Safeguard's documentation has CI examples for GitHub Actions, GitLab CI, Jenkins and Azure DevOps. It does not mention CircleCI. The CLI is a single static binary with a curl installer, so the same steps should work, but treat this as an adaptation that you test yourself.
What is and is not documented
The CI/CD integration page does not list CircleCI, and no pipeline plugin or orb exists for the CLI. What the documentation does say is general: the CLI scans from a terminal or a pipeline, installs with one command, and has no runtime dependencies. Anything below that goes beyond those statements is our reading of how CircleCI works, not a tested Safeguard feature.
A sketch of the config
version: 2.1
jobs:
safeguard-detect:
docker:
- image: cimg/base:stable
steps:
- checkout
- run:
name: Install Safeguard CLI
command: |
export SAFEGUARD_VERSION="<version from the download page>"
curl -fsSL https://cli.safeguard.sh/install | bash
- run:
name: Detect
command: safeguard detect --path . --format sarif --output safeguard.sarif
- store_artifacts:
path: safeguard.sarif
workflows:
scan:
jobs:
- safeguard-detect
The image name is a placeholder for whatever base image you already use. Check that curl and ca-certificates are present in it. The install step needs outbound network access to the installer host.
How CircleCI keeps the file
CircleCI's store_artifacts step takes a path and an optional destination. It has a when setting with on_success, on_fail and always. Artifacts are kept for 30 days by default and individual files can be up to 3 GB, per CircleCI's documentation. Use always if you want results from runs that failed elsewhere.
Things to verify before you rely on it
Run the job on a throwaway branch and confirm four things. The installer puts the binary on the PATH of that image. The detect command exits zero. The artifact appears in the job. And, if you use scan instead of detect, that syft and grype are present, as covered in the scanner prerequisite post.
When to skip the job
If your code lives on GitHub, GitLab, Bitbucket or another connected host, you can connect the repository to Safeguard and skip the job entirely. That avoids maintaining the install step, and platform policies still apply.
Why we are cautious
A recipe that looks right and fails at the install step wastes an afternoon, and a recipe that silently skips vulnerability matching is worse, because it gives false comfort. That is why this post stays close to what the documentation states and marks the rest as untested. If you try it and it works, keep the throwaway branch job as a canary: run it weekly and alert when it breaks.
Quick check
Is CircleCI officially supported?
It is not listed in the documented examples. Test the adaptation yourself and confirm with Safeguard support if you need a statement.
Is there a CircleCI orb?
The documentation says no pipeline plugin is published for the CLI.
Sources
Last reviewed: 19 October 2026.
