What you can run in a pipeline today, and what is evaluated by the platform instead

CI/CD Integration

There are two ways Safeguard fits into a pipeline:

Connect the repository. Once a repository is connected as an integration, the platform scans it and evaluates your policies and gates on the results. Nothing has to run in your pipeline for this.
Run the CLI in the job. safeguard scan and safeguard detect run on the build machine and write results you can keep as build artifacts or upload to a code-scanning tab.

There is no published Safeguard GitHub Action, container image or pipeline plugin for the CLI yet, and the CLI has no severity threshold flag. The CLI reports findings; it does not fail a build on them. Enforcement is done by the platform's policy gates.

Install in a job

The installer is the same one you use locally. Pin a version in CI so a release does not change a build under you:

curl -fsSL https://cli.safeguard.sh/install | SAFEGUARD_VERSION=<version> bash

safeguard scan runs syft and grype. A fresh CI runner does not have them, so install both on the PATH (or point TOOLS_DIR at a directory that holds them) before the scan step.

GitHub Actions

Secrets and misconfigurations as SARIF, shown in the repository's code-scanning tab:

name: Safeguard
on: [push, pull_request]

jobs:
  detect:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - name: Install the Safeguard CLI
        run: curl -fsSL https://cli.safeguard.sh/install | SAFEGUARD_VERSION=<version> bash
      - name: Detect secrets and misconfigurations
        run: safeguard detect --format sarif --output safeguard.sarif
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: safeguard.sarif

GitLab CI/CD

safeguard-scan:
  stage: test
  image: ubuntu:24.04
  script:
    - apt-get update && apt-get install -y curl
    - curl -fsSL https://cli.safeguard.sh/install | SAFEGUARD_VERSION=<version> bash
    # syft and grype must be on the PATH before this step
    - safeguard scan --dir . --output safeguard-results
  artifacts:
    paths:
      - safeguard-results/

Jenkins

pipeline {
    agent any
    stages {
        stage('Safeguard') {
            steps {
                sh 'curl -fsSL https://cli.safeguard.sh/install | SAFEGUARD_VERSION=<version> bash'
                sh 'safeguard detect --format json --output detect.json'
                archiveArtifacts artifacts: 'detect.json'
            }
        }
    }
}

Azure DevOps

steps:
  - script: |
      curl -fsSL https://cli.safeguard.sh/install | SAFEGUARD_VERSION=<version> bash
      safeguard detect --format sarif --output $(Build.ArtifactStagingDirectory)/safeguard.sarif
    displayName: 'Safeguard detect'

Exit codes

Command	Exit code
`safeguard scan`	`0` when the scan ran, whatever it found. `2` when results were written but the vulnerability scan did not run. `1` when the command failed.
`safeguard detect`	`0` when the scan ran, whatever it found. Non-zero only when the command failed, for example an invalid `--detect` value.

Dependency gate on Gold (planned)

A small dependency gate that checks your manifests against the free Gold Open Source database, and can fail a build on actively exploited (CISA KEV) dependencies, is built but not yet published as a GitHub Action or npm package. This section will carry the install line once it is.

Best practices

Connect the repository so the platform scans it and gates evaluate every result.
Pin the CLI version in CI and update it deliberately.
Keep the results as build artifacts; they are the evidence of what was scanned.
Enable AI Remediate so Griffin AI opens fix PRs for what the scans find.

CI/CD Integration

On this page