Use the CLI in CI/CD

Overview

Use cysmiq check in CI/CD to evaluate findings from a Cysmiq scan and fail the job when a severity or count threshold is exceeded. The CLI queries scan results from Cysmiq. It does not replace the repository integration that triggers scans.

Availability depends on your Cysmiq plan.

Prerequisites

Connect the repository to Cysmiq and confirm that push or pull request scans run.
Create an API key with vulnerabilities:read and scans:read scopes.
Store the token in the CI provider’s secret store.
Know the Cysmiq workspace slug and repository path.

Choose the revision

Use a commit SHA when the job must wait for and evaluate the scan of the exact revision:

Check a commit

cysmiq check --repo my-org/my-repo --sha "$COMMIT_SHA"

Use a ref when the job should evaluate the latest known scan for a branch or tag:

Check a branch

cysmiq check --repo my-org/my-repo --ref main

Application checks evaluate findings across all repositories in an application and do not wait for one repository scan:

Check an application

cysmiq check --application app_01hxyz

Configure the policy gate

By default, cysmiq check fails when it finds a critical or high-severity vulnerability. Adjust the gate for the workflow:

Fail only on critical vulnerabilities

cysmiq check --repo my-org/my-repo --sha "$COMMIT_SHA" --fail-on critical

Fail when more than ten findings match

cysmiq check --repo my-org/my-repo --sha "$COMMIT_SHA" --max-count 10

Use --severity, --type, --state, and --triaged to focus the evaluation. See the CLI reference for every option.

Add the CI job

GitHub Actions
GitLab CI
CircleCI

GitHub Actions workflow

name: Security Check

on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Cysmiq CLI
        run: |
          curl -fsSL https://github.com/cysmiq/cli-releases/releases/latest/download/cysmiq_linux_amd64.tar.gz | tar -xz
          sudo mv cysmiq /usr/local/bin/

      - name: Run security check
        env:
          CYSMIQ_BASE_URL: https://app.cysmiq.com
          CYSMIQ_TENANT: ${{ vars.CYSMIQ_TENANT }}
          CYSMIQ_TOKEN: ${{ secrets.CYSMIQ_TOKEN }}
          CYSMIQ_REPO: ${{ github.repository }}
          CYSMIQ_SHA: ${{ github.sha }}
        run: cysmiq check

GitLab CI configuration

security-check:
  image: alpine:latest
  before_script:
    - apk add --no-cache curl
    - curl -fsSL https://github.com/cysmiq/cli-releases/releases/latest/download/cysmiq_linux_amd64.tar.gz | tar -xz
    - mv cysmiq /usr/local/bin/
  script:
    - cysmiq check
  variables:
    CYSMIQ_BASE_URL: https://app.cysmiq.com
    CYSMIQ_REPO: $CI_PROJECT_PATH
    CYSMIQ_SHA: $CI_COMMIT_SHA

CircleCI configuration

version: 2.1

jobs:
  security-check:
    docker:
      - image: cimg/base:current
    steps:
      - checkout
      - run:
          name: Install Cysmiq CLI
          command: |
            curl -fsSL https://github.com/cysmiq/cli-releases/releases/latest/download/cysmiq_linux_amd64.tar.gz | tar -xz
            sudo mv cysmiq /usr/local/bin/
      - run:
          name: Run security check
          command: cysmiq check --repo "$CIRCLE_PROJECT_USERNAME/$CIRCLE_PROJECT_REPONAME" --sha "$CIRCLE_SHA1"
          environment:
            CYSMIQ_BASE_URL: https://app.cysmiq.com

workflows:
  main:
    jobs:
      - security-check:
          context: cysmiq

Configure CYSMIQ_TENANT and CYSMIQ_TOKEN as protected CI/CD variables or secrets in the provider. The examples inherit those values without writing them into the workflow file.

Interpret the result

The most important exit codes for a pipeline are:

Exit code	Meaning
`0`	The check passed.
`4`	The API token is invalid or expired.
`5`	The token or workspace lacks access to the operation.
`6`	The workspace, repository, application, ref, or SHA was not found.
`7`	A scan was not available for the requested SHA.
`9`	An API, transport, terminal scan, or wait-timeout error occurred.
`10`	The configured vulnerability threshold was exceeded.

Use JSON output when the pipeline also needs the structured result:

Emit JSON

cysmiq check --repo my-org/my-repo --sha "$COMMIT_SHA" --output json

Keep exit code 10 distinct from authentication, configuration, and service failures when the pipeline reports the result.

Onboarding & setup

Integrations

Workflows

Administration

Self-hosting

Use the CLI in CI/CD

Overview

Prerequisites

Choose the revision

Configure the policy gate

Add the CI job

Interpret the result

​Overview

​Prerequisites

​Choose the revision

​Configure the policy gate

​Add the CI job

​Interpret the result

​Related docs

Overview

Prerequisites

Choose the revision

Configure the policy gate

Add the CI job

Interpret the result

Related docs