CI Gate action

Last updated: Oct 6, 2026

The CI Gate action connects to the Fluid Attacks platform from your GitHub Actions workflows and checks whether your repository has open vulnerabilities reported by Fluid Attacks. It acts as a security gate in your CI/CD pipeline, optionally blocking merges when policy-breaking findings are present.

Marketplace: fluidattacks/ci-gate-action

Setup

1. Store your Group token as a secret

Go to Settings → Secrets and variables → Actions in your repository and create a secret named FA_API_TOKEN with your Group token.

To generate or retrieve the token, go to Organization → Groups → GroupName → DevSecOps in the Fluid Attacks platform and click Manage token. The token is valid for 180 days and must be renewed before it expires.

The Group token is the same credential Fluid Attacks' scanners use to authenticate (as INTEGRATES_API_TOKEN). See Authentication.

2. Create the workflow

Add .github/workflows/ci-gate.yml to your repository:

name: Fluid Attacks CI Gate

on:
  push:
  pull_request_target:
    types: [opened, synchronize, reopened]

jobs:
  ci-gate:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: fluidattacks/ci-gate-action@<version>
        id: gate
        with:
          api_token: ${{ secrets.FA_API_TOKEN }}

Replace <version> with the latest release tag. Find it on the Marketplace page.

pull_request_target is required instead of pull_request because GitHub withholds secrets from workflows triggered by pull_request when the PR originates from a fork, which would prevent the action from authenticating. pull_request_target runs in the base branch context and always has access to secrets. This is safe because the action never checks out or executes any PR code. If you add actions/checkout before the action, keep its default ref, which is the base branch, and set persist-credentials: false, since the action needs no Git credentials.

When repo_name is not set, the action uses the GitHub repository name as the nickname. If your repository is registered under a different nickname on the Fluid Attacks platform, set repo_name explicitly:

with:
  api_token: ${{ secrets.FA_API_TOKEN }}
  repo_name: my-platform-nickname

3. Push and run

Commit the file and push. The check runs automatically on the next push or pull request.

How it works

The action runs the Fluid Attacks CI Gate as a Docker container. In lax mode (default), the job passes even when vulnerabilities break policy, and vulnerabilities_found tells you whether they did. In strict mode, the job fails with exit code 66 when they do. In both modes, the job fails if the gate cannot finish, for example because the token is invalid.

The container runs in the job workspace, mounted read-only, so it cannot change your files. When report_output_path is set, the container writes the report to a temporary folder, and the action copies it to that path once the container finishes. If the workflow checks out the repository before this step, the gate reads the commit, branch and origin from Git. Otherwise, it takes the commit and branch from GitHub (GITHUB_SHA and GITHUB_REF_NAME).

Action inputs

Action outputs

You can use these outputs in subsequent workflow steps:

- name: Print result
  if: steps.gate.outputs.vulnerabilities_found == 'true'
  run: echo "Open vulnerabilities found. Review them on the Fluid Attacks platform."

Common scenarios

Strict mode: block merges with open vulnerabilities

Set strict: true to fail the job when policy-breaking vulnerabilities are found. Combined with branch protection rules, this prevents vulnerable code from being merged:

- uses: fluidattacks/ci-gate-action@<version>
  with:
    api_token: ${{ secrets.FA_API_TOKEN }}
    repo_name: my-repo
    strict: true

Then, in your repository settings, enable Require status checks to pass before merging and select the CI Gate check.

Save the vulnerability report as JSON

Use report_output_path to write the full report to a file, then upload it as a workflow artifact:

- uses: fluidattacks/ci-gate-action@<version>
  id: gate
  with:
    api_token: ${{ secrets.FA_API_TOKEN }}
    repo_name: my-repo
    report_output_path: fa-report.json

- name: Upload report
  if: always()
  uses: actions/upload-artifact@v4
  with:
    name: fluid-attacks-report
    path: ${{ steps.gate.outputs.report_output_path }}

Lax mode with conditional failure

Run in lax mode but fail the job manually based on the output:

- uses: fluidattacks/ci-gate-action@<version>
  id: gate
  with:
    api_token: ${{ secrets.FA_API_TOKEN }}
    repo_name: my-repo

- name: Fail if vulnerabilities found
  if: steps.gate.outputs.vulnerabilities_found == 'true'
  run: exit 1

Troubleshooting

The action fails with an authentication error

Verify that your Group token is correct and has not expired. Tokens are valid for 180 days. To renew it, go to Organization → Groups → GroupName → DevSecOps in the platform and click Manage token. Update the FA_API_TOKEN secret in your repository with the new token.

You see an error saying the repository has not been registered, or is inactive

Ensure that repo_name matches the nickname registered in the Fluid Attacks platform exactly. When repo_name is not set, the action derives it from the GitHub repository name, which may differ from the nickname on the platform. Set repo_name explicitly to resolve the mismatch.

The action reports no vulnerabilities but I expect some

Confirm that the repo_name input matches the repository nickname configured in the Fluid Attacks platform exactly. A mismatch causes the gate to query the wrong repository and return no findings.

The pipeline fails unexpectedly

If strict: true is set, the job fails with exit code 66 whenever policy-breaking vulnerabilities are found. This is intentional. Set strict: false if you want the check to report results without failing the pipeline.

Any other non-zero exit code means the check did not finish, and the log shows the reason as an error. CI Gate failed with exit code followed by the code comes from the gate: check the token, the repo_name input and the network access to the Fluid Attacks platform. Exit code 2 with must be a single line or must be a file path inside the workspace points to the repo_name or report_output_path inputs.

The action fails on a non-Linux runner

The action requires Docker, which is only available on Linux-hosted runners. Make sure your workflow uses runs-on: ubuntu-latest or another Linux runner. The step must also run directly on the runner, not inside a job container (jobs.<job_id>.container), because the action mounts the workspace into its own container.

See the Marketplace page for all configuration options and additional troubleshooting.