CI/CD Integration

Relevant source files

The following files were used as context for generating this wiki page:

• README.md
• QUICK_START.md
• CHANGELOG.md
• configs/default.json
• SECURITY_REVIEW.md
• CONTRIBUTING.md

The CI/CD integration of the Unified Security Scanner provides automated, enterprise-grade security gates within software development lifecycles. It is designed to run in multiple phases—including traditional SAST, AI-enhanced validation, and targeted deep dives—to maintain a low false-positive rate of less than 5%. The scanner supports native integration with GitHub Actions and is compatible with all major CI/CD platforms by utilizing machine-readable formats like SARIF and JSON for results reporting.

Sources: README.md:3-33, CHANGELOG.md:12-21

Automated Workflow and Pipeline Logic

The integration logic typically follows a structured sequence in a pipeline: checking out the code, installing dependencies, executing the scanner with specific flags (such as --multi-phase), and uploading the resulting SARIF file to security dashboards like the GitHub Security tab. This process allows teams to block merges based on defined severity thresholds, such as critical or high vulnerabilities.

Pipeline Execution Flow

The following diagram illustrates the typical sequence of events when the scanner is triggered within a CI/CD environment.

Configuration for Automation

CI/CD environments utilize specific configuration settings to optimize performance and define "fail-on" criteria. Key optimizations include incremental scanning—which uses git diff to target only changed files—and parallel execution to reduce build times.

Key CI/CD Configuration Options

Option	Type	Description	Default
failOn	Array	Severity levels that will cause the CI pipeline to fail.	["CRITICAL", "HIGH"]
incrementalScan	Boolean	Whether to scan only modified files based on git diff.	false
parallelWorkers	Number	Number of concurrent workers for multi-core scanning.	4
format	String	Output format (e.g., sarif, json) for machine consumption.	terminal

Sources: configs/default.json:44-53, QUICK_START.md:162-171

Incremental Scanning Logic

To optimize performance in PRs, the scanner can be configured to only analyze files modified between the base branch and the head.

Blocking Criteria and Severity Management

The scanner implements a tiered blocking strategy that varies depending on the branch type. This ensures that critical vulnerabilities never reach production while allowing developers flexibility on feature branches.

• Production/Main: Blocks on Critical, High, and Medium (with approval) findings.
• Staging/Develop: Blocks on Critical and High findings.
• Feature Branches: Usually provides comments/warnings without blocking the build unless Critical issues are found.

Sources: README.md:214-220, QUICK_START.md:173-182

Integration with GitHub Security

The scanner is designed to produce SARIF (Static Analysis Results Interchange Format) output, which is the standard format for the GitHub Code Scanning API. This enables inline code annotations directly within Pull Requests, allowing developers to see security findings in the context of their code changes.

- name: Run Security Scan
  run: |
    node packages/cli/dist/index.js scan . \
      --format=sarif \
      --output=./reports \
      --fail-on=critical,high

- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v2
  with:
    sarif_file: reports/security-results.sarif

Sources: QUICK_START.md:124-138, README.md:195-212

Security of the Scanner Pipeline

The project maintains its own security through self-scanning and input validation to prevent common pipeline attacks, such as shell injection. Technical debt tracking is also integrated into the CI process to identify EOL (End of Life) dependencies that could introduce vulnerabilities.

• Shell Injection Prevention: The scanner avoids using shell: true in spawn commands when executing tools like npm audit to prevent malicious target paths from executing arbitrary code.
• Input Sanitization: Paths are normalized and validated before file system operations.

Sources: SECURITY_REVIEW.md:28-55, CHANGELOG.md:25-27

The CI/CD integration serves as a critical quality gate, combining multi-tool orchestration with AI-driven validation to ensure that security analysis is both comprehensive and efficient enough for modern DevOps workflows.