cycodelabs/Cimon by Cycode
Runtime Security Solution for your CI/CD Pipeline
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 17, 2026
- License
- Apache 2.0
Pinned Snippet
uses: cycodelabs/cimon-action@a0870cc3d9e3bf3cedd28bdb67bf3fd3281e5941 # v1.0.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| client-id | Cimon client ID for authentication | no | — |
| secret | Cimon secret for authentication | no | — |
| url | Cimon endpoint for authentication | no | — |
| prevent | Enable prevention mode | yes | false |
| allowed-ips | A comma-separated list of allowed IP addresses | no | — |
| allowed-hosts | A comma-separated list of domain names | no | — |
| file-integrity | Enable file integrity module in prevent mode | no | false |
| memory-protection | Enable memory protection module in prevent mode | no | false |
| ignored-ip-nets | A comma or white space separated list of ignored IP networks in CIDR notation, e.g. 10.0.0.0/8, 172.16.0.0/12. This setting is mandatory if your workflow runs containers attached to a custom network with configured sub-range. In other words, inter-container networking is usually ignored by Cimon. Cimon implicitly ignores 10.0.0.0/8 and 172.16.0.0/12 networks. | no | — |
| github-token | GitHub token for enriching build information | no | ${{ github.token }} |
| report-job-summary | Report results through job summary output | no | true |
| report-pr-summary | Report results through PR comment | no | false |
| report-process-tree | Enable to report the process tree | no | false |
| slack-webhook-endpoint | Slack webhook endpoint to report security events | no | — |
| apply-fs-events | Enable processing filesystem events and display them in the process tree report | no | false |
| log-level | Log level (Used for debugging) | no | info |
| feature-gates | Set of key=value pairs that describe Cimon features. | no | — |
| fail-on-error | Fail the CI if Cimon encountered an error | no | false |
| release-path | Path to Cimon release file (Used for debugging) | no | "" |
| hardening | Enable hardening rules engine to detect/prevent CI/CD supply chain attacks (base64-decode-exec, credential theft, typosquatting, etc.). Combine with prevent=true for active blocking. | no | false |
| hardening-tier | Maximum hardening tier to enable: 1 = critical rules only (Tier 1) 2 = critical + high impact (Tier 1+2, default) 3 = all rules including defense-in-depth (Tier 1+2+3) | no | 2 |
| hardening-disabled-rules | Comma-separated list of hardening rule IDs to disable | no | — |
Outputs
no outputs