**

Sign in to [app.safedep.io](https://app.safedep.io) and select **Endpoints**. In GitHub Actions, each repository is one endpoint by default. Set the `endpoint-id` input of the PMG action to change it.

**2. Open the endpoint**

Select the endpoint, then select **Package Events**. Each session shows the install command and its outcome, such as **Blocked** or **Success**. Each package row shows its action, such as **Blocked** or **Cooldown**.

**3. Filter the events**

Use **Package action** or **Session outcome** to show only the blocks.

![Package Events of a GitHub Actions endpoint in SafeDep Cloud with blocked, cooldown, and successful installs](https://mintcdn.com/safedep/OcmrdF-YkbEncxxA/images/cloud/ci-runner-package-events.png?fit=max\&auto=format\&n=OcmrdF-YkbEncxxA\&q=85\&s=9e88bf4f14de80062afd60bce2c98d11)

## Review all pipelines

PMG records the CI provider for GitHub Actions jobs. This query lists the malicious package blocks and the cooldown holds in all GitHub Actions jobs:

```sql theme={null}
SELECT endpoints.identifier,
       package_guard_events.package_name,
       package_guard_events.package_action,
       package_guard_events.timestamp
FROM package_guard_events
JOIN endpoints ON endpoints.id = package_guard_events.invocation_id
WHERE package_guard_events.ci_provider = 'ENDPOINT_CI_PROVIDER_GITHUB_ACTIONS'
  AND package_guard_events.package_action IN (
    'PMG_PACKAGE_ACTION_BLOCKED', 'PMG_PACKAGE_ACTION_COOLDOWN_BLOCKED')
ORDER BY package_guard_events.timestamp DESC
```

Run it from **Query** in the sidebar, or with `safedep query exec --sql-file`.

![SafeDep Cloud query console with the package blocks in all GitHub Actions jobs](https://mintcdn.com/safedep/OcmrdF-YkbEncxxA/images/cloud/sql-ci-blocks.png?fit=max\&auto=format\&n=OcmrdF-YkbEncxxA\&q=85\&s=1a9df428f968f3a2e71ca8cb0be9d724)

The console shows enum columns as numbers. In `package_action`, `1` is a malicious package block and `4` is a cooldown hold.

### Other CI systems

PMG does not record the CI provider for other CI systems. To group their events, give each CI endpoint an ID with a common prefix. In the job, set `PMG_CLOUD_ENDPOINT_ID`, for example to `ci-jenkins-payments`. Then filter on the prefix:

```sql theme={null}
SELECT endpoints.identifier,
       package_guard_events.package_name,
       package_guard_events.package_action,
       package_guard_events.timestamp
FROM package_guard_events
JOIN endpoints ON endpoints.id = package_guard_events.invocation_id
WHERE endpoints.identifier LIKE 'ci-%'
  AND package_guard_events.package_action IN (
    'PMG_PACKAGE_ACTION_BLOCKED', 'PMG_PACKAGE_ACTION_COOLDOWN_BLOCKED')
ORDER BY package_guard_events.timestamp DESC
```

## Next steps

> **[Send Alerts from SafeDep Cloud](/governance/cloud/alerts)**
>
> Send each new block to Slack or a webhook.

> **[Find Where a Malicious Package Reached Your Organization](/governance/cloud/endpoint-hub/find-malicious-package)**
>
> Find the endpoints and projects that a malicious package reached.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.