CLI & CI Agent
The apposture agent (agent.sh) is a portable, dependency-light shell
script (curl + tar/git) that wires scanning into any pipeline. It's downloaded
and checksum-verified before it runs - never a blind curl | sh.
Install (checksum-pinned)
curl -fsSL "$APPOSTURE_URL/api/v1/ci/agent.sh" -o apposture
curl -fsSL "$APPOSTURE_URL/api/v1/ci/agent.sh.sha256" | sha256sum -c -
chmod +x apposture
Commands
| Command | What it does |
|---|---|
apposture test | Run source scanners (SAST/SCA/secrets/IaC) and gate the build. (default) |
apposture monitor | Snapshot the default branch to set the baseline; never fails the build. |
apposture upload | Send a SARIF report only (bring-your-own scanner). |
apposture container --image X | Scan a built image with Trivy on the runner; upload its SARIF. |
Environment & flags
| Variable / flag | Purpose |
|---|---|
APPOSTURE_URL | e.g. https://aspm.apposture.com |
APT_TOKEN | a write-capable apt_ token (set as a CI secret) |
--app NAME / --service NAME | which application/service this run belongs to |
--severity-threshold | critical|high|medium|low|none |
--fail-on | new (only new vs baseline) or all |
--scanners | sast,sca,secrets,iac |
--no-gate | report only, never fail |
The agent auto-detects GitHub Actions / GitLab CI / Jenkins (repo, branch, commit, PR id) and sends a delta of changed files on PRs so unchanged scanner classes are skipped. It waits for the gate verdict and relays the exit code - non-zero fails the stage (unless the gate is in Monitor mode, which never breaks the build).
GitHub Actions
- name: apPosture security gate
env:
APPOSTURE_URL: https://aspm.apposture.com
APT_TOKEN: ${{ secrets.APPOSTURE_TOKEN }}
run: |
curl -fsSL "$APPOSTURE_URL/api/v1/ci/agent.sh" -o apposture
curl -fsSL "$APPOSTURE_URL/api/v1/ci/agent.sh.sha256" | sha256sum -c -
chmod +x apposture
./apposture test --app "$GITHUB_REPOSITORY" --severity-threshold high --fail-on new
Ready-to-paste snippets for GitLab CI, Jenkins, Azure and Bitbucket are on the in-app CI/CD → Setup page. See CI/CD Setup for the full flow, including zero-pipeline webhook scanning.