Skip to content

CI/CD Quick Start

Use this guide to add a repeatable PostQ scan to a pipeline. Choose a native runner when Java, OpenGrep, and the CLI are installed on the agent; choose a container runner for a fixed runtime.

Typical time: 15 minutes. Requires a protected file secret for postq.lic and protected report-artifact storage.

1. Choose the runner model

Run the runtime prerequisite profile for a native agent or the container profile for a Docker or Podman agent. Pin the PostQ version used by the pipeline.

2. Install prerequisites

Use your organization's approved runner image or software distribution process. Install the prerequisites for the selected execution model:

Execution model Official installation resources
Native runner Eclipse Temurin installation and OpenGrep installation
Container runner Install Docker Engine or Install Podman

After installation, run the matching supplied pre-install profile. See Prerequisites for supported versions and runner validation commands.

3. Add protected inputs

Configure these pipeline values using the CI product's protected secret and variable controls:

Value Purpose
WORKSPACE Absolute checked-out source directory
POSTQ_LICENSE_FILE Absolute path to the protected license file secret
POSTQ_REPORT_DIR Writable protected output directory
Project name/version Traceable identity stored in generated reports

Do not expose license content in an environment variable, command trace, job log, or build artifact.

For a controlled first run, download the Java Quick Start project and use its extracted directory as the pipeline workspace in a disposable test job.

4. Add the scan job

postq-code-scanner-cli \
  --project "$WORKSPACE" \
  --output "$POSTQ_REPORT_DIR" \
  --name "$PROJECT_NAME" \
  --version "$PROJECT_VERSION" \
  --license-file "$POSTQ_LICENSE_FILE"

docker run --rm \
  --read-only \
  --security-opt no-new-privileges \
  --cap-drop ALL \
  --tmpfs /tmp:rw,nosuid,nodev,size=512m \
  -v "$WORKSPACE:/repo:ro" \
  -v "$POSTQ_REPORT_DIR:/reports:rw" \
  -v "$POSTQ_LICENSE_FILE:/run/secrets/postq.lic:ro" \
  postq-code-scanner-cli:<version> \
  --license-accepted \
  --license-file /run/secrets/postq.lic

5. Retain the report set

Publish the report directory as a protected pipeline artifact. At minimum retain manifest.json, the three primary review reports, and any CBOM or SARIF output consumed downstream. Do not include postq.lic.

6. Confirm pipeline behavior

  • Exit 0 means scan and report generation succeeded.
  • Exit 1 means scanner execution failed.
  • Exit 2 means configuration is invalid.
  • Exit 3 means license validation failed.
  • Findings do not cause a nonzero scanner exit by themselves.

Apply organizational acceptance policy to deterministic report fields in a separate, version-controlled pipeline step.

Next: CI/CD operations and Exit Codes.