> ## Documentation Index
> Fetch the complete documentation index at: https://docs.octopoda.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Run Octopoda scans in CI with the CLI

> Run an Octopoda code scan from GitHub Actions or another CI system with OCTOPODA_TOKEN, and fail the build when a serious finding is proven.

You can run the Octopoda CLI in any CI system to scan your code on every build and fail the build when a serious issue is proven. On GitHub, [pull request checks](https://docs.octopoda.dev/scanning/pull-request-checks.md) do this without any CI setup and use 1 credit per scan instead of 5; use the CLI in CI when you need a full code scan, or a CI system other than GitHub.

## Get a token

The CLI reads a token from the `OCTOPODA_TOKEN` environment variable instead of a saved sign-in. To get one:

**1. Create the token**

In the web app, go to **Settings → CLI sessions** and select **Create CI token**. Give it a name you will recognize, such as the repository and CI system, and select **Create token**.

**2. Copy it now**

The token is shown only once. Copy it before you close the dialog.

**3. Store it as a CI secret**

Add it to your CI system as a secret named `OCTOPODA_TOKEN`. Never commit it to the repository.

The token acts as you, in the account you were in when you created it, until you revoke it. It is listed on **Settings → CLI sessions** with the other sessions, where you can see when it was last used and select **Revoke**.

## Example: GitHub Actions

```yaml .github/workflows/octopoda.yml theme={null}
name: Octopoda
on:
  push:
    branches: [main]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install the Octopoda CLI
        run: |
          curl -fsSL https://get.octopoda.dev | OCTOPODA_INSTALL_DIR="$HOME/.local/bin" sh
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
      - name: Scan
        env:
          OCTOPODA_TOKEN: ${{ secrets.OCTOPODA_TOKEN }}
        run: octopoda scan --fail-on high
```

The scan step waits for the scan to finish, which can take up to 30 minutes, and prints each finding in the build log.

## Exit codes

| Code | When |
| - | - |
| `0` | The scan finished, and no finding is at or above the `--fail-on` level. |
| `1` | The scan failed, a finding is at or above the `--fail-on` level, or the scan could not start (for example, not enough credits). |
| `2` | The command line was not valid, for example an unknown flag. |

Without `--fail-on`, a finished scan exits with `0` whatever it finds. To start a scan without waiting for it, add `--no-wait`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.