CI/CD Integration

Severity-Based Exit Codes

ThreatMitigator returns exit codes based on the highest severity threat found, enabling pipeline gating:

Exit Code	Meaning
`0`	No threats found (or all below threshold)
`1`	Error - invalid config, parse failure
`2`	Highest threat is Low or Info severity
`3`	Highest threat is Medium severity
`4`	Highest threat is High or Critical severity

Control the threshold with --severity-threshold:

1
2
# Only fail the build on High or Critical threats
threatmitigator scan terraform ./infra --severity-threshold high

CI-Optimized Command

The check-drift command is designed for CI pipelines:

1
threatmitigator check-drift ./infra --format json --severity-threshold medium

Never modifies .threatmodel.yaml
JSON output by default
Severity-based exit codes for pass/fail gating

SARIF for GitHub Security

Upload results directly to GitHub Advanced Security:

1
2
3
4
5
6
7
# GitHub Actions
- name: Scan infrastructure
  run: threatmitigator scan terraform ./infra --format sarif --output results.sarif
- name: Upload to GitHub Security
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif

Pipeline Examples

Works with any CI system: GitHub Actions, GitLab CI, Jenkins, CircleCI, and more. Severity-based exit codes and machine-readable output formats make integration straightforward.

GitHub Actions

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
name: Security Scan
on: [push, pull_request]

jobs:
  threat-model:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Scan Infrastructure
        run: threatmitigator scan terraform ./infra --format sarif --output results.sarif
      - name: Upload to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif

GitLab CI

1
2
3
4
5
6
7
threat-scan:
  stage: test
  script:
    - threatmitigator check-drift ./infra --format json --severity-threshold medium
  artifacts:
    reports:
      sast: threats.json

Jenkins

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
stage('Security Scan') {
    steps {
        sh 'threatmitigator scan terraform ./infra --format json --output threats.json'
    }
    post {
        always {
            archiveArtifacts artifacts: 'threats.json'
        }
    }
}