CI/CD integration

The same binary that runs locally runs in your pipeline. Gating is policy-driven, so the build fails on what your thresholds define as blocking.

GitHub Actions

name: Security

on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v4

      - name: Install Sentrasec
        run: curl -fsSL https://cli.sentrasec.ai/install.sh | bash

      - name: Scan
        run: sentrasec scan . --format sarif > results.sarif
        env:
          SENTRASEC_TOKEN: ${{ secrets.SENTRASEC_TOKEN }}

      - name: Upload results
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif

Uploading SARIF puts findings in the GitHub Security tab and annotates the pull request directly.

GitLab CI

security_scan:
  image: ubuntu:latest
  before_script:
    - apt-get update && apt-get install -y curl
    - curl -fsSL https://cli.sentrasec.ai/install.sh | bash
  script:
    - sentrasec scan . --format json > gl-sast-report.json
  artifacts:
    reports:
      sast: gl-sast-report.json

Jenkins

pipeline {
  agent any
  stages {
    stage('Security scan') {
      steps {
        sh 'curl -fsSL https://cli.sentrasec.ai/install.sh | bash'
        sh 'sentrasec scan . --format sarif > results.sarif'
      }
    }
  }
  post {
    always {
      archiveArtifacts artifacts: 'results.sarif'
    }
  }
}

CircleCI

version: 2.1
jobs:
  security:
    docker:
      - image: cimg/base:current
    steps:
      - checkout
      - run: curl -fsSL https://cli.sentrasec.ai/install.sh | bash
      - run: sentrasec scan . --format sarif > results.sarif
      - store_artifacts:
          path: results.sarif

Azure Pipelines

steps:
  - script: curl -fsSL https://cli.sentrasec.ai/install.sh | bash
    displayName: Install Sentrasec
  - script: sentrasec scan . --format sarif > results.sarif
    displayName: Security scan
    env:
      SENTRASEC_TOKEN: $(SentrasecToken)

Gating strategy

Failing the build on every finding trains people to bypass the check. A pattern that survives contact with a real team:

• Pull requests: scan changed files only, fail on critical and high.
• Main branch: full scan, fail on critical.
• Nightly: full scan including DAST and cloud posture, report without gating.

# Pull request
sentrasec scan . --since origin/main --severity high

# Main
sentrasec scan . --severity critical

Authentication

Store the workspace token as a secret in your CI system and expose it as SENTRASEC_TOKEN. Unauthenticated scans still work against bundled rules: useful for forked pull requests where secrets are unavailable.