CI/CD integration

Last updated: Oct 26, 2026

When you add a Fluid Attacks scanner to your CI/CD pipeline, you get automated security testing in all the stages of your software development lifecycle (SDLC).

Select the distribution that is best for your workflow:

• Docker containers: Work on all CI/CD providers that support Docker images. Available for MAST, CSPM, DAST, SAST, and SCA.
• GitHub Actions: Actions with native GitHub integration. Available for SAST, SCA, Secret Scan, DAST, and CI Gate.
• Distributed binaries: Install with one binary, without Docker. Available for Secret Scanning, Container Scanning, and DAST API Scanning.

Run with standalone binaries

The ss and cs standalone binaries can run on all CI/CD providers without Docker. The procedure is always the same: install the binary with the one-line installer, and then run the scan.

ss (secrets detection)

To attribute runs to your Fluid Attacks group, authenticate the scan. All systems that can issue OpenID Connect tokens can authenticate with no stored secret (the examples below use CI providers). Name your group with --group and give the token as INTEGRATES_OIDC_TOKEN. (On GitHub Actions, ss requests the token automatically.) If OIDC is not available, set an INTEGRATES_API_TOKEN secret. Authentication is optional and does not block the scan. For the full guide, read Authentication. It also shows how to configure OIDC federation with no stored secret.

# .github/workflows/ss.yml
name: Secret Scan
on: [push, pull_request]
permissions:
  id-token: write # allow the job to request an OIDC token
  contents: read
jobs:
  secretScan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@f095bcc56b7c2baf48f3ac70d6d6782f4f553222
      - name: Install ss
        run: curl -fsSL https://public.fluidattacks.com/ss/install.sh | sh
      - name: Run secret scan
        run: ss scan --group my-group --strict .

cs (container scanning)

To attribute runs to your Fluid Attacks group, authenticate the scan. All systems that can issue OpenID Connect tokens can authenticate with no stored secret (the examples below use CI providers). Name your group with --group and give the token as INTEGRATES_OIDC_TOKEN. (On GitHub Actions, cs requests the token automatically.) If OIDC is not available, set an INTEGRATES_API_TOKEN secret. Authentication is optional and does not block the scan. For the full guide, read Authentication. It also shows how to configure OIDC federation with no stored secret.

# .github/workflows/cs.yml
name: Container Scan
on: [push, pull_request]
permissions:
  id-token: write # allow the job to request an OIDC token
  contents: read
jobs:
  containerScan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@f095bcc56b7c2baf48f3ac70d6d6782f4f553222
      - name: Build image
        run: docker build -t myapp:latest .
      - name: Install cs
        run: curl -fsSL https://public.fluidattacks.com/cs/install.sh | sh
      - name: Run container scan
        run: cs scan --group my-group --strict myapp:latest

General recommendations

• Trunk-based or feature-based development: Fluid Attacks recommends that you add the scanners to trunk-based or feature-based workflows. Thus, scans run only on changed files in a pull request or feature branch, and new vulnerabilities do not get into the codebase.
• Break the build: To stop your CI/CD pipeline when the scanner detects vulnerabilities, use the strict option in your configuration file. For details, read the configuration documentation.
• Handling false positives: If the scanner reports a finding that you think is a false positive, use the exclusions as code feature. Thus, subsequent scans do not report it.

Troubleshooting

For solutions to common errors and issues during the scanning process, read the "Scanner FAQ".