CI security pipeline

Configure thresholds in CodeAnt, then set quality_gate in your workflow.

1. Configure CodeAnt

Enable secrets, SAST, and SCA in Analysis Configuration.
Open Settings → Code Analysis → Quality Gates. Select your repository and turn Quality Gate On.
Click Add Condition → Full Code. Add these conditions; changes save automatically:

Metric	Operator	Rating	Fails when
SAST Security Rating	Less Than or Equals	C	Rating is C or worse
SCA Security Rating	Less Than or Equals	C	Rating is C or worse

Create a token with the Codeant CI/CD role and repository access. Save it as the GitHub Actions secret CODEANT_TOKEN.

Configure conditions first: without them, the backend can return PASSED.

2. Add the workflow

Save as .github/workflows/security.yml. Replace main with your target branch.

.github/workflows/security.yml

name: CodeAnt security pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  security:
    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - name: Scan repository
        uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.6
        with:
          access_token: ${{ secrets.CODEANT_TOKEN }}
          scanners: sast,sca,secrets
          scan_timeout: '1200'
          quality_gate: 'true'
      - name: Save reports
        if: ${{ always() }}
        uses: actions/upload-artifact@v4
        with:
          name: codeant-results
          if-no-files-found: error
          path: |
            results.json
            codeant.sarif
            codeant-qg.xml

  deploy:
    if: ${{ github.ref == 'refs/heads/main' }}
    needs: security
    runs-on: ubuntu-latest
    steps:
      - run: echo 'Replace this step with your deployment command'

Secrets appear in reports but currently have no Full Code gate metric.

3. Run and review

Merge onto your default branch.
Open Actions → CodeAnt security pipeline → Run workflow.
Open the run → Artifacts → download codeant-results.

The archive contains JSON findings, SARIF, and JUnit XML. The action does not generate CSV/PDF.

4. Connect deployment

Replace the deployment placeholder with your command; keep needs: security. For a report-only rollout, set quality_gate: 'false'. Test on a known vulnerable commit: security must fail and deploy must be skipped before you roll this out.

Setting	Failed gate verdict	Scan errors / timeout
`'false'`	Reports the verdict; deployment allowed	Scan errors fail; results may finish asynchronously
`'true'`	Failed verdict blocks deployment	Scan errors and results timeout fail

To block merges, require the security check in your branch protection rule or ruleset. Fork PRs are skipped because secrets are unavailable.

Troubleshooting

Problem	Action
`401` / `403`	Check the token’s validity, role, organization, and repository scope.
Incomplete scan	Enable required analyses; increase `scan_timeout`.
Unexpected pass	Verify full-code SAST/SCA conditions are enabled for this repository.
Failed gate	Review findings; fix or dismiss false positives in CodeAnt.

See the example workflow and reports and actual action run.

Get Started

AI Code Review

Code Security

Cloud Security

Code Quality

Engineering Metrics

IDE, CLI & CI/CD

Rule Reference

Resources

CI security pipeline

1. Configure CodeAnt

2. Add the workflow

3. Run and review

4. Connect deployment

Troubleshooting

​1. Configure CodeAnt

​2. Add the workflow

​3. Run and review

​4. Connect deployment

​Troubleshooting

1. Configure CodeAnt

2. Add the workflow

3. Run and review

4. Connect deployment

Troubleshooting