CI/CD Guides

CI/CD Integration Guides

Automate security & code review in your pipeline

Integrate Lurus Code into your existing CI/CD infrastructure in minutes. Headless execution, defined exit codes, SARIF output, and native PR integration.

GitHub Actions GitLab CI Jenkins CircleCI

CLI Reference → Quick Start → CI/CD Guides

How CI/CD Integration Works

Lurus Code provides two dedicated CI/CD commands: lurus security-ci for automated security scanning and lurus code-review-ci for AI-powered code review. Both commands run headless (no browser required), produce machine-readable output, and return standardized exit codes.

Exit Codes

0 Success – no blocking findings

1 Findings at or above --fail-on threshold

2 Scan/review failed (technical error)

3 Credit balance exhausted (partial results)

Authentication in CI/CD

Set LURUS_API_KEY as an environment variable or secret in your CI/CD system. Never commit API keys to your repository.

export LURUS_API_KEY=your-api-key-here

GitHub Actions

GitHub Actions has first-class support in Lurus Code. The CLI automatically detects the GITHUB_ACTIONS environment variable and writes results to GITHUB_STEP_SUMMARY and GITHUB_OUTPUT.

Automatic Step Summary with findings table Output variables: total_findings, blocking_findings, passed Inline PR review comments via --pr-comments Automatic PR verdict (APPROVE / REQUEST_CHANGES) via --verdict SARIF upload to GitHub Code Scanning

Security Scan on Pull Requests

Run a security scan on every PR and post inline findings as review comments.

.github/workflows/lurus-security.yml

name: Lurus Security Scan

on:
  pull_request:
    branches: [main, develop]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write   # Required for PR comments
      security-events: write # Required for SARIF upload

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0   # Full history for git diff

      - uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install Lurus Code CLI
        run: npm install -g @scramble-cloud/lurus-code-cli

      - name: Run Lurus Security Scan
        run: lurus security-ci --diff --pr-comments --fail-on high
        env:
          LURUS_API_KEY: ${{ secrets.LURUS_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload SARIF to GitHub Code Scanning
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: lurus-security-results.sarif

Code Review with Automatic Verdict

Run an AI code review on every PR and automatically approve or request changes.

.github/workflows/lurus-review.yml

name: Lurus Code Review

on:
  pull_request:
    branches: [main, develop]

jobs:
  code-review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install Lurus Code CLI
        run: npm install -g @scramble-cloud/lurus-code-cli

      - name: Run Lurus Code Review
        run: lurus code-review-ci --pr-comments --verdict --fail-on high
        env:
          LURUS_API_KEY: ${{ secrets.LURUS_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Combined Pipeline (Security + Review)

Run both security scan and code review in parallel for maximum coverage.

.github/workflows/lurus-full.yml

name: Lurus Full CI Check

on:
  pull_request:
    branches: [main, develop]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      security-events: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - run: npm install -g @scramble-cloud/lurus-code-cli
      - name: Security Scan
        run: lurus security-ci --diff --pr-comments --fail-on high
        env:
          LURUS_API_KEY: ${{ secrets.LURUS_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Upload SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: lurus-security-results.sarif

  code-review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - run: npm install -g @scramble-cloud/lurus-code-cli
      - name: Code Review
        run: lurus code-review-ci --pr-comments --verdict --fail-on high
        env:
          LURUS_API_KEY: ${{ secrets.LURUS_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Scheduled Full Project Scan

Run a full security scan on the entire codebase on a schedule (e.g. nightly).

.github/workflows/lurus-nightly.yml

name: Lurus Nightly Security Scan

on:
  schedule:
    - cron: '0 2 * * *'   # Every night at 2:00 AM UTC
  workflow_dispatch:        # Manual trigger

jobs:
  full-security-scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install Lurus Code CLI
        run: npm install -g @scramble-cloud/lurus-code-cli

      - name: Full Security Scan
        run: |
          lurus security-ci \
            --format sarif \
            --output lurus-security-results.sarif \
            --fail-on critical
        env:
          LURUS_API_KEY: ${{ secrets.LURUS_API_KEY }}

      - name: Upload SARIF to GitHub Code Scanning
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: lurus-security-results.sarif

security-ci

total_findings Total number of findings

blocking_findings Findings at or above --fail-on threshold

passed `true` if no blocking findings

code-review-ci

total_findings Total number of review findings

blocking_findings Findings at or above --fail-on threshold

verdict `approve`, `needsChanges`, or `comment`

passed `true` if no blocking findings

GitLab CI

Integrate Lurus Code into your GitLab CI/CD pipeline using .gitlab-ci.yml. Use GitLab CI/CD variables to store your API key securely.

Runs in any Docker-based GitLab Runner SARIF artifacts for GitLab Security Dashboard Merge request pipeline integration GitLab CI/CD Variables for secrets management Artifacts for HTML reports

Security Scan on Merge Requests

Scan changed files on every merge request and fail the pipeline on high+ findings.

.gitlab-ci.yml

stages:
  - security

lurus-security-scan:
  stage: security
  image: node:20-alpine
  only:
    - merge_requests
  before_script:
    - npm install -g @scramble-cloud/lurus-code-cli
  script:
    - lurus security-ci
        --diff
        --format sarif
        --output gl-sast-report.sarif
        --fail-on high
  variables:
    LURUS_API_KEY: $LURUS_API_KEY
  artifacts:
    when: always
    reports:
      sast: gl-sast-report.sarif
    paths:
      - gl-sast-report.sarif
    expire_in: 1 week

Code Review on Merge Requests

Run an AI code review and generate an HTML report as a downloadable artifact.

.gitlab-ci.yml

stages:
  - review

lurus-code-review:
  stage: review
  image: node:20-alpine
  only:
    - merge_requests
  before_script:
    - npm install -g @scramble-cloud/lurus-code-cli
  script:
    - lurus code-review-ci
        --format html
        --output code-review-report.html
        --fail-on high
  variables:
    LURUS_API_KEY: $LURUS_API_KEY
  artifacts:
    when: always
    paths:
      - code-review-report.html
    expire_in: 1 week

Full Pipeline with Both Commands

Complete GitLab CI configuration with security scan and code review in parallel.

.gitlab-ci.yml

stages:
  - lurus-checks

variables:
  LURUS_API_KEY: $LURUS_API_KEY

.lurus-base:
  image: node:20-alpine
  only:
    - merge_requests
  before_script:
    - npm install -g @scramble-cloud/lurus-code-cli

lurus-security:
  extends: .lurus-base
  stage: lurus-checks
  script:
    - lurus security-ci --diff --format sarif --fail-on high
  artifacts:
    when: always
    reports:
      sast: lurus-security-results.sarif
    expire_in: 1 week

lurus-review:
  extends: .lurus-base
  stage: lurus-checks
  script:
    - lurus code-review-ci --format html --output review.html --fail-on high
  artifacts:
    when: always
    paths:
      - review.html
    expire_in: 1 week

Setting up GitLab CI/CD Variables

1 Go to your project → Settings → CI/CD → Variables
2 Add a new variable: Key = LURUS_API_KEY, Value = your API key
3 Check "Mask variable" to hide the value in job logs
4 Check "Protect variable" to restrict it to protected branches

Jenkins

Integrate Lurus Code into Jenkins using a Declarative Pipeline (Jenkinsfile). Store your API key as a Jenkins credential.

Declarative Pipeline (Jenkinsfile) Jenkins Credentials for API key management HTML Publisher Plugin for report display Parallel stages for security + review Post-build artifact archiving

Security Scan Pipeline

A Jenkinsfile that runs a security scan on pull request branches.

Jenkinsfile

pipeline {
  agent {
    docker {
      image 'node:20-alpine'
    }
  }

  environment {
    LURUS_API_KEY = credentials('lurus-api-key')
  }

  stages {
    stage('Install') {
      steps {
        sh 'npm install -g @scramble-cloud/lurus-code-cli'
      }
    }

    stage('Security Scan') {
      steps {
        sh '''
          lurus security-ci \
            --diff \
            --format sarif \
            --output lurus-security-results.sarif \
            --fail-on high
        '''
      }
      post {
        always {
          archiveArtifacts artifacts: 'lurus-security-results.sarif',
                           allowEmptyArchive: true
        }
      }
    }
  }

  post {
    failure {
      echo 'Security scan failed – blocking findings detected'
    }
    success {
      echo 'Security scan passed'
    }
  }
}

Code Review Pipeline with HTML Report

Run a code review and publish the HTML report in the Jenkins UI.

Jenkinsfile

pipeline {
  agent {
    docker {
      image 'node:20-alpine'
    }
  }

  environment {
    LURUS_API_KEY = credentials('lurus-api-key')
  }

  stages {
    stage('Install') {
      steps {
        sh 'npm install -g @scramble-cloud/lurus-code-cli'
      }
    }

    stage('Code Review') {
      steps {
        sh '''
          lurus code-review-ci \
            --format html \
            --output code-review-report.html \
            --fail-on high
        '''
      }
      post {
        always {
          publishHTML(target: [
            allowMissing: true,
            alwaysLinkToLastBuild: true,
            keepAll: true,
            reportDir: '.',
            reportFiles: 'code-review-report.html',
            reportName: 'Lurus Code Review Report'
          ])
        }
      }
    }
  }
}

Full Pipeline with Parallel Stages

Run security scan and code review in parallel for faster feedback.

Jenkinsfile

pipeline {
  agent {
    docker {
      image 'node:20-alpine'
    }
  }

  environment {
    LURUS_API_KEY = credentials('lurus-api-key')
  }

  stages {
    stage('Install') {
      steps {
        sh 'npm install -g @scramble-cloud/lurus-code-cli'
      }
    }

    stage('Lurus Checks') {
      parallel {
        stage('Security Scan') {
          steps {
            sh 'lurus security-ci --diff --fail-on high'
          }
          post {
            always {
              archiveArtifacts artifacts: 'lurus-security-results.sarif',
                               allowEmptyArchive: true
            }
          }
        }

        stage('Code Review') {
          steps {
            sh 'lurus code-review-ci --format html --output review.html --fail-on high'
          }
          post {
            always {
              publishHTML(target: [
                reportDir: '.',
                reportFiles: 'review.html',
                reportName: 'Code Review Report'
              ])
            }
          }
        }
      }
    }
  }

  post {
    failure {
      echo 'Lurus checks failed – review findings above'
    }
  }
}

Adding the API Key as Jenkins Credential

1 Go to Jenkins → Manage Jenkins → Manage Credentials
2 Click "Add Credentials" → Kind: "Secret text"
3 ID: lurus-api-key, Secret: your API key
4 Reference in Jenkinsfile with credentials('lurus-api-key')

CircleCI

Add Lurus Code to your CircleCI config using .circleci/config.yml. Store your API key as a CircleCI environment variable.

Docker executor with Node.js CircleCI Context for secrets management Artifact storage for reports Parallel workflow jobs Branch-based filtering

Security Scan Job

A CircleCI job that runs a security scan on every push to a PR branch.

.circleci/config.yml

version: 2.1

jobs:
  lurus-security-scan:
    docker:
      - image: cimg/node:20.0
    steps:
      - checkout
      - run:
          name: Install Lurus Code CLI
          command: npm install -g @scramble-cloud/lurus-code-cli
      - run:
          name: Run Security Scan
          command: |
            lurus security-ci \
              --diff \
              --format sarif \
              --output lurus-security-results.sarif \
              --fail-on high
      - store_artifacts:
          path: lurus-security-results.sarif
          destination: security-report

workflows:
  pr-checks:
    jobs:
      - lurus-security-scan:
          filters:
            branches:
              ignore: main

Code Review Job

Run an AI code review and store the HTML report as a CircleCI artifact.

.circleci/config.yml

version: 2.1

jobs:
  lurus-code-review:
    docker:
      - image: cimg/node:20.0
    steps:
      - checkout
      - run:
          name: Install Lurus Code CLI
          command: npm install -g @scramble-cloud/lurus-code-cli
      - run:
          name: Run Code Review
          command: |
            lurus code-review-ci \
              --format html \
              --output code-review-report.html \
              --fail-on high
      - store_artifacts:
          path: code-review-report.html
          destination: code-review-report

workflows:
  pr-checks:
    jobs:
      - lurus-code-review:
          filters:
            branches:
              ignore: main

Full Workflow with Parallel Jobs

Complete CircleCI configuration running security scan and code review in parallel.

.circleci/config.yml

version: 2.1

executors:
  node-executor:
    docker:
      - image: cimg/node:20.0

commands:
  install-lurus:
    steps:
      - run:
          name: Install Lurus Code CLI
          command: npm install -g @scramble-cloud/lurus-code-cli

jobs:
  lurus-security:
    executor: node-executor
    steps:
      - checkout
      - install-lurus
      - run:
          name: Security Scan
          command: |
            lurus security-ci \
              --diff \
              --fail-on high \
              --format sarif
      - store_artifacts:
          path: lurus-security-results.sarif

  lurus-review:
    executor: node-executor
    steps:
      - checkout
      - install-lurus
      - run:
          name: Code Review
          command: |
            lurus code-review-ci \
              --fail-on high \
              --format html \
              --output review.html
      - store_artifacts:
          path: review.html

workflows:
  pr-pipeline:
    jobs:
      - lurus-security:
          context: lurus-credentials
          filters:
            branches:
              ignore: main
      - lurus-review:
          context: lurus-credentials
          filters:
            branches:
              ignore: main

Setting up CircleCI Environment Variables

1 Go to your CircleCI project → Project Settings → Environment Variables
2 Add LURUS_API_KEY with your API key as the value
3 Alternatively, create a CircleCI Context (Organization Settings → Contexts) for sharing across projects
4 Reference the context in your workflow with context: your-context-name

Best Practices

Secure API Key Storage

Always store LURUS_API_KEY as an encrypted secret/credential in your CI/CD system. Never hardcode it in configuration files.

Use --diff for PR Pipelines

Use --diff to scan only changed files in PR pipelines. This is faster, cheaper, and provides more relevant feedback.

Start with --fail-on critical

Begin with --fail-on critical and progressively lower the threshold as your team addresses existing issues.

Archive Reports as Artifacts

Always archive SARIF and HTML reports as CI artifacts for later review, even when the job passes.

Separate Jobs for Security and Review

Run security-ci and code-review-ci as separate parallel jobs to get faster feedback and independent failure states.

Schedule Full Scans Separately

Use --diff for PR pipelines and schedule full project scans (without --diff) nightly or weekly.

security-ci & code-review-ci

Full command reference with all flags and options

Quick Start

Install, login, and first session in 5 minutes

Best Practices

Patterns and anti-patterns for CI/CD usage

More Docs Quick Start → CLI Reference → Model Costs →

Ready to automate your pipeline?

Get your API key and start integrating Lurus Code into your CI/CD workflow today.

Get API Key View CLI Reference →