The workflow version runs on every push to main and when you start it by hand. The pipeline version runs as a job in the test stage whenever your pipeline runs. Both are non-blocking and never fail the build.
The short version
It runs after code lands on main, or when you start it yourself. It reports. It never stops your build, whatever the scan finds.
How it works in Cyberlop
Integrations offers two ready-made jobs, and they trigger differently.
| Version | When it starts |
|---|---|
| Workflow | On a push to the main branch, or manually through the manual-run option |
| Pipeline | As a job in the test stage, whenever your pipeline runs |
Once started, the job triggers the scan, then asks for the result every 30 seconds, up to 120 times. After that it prints one line per finding and a count. A comment at the top of each version explains the same thing: it reports findings and never fails the build.
Because the scan runs in Cyberlop, the job only waits and reads. A long scan can outlast the 120 checks, which add up to about an hour, but the scan itself still finishes in the app and you can read it there. See why the job stopped waiting.
What to do next
- Pick the profile and copy the YAML from Integrations.
- Add the two secrets from which secrets to add.
- Push a small change to
mainand open the build log. - If you would rather run it on a clock, set up a schedule instead of a CI trigger.
Want a hard stop on findings? The generated jobs do not do that. Read why the build still passes for the reason, or the full CI/CD tutorial.
Related questions
- How do I trigger a Cyberlop scan from my CI pipeline?
- Why did my CI job pass even though Cyberlop found critical issues?
- My CI job stopped waiting before the scan finished. Why?
- What's the difference between scheduled scans and CI-triggered scans?
- How do I copy the ready-made CI workflow for my code host?
How to add security scanning to your CI/CD pipeline
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Wiring it into your pipeline?
Share what you are building and we will help you set up the right token, profile and job.