Skip to content

CI/CD

Use the CLI or container runner for non-interactive scans. Pin the PostQ product version, keep the license in the CI secret store as a file, and retain the complete report directory as a protected pipeline artifact.

Native runner example

postq-code-scanner-cli \
  --project "$CI_PROJECT_DIR" \
  --output "$CI_PROJECT_DIR/postq-reports" \
  --name "$CI_PROJECT_NAME" \
  --version "$CI_COMMIT_REF_NAME" \
  --license-file "$POSTQ_LICENSE_FILE"

Use your CI product's protected file-secret mechanism for POSTQ_LICENSE_FILE. Do not print the file content or include it in the report artifact.

Container runner pattern

docker run --rm \
  --read-only \
  --security-opt no-new-privileges \
  --cap-drop ALL \
  --tmpfs /tmp:rw,nosuid,nodev,size=512m \
  -v "$CI_PROJECT_DIR:/repo:ro" \
  -v "$CI_PROJECT_DIR/postq-reports:/reports:rw" \
  -v "$POSTQ_LICENSE_FILE:/run/secrets/postq.lic:ro" \
  postq-code-scanner-cli:<version> \
  --license-accepted \
  --license-file /run/secrets/postq.lic

Define pipeline policy explicitly

Scanner exit codes describe execution, not security acceptance. A successful scan that contains high-risk evidence still exits 0. If the pipeline must enforce an organizational threshold, parse the deterministic assessment or SARIF output in a separate, version-controlled policy step. Record the policy version beside the retained report set.

Retain these artifacts

  • manifest.json for traceability and warnings;
  • the three primary review reports for investigation;
  • results.sarif when a code-scanning platform consumes SARIF;
  • cbom.json when inventory or governance systems consume CBOM;
  • raw OpenGrep results only when evidence retention and troubleshooting policy require them.

Do not publish reports to an unrestricted build-artifact location. They can contain source paths, code excerpts, algorithm names, and security findings.

Operational recommendations

  • Scan immutable checkout content.
  • Keep source read-only and output writable.
  • Pin the scanner image by approved tag or digest.
  • Preserve /reports/.postq/ for container license ledger continuity.
  • Record product version, report schemaVersion, commit identity, and pipeline policy version.
  • Redact license paths and secrets from shared logs.