CypherScan Agent integration

Scan CI/CD artifacts in GitHub Actions

Add a malware and artifact-security check to GitHub Actions before a build, release, or deployment artifact moves downstream. CypherScan scans the artifact through the same canonical API used by other M2M integrations, then the result can be attached to CypherScan Agent.

Create API key Open Agent

When to use this

Use this integration when your pipeline produces ZIPs, packages, release bundles, deployment artifacts, or other files that should be checked before promotion or delivery.

Setup

STEP 1

Create an API key

Generate a CypherScan API key from your dashboard.

STEP 2

Create a GitHub secret

Add the key to your repository as the CYPHERSCAN_API_KEY Actions secret.

STEP 3

Choose the artifact

Select the build, release, package, or deployment artifact that should be checked before the pipeline continues.

STEP 4

Upload and scan

Presign the upload, PUT the artifact, then scan the returned objectKey through the canonical CypherScan API.

STEP 5

Submit the CI/CD event

Attach the completed scanId to the GitHub Actions pipeline through the CI/CD Agent endpoint.

STEP 6

Review Agent

The pipeline appears as a CI/CD asset with observations, changes, and attention decisions.

Required GitHub secret

Repository Settings
→ Secrets and variables
→ Actions
→ New repository secret

Name:
CYPHERSCAN_API_KEY

Canonical API sequence

1. POST /api/v1/upload/presign
   body: { filename, contentType, sizeBytes }

2. PUT the artifact to the returned upload URL

3. POST /api/v1/scan
   body: { objectKey: returned_key }

4. Read the returned scanId

5. POST /api/v1/agent/cicd/event
   body includes the scanId and pipeline metadata

Presign request

curl -X POST https://cyphernetsecurity.com/api/v1/upload/presign \
  -H "Authorization: Bearer $CYPHERSCAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "filename": "artifact.zip",
    "contentType": "application/zip",
    "sizeBytes": 1048576
  }'

Scan the uploaded object

curl -X POST https://cyphernetsecurity.com/api/v1/scan \
  -H "Authorization: Bearer $CYPHERSCAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"objectKey":"RETURNED_OBJECT_KEY"}'

CI/CD Agent event

POST /api/v1/agent/cicd/event

Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

{
  "provider": "github-actions",
  "pipeline": "production-build",
  "runId": "RUN_ID",
  "scanId": "SCAN_ID",
  "stage": "build",
  "artifactName": "artifact.zip",
  "commitSha": "COMMIT_SHA",
  "environment": "production"
}

Expected Agent result

A successful run creates or updates a CICD_PIPELINE asset and records the artifact as a security observation. Meaningful changes can then enter Controller verification, attention, alerting, and activity.

Start CI/CD scanning Read API docs

Keep CYPHERSCAN_API_KEY in GitHub Actions secrets. Do not write it into the workflow file.