Skip to main content

Vulkro on CircleCI

This job scans the repository, stores SARIF and JUnit reports in the CircleCI UI, and fails on Critical or High findings.

.circleci/config.yml
version: 2.1

jobs:
  vulkro:
    docker:
      - image: cimg/base:current
    steps:
      - checkout
      - run:
          name: Install Vulkro
          command: |
            curl -fsSL https://dist.vulkro.com/install.sh | VULKRO_BIN_DIR="$HOME/.local/bin" bash
            echo 'export PATH="$HOME/.local/bin:$PATH"' >> "$BASH_ENV"
      - run:
          name: Reports
          command: |
            mkdir -p reports
            vulkro scan ci . --format junit > reports/vulkro.junit.xml || true
            vulkro scan ci . --format sarif > reports/vulkro.sarif || true
      - store_test_results:
          path: reports
      - store_artifacts:
          path: reports
      - run:
          name: Gate
          command: vulkro scan ci .

workflows:
  security:
    jobs:
      - vulkro

Set the secret​

Create a CI key in the customer portal (app.vulkro.com, Settings) and add it as a project environment variable (or a context variable) named VULKRO_ACCOUNT_TOKEN. The scan signs in with it, so no vulkro login step is needed. A CI key works during the 14-day trial and on paid plans, and uses no device seat. See CI keys.

What fails the build​

The reports step never fails. The Gate step runs the ci preset, which exits 1 on Critical or High findings (or the [quality_gate] thresholds in vulkro.toml, when you set them).

Exit codeMeaning
0No findings at the gate level
1Findings at the gate level, or no licence (license_required on stderr)
2Error: bad arguments, IO failure

Fail only on new findings​

To fail only on findings a branch adds compared with main, replace the Gate command with vulkro gate:

          command: vulkro gate --base origin/main

Air-gapped runners​

A runner with no route out uses a licence file instead of a CI key. Set VULKRO_LICENSE_B64 to the base64 of your .lic file (base64 -w0 your.lic) and VULKRO_OFFLINE=1, and install from your internal mirror. See Offline mode.

Last updated on