> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CI/CD Integration

> Integrate CodeThreat into your CI/CD pipeline

Integrate security scanning into your continuous integration and deployment pipelines.

## Benefits

<CardGroup cols={2}>
  <Card title="Shift Left" icon="arrow-left">
    Catch vulnerabilities before deployment
  </Card>

  <Card title="Automated" icon="repeat">
    No manual intervention needed
  </Card>

  <Card title="Fail Fast" icon="xmark">
    Block builds with security issues
  </Card>

  <Card title="Consistent" icon="check">
    Same security checks every build
  </Card>
</CardGroup>

## GitHub Actions

```yaml theme={null}
name: CodeThreat Security Scan
on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: CodeThreat Scan
        uses: codethreat/scan-action@v1
        with:
          api-key: ${{ secrets.CODETHREAT_API_KEY }}
          fail-on: critical,high
```

## GitLab CI

```yaml theme={null}
codethreat_scan:
  stage: security
  script:
    - curl -X POST "https://app.codethreat.com/api/v1/scans" \
        -H "X-API-Key: $CODETHREAT_API_KEY" \
        -H "Content-Type: application/json" \
        -d '{"repository_id": "$CI_PROJECT_ID"}'
  only:
    - main
    - merge_requests
```

## Azure Pipelines

```yaml theme={null}
trigger:
  - main

pool:
  vmImage: 'ubuntu-latest'

steps:
- task: CodeThreatScan@1
  inputs:
    apiKey: '$(CodeThreatApiKey)'
    failOnCritical: true
```

## Jenkins

```groovy theme={null}
pipeline {
    agent any
    stages {
        stage('Security Scan') {
            steps {
                sh '''
                    curl -X POST "https://app.codethreat.com/api/v1/scans" \
                      -H "X-API-Key: ${CODETHREAT_API_KEY}" \
                      -H "Content-Type: application/json" \
                      -d '{"repository_id": "repo_123"}'
                '''
            }
        }
    }
}
```

## Best Practices

**Create dedicated API key**: Use separate key for CI/CD

**Store securely**: Use secret management (GitHub Secrets, etc.)

**Fail on Critical/High**: Block builds with serious issues

**Run on every push**: Continuous security checking

**Cache results**: Speed up builds with caching

**Parallel execution**: Run security scan in parallel with tests

## What's Next?

<CardGroup cols={2}>
  <Card title="API Keys" icon="key" href="/automation/api-keys">
    Create API keys for CI/CD
  </Card>

  <Card title="API Reference" icon="code" href="/api-reference/scans">
    View API documentation
  </Card>
</CardGroup>