CI/CD integration

Prerequisites and exits

You need Node.js 20.9.0 or later, an installed CLI, credentials from a secret manager, the required subscription entitlement and a trusted checkout. Analyses can disclose code to services and incur costs. Never put real keys in YAML or logs.

Severity levels are critical, high, medium, low and info. --fail-on defaults to high; invalid severity values fall back to high, including the comment minimum. Unknown output formats fall back to JSON. Exit code 0 does not prove complete security.

Every security-CI flag

Warning: Reports can overwrite existing destination files. Check the output path before running the command.

lurus security-ci --diff --fail-on high --format sarif --output lurus-security-results.sarif --no-upload

Upload includes project name/findings/summary when findings exist. --no-upload does not stop model requests, reports, GitHub summaries or explicitly requested PR actions. Not an offline flag.

Every code-review-CI flag

lurus code-review-ci --staged --fail-on high --format json --output lurus-code-review-results.json

Reports can overwrite targets. False positives do not trigger the threshold. Distinguish balance/execution failure from findings.

GitHub Actions

Adapt this manually triggered example to your CI environment. Configure secrets through protected CI management and pin action revisions according to your supply-chain policy. Never automatically run untrusted fork code with secrets, write access or executable project configuration.

name: Lurus review
on: [workflow_dispatch]
permissions:
  contents: read
jobs:
  review:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
      - run: npm install -g @scramble-cloud/lurus-code-cli
      - run: lurus security-ci --format sarif --no-upload
        env:
          LURUS_API_KEY: ${{ secrets.LURUS_API_KEY }}

GITHUB_ACTIONS=true enables summaries and outputs. Security output names: total_findings, blocking_findings, passed. Opt-in comments require GITHUB_TOKEN/GITHUB_EVENT_PATH, PR/repository data and matching context. Missing prerequisites skip comments; errors are logged. Submitting a review verdict also requires --verdict, the appropriate GitHub context and an analysis result containing a verdict.

PR comments and review verdicts are externally visible. Enable them deliberately and grant only the required write permissions. Never automatically run untrusted fork code with secrets, write access or executable project configuration. Do not use dangerous permission modes or automatic consent as blanket defaults.

GitLab CI

Example of a manually triggered job:

lurus-review:
  image: node:22
  when: manual
  variables:
    GIT_DEPTH: '0'
  script:
    - npm install -g @scramble-cloud/lurus-code-cli
    - lurus code-review-ci --format json --output lurus-code-review-results.json
  artifacts:
    when: always
    paths:
      - lurus-code-review-results.json

Store LURUS_API_KEY protected/masked in CI secrets, not YAML. Use headless reports/exits; GitHub PR flags are not a generic GitLab comment adapter.

Other runners

Jenkins, CircleCI and other runners can execute these CLI commands with Node.js, protected environment credentials and an existing checkout. No universal plugin is promised. Preserve reports as artifacts even after exit code 1 or 3, and do not blindly ignore failure codes. Follow your CI permission and supply-chain policies.

Acceptance and safety

Check analysis scope, comparison base, threshold, actual report and exit code. Review logs for secrets and deliberately enable PR actions and uploads. Compare parameters with the reference. Automation explains other formats; permissions covers noninteractive boundaries.