Running in CI

In CI there is no browser and no terminal to prompt in. Set a token, pass --repo, and use exit codes rather than reading output.

GitHub Actions

name: cefense
on:
  push:
    branches: [main]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - run: npm install -g @cefense-npm/cefense-cli
      - name: Scan
        env:
          CEFENSE_TOKEN: ${{ secrets.CEFENSE_TOKEN }}
        run: |
          cf scan --repo ${{ github.repository }} --wait
          cf reproduced --repo ${{ github.repository }} --severity critical,high --exit-code

The three things that make it work

CEFENSE_TOKENenvironmentrequired

Read straight from the environment, never written to disk. Keep it in your CI provider's secret store.

--repo owner/nameflagrequired

Skips directory resolution entirely, which cannot prompt in CI.

--waitflag

Blocks until the scan settles, so the next step reads a finished scan rather than an empty one.

Failing the build

cf reproduced --repo acme/api --severity critical,high --exit-code

Other providers

cefense:
  image: node:22
  script:
    - npm install -g @cefense-npm/cefense-cli
    - cf scan --repo $CI_PROJECT_PATH --wait
    - cf reproduced --repo $CI_PROJECT_PATH --severity critical,high --exit-code

What not to automate