cicd-sensor/cicd-sensor
eBPF-powered CI/CD runtime security sensor for GitHub Actions — detect attacks and suspicious activity at runtime.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| cicd-sensor-version | cicd-sensor agent version this action installs. Bumped automatically by Renovate when a new cicd-sensor/cicd-sensor releases/v* tag is published. Override only to pin to a different release (for example, to test a pre-release). | no | v0.0.43 |
| github-token | Token used to fetch `.cicd-sensor/config.yaml` and `.cicd-sensor/rules/` from the calling repo via the GitHub Contents API. Defaults to the workflow's automatic GITHUB_TOKEN; only set this if your workflow strips the default. | no | ${{ github.token }} |
| socket-path | Path to the agent control socket. Override for self-hosted runners that already run cicd-sensor under a non-default socket; when the path already points to a live socket, the action skips download / install and reuses the existing agent. | no | /run/cicd-sensor/agent.sock |
| manager-url | Optional manager URL for host- and project-scope config. When set, manager-token is also required, and project-local `.cicd-sensor/` config is ignored (config is fetched from the manager). | no | "" |
| manager-token | Bearer token for the manager. Registered with `core.setSecret` and staged to a 0600 file under $RUNNER_TEMP; the raw value never crosses the agent's command line. The post step unlinks the staged file before exiting. | no | "" |
| enable-html-report | Render the runtime-trace HTML report in the post step and upload it as the `cicd-sensor-report` artifact (single-file, opens inline in the Actions UI). Accepts true / false. | no | true |
| enable-attestation-artifact | Generate the in-toto predicate body (predicate.json) in the post step and upload it as the `cicd-sensor-attestation` artifact. Signing the predicate is the caller's responsibility and runs in a downstream step or job (e.g. actions/attest@v3 after actions/download-artifact). Accepts true / false. | no | true |
| enable-debug | Upload a forensics bundle as the `cicd-sensor-debug` artifact. The bundle includes Runtime Event Log output when available, plus journalctl output, raw result-log.json, and a `systemctl show` snapshot. Useful for investigating tampering detections or agent crashes. Accepts true / false. | no | false |
Outputs
| name | description |
|---|---|
| attestation-artifact-id | ID of the uploaded `cicd-sensor-attestation` artifact. Empty string when enable-attestation-artifact is false or when upload failed. |
| attestation-artifact-url | Run-scoped URL of the uploaded `cicd-sensor-attestation` artifact. Empty string when enable-attestation-artifact is false or when upload failed. |