> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# CI security pipeline

> Run a repository scan, save reports, and check security gates in one workflow.

Configure thresholds in CodeAnt, then set `quality_gate` in your workflow.

## 1. Configure CodeAnt

1. Enable secrets, SAST, and SCA in [Analysis Configuration](https://docs.codeant.ai/repositories/analysis_configuration.md).
2. Open **Settings → Code Analysis → Quality Gates**. Select your repository and turn **Quality Gate** **On**.
3. Click **Add Condition → Full Code**. Add these conditions; changes save automatically:

| Metric | Operator | Rating | Fails when |
| - | - | - | - |
| SAST Security Rating | Less Than or Equals | C | Rating is C or worse |
| SCA Security Rating | Less Than or Equals | C | Rating is C or worse |

4. [Create a token](https://docs.codeant.ai/settings/api-tokens.md#create-a-token) with the **Codeant CI/CD** role and repository access. Save it as the GitHub Actions secret `CODEANT_TOKEN`.

Configure conditions first: without them, the backend can return `PASSED`.

## 2. Add the workflow

Save as `.github/workflows/security.yml`. Replace `main` with your target branch.

```yaml .github/workflows/security.yml expandable theme={"theme":"css-variables"}
name: CodeAnt security pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  security:
    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - name: Scan repository
        uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.6
        with:
          access_token: ${{ secrets.CODEANT_TOKEN }}
          scanners: sast,sca,secrets
          scan_timeout: '1200'
          quality_gate: 'true'
      - name: Save reports
        if: ${{ always() }}
        uses: actions/upload-artifact@v4
        with:
          name: codeant-results
          if-no-files-found: error
          path: |
            results.json
            codeant.sarif
            codeant-qg.xml

  deploy:
    if: ${{ github.ref == 'refs/heads/main' }}
    needs: security
    runs-on: ubuntu-latest
    steps:
      - run: echo 'Replace this step with your deployment command'
```

Secrets appear in reports but currently have no **Full Code** gate metric.

## 3. Run and review

1. Merge onto your default branch.
2. Open **Actions → CodeAnt security pipeline → Run workflow**.
3. Open the run → **Artifacts** → download **codeant-results**.

The archive contains JSON findings, SARIF, and JUnit XML. The action does not generate CSV/PDF.

## 4. Connect deployment

Replace the deployment placeholder with your command; keep `needs: security`. For a report-only rollout, set `quality_gate: 'false'`.

Test on a known vulnerable commit: **security** must fail and **deploy** must be skipped before you roll this out.

| Setting | Failed gate verdict | Scan errors / timeout |
| - | - | - |
| `'false'` | Reports the verdict; deployment allowed | Scan errors fail; results may finish asynchronously |
| `'true'` | Failed verdict blocks deployment | Scan errors and results timeout fail |

To block merges, require the security check in your branch protection rule or ruleset. Fork PRs are skipped because secrets are unavailable.

## Troubleshooting

| Problem | Action |
| - | - |
| `401` / `403` | Check the token's validity, role, organization, and repository scope. |
| Incomplete scan | Enable required analyses; increase `scan_timeout`. |
| Unexpected pass | Verify full-code SAST/SCA conditions are enabled for this repository. |
| Failed gate | Review findings; fix or dismiss false positives in CodeAnt. |

See the [example workflow and reports](https://github.com/codeanttesting/codeant-demo/tree/examples/security-pipeline/examples/security-pipeline) and [actual action run](https://github.com/codeanttesting/codeant-demo/actions/runs/42313732456).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.