The XYZ gate
in your pipeline

xyz ci init · shellbashCopy

pip install --upgrade cyberxyz-scanner   # 1.4.56 or later
cd your-repo
xyz ci init            # detects GitHub, GitLab or Azure from origin and writes the pipeline file
xyz ci init --fail-on quarantine

xyz depalert scan · shellbashCopy

pip install --quiet cyberxyz-scanner

xyz depalert scan --package-lock package-lock.json --fail-on block
xyz depalert scan --requirements requirements.txt  --fail-on block
xyz depalert scan --go-sum go.sum                   --fail-on block

# ad hoc, no lockfile
xyz depalert scan -p axios@1.14.1 -p lodash@4.17.21 --fail-on block

exit codestextCopy

0   all packages allowed
1   BLOCK       confirmed malicious version in the manifest
2   QUARANTINE  day-zero anomaly, held for review
3   ALERT       advisory match, suspicious but not confirmed
4   ERROR       backend unreachable, refusing to fail open

.github/workflows/xyz-depalert.ymlyamlCopy

name: CyberXYZ gate
on: [push, pull_request]

jobs:
  depalert:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: CyberXYZSecurity/depalert-action@v1
        with:
          api-key: ${{ secrets.XYZ_API_KEY }}
          fail-on: block        # block | quarantine | alert

.github/workflows/xyz-depalert.ymlyamlCopy

name: XYZ Dependency Security Gate
on:
  push:
    branches: ["main", "master", "develop"]
    paths: ["package-lock.json", "yarn.lock", "requirements*.txt", "Pipfile.lock", "poetry.lock", "go.sum"]
  pull_request:
    branches: ["main", "master", "develop"]
    paths: ["package-lock.json", "yarn.lock", "requirements*.txt", "Pipfile.lock", "poetry.lock", "go.sum"]
  workflow_dispatch:

jobs:
  xyz-depalert:
    runs-on: ubuntu-latest
    # Dependabot PRs cannot read secrets: advisory mode, never a red build
    continue-on-error: ${{ github.actor == 'dependabot[bot]' }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.11", cache: "pip" }
      - run: pip install --quiet cyberxyz-scanner
      - name: Scan package-lock.json
        if: hashFiles('package-lock.json') != ''
        env:
          XYZ_API_KEY: ${{ secrets.XYZ_API_KEY }}
          XYZ_API_URL: https://api.cyberxyz.io
        run: xyz depalert scan --package-lock package-lock.json --fail-on block
      - name: Scan requirements.txt
        if: hashFiles('requirements.txt') != ''
        env:
          XYZ_API_KEY: ${{ secrets.XYZ_API_KEY }}
          XYZ_API_URL: https://api.cyberxyz.io
        run: xyz depalert scan --requirements requirements.txt --fail-on block

.gitlab-ci.ymlyamlCopy

include:
  - remote: 'https://raw.githubusercontent.com/CyberXYZSecurity/XYZ-Exploitability-Scanner/main/integrations/gitlab-ci/cyberxyz-supply-chain.gitlab-ci.yml'

# or inline
image: python:3.11-slim
stages: [scan]
variables:
  XYZ_API_URL: "https://api.cyberxyz.io"
  XYZ_FAIL_ON: "block"
before_script:
  - pip install --quiet cyberxyz-scanner

xyz_depalert_npm:
  stage: scan
  rules: [{ exists: ["package-lock.json", "yarn.lock"] }]
  script:
    - xyz depalert scan --package-lock package-lock.json --fail-on "$XYZ_FAIL_ON"

xyz_depalert_python:
  stage: scan
  rules: [{ exists: ["requirements.txt", "Pipfile.lock", "poetry.lock"] }]
  script:
    - for f in requirements.txt requirements-dev.txt Pipfile.lock poetry.lock; do
        if [ -f "$f" ]; then xyz depalert scan --requirements "$f" --fail-on "$XYZ_FAIL_ON"; fi; done

xyz_depalert_go:
  stage: scan
  rules: [{ exists: ["go.sum"] }]
  script:
    - xyz depalert scan --go-sum go.sum --fail-on "$XYZ_FAIL_ON"

azure-pipelines.ymlyamlCopy

trigger:
  branches: { include: [main, master, develop] }
  paths:    { include: ["package-lock.json", "yarn.lock", "requirements*.txt", "Pipfile.lock", "poetry.lock", "go.sum"] }
pool: { vmImage: 'ubuntu-latest' }
variables:
  XYZ_API_URL: 'https://api.cyberxyz.io'
  XYZ_FAIL_ON: 'block'
steps:
  - task: UsePythonVersion@0
    inputs: { versionSpec: '3.11', addToPath: true }
  - script: pip install --quiet cyberxyz-scanner
  - script: |
      if [ -f package-lock.json ]; then xyz depalert scan --package-lock package-lock.json --fail-on "$XYZ_FAIL_ON"; fi
      if [ -f requirements.txt ];  then xyz depalert scan --requirements requirements.txt  --fail-on "$XYZ_FAIL_ON"; fi
      if [ -f go.sum ];            then xyz depalert scan --go-sum go.sum                   --fail-on "$XYZ_FAIL_ON"; fi
    env:
      XYZ_API_KEY: $(XYZ_API_KEY)

XYZ_FAIL_ONtextCopy

block        confirmed malicious only            start here
quarantine   plus day-zero anomaly signals       recommended once you have a baseline
alert        plus CVE, GHSA and OSV advisories   strictest

before_script · any runneryamlCopy

before_script:
  - pip install --quiet cyberxyz-scanner
  - xyz proxy setup --machine-name "ci/$CI_PROJECT_PATH" --enrollment-token "$XYZ_ENROLLMENT_TOKEN" --no-install-daemon
  # npm, pip and go now resolve through proxy.cyberxyz.io for the rest of the job