> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infraudit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Using the InfraAudit CLI in CI/CD automation pipelines

> Integrate infraudit into GitHub Actions or GitLab CI for automated drift and vulnerability checks. Use --output json with jq to gate builds on findings.

The `infraudit` CLI is designed to work as a security gate in automated pipelines. Use `--output json` with `jq` to parse results programmatically and fail the build when critical findings are present.

## Authentication in CI

Never store credentials in the repository or hardcode them in pipeline files. Pass them via CI secrets:

```bash theme={null}
infraudit auth login --email "$CI_EMAIL" --password "$CI_PASSWORD"
```

Or authenticate with an API token:

```bash theme={null}
infraudit auth login --token "$INFRAUDIT_TOKEN"
```

Set `INFRAUDIT_SERVER_URL` as a CI secret rather than hardcoding your server address:

```bash theme={null}
export INFRAUDIT_SERVER_URL="$INFRAUDIT_SERVER_URL"
```

## GitHub Actions

The following workflow runs a drift scan and vulnerability scan on every push to `main` and on a daily schedule. It fails the job if any critical findings are present:

```yaml theme={null}
name: InfraAudit security check

on:
  push:
    branches: [main]
  schedule:
    - cron: "0 6 * * *"

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - name: Install infraudit CLI
        run: go install github.com/pratik-mahalle/infraudit/cmd/cli@latest

      - name: Authenticate
        run: infraudit auth login --email "${{ secrets.INFRAUDIT_EMAIL }}" --password "${{ secrets.INFRAUDIT_PASSWORD }}"
        env:
          INFRAUDIT_SERVER_URL: ${{ secrets.INFRAUDIT_SERVER_URL }}

      - name: Run drift scan
        run: infraudit drift detect

      - name: Fail on critical drift findings
        run: |
          CRITICAL=$(infraudit drift list --severity critical -o json | jq 'length')
          if [ "$CRITICAL" -gt 0 ]; then
            echo "FAIL: $CRITICAL critical drift(s) detected"
            infraudit drift list --severity critical
            exit 1
          fi
          echo "PASS: No critical drifts"
```

## GitLab CI

```yaml theme={null}
infraudit-security:
  stage: test
  image: golang:1.24
  before_script:
    - go install github.com/pratik-mahalle/infraudit/cmd/cli@latest
    - infraudit auth login --email "$INFRAUDIT_EMAIL" --password "$INFRAUDIT_PASSWORD"
  script:
    - infraudit drift detect
    - infraudit vulnerability scan
    - |
      CRITICAL=$(infraudit drift list --severity critical -o json | jq 'length')
      CRITICAL_VULNS=$(infraudit vulnerability list --severity critical -o json | jq 'length')
      if [ "$CRITICAL" -gt 0 ] || [ "$CRITICAL_VULNS" -gt 0 ]; then
        echo "FAIL: $CRITICAL critical drifts, $CRITICAL_VULNS critical vulnerabilities"
        exit 1
      fi
      echo "PASS: No critical findings"
  variables:
    INFRAUDIT_SERVER_URL: $INFRAUDIT_SERVER_URL
```

## Shell script pattern

For custom pipeline environments or cron jobs:

```bash theme={null}
#!/bin/bash
set -e

export INFRAUDIT_SERVER_URL="https://api.infraudit.dev"

infraudit auth login --email "$CI_EMAIL" --password "$CI_PASSWORD"

infraudit drift detect
infraudit vulnerability scan

CRITICAL=$(infraudit drift list --severity critical -o json | jq 'length')
CRITICAL_VULNS=$(infraudit vulnerability list --severity critical -o json | jq 'length')

if [ "$CRITICAL" -gt 0 ] || [ "$CRITICAL_VULNS" -gt 0 ]; then
  echo "FAIL: $CRITICAL critical drifts, $CRITICAL_VULNS critical vulnerabilities"
  exit 1
fi

echo "PASS: No critical findings"
```

## Tips

<AccordionGroup>
  <Accordion title="Parse specific fields from JSON output">
    All list commands support `-o json`. Pipe the output to `jq` to extract fields or count results:

    ```bash theme={null}
    # Count critical drift findings
    infraudit drift list --severity critical -o json | jq 'length'

    # Extract resource names from a list
    infraudit resource list -o json | jq '.[].name'

    # Convert drift list to CSV
    infraudit drift list -o json | jq -r '.[] | [.id, .drift_type, .severity, .status] | @csv'
    ```
  </Accordion>

  <Accordion title="Exit codes">
    The CLI exits with code `1` on errors and unexpected conditions. Failures propagate naturally to the CI build status without extra logic.
  </Accordion>

  <Accordion title="Caching the binary">
    To avoid reinstalling the CLI on every run, cache the `$HOME/go/bin` directory using your CI platform's caching mechanism. In GitHub Actions, use `actions/cache` keyed on the CLI version.
  </Accordion>
</AccordionGroup>