Safeguard documents CI examples for GitHub Actions, GitLab CI, Jenkins and Azure DevOps, all using the CLI. CircleCI is not documented. There is no published Safeguard GitHub Action, container image or pipeline plugin yet. You can also skip CI entirely by connecting the repository.
Which systems have documented examples?
Four. GitHub Actions runs detect with SARIF output and uploads it to code scanning. GitLab CI runs scan and saves a results folder as an artifact. Jenkins runs detect with JSON output and archives it. Azure DevOps runs detect with SARIF output into the artifact staging directory. Recipes: GitHub, GitLab, Jenkins, Azure DevOps.
What about CircleCI?
Not in the documentation. The CLI is a static binary with a curl installer, so an adaptation is plausible, but test it yourself. See the CircleCI adaptation.
Is there an official GitHub Action?
No. The documentation says no published Action, container image or pipeline plugin exists for the CLI. It mentions a dependency gate that is built but not yet published as an Action or npm package.
Can the CLI fail my build on findings?
No. It has no severity threshold flag, and a scan that runs exits zero. Enforcement is through platform policy gates. Details in the gating post.
Do I have to use CI at all?
No. Connect the repository as an integration and the platform scans it and evaluates policies and gates, with nothing in the pipeline. See the decision guide.
What operating systems does the CLI run on?
macOS and Linux on amd64 and arm64, and Windows on amd64, per the CLI site. The install is a curl command on macOS and Linux and a PowerShell command on Windows. npm is listed as coming soon.
What does the scan need on the runner?
Scan needs syft and grype. See that post.
How should I authenticate in CI?
The pages we read do not document an API key for CI, and say there is no such variable. Ask Safeguard support for the supported method for unattended jobs.
How this FAQ was checked
Every statement above comes from Safeguard's CI/CD documentation, the CLI documentation and the download page as read on 19 October 2026. Documentation changes, so recheck the pages in the sources before you commit a pipeline design. Where a page was silent, this post says so.
Quick check
Is Bitbucket Pipelines covered?
Not in the documented examples. Bitbucket repositories can be connected as an integration, which needs no pipeline step.
Where do I try it without any pipeline?
Use the free scan at https://gold.safeguard.sh/scan, or install the CLI from the download page.
Sources
- Safeguard docs: CI/CD Integration
- Safeguard CLI site
- Safeguard docs: CLI system configuration
- Safeguard download page
Last reviewed: 19 October 2026.
