CI/CD Integration

HAIEC CI Pipeline

GitHub Actions integration with AST sidecars, evidence bundle generation, SARIF export, and policy gate enforcement. Supports 6 scan profiles with 92 core rules plus specialized rule packs. Deterministic, reproducible, and blocking by default.

Two distinct source paths: the HAIEC GitHub App (installed, consent-scoped repository binding for PR scans) and the standalone CI Action shown below are separate products with separate activation. Check the Action repository for its current release state before depending on @v1 — a listed tag is not a general-availability guarantee. Both flows produce the same deterministic scan result contract; a produced bundle is evidence intake, not by itself a HAIEC Assurance Engine disposition.

3 AST Sidecars

6 Scan Profiles

Evidence Bundles

Policy Gates

What It Does

The CI Pipeline extends the static scanner with enhanced AST analysis and policy enforcement.

AST Sidecars

Three language-specific sidecars (Python, Go, JS/TS) provide authoritative AST analysis in CI environments.

Evidence Bundles

Commit-scoped, deterministic JSON bundles with content hashes. Reproducible from commit SHA + versions.

SARIF Export

SARIF v2.1.0 compliant reports for GitHub Code Scanning and third-party security tools.

Policy Gates

Configurable gates that block CI if thresholds are exceeded. Blocking by default for critical findings.

Pipeline Flow

Code Checkout

Repository is checked out with full history for incremental scans. Base commit determined from PR or previous commit.

AST Sidecar Execution

Python, Go, and JS/TS sidecars run in parallel. Each produces findings with confidence_type: "ast" and snippet_hash.

Finding Merge & Deduplication

Sidecar findings are merged with regex fallback. AST findings override regex for same location. Stable fingerprints used.

Evidence Bundle Generation

Deterministic evidence bundle created with findings, metadata, sidecar status, and content_hash. Always generated, even on failure.

SARIF Export

Evidence bundle converted to SARIF v2.1.0. Preserves confidence_type, detection_method, sidecar_status in properties.

Policy Gate Evaluation

Gates evaluate bundle: critical-findings, high-findings, sidecar-success, degradation-level, ast-coverage. Blocking gates fail CI.

AST Sidecars

Language-specific sidecars provide authoritative AST analysis in CI environments.

Sidecar	Language	Guard	Detection
python-sidecar	Python	CI=true && HAIEC_PY_AST=1	AST via Python ast module
go-sidecar	Go	CI=true && HAIEC_GO_AST=1	AST via go/ast
js-sidecar	JS/TS	CI=true && HAIEC_JS_AST=1	AST via TypeScript compiler API

Sidecar Output

confidence_type: 'ast' (authoritative, overrides regex)
snippet_hash for stable merge keys
Deterministic output (sorted, no timestamps in signed payload)

Policy Gates

Configurable gates that control when your CI pipeline passes or fails.

Gate	Default	Blocking	Description
critical-findings	maxCritical: 0	BLOCKING	Fails if any CRITICAL severity findings exist
high-findings	maxHigh: 5	WARN	Warns/fails if HIGH findings exceed threshold
sidecar-success	minSuccessRate: 50%	BLOCKING	Fails if sidecar success rate is too low
degradation-level	allowFallback: false	BLOCKING	Fails if all sidecars fail (regex-only mode)
ast-coverage	minAstPercentage: 50%	WARN	Warns if AST coverage is below threshold

Degradation Handling

The pipeline gracefully handles sidecar failures with explicit degradation levels.

FULL

All sidecars succeeded

Authoritative

PARTIAL

Some sidecars failed

Authoritative

FALLBACK

All sidecars failed (regex only)

Non-authoritative

CRITICAL

No sidecars executed

Non-authoritative

Critical Invariant

If all sidecars fail, the pipeline generates a degraded evidence bundle with findingsAuthoritative: false and the degradation-level gate FAILS the CI by default. This prevents failed scans from being misinterpreted as clean scans.

Security Hardening

CODEOWNERS Protection

Security-critical files require designated reviewer approval

Artifact Integrity

Evidence bundles include cryptographic hashes verified before policy evaluation

Blocking Gates

Policy gates are blocking by default - failed scans cannot be bypassed

No pull_request_target

Forked PRs cannot access secrets or modify workflow behavior

Degradation Detection

Failed sidecars are detected and prevent silent clean-scan interpretation

Input Sanitization

All user-controllable content is sanitized before rendering

Failure Modes

Understanding how the pipeline handles failures.

Sidecar Failure

exit 0 (unless degradation-level gate is blocking)

Degrades to regex-only mode. Generates degraded bundle with findingsAuthoritative: false.

Invalid JSON Output

exit 0 (unless policy gates fail)

Generates degraded bundle with explicit failure markers. Policy gates still evaluate.

Policy Gate Failure

exit 1 (for blocking gates)

Blocking gates fail the CI. Non-blocking gates produce warnings only.

Scan Error/Exception

exit 1

Logs error, generates minimal error bundle if possible.

Timeout

exit 1

Scan aborted, partial results may be available.

YAML Examples

Minimal Setup

name: HAIEC Security Scan
on: [pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: subodhkc/haiec-github-action@v1
        with:
          haiec-api-key: ${{ secrets.HAIEC_API_KEY }}

Advanced Configuration

name: HAIEC Security Scan
on:
  pull_request:
    branches: [main]
  workflow_dispatch:

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # For incremental scans
      
      - uses: subodhkc/haiec-github-action@v1
        with:
          haiec-api-key: ${{ secrets.HAIEC_API_KEY }}
          fail-on-critical: 'true'
          fail-on-high: 'false'
          python-sidecar: 'true'
          go-sidecar: 'true'
          js-sidecar: 'true'
          upload-sarif: 'true'
          policy-file: '.haiec/policy.json'

Versioning & Breaking Changes

Version Components

•Engine Version: Scanner core (3.22.0)
•Rulepack Version: Detection rules (core-1.0 + profiles)
•Sidecar Versions: Python/Go/JS (1.0.0)
•Bundle Schema: Evidence format (1.0.0)

Breaking Change Policy

•Major version bumps may change output format
•Minor versions add rules, never remove
•Patch versions fix bugs only
•All versions recorded in evidence bundle

Support Boundary

HAIEC CI Pipeline is supported for GitHub Actions only. GitLab CI, CircleCI, and other CI systems are not officially supported but may work with the API-based scanning mode. For enterprise support, contact security@haiec.com.

Ready to Integrate CI Pipeline?

Add the HAIEC CI template to your GitHub Actions workflow.

Setup CI Pipeline Runtime Engine Docs