CI/CD Integration

Overview

Pensar provides a CLI tool and API for integrating automated pentesting directly into your CI/CD pipeline. Run pentests on every commit or deployment to catch vulnerabilities before they reach production.

Installation

Install the Pensar CI package globally:

$
npm install -g @pensar/ci

Or add it as a dev dependency:

$
npm install --save-dev @pensar/ci

Configuration

Required Environment Variables

Optional Environment Variables

CLI Usage

Run a Pentest

$
pensar pentest [options]

Options:

Examples:

$
# Basic pentest using environment variables
$
pensar pentest
$
$
# Pentest a specific branch
$
pensar pentest --branch main
$
$
# Pentest without waiting for completion
$
pensar pentest --no-wait
$
$
# Pentest with explicit environment
$
pensar pentest --branch develop --environment staging

Check Scan Status

$
pensar status <scanId>

Example:

$
pensar status abc123-def456-789

CI/CD Examples

GitHub Actions

1
name: Pensar Pentest
2
3
on:
4
  push:
5
    branches: [main, master, develop]
6
7
jobs:
8
  pentest:
9
    name: Pensar Pentest
10
    runs-on: ubuntu-latest
11
    timeout-minutes: 60
12
    steps:
13
      - uses: actions/checkout@v4
14
15
      - uses: actions/setup-node@v4
16
        with:
17
          node-version: '22'
18
19
      - name: Install Pensar CI
20
        run: npm install -g @pensar/ci
21
22
      - name: Run Pensar Pentest
23
        env:
24
          PENSAR_API_KEY: ${{ secrets.PENSAR_API_KEY }}
25
        run: pensar pentest --branch ${{ github.ref_name }}

GitLab CI

Add to your .gitlab-ci.yml:

1
stages:
2
  - security
3
4
pensar-pentest:
5
  stage: security
6
  image: node:22
7
  rules:
8
    - if: $CI_COMMIT_BRANCH == "main"
9
  before_script:
10
    - npm install -g @pensar/ci
11
  script:
12
    - pensar pentest --branch $CI_COMMIT_REF_NAME
13
  variables:
14
    PENSAR_API_KEY: $PENSAR_API_KEY

Bitbucket Pipelines

Add to your bitbucket-pipelines.yml:

1
pipelines:
2
  branches:
3
    main:
4
      - step:
5
          name: Pensar Pentest
6
          image: node:22
7
          script:
8
            - npm install -g @pensar/ci
9
            - pensar pentest --branch main

Exit Codes

API Reference

Dispatch Scan

POST /ci/dispatch

Headers:

• Authorization: Bearer <api_key> or x-api-key: <api_key>
• Content-Type: application/json

Request Body:

1
{
2
  "projectId": "string",
3
  "branch": "string (optional)",
4
  "scanLevel": "priority | full (optional)"
5
}

Response:

1
{
2
  "scanId": "string",
3
  "label": "string",
4
  "status": "queued"
5
}

Get Scan Status

GET /ci/status/{scanId}

Headers:

• Authorization: Bearer <api_key> or x-api-key: <api_key>

Response:

1
{
2
  "scanId": "string",
3
  "label": "string",
4
  "status": "queued | running | completed | failed | paused",
5
  "startedAt": "string | null",
6
  "completedAt": "string | null",
7
  "errorMessage": "string | null",
8
  "issuesCount": 0,
9
  "reportReady": false
10
}

Next Steps