From 6d2348281bbe82db494e8309e7fadae70297c026 Mon Sep 17 00:00:00 2001
From: monssefbaakka <monssef.baakka@gmail.com>
Date: Sun, 15 Mar 2026 23:41:00 +0000
Subject: [PATCH] feat: add CI/CD integration examples and documentation for
 Azure DevOps, GitLab CI, and Jenkins.

---
 docs/CI_CD_INTEGRATION.md       | 110 ++++++++++++++++++++++++++++++++
 examples/ci/.gitlab-ci.yml      |  15 +++++
 examples/ci/Jenkinsfile         |  22 +++++++
 examples/ci/azure-pipelines.yml |  15 +++++
 4 files changed, 162 insertions(+)
 create mode 100644 docs/CI_CD_INTEGRATION.md
 create mode 100644 examples/ci/.gitlab-ci.yml
 create mode 100644 examples/ci/Jenkinsfile
 create mode 100644 examples/ci/azure-pipelines.yml

diff --git a/docs/CI_CD_INTEGRATION.md b/docs/CI_CD_INTEGRATION.md
new file mode 100644
index 0000000..a8d2aba
--- /dev/null
+++ b/docs/CI_CD_INTEGRATION.md
@@ -0,0 +1,110 @@
+# CI/CD Integration Guide
+
+Integrate Inkog into your CI/CD pipelines to ensure automated security and logic checks on every commit or merge request. All our CI/CD templates produce SARIF files, enabling native integration with your platform's security dashboards.
+
+## GitHub Actions
+
+Use the official Inkog GitHub Action:
+
+```yaml
+name: Inkog Security Scan
+on:
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Inkog Scan
+        uses: inkog-io/inkog@v1
+        with:
+          api-key: ${{ secrets.INKOG_API_KEY }}
+          sarif-upload: true
+          policy: balanced
+          severity: low
+          path: .
+```
+
+## GitLab CI
+
+GitLab has native SARIF support in its Security Dashboard. You can upload Inkog's SARIF output as a SAST report artifact.
+Add the following to your `.gitlab-ci.yml`:
+
+> **Note:** Ensure you add `INKOG_API_KEY` as a masked variable in your GitLab CI/CD Settings!
+
+```yaml
+variables:
+  INKOG_POLICY: "balanced"
+  INKOG_PATH: "."
+  INKOG_SEVERITY: "low"
+
+inkog-scan:
+  stage: test
+  image: ghcr.io/inkog-io/inkog:latest
+  script:
+    - inkog -path $INKOG_PATH -policy $INKOG_POLICY -severity $INKOG_SEVERITY -output sarif > gl-inkog-results.sarif
+  artifacts:
+    reports:
+      sast: gl-inkog-results.sarif
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+```
+
+## Azure DevOps
+
+Azure DevOps can view SARIF files using the [SARIF viewer extension](https://marketplace.visualstudio.com/items?itemName=sariftools.scans).
+Add this task to your `azure-pipelines.yml`:
+
+> **Note:** Map your `INKOG_API_KEY` secret variable to the environment variable!
+
+```yaml
+variables:
+  INKOG_POLICY: 'balanced'
+  INKOG_PATH: '$(Build.SourcesDirectory)'
+  INKOG_SEVERITY: 'low'
+
+steps:
+- task: Bash@3
+  displayName: 'Inkog Security Scan'
+  inputs:
+    targetType: 'inline'
+    script: |
+      curl -fsSL https://get.inkog.io | sh
+      inkog -path $(INKOG_PATH) -policy $(INKOG_POLICY) -severity $(INKOG_SEVERITY) -output sarif > $(Build.ArtifactStagingDirectory)/inkog.sarif
+  env:
+    INKOG_API_KEY: $(INKOG_API_KEY)
+```
+
+## Jenkins
+
+For Jenkins, use the Warnings Next Generation plugin to read SARIF output.
+Add the following stage to your `Jenkinsfile`:
+
+> **Note:** Make sure you have added your Inkog API key to your Jenkins credentials.
+
+```groovy
+pipeline {
+    agent any
+    environment {
+        INKOG_API_KEY = credentials('inkog-api-key')
+        INKOG_POLICY = 'balanced'
+        INKOG_PATH = '.'
+        INKOG_SEVERITY = 'low'
+    }
+    stages {
+        stage('Inkog Security Scan') {
+            steps {
+                sh 'curl -fsSL https://get.inkog.io | sh'
+                sh 'inkog -path ${INKOG_PATH} -policy ${INKOG_POLICY} -severity ${INKOG_SEVERITY} -output sarif > inkog-results.sarif'
+            }
+        }
+    }
+    post {
+        always {
+            recordIssues(tools: [sarif(pattern: 'inkog-results.sarif')])
+        }
+    }
+}
+```
diff --git a/examples/ci/.gitlab-ci.yml b/examples/ci/.gitlab-ci.yml
new file mode 100644
index 0000000..4ddb923
--- /dev/null
+++ b/examples/ci/.gitlab-ci.yml
@@ -0,0 +1,15 @@
+variables:
+  INKOG_POLICY: "balanced"
+  INKOG_PATH: "."
+  INKOG_SEVERITY: "low"
+
+inkog-scan:
+  stage: test
+  image: ghcr.io/inkog-io/inkog:latest
+  script:
+    - inkog -path $INKOG_PATH -policy $INKOG_POLICY -severity $INKOG_SEVERITY -output sarif > gl-inkog-results.sarif
+  artifacts:
+    reports:
+      sast: gl-inkog-results.sarif
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
diff --git a/examples/ci/Jenkinsfile b/examples/ci/Jenkinsfile
new file mode 100644
index 0000000..5704c30
--- /dev/null
+++ b/examples/ci/Jenkinsfile
@@ -0,0 +1,22 @@
+pipeline {
+    agent any
+    environment {
+        INKOG_API_KEY = credentials('inkog-api-key')
+        INKOG_POLICY = 'balanced'
+        INKOG_PATH = '.'
+        INKOG_SEVERITY = 'low'
+    }
+    stages {
+        stage('Inkog Security Scan') {
+            steps {
+                sh 'curl -fsSL https://get.inkog.io | sh'
+                sh 'inkog -path ${INKOG_PATH} -policy ${INKOG_POLICY} -severity ${INKOG_SEVERITY} -output sarif > inkog-results.sarif'
+            }
+        }
+    }
+    post {
+        always {
+            recordIssues(tools: [sarif(pattern: 'inkog-results.sarif')])
+        }
+    }
+}
diff --git a/examples/ci/azure-pipelines.yml b/examples/ci/azure-pipelines.yml
new file mode 100644
index 0000000..3e4b8e1
--- /dev/null
+++ b/examples/ci/azure-pipelines.yml
@@ -0,0 +1,15 @@
+variables:
+  INKOG_POLICY: 'balanced'
+  INKOG_PATH: '$(Build.SourcesDirectory)'
+  INKOG_SEVERITY: 'low'
+
+steps:
+- task: Bash@3
+  displayName: 'Inkog Security Scan'
+  inputs:
+    targetType: 'inline'
+    script: |
+      curl -fsSL https://get.inkog.io | sh
+      inkog -path $(INKOG_PATH) -policy $(INKOG_POLICY) -severity $(INKOG_SEVERITY) -output sarif > $(Build.ArtifactStagingDirectory)/inkog.sarif
+  env:
+    INKOG_API_KEY: $(INKOG_API_KEY)