CI/CD Integration

Overview

Pensar provides a CLI tool and API for integrating security scanning directly into your CI/CD pipeline. Run automated pentests on every pull request, commit, or deployment to catch vulnerabilities before they reach production.

Installation

Install the Pensar CI package globally:

$
npm install -g @pensar/ci

Or add it as a dev dependency:

$
npm install --save-dev @pensar/ci

Configuration

Required Environment Variables

Optional Environment Variables

CLI Usage

Trigger a Scan

$
pensar scan [options]

Options:

Examples:

$
# Basic scan using environment variables
$
pensar scan
$
$
# Scan a specific branch
$
pensar scan --branch main
$
$
# Quick priority scan without waiting
$
pensar scan --level priority --no-wait
$
$
# Full scan with explicit project ID
$
pensar scan --project abc123-def456 --branch develop

Check Scan Status

$
pensar status <scanId>

Example:

$
pensar status abc123-def456-789

CI/CD Examples

GitHub Actions

1
name: Pensar Security Scan
2
3
on:
4
  pull_request:
5
    branches: [main, master, develop]
6
7
jobs:
8
  security-scan:
9
    runs-on: ubuntu-latest
10
    steps:
11
      - uses: actions/checkout@v4
12
13
      - uses: actions/setup-node@v4
14
        with:
15
          node-version: '20'
16
17
      - name: Install Pensar CI
18
        run: npm install -g @pensar/ci
19
20
      - name: Run Security Scan
21
        env:
22
          PENSAR_API_KEY: ${{ secrets.PENSAR_API_KEY }}
23
          PENSAR_PROJECT_ID: ${{ secrets.PENSAR_PROJECT_ID }}
24
        run: pensar scan --branch ${{ github.head_ref }}

GitLab CI

Add to your .gitlab-ci.yml:

1
stages:
2
  - security
3
4
pensar-scan:
5
  stage: security
6
  image: node:20
7
  rules:
8
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
9
    - if: $CI_COMMIT_BRANCH == "main"
10
  before_script:
11
    - npm install -g @pensar/ci
12
  script:
13
    - pensar scan --branch $CI_COMMIT_REF_NAME
14
  variables:
15
    PENSAR_API_KEY: $PENSAR_API_KEY
16
    PENSAR_PROJECT_ID: $PENSAR_PROJECT_ID

Bitbucket Pipelines

Add to your bitbucket-pipelines.yml:

1
pipelines:
2
  pull-requests:
3
    '**':
4
      - step:
5
          name: Pensar Security Scan
6
          image: node:20
7
          script:
8
            - npm install -g @pensar/ci
9
            - pensar scan --branch $BITBUCKET_BRANCH
10
11
  branches:
12
    main:
13
      - step:
14
          name: Pensar Security Scan
15
          image: node:20
16
          script:
17
            - npm install -g @pensar/ci
18
            - pensar scan --branch main

Programmatic Usage

Use the CI package programmatically in your Node.js scripts:

1
import { CI } from '@pensar/ci';
2
3
// Run a scan and wait for completion
4
const result = await CI.runScan({
5
  projectId: 'your-project-id',
6
  branch: 'main',
7
  scanLevel: 'full',
8
  wait: true,
9
});
10
11
console.log(`Scan completed with ${result.issuesCount} issues`);
12
13
// Or use lower-level APIs
14
const { scanId, label } = await CI.dispatchScan({
15
  apiKey: process.env.PENSAR_API_KEY,
16
  projectId: 'your-project-id',
17
});
18
19
// Check status
20
const status = await CI.getScanStatus({
21
  apiKey: process.env.PENSAR_API_KEY,
22
  scanId,
23
});
24
25
console.log(`Scan ${label}: ${status.status}`);

Exit Codes

Best Practices

$
pensar scan --level priority

API Reference

Dispatch Scan

POST /ci/dispatch

Headers:

• Authorization: Bearer <api_key> or x-api-key: <api_key>
• Content-Type: application/json

Request Body:

1
{
2
  "projectId": "string",
3
  "branch": "string (optional)",
4
  "scanLevel": "priority | full (optional)"
5
}

Response:

1
{
2
  "scanId": "string",
3
  "label": "string",
4
  "status": "queued"
5
}

Get Scan Status

GET /ci/status/{scanId}

Headers:

• Authorization: Bearer <api_key> or x-api-key: <api_key>

Response:

1
{
2
  "scanId": "string",
3
  "label": "string",
4
  "status": "queued | running | completed | failed | paused",
5
  "startedAt": "string | null",
6
  "completedAt": "string | null",
7
  "errorMessage": "string | null",
8
  "issuesCount": 0,
9
  "reportReady": false
10
}

Next Steps