CypherScan Agent integration

GitHub Actions CI/CD

Scan build, release, or deployment artifacts during GitHub Actions and feed the completed result into the same CypherScan Agent attention pipeline used by your other monitored sources.

Create API key Open Agent

Setup

STEP 1

Create an API key

Generate a CypherScan API key from your dashboard.

STEP 2

Create a GitHub secret

Add the key to your repository as the CYPHERSCAN_API_KEY Actions secret.

STEP 3

Add the workflow

Add a CypherScan workflow under .github/workflows and choose the artifact you want to scan.

STEP 4

Scan the artifact

The workflow presigns, uploads, and scans the artifact through the canonical CypherScan API.

STEP 5

Submit the CI/CD event

Attach the completed scanId to the GitHub Actions pipeline through the CI/CD Agent endpoint.

STEP 6

Review Agent

The pipeline appears as a CI/CD asset with observations, changes, and attention decisions.

Required GitHub secret

Repository Settings
→ Secrets and variables
→ Actions
→ New repository secret

Name:
CYPHERSCAN_API_KEY

Workflow sequence

1. POST /api/v1/upload/presign
2. PUT the artifact to the returned upload URL
3. POST /api/v1/scan with objectKey
4. Read the returned scanId
5. POST /api/v1/agent/cicd/event with that scanId

CI/CD Agent event

POST /api/v1/agent/cicd/event

Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

{
  "provider": "github-actions",
  "pipeline": "production-build",
  "runId": "RUN_ID",
  "scanId": "SCAN_ID",
  "stage": "build",
  "artifactName": "artifact.zip",
  "commitSha": "COMMIT_SHA",
  "environment": "production"
}

Expected Agent result

A successful run creates or updates a CICD_PIPELINE asset and records the artifact as a security observation. Meaningful changes can then enter Controller verification, attention, alerting, and activity.

Keep CYPHERSCAN_API_KEY in GitHub Actions secrets. Do not write it into the workflow file.