CI/CD integration

Run a pentest from GitHub Actions and fail the check if it discovers critical vulnerabilities. This example runs nightly or on demand.

1. Configure credentials and targets

Add these values to your GitHub repository:

Name	Type	Value
`ANTIGEN_API_KEY`	Repository secret	An Antigen API key.
`ANTIGEN_TARGET`	Repository variable	An approved target, such as `api.example.com`.

The CLI authenticates with the API key automatically. See Targets if you haven’t submitted your target for approval.

2. Add the pentest script

Create scripts/pentest.sh:

#!/usr/bin/env bash
set -euo pipefail

: "${ANTIGEN_API_KEY:?Set ANTIGEN_API_KEY}"
: "${ANTIGEN_TARGET:?Set ANTIGEN_TARGET}"

antigen run \
  --targets "$ANTIGEN_TARGET" \
  --quiet \
  --json > results.json

jq -e 'all(.[]; .severity != "critical")' results.json

antigen run waits until testing completes. --quiet suppresses activity, and --json writes the vulnerabilities to results.json. The last command checks every vulnerability. It exits successfully if none are critical and fails otherwise. If the run itself fails or stops, the script exits before checking results. To include your repository’s skills, add --skills ./skills/ to the run command.

3. Configure GitHub Actions

Create .github/workflows/security.yml:

name: Security

on:
  schedule:
    - cron: "0 2 * * *"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: antigen-security
  cancel-in-progress: false

jobs:
  pentest:
    runs-on: ubuntu-latest
    timeout-minutes: 350

    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v7
        with:
          node-version: 24
          package-manager-cache: false

      - name: Install the CLI
        run: npm install -g @antigen/cli

      - name: Run pentest
        run: bash scripts/pentest.sh
        env:
          ANTIGEN_API_KEY: ${{ secrets.ANTIGEN_API_KEY }}
          ANTIGEN_TARGET: ${{ vars.ANTIGEN_TARGET }}

      - name: Save results
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: pentest-results
          path: results.json
          if-no-files-found: ignore

The schedule runs at 02:00 UTC. You can also start it manually from the repository’s Actions tab.

Work with the results

The workflow saves results.json as a job artifact. You can download it to inspect the vulnerabilities or process it with other tools:

jq '.[] | select(.severity == "critical")' results.json

Vulnerabilities and evidence are also available in the Antigen platform. For testing after a production deployment, see the SDK example.

Getting started

Asset Map

Runs

Vulnerability Lifecycle

Team Workflows

SDK

CLI

Integrations

1. Configure credentials and targets

2. Add the pentest script

3. Configure GitHub Actions

Work with the results

​1. Configure credentials and targets

​2. Add the pentest script

​3. Configure GitHub Actions

​Work with the results

1. Configure credentials and targets

2. Add the pentest script

3. Configure GitHub Actions

Work with the results