Run Octopoda scans in CI with the CLI

Run an Octopoda code scan from GitHub Actions or another CI system with OCTOPODA_TOKEN, and fail the build when a serious finding is proven.

You can run the Octopoda CLI in any CI system to scan your code on every build and fail the build when a serious issue is proven. On GitHub, pull request checks do this without any CI setup and use 1 credit per scan instead of 5; use the CLI in CI when you need a full code scan, or a CI system other than GitHub.

​

Get a token

The CLI reads a token from the OCTOPODA_TOKEN environment variable instead of a saved sign-in. To get one:

1. Create the token

   In the web app, go to Settings → CLI sessions and select Create CI token. Give it a name you will recognize, such as the repository and CI system, and select Create token.

2. Copy it now

   The token is shown only once. Copy it before you close the dialog.

3. Store it as a CI secret

   Add it to your CI system as a secret named OCTOPODA_TOKEN. Never commit it to the repository.

The token acts as you, in the account you were in when you created it, until you revoke it. It is listed on Settings → CLI sessions with the other sessions, where you can see when it was last used and select Revoke.

​

Example: GitHub Actions

.github/workflows/octopoda.yml

name: Octopoda
on:
  push:
    branches: [main]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install the Octopoda CLI
        run: |
          curl -fsSL https://get.octopoda.dev | OCTOPODA_INSTALL_DIR="$HOME/.local/bin" sh
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
      - name: Scan
        env:
          OCTOPODA_TOKEN: ${{ secrets.OCTOPODA_TOKEN }}
        run: octopoda scan --fail-on high

The scan step waits for the scan to finish, which can take up to 30 minutes, and prints each finding in the build log.

​

Exit codes

Code	When
0	The scan finished, and no finding is at or above the --fail-on level.
1	The scan failed, a finding is at or above the --fail-on level, or the scan could not start (for example, not enough credits).
2	The command line was not valid, for example an unknown flag.

Without --fail-on, a finished scan exits with 0 whatever it finds. To start a scan without waiting for it, add --no-wait.