Integration access, with the fine print

Ranked findings summary as a PR comment, updated in place on later runs — never one duplicate review per push. A check run adds inline annotations at each finding's line, chunked to GitHub's 50-annotation limit.

Enable

ciphermap ci-review --provider github (auto-detects repo and PR inside Actions)

Credential

GITHUB_TOKEN with pull-requests: write, plus checks: write for annotations. A 403 names the missing permission in the error.

Fails the build?

Provider and command errors exit nonzero. Findings alone fail only when blocking mode's severity gate trips.

The same summary as an MR note, updated in place on later pipeline runs.

Enable

ciphermap ci-review --provider gitlab (auto-detects inside GitLab CI)

Credential

Token with the api scope, Developer role or above. The job token deliberately isn't used — it cannot post MR notes.

Fails the build?

Provider and command errors exit nonzero. Findings alone fail only when blocking mode's severity gate trips.

Summary as a PR thread, updated in place. Created closed — an active thread would block PR completion under common branch policies until someone resolves the bot.

Enable

ciphermap ci-review --provider azure (auto-detects inside Azure Pipelines)

Credential

PAT with Code (Read & Write), or the pipeline's $(System.AccessToken) — both auth shapes handled automatically.

Fails the build?

Provider and command errors exit nonzero. Findings alone fail only when blocking mode's severity gate trips.

Summary as a PR comment, updated in place. Bitbucket Cloud only — Server/Data Center is a different API and is not claimed.

Enable

ciphermap ci-review --provider bitbucket (auto-detects inside Bitbucket Pipelines)

Credential

Access token with pullrequest:write, or username:app-password.

Fails the build?

Provider and command errors exit nonzero. Findings alone fail only when blocking mode's severity gate trips.

Free SARIF 2.1.0 output with stable fingerprints, rule metadata, and tool-notification records. Keep upload and policy separate from the free --fail-on exit-code gate so finding delivery cannot change the scan verdict.

Enable

ciphermap scan . --format sarif -o results.sarif, then upload-sarif — or the GitHub Action, which does both.

Credential

None for CipherMap; the workflow's upload step needs security-events: write.

Fails the build?

No — the gate is --fail-on's exit code, kept separate on purpose.

Generated templates for GitHub Actions, GitLab CI, Jenkins, Azure Pipelines and Bitbucket Pipelines, plus a composite GitHub Action and pre-commit hook. These package the free scanner gate without adding provider-side PR automation.

Enable

Generate a provider template with ciphermap init --ci. The Action must be vendored until its public marketplace handle is published.

Credential

security-events: write for the SARIF upload; a license secret only for paid profiles.

Fails the build?

Yes, by design — that is the point of a gate.

Creates a ticket per new finding, skips findings with an open ticket, comments when a resolved ticket's finding reappears. Never reopens or closes — ticket state is a human decision. Identity is the same fingerprint SARIF publishes, so triage agrees across both.

Enable

ciphermap jira . --jira-url … --jira-project SEC — dry-run by default, --apply to write. Severity gate and per-run cap, both reported when they suppress.

Credential

Cloud: email + API token. Data Center: a PAT.

Fails the build?

Command or synchronization errors exit nonzero; finding presence alone is not a build gate.

A Block Kit summary card to an incoming webhook, gated by severity so a channel is not trained to mute it. A clean scan says so; nothing fires below the threshold.

Enable

ciphermap scan . --webhook-url … --webhook-on high, or CIPHERMAP_SLACK_WEBHOOK.

Credential

The webhook URL is the credential; CipherMap redacts it from every error it prints.

Fails the build?

No — a notification failing should not fail a build.

Scan logs and metrics as OTLP JSON — severityNumber on every record, real instrument types, payloads verified against the collector's own unmarshaller in tests. A slow collector can delay a scan by at most the 800 ms delivery budget.

Enable

CIPHERMAP_OTEL_ENDPOINT=http://collector:4318

Credential

OTEL_EXPORTER_OTLP_HEADERS — the OpenTelemetry standard, so an already-configured runner needs nothing CipherMap-specific.

Fails the build?

No.

Uploads the CycloneDX CBOM to /api/v1/bom. Non-CycloneDX formats are refused before any network call — the endpoint does not ingest SPDX or OpenVEX, and a silent 4xx would read as success.

Enable

ciphermap cbom . --push-url … --api-key … --project-id <uuid>

Credential

X-Api-Key with BOM upload permission.

Fails the build?

Yes, on error — a compliance artifact that failed to land must be visible.

sonar.sarifReportPaths ingests our SARIF — no exporter needed. Structural conformance to SonarQube's documented import contract is pinned by test; live ingestion has not been exercised and is not claimed.

Enable

sonar-scanner -Dsonar.sarifReportPaths=ciphermap.sarif

Credential

Your scanner's own.

Fails the build?

No.

The fleet server exposes /metrics (readiness score, scans processed, repos monitored) and an SVG readiness badge per repo.

Enable

Run ciphermap server; mint one repository ingest token with ciphermap server --mint-ingest-token owner/repository; scrape /metrics with the admin credential.

Credential

Server-only ingest signing key; repository-scoped CI write tokens; admin bearer token for metrics; separately-revocable badge token. Only the badge token is accepted in a query string.

Fails the build?

n/a