The Safeguard CLI is plain shell, so it runs in any CI system that can execute a command. The documentation shows four setups: GitHub Actions and Azure DevOps use SARIF output, GitLab CI keeps the scan folder as an artifact, and Jenkins archives a JSON file. There is no published pipeline plugin yet.
Two ways to connect CI
The CI/CD documentation describes two models:
- Connect the repository. The platform scans it and evaluates policies and gates. Nothing runs in your pipeline.
- Run the CLI in the job. The scan and detect commands run on the build machine and write results you keep as artifacts or send to a code scanning view.
The docs say no GitHub Action, container image or pipeline plugin exists for the CLI yet, so the second model means a few shell lines in each pipeline. You can use both models at once.
What the job needs
Every setup shares the same steps: install the CLI, run a command, keep the output. The scan command also needs two scanner tools, syft and grype, on the PATH. On a fresh runner, either install them or set the tools directory variable to a folder that holds them.
Install, with the version pinned:
curl -fsSL https://cli.safeguard.sh/install | SAFEGUARD_VERSION=VERSION_HERE bash
GitHub Actions
The documented example runs the detect command with SARIF output and uploads the file with the standard CodeQL upload action. The job needs the security events write permission.
safeguard detect --format sarif --output safeguard.sarif
Findings then show up in the repository's code scanning view. Detect covers secrets and misconfigurations, not dependency vulnerabilities.
GitLab CI
The example runs the scan command in the test stage on an Ubuntu image, installs curl first, and stores the results folder as a job artifact.
safeguard scan --dir . --output safeguard-results
Remember that syft and grype must be on the PATH inside that image.
Jenkins
The Jenkins example installs the CLI, runs detect with JSON output and archives the file.
safeguard detect --format json --output detect.json
Archiving the file lets reviewers open it from the build page.
Azure DevOps
The Azure example writes the SARIF file into the build artifact staging directory:
safeguard detect --format sarif --output $(Build.ArtifactStagingDirectory)/safeguard.sarif
Which output format to choose
- SARIF is the right choice when your platform has a code scanning view that reads it.
- JSON suits custom scripts and dashboards.
- A scan output folder suits anything that needs the SBOM and the vulnerability file, such as a jq gate.
Failing the build
The CLI reports but does not fail on findings, and the docs say enforcement comes from platform policy gates. If you want to stop a build locally, add a check on the output file. Our post on jq gates shows one.
Quick check
Is there an official GitHub Action for the Safeguard CLI?
Not according to the CI documentation, which says no published action, container image or pipeline plugin exists yet. Use the shell steps shown there.
Why does detect not show dependency vulnerabilities?
Detect looks for secrets and misconfigurations. Use the scan command for dependencies.
For a no-setup comparison, the free scan at gold.safeguard.sh/scan works in a browser.
Sources
Last reviewed: 19 October 2026.
