MAGDOX Code Security documentation

CI integration

Scanning in pipelines, gating on new findings and publishing reports as artefacts.

Status: Preview

In CI the CLI runs on the pipeline runner with a scoped token. The scan happens on the runner, the findings go to the dashboard, the local report becomes a build artefact, and the exit code decides whether the build passes.

Generic step

bashplaceholder
export MAGDOX_TOKEN="$MAGDOX_CI_TOKEN"
magdox scan --yes --baseline main --fail-on high
status=$?
# publish ./magdox-report as a build artefact
exit $status   # 4 means new findings at or above high

GitHub Actions

yamlplaceholder
- uses: magdox/setup-cli@v1
- name: MAGDOX Code Security
  env:
    MAGDOX_TOKEN: ${{ secrets.MAGDOX_CI_TOKEN }}
  run: magdox scan --yes --baseline main --fail-on high
- uses: actions/upload-artifact@v4
  if: always()
  with:
    name: magdox-report
    path: magdox-report
- uses: github/codeql-action/upload-sarif@v3
  if: always()
  with:
    sarif_file: magdox-report/findings.sarif

GitLab CI

yamlplaceholder
magdox_scan:
  image: magdox/magdox:latest
  script:
    - magdox scan --yes --baseline main --fail-on high
  artifacts:
    when: always
    paths: [magdox-report/]

Gating

--fail-on compares against the baseline, so a pull request fails only for findings it introduced. Thresholds can be pinned by the organisation so individual pipelines cannot weaken them.

ConfigurationData and deployment