Skip to main content

CI/CD Integration

FirePan connects to your development workflow through the GitHub App, the public scan API, and tenant service keys. This page covers the supported paths and how to combine them with open-source analyzers in your own CI.

  1. Install the FirePan GitHub App
  2. Select the repositories you want FirePan to analyze
  3. Configured GitHub events trigger repository-scoped analysis, and you can also start scans from the dashboard

Confirm the triggering events and enforcement settings for each connected project in the dashboard before you treat a result as a merge gate.

note

FirePan does not currently publish a standalone GitHub Action or pre-commit hook. Earlier versions of this page referenced firepan-labs/security-action and firepan-labs/pre-commit-hook; those packages are not available. Use the GitHub App or the API below.

Free Scan From Any Pipeline​

For a public GitHub repository, call the unauthenticated scan endpoint from any CI system:

curl -sS https://api.firepan.com/surface/scan \
  -H "Content-Type: application/json" \
  -d '{"target": "https://github.com/your-org/your-repo"}'

Check both the HTTP status and the JSON error field. A successful response includes execution_id, risk_score, risk_level, findings, quality_metrics, and contracts_scanned. The target must be a plain https://github.com/OWNER/REPO URL; do not send model or budget overrides.

Tenant API Keys​

For an existing FirePan account, a team admin creates a service key at app.firepan.com/settings/api-keys. Store it in your CI secret store and send it as a Bearer token to supported tenant endpoints:

curl -sS https://api.firepan.com/surface/scans \
  -H "Authorization: Bearer $FIREPAN_API_KEY"

Keys keep the tenant, product, and subscription checks of your account. They do not supply GitHub credentials, so private repositories are analyzed through the GitHub App connection.

Agents and Wallet-Native Calls​

Autonomous agents can buy a public-repository scan ($0.50) or audit ($5.00) through the x402 Agent API without an account. See the agent skill for the exact endpoints and payment flow.

Pairing FirePan With Open-Source Checks​

FirePan works alongside deterministic analyzers you run yourself. A common GitHub Actions setup runs Slither on every pull request and uploads SARIF to code scanning:

name: Slither

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read
  security-events: write

jobs:
  slither:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: crytic/slither-action@v0.4.2
        id: slither
        with:
          sarif: results.sarif
          fail-on: none
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.slither.outputs.sarif }}

For a fuller pipeline with Foundry tests, Echidna fuzzing, and optional Mythril, see Smart Contract Security in GitHub Actions.

Best Practices​

  • Start permissive, tighten over time. Report findings first, then block merges on high-severity results once false positives are understood.
  • Pin the commit. Record the commit each scan or audit covered so later changes are easy to compare.
  • Re-run after fixes. A Probe baseline makes it easy to see what changed between runs.
  • Layer methods. Automated analysis is triage, not certification. High-value systems still need tests, invariants, and independent review.

Next Steps​