CI/CD Integration

Overview

Pensar provides a CLI tool and API for integrating automated pentesting directly into your CI/CD pipeline. Run pentests on every commit or deployment to catch vulnerabilities before they reach production.

Installation

Install the Pensar CI package globally:

$
npm install -g @pensar/ci

Or add it as a dev dependency:

$
npm install --save-dev @pensar/ci

Configuration

Required Environment Variables

Optional Environment Variables

CLI Usage

Run a Pentest

$
pensar pentest [options]

Options:

Examples:

$
# Basic pentest using environment variables
$
pensar pentest
$
$
# Pentest a specific branch
$
pensar pentest --branch main
$
$
# Pentest without waiting for completion
$
pensar pentest --no-wait
$
$
# Pentest with explicit environment
$
pensar pentest --branch develop --environment staging

Check Scan Status

$
pensar status <scanId>

Example:

$
pensar status abc123-def456-789

CI/CD Examples

GitHub Actions

1
name: Pensar Pentest
2
3
on:
4
  push:
5
    branches: [main, master, develop]
6
7
jobs:
8
  pentest:
9
    name: Pensar Pentest
10
    runs-on: ubuntu-latest
11
    timeout-minutes: 60
12
    steps:
13
      - uses: actions/checkout@v4
14
15
      - uses: actions/setup-node@v4
16
        with:
17
          node-version: '22'
18
19
      - name: Install Pensar CI
20
        run: npm install -g @pensar/ci
21
22
      - name: Run Pensar Pentest
23
        env:
24
          PENSAR_API_KEY: ${{ secrets.PENSAR_API_KEY }}
25
        run: pensar pentest --branch ${{ github.ref_name }}

GitLab CI

Add to your .gitlab-ci.yml:

1
stages:
2
  - security
3
4
pensar-pentest:
5
  stage: security
6
  image: node:22
7
  rules:
8
    - if: $CI_COMMIT_BRANCH == "main"
9
  before_script:
10
    - npm install -g @pensar/ci
11
  script:
12
    - pensar pentest --branch $CI_COMMIT_REF_NAME
13
  variables:
14
    PENSAR_API_KEY: $PENSAR_API_KEY

Bitbucket Pipelines

Add to your bitbucket-pipelines.yml:

1
pipelines:
2
  branches:
3
    main:
4
      - step:
5
          name: Pensar Pentest
6
          image: node:22
7
          script:
8
            - npm install -g @pensar/ci
9
            - pensar pentest --branch main

Exit Codes

API Reference

Dispatch Scan

POST /ci/dispatch

Headers:

• Authorization: Bearer <api_key> or x-api-key: <api_key>
• Content-Type: application/json

Request Body:

Provide a repository so the pentest is scoped to that repository’s applications. Supply either repoId (GitHub’s numeric repository id — the CLI auto-detects this from GITHUB_REPOSITORY_ID) or repositoryId (the internal repository UUID). When neither is supplied the scan covers every application in the workspace.

1
{
2
  "repoId": 123456789,
3
  "repositoryId": "string (uuid, optional alternative to repoId)",
4
  "branch": "string (optional)",
5
  "scanLevel": "priority | full (optional)",
6
  "commitSha": "string (optional)"
7
}

The repository must already be connected to the workspace. If it isn’t found, the API responds 404; if it belongs to another workspace, 403; if it has no discovered applications yet (run reconnaissance first), 422.

Response:

1
{
2
  "scanId": "string",
3
  "label": "string",
4
  "status": "queued"
5
}

Get Scan Status

GET /ci/status/{scanId}

Headers:

• Authorization: Bearer <api_key> or x-api-key: <api_key>

Response:

1
{
2
  "scanId": "string",
3
  "label": "string",
4
  "status": "queued | running | completed | failed | paused",
5
  "startedAt": "string | null",
6
  "completedAt": "string | null",
7
  "errorMessage": "string | null",
8
  "issuesCount": 0,
9
  "issueCountsBySeverity": {
10
    "critical": 0,
11
    "high": 0,
12
    "medium": 0,
13
    "low": 0
14
  },
15
  "reportReady": false
16
}

Next Steps