Skip to content
Hardn

Help centre · Walkthrough

Add Hardn to your CI pipeline

Here's how to add Hardn to your CI pipeline, so a deploy stops when a scan finds something serious. (1:15)

All help topics

Step by step

The same steps as the video.

  1. 1

    Store your API key

    Create an API key in Hardn, and save it in your repository's secrets as HARDN_API_KEY.

    In your repository on GitHub: Settings → Secrets and variables → Actions → New repository secret, named HARDN_API_KEY.

  2. 2

    Add the workflow

    Add a workflow that installs hardn-cli, scans your site, and uploads the SARIF report to GitHub code scanning.

    .github/workflows/hardn.yml
    name: hardnon:  push:    branches: [main]jobs:  scan:    runs-on: ubuntu-latest    permissions:      contents: read      security-events: write   # to upload the SARIF report    steps:      - uses: actions/setup-python@v5        with:          python-version: "3.12"      - name: Hardn scan        env:          HARDN_API_KEY: ${{ secrets.HARDN_API_KEY }}        run: |          pip install hardn-cli          hardn scan --target tgt_… --fail-on high --sarif hardn.sarif      - name: Upload to GitHub code scanning        if: always()        uses: github/codeql-action/upload-sarif@v3        with:          sarif_file: hardn.sarif
  3. 3

    A passing run

    When nothing is at or above high, the scan step exits with zero, and the pipeline carries on.

  4. 4

    A failing run

    When the scan finds a high or critical issue, it exits with one, and the job stops before your deploy.

    The SARIF upload runs either way (if: always()), so the issues also appear under the repository's Security tab.

  5. 5

    Or use the REST API

    Prefer plain HTTP? Start a scan with the REST API, poll until it's finished, and gate on the grade.

    hardn-gate.sh
    #!/usr/bin/env bash# Start a scan with the REST API, wait for it, and fail unless the grade is A or B.HARDN=${HARDN_API:-https://api.hardn.si/v1}ID=$(curl -s $HARDN/scans -H "Authorization: Bearer $HARDN_API_KEY" \  -H "Content-Type: application/json" \  -d "{\"target_id\": \"$1\", \"scan_type\": \"public\"}" | jq -r .id)echo "Started scan $ID"while :; do  SCAN=$(curl -s $HARDN/scans/$ID -H "Authorization: Bearer $HARDN_API_KEY")  case "$(echo "$SCAN" | jq -r .status)" in queued|running) sleep 5;; *) break;; esacdoneGRADE=$(echo "$SCAN" | jq -r .grade)echo "Hardn grade $GRADE"case "$GRADE" in A|B) ;; *) exit 1;; esac

If something goes wrong

upload-sarif fails with “Resource not accessible by integration”.
The job needs security-events: write permission, as in the workflow above.
The step fails with exit code 2.
The scan didn't finish or the key was refused. The step's log has Hardn's message; check the secret's name and value.
I don't use GitHub Actions.
Any CI with Python works: run pip install hardn-cli and the same hardn scan line with HARDN_API_KEY set as a secret variable. Or use the REST API script.

More walkthroughs

Still stuck? Email support@hardn.si and a person will reply.