CI Gate action

Last updated: Oct 26, 2026

The CI Gate action connects to the Fluid Attacks platform from your GitHub Actions workflows and checks if your repository has open vulnerabilities that Fluid Attacks reported. It is a security gate in your CI/CD pipeline. If you want, it can block merges when there are findings that break your policies.

Marketplace: fluidattacks/ci-gate-action

Setup

1. Store your Group token as a secret

Go to Settings → Secrets and variables → Actions in your repository and create a secret named FA_API_TOKEN with your Group token.

To generate or get the token, go to Organization → Groups → GroupName → DevSecOps in the Fluid Attacks platform. Then, click Manage token. The token is valid for 180 days and must be renewed before it expires.

The Group token is the same credential that Fluid Attacks' scanners use to authenticate (as INTEGRATES_API_TOKEN). For more information, read Authentication.

2. Create the workflow

Add .github/workflows/ci-gate.yml to your repository:

name: Fluid Attacks CI Gate

on:
  push:
  pull_request_target:
    types: [opened, synchronize, reopened]

jobs:
  ci-gate:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: fluidattacks/ci-gate-action@<version>
        id: gate
        with:
          api_token: ${{ secrets.FA_API_TOKEN }}

Replace <version> with the latest release tag. Find it on the Marketplace page.

You must use pull_request_target, not pull_request. When a PR comes from a fork, GitHub does not give secrets to workflows that pull_request starts. Without the secrets, the action cannot authenticate. pull_request_target runs in the context of the base branch and always has access to secrets. This is safe because the action never checks out or runs PR code. If you add actions/checkout before the action, keep its default ref, which is the base branch. Also, set persist-credentials: false, because the action does not use Git credentials.

When repo_name is not set, the action uses the GitHub repository name as the nickname. If your repository has a different nickname on the Fluid Attacks platform, set repo_name explicitly:

with:
  api_token: ${{ secrets.FA_API_TOKEN }}
  repo_name: my-platform-nickname

3. Push and run

Commit the file and push. The check runs automatically on the subsequent push or pull request.

How it works

The action runs the Fluid Attacks CI Gate as a Docker container. In lax mode (default), the job always passes, also when vulnerabilities break the policy. vulnerabilities_found tells you if they break it. In strict mode, the job fails with exit code 66 when vulnerabilities break the policy. In the two modes, the job fails if the gate cannot finish, for example because the token is not correct.

The container runs in the job workspace, mounted as read-only. Thus, it cannot change your files. When report_output_path is set, the container writes the report to a temporary folder, and the action copies it to that path after the container finishes. If the workflow checks out the repository before this step, the gate reads the commit, branch and origin from Git. If not, it gets the commit and branch from GitHub (GITHUB_SHA and GITHUB_REF_NAME).

Action inputs

Action outputs

You can use these outputs in the subsequent workflow steps:

- name: Print result
  if: steps.gate.outputs.vulnerabilities_found == 'true'
  run: echo "Open vulnerabilities found. Review them on the Fluid Attacks platform."

Common scenarios

Strict mode: block merges with open vulnerabilities

Set strict: true to fail the job when the gate finds vulnerabilities that break your policies. With branch protection rules, this prevents merges of vulnerable code:

- uses: fluidattacks/ci-gate-action@<version>
  with:
    api_token: ${{ secrets.FA_API_TOKEN }}
    repo_name: my-repo
    strict: true

Then, in your repository settings, enable Require status checks to pass before merging and select the CI Gate check.

Save the vulnerability report as JSON

Use report_output_path to write the full report to a file. Then, upload it as a workflow artifact:

- uses: fluidattacks/ci-gate-action@<version>
  id: gate
  with:
    api_token: ${{ secrets.FA_API_TOKEN }}
    repo_name: my-repo
    report_output_path: fa-report.json

- name: Upload report
  if: always()
  uses: actions/upload-artifact@v4
  with:
    name: fluid-attacks-report
    path: ${{ steps.gate.outputs.report_output_path }}

Lax mode with conditional failure

Run in lax mode, but fail the job manually from the output:

- uses: fluidattacks/ci-gate-action@<version>
  id: gate
  with:
    api_token: ${{ secrets.FA_API_TOKEN }}
    repo_name: my-repo

- name: Fail if vulnerabilities found
  if: steps.gate.outputs.vulnerabilities_found == 'true'
  run: exit 1

Troubleshooting

The action fails with an authentication error

Make sure that your Group token is correct and did not expire. Tokens are valid for 180 days. To renew it, go to Organization → Groups → GroupName → DevSecOps in the platform and click Manage token. Update the FA_API_TOKEN secret in your repository with the new token.

You see an error saying the repository has not been registered, or is inactive

Make sure that repo_name is the same as the nickname registered in the Fluid Attacks platform. When repo_name is not set, the action gets it from the GitHub repository name. This name can be different from the nickname on the platform. To correct the difference, set repo_name explicitly.

The action reports no vulnerabilities but I expect some

Make sure that the repo_name input is the same as the repository nickname configured in the Fluid Attacks platform. If they are different, the gate queries the incorrect repository and returns no findings.

The pipeline fails unexpectedly

If strict: true is set, the job fails with exit code 66 each time that the gate finds vulnerabilities that break your policies. This is intentional. Set strict: false if you want the check to report results without a pipeline failure.

All other non-zero exit codes mean that the check did not finish. The log shows the reason as an error. CI Gate failed with exit code followed by the code comes from the gate: check the token, the repo_name input and the network access to the Fluid Attacks platform. Exit code 2 with must be a single line or must be a file path inside the workspace shows a problem with the repo_name or report_output_path inputs.

The action fails on a non-Linux runner

The action requires Docker, which is available only on Linux-hosted runners. Make sure that your workflow uses runs-on: ubuntu-latest or another Linux runner. The step must also run directly on the runner, not inside a job container (jobs.<job_id>.container), because the action mounts the workspace into its own container.

See the Marketplace page for all the configuration options and more troubleshooting.