CI/CD Policy Gate

Block vulnerable or non-compliant code from reaching production.

Policy enforcement

Block critical CVEs, license violations, and typosquats.

Fast checks

Sub-second evaluation. No scan needed if recent results exist.

CI native

GitHub Action, CLI binary, or direct API. Works everywhere.

Prerequisites:You need a Sectora CI token. Go to Settings > Integrations > CI Tokens to create one.

GitHub Action

Add the Sectora SCA Gate to any GitHub Actions workflow:

Copy

# .github/workflows/ci.yml
name: CI
on: [push, pull_request]

jobs:
  security-gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Sectora SCA Gate
        uses: sectora/sca-gate-action@v1
        with:
          token: ${{ secrets.SECTORA_CI_TOKEN }}
          fail-on-critical: true
          fail-on-license: true

Inputs

Input	Required	Default	Description
`token`	Yes	-	Sectora CI token
`fail-on-critical`	No	true	Fail if critical vulns found
`fail-on-high`	No	false	Fail if high vulns found
`fail-on-license`	No	false	Fail on license policy violations
`fail-on-slopsquat`	No	false	Fail on typosquatting detection
`scan-id`	No	latest	Specific SCA scan ID to check
`policy-id`	No	default	License policy to evaluate against
`api-url`	No	https://api.sectora.io	Sectora API URL

Outputs

Output	Description
`pass`	Whether the gate passed (true/false)
`total-deps`	Total dependencies scanned
`critical`	Critical vulnerability count
`high`	High vulnerability count

Advanced: PR Comment

Copy

- name: Sectora SCA Gate
  id: gate
  uses: sectora/sca-gate-action@v1
  with:
    token: ${{ secrets.SECTORA_CI_TOKEN }}
    fail-on-critical: true

- name: Comment on PR
  if: always() && github.event_name == 'pull_request'
  uses: actions/github-script@v7
  with:
    script: |
      const pass = '${{ steps.gate.outputs.pass }}' === 'true'
      const body = pass
        ? '**Sectora SCA Gate: PASSED** :white_check_mark:'
        : '**Sectora SCA Gate: FAILED** :x: — ${{ steps.gate.outputs.critical }} critical vulns'
      github.rest.issues.createComment({
        owner: context.repo.owner,
        repo: context.repo.repo,
        issue_number: context.issue.number,
        body
      })

What Gets Checked

Critical and high severity vulnerabilities in your dependencies (CVE matching via NVD + GHSA + OSV)
License policy violations — blocked licenses (AGPL, SSPL, etc.) per your policy settings
Slopsquatting/typosquatting — packages with names suspiciously similar to popular packages
Reachability — whether vulnerable code is actually imported in your application
Known malicious packages from OSV.dev threat intelligence