CI/CD Integration

# .github/workflows/security.yml
name: Security Scan

on:
  pull_request:
  push:
    branches: [main]

jobs:
  zenveil:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744

      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - run: pip install zenveil

      - name: Scan
        env:
          ZENVEIL_API_KEY: ${{ secrets.ZENVEIL_API_KEY }}
        run: zenveil scan repo . --json results.json

      - name: Upload results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: security-results
          path: results.json

# .gitlab-ci.yml
security-scan:
  image: python:3.11-slim
  stage: test
  before_script:
    - pip install zenveil
  script:
    - zenveil scan repo . --json security-results.json
  artifacts:
    when: always
    paths:
      - security-results.json
    expire_in: 30 days
  variables:
    ZENVEIL_API_KEY: $ZENVEIL_API_KEY

# bitbucket-pipelines.yml
pipelines:
  default:
    - step:
        name: Security Scan
        image: python:3.11
        script:
          - pip install zenveil
          - zenveil scan repo . --json security-results.json
        artifacts:
          - security-results.json

# .circleci/config.yml
version: 2.1
jobs:
  security:
    docker:
      - image: cimg/python:3.11
    steps:
      - checkout
      - run:
          name: Install ZenVeil
          command: pip install zenveil
      - run:
          name: Security Scan
          command: zenveil scan repo . --json security-results.json
          environment:
            ZENVEIL_API_KEY: $ZENVEIL_API_KEY
      - store_artifacts:
          path: security-results.json

FROM python:3.11-slim
RUN pip install zenveil
WORKDIR /scan
ENTRYPOINT ["zenveil", "scan", "repo", "."]

docker run --rm \
  -v $(pwd):/scan \
  -e ZENVEIL_API_KEY=$ZENVEIL_API_KEY \
  zenveil-scanner

┌────────────┐    ┌──────────────┐    ┌──────────────┐    ┌──────────────┐
│    lint    │ →  │  unit tests  │ →  │  zenveil     │ →  │    deploy    │
│            │    │              │    │  security    │    │              │
└────────────┘    └──────────────┘    │  gate        │    └──────────────┘
                                      └──────────────┘
                                      Exits 1 if CRITICAL/HIGH

# GitHub Actions scheduled scan
on:
  schedule:
    - cron: '0 9 * * 1'  # Every Monday at 9am UTC

# With CVE checks and Slack notification
- name: Weekly security scan
  run: |
    zenveil scan repo . --check-cves --json weekly-scan.json
    if [ $? -eq 1 ]; then
      echo "Critical findings detected — alerting team"
      # pipe to Slack, email, or ticketing system
    fi