CI/CD Integration

Neptune is designed for CI/CD pipelines with JSON output, exit codes, and policy gates.

JSON output

Use --json --quiet for machine-readable output:

neptune analyze firmware.bin --json --quiet > result.json

Policy gates

Use neptune policy as a CI gate. It exits with code 1 on failure:

- name: Analyze firmware
  run: neptune analyze firmware.bin --json --quiet --output ./reports

- name: Check policy
  run: neptune policy security-policy.toml ./reports/result.json

GitHub Actions example

name: Firmware SBOM
on:
  push:
    paths: ["firmware/**"]

jobs:
  analyze:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Neptune
        run: |
          curl -L https://github.com/semicentric/neptune/releases/latest/download/neptune-linux-x86_64 -o neptune
          chmod +x neptune
          sudo mv neptune /usr/local/bin/

      - name: Analyze
        run: neptune analyze firmware/device.bin --format cyclonedx --output ./sbom
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

      - name: Upload SBOM
        uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: ./sbom/

Vulnerability gate

Use neptune gate to compare a current analysis against a baseline and fail on new critical vulnerabilities:

- name: Analyze firmware
  run: neptune analyze firmware.bin --json --quiet --output ./reports

- name: Gate check
  run: neptune gate baseline.json ./reports/neptune-analysis.json --max-new-critical 0

See neptune gate for all options.

SBOM diff

Track component drift between firmware versions:

neptune sbom-diff old-sbom.json new-sbom.json --json

See neptune sbom-diff for details.

Supply chain attestation

Generate in-toto/DSSE attestation envelopes for SBOMs, with optional cosign signing:

- name: Attest SBOM
  run: neptune attest ./reports/neptune-sbom-cyclonedx.json --sign

See neptune attest for details.

No-AI mode

For deterministic CI runs without API dependencies:

neptune analyze firmware.bin --no-ai --min-confidence 0.5

CI/CD Integration

On this page