Pipeline
Pipeline compliance scanner
Prerequisites
- Node.js 20+
- npm, yarn, or pnpm
- GitHub or GitLab repository
Quick Start
Three steps. Under five minutes.
Install
npm install -g @cveriskpilot/scanScan
npx crp-scan --preset startupReview
Findings are classified locally (actionable, needs review, auto-dismissed). With an API key, every scan is uploaded, even one with no findings: findings and cases appear on the dashboard (the CLI prints a link to the upload), the pass/fail verdict appears on the Pipelines page, and findings a newer scan of the same repository no longer reports move to verification. Compliance results are mapped automatically to NIST 800-53, CMMC, SOC 2, FedRAMP, ASVS, and SSDF.
CLI Options
| Flag | Description |
|---|---|
--preset startup | Map findings to SOC 2 and ASVS |
--preset enterprise | Map to NIST 800-53, SOC 2, ASVS and SSDF |
--frameworks nist | Map to specific frameworks (comma-separated) |
--severity HIGH | Minimum severity threshold |
--format json | Output format (json, table, sarif, markdown) |
--exclude <glob> | Exclude paths from the secrets and IaC scanners (repeatable); findings under newly excluded paths close as fixed |
--ci | CI mode (non-interactive, exit code on failures) |
--client <id|name> | Client to upload into (or CRP_CLIENT); needed when your organization has several |
--asset <name> | Asset the scan covers (default: the repository as host/owner/repo) |
--fail-on-upload-error | Exit with code 3 when nothing reaches the dashboard |
--save-profile | Save these options to .cveriskpilot.json in the project |
rerun [dir] | Scan again with the saved profile (or the last run's options) and upload |
GitHub Actions Integration
Add this workflow to your repository at .github/workflows/compliance.yml
Option 1: GitHub Action (recommended)
Scans your code, posts a compliance summary as a PR comment, and fails the check on severity threshold.
# CVERiskPilot Compliance Scan with PR Comment
name: Compliance Scan
on:
pull_request:
push:
branches: [main]
jobs:
compliance:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: devbrewster/cveriskpilot-scan/action@main
with:
preset: 'startup'
fail-on: 'critical'
# upload from pushes to main only, never pull requests
api-key: ${{ github.event_name == 'push' && secrets.CRP_API_KEY || '' }}
# only when your organization has several clients
client: 'Acme Production'Option 2: npx (manual setup)
Run the CLI directly if you want full control over the workflow steps.
name: Compliance Scan
on:
pull_request:
push:
branches: [main]
jobs:
compliance:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: '20'
- run: npx @cveriskpilot/scan@latest --ci --preset startup
env:
# upload from pushes to main only, never pull requests
CRP_API_KEY: ${{ github.event_name == 'push' && secrets.CRP_API_KEY || '' }}
CRP_CLIENT: Acme ProductionWhere results appear
- Dashboard. Each upload shows its findings, the cases they belong to, and the repository, commit and branch it came from. The CLI prints the link on stderr.
- Pipelines. The pass/fail verdict against your pipeline policy for each CLI or CI scan.
- Fixed findings. When a newer scan of the same asset and scanners no longer reports a finding, it is marked resolved and its case moves to Fixed, pending verification for a person to confirm. Scans with no findings are uploaded for this reason.
- Which builds upload. Upload scans of the code you ship: pushes to the default branch and scheduled scans. A pull request scans code that is not merged; uploaded, it could close a default-branch finding it happens to fix, or open cases for code that never merges. The workflows above pass the API key on pushes to main only, so pull requests still get the check and the comment without touching the dashboard.
- Re-runs. Save the options once with
--save-profileand runcrp-scan rerunto scan and upload again. See the CLI reference for profiles and precedence.
What Gets Scanned
Dependencies (SBOM)
npm, yarn, pnpm lockfiles
Secrets
API keys, tokens, credentials in source
Infrastructure as Code
Terraform, CloudFormation, Docker
Auto-Triage
Every finding is automatically classified to cut through noise.
Compliance Mapping
Each finding maps through CWE to NIST 800-53 to framework controls. One vulnerability, multiple compliance impacts surfaced automatically.
| Finding | CWE | NIST 800-53 | SOC 2 | CMMC |
|---|---|---|---|---|
| SQL Injection | CWE-89 | SI-10 | CC6.8 | SI.L2-3.14.1 |
| XSS | CWE-79 | SI-10 | CC6.8 | SI.L2-3.14.1 |
| Hardcoded Secret | CWE-798 | IA-5 | CC6.1 | IA.L2-3.5.3 |
Next Steps
GitHub Action
Use the hosted action path for pull-request and CI workflow coverage.
Open pageStart Audit Readiness trial
Create a workspace and move from local scans into hosted API workflows with a 14-day Audit Readiness trial.
Start Audit Readiness trialManage keys
Review the org-owned key model, usage visibility, and hosted access flow.
Manage keys