Vulnetix CLI & GitHub Action
Automated vulnerability management for your CI/CD pipelines and development workflows.
Contents
GitHub Action
This GitHub Action provides the Vulnetix CLI for your workflows, enabling automated vulnerability scanning directly in your CI/CD pipeline.
Basic Usage
- name: Vulnetix Scan
uses: Vulnetix/[email protected]
with:
org-id: ${{ secrets.VULNETIX_ORG_ID }}
api-key: ${{ secrets.VULNETIX_API_KEY }}
Workflow Examples
Scan on Pull Request
name: Security Scan
on: [pull_request]
permissions:
contents: read
jobs:
vulnetix:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- uses: Vulnetix/cli@v3
with:
org-id: ${{ secrets.VULNETIX_ORG_ID }}
api-key: ${{ secrets.VULNETIX_API_KEY }}
Upload Artifacts
- uses: Vulnetix/[email protected]
with:
org-id: ${{ secrets.VULNETIX_ORG_ID }}
api-key: ${{ secrets.VULNETIX_API_KEY }}
task: upload
artifact-path: ./reports/
See GitHub Actions documentation for complete configuration options, and Artifact Upload guide for uploading workflow artifacts to Vulnetix.
Other CI/CD Platforms
Claude Code Plugin
Integrate Vulnetix vulnerability intelligence directly into Claude Code with automated pre-commit scanning, six interactive analysis skills, and multi-hook architecture.
Install
Add the marketplace:
/plugin marketplace add Vulnetix/pix-ai-coding-assistant
Install the plugin:
/plugin install vulnetix@vulnetix-plugins
Upgrade
/plugin update vulnetix
Requires: Vulnetix CLI installed and authenticated (vulnetix auth login).
Full plugin documentation | Plugin repository
CLI Installation
Architecture support: AMD64, ARM64, ARM, 386.
Quick Start
brew install vulnetix/tap/vulnetix
vulnetix auth login
vulnetix vdb status
See CLI Documentation for complete usage and command reference.
Available Tasks
| Task | Description | Use Case |
|---|
info | Auth healthcheck (default) | Verify credential setup |
Using the CycloneDX Go Module
Other Go projects can generate the same Vulnetix CycloneDX document shape by
importing github.com/Vulnetix/vdb-cyclonedx directly:
package main
import (
"os"
cyclonedx "github.com/Vulnetix/vdb-cyclonedx"
)
func main() {
bom, err := cyclonedx.BuildSBOM(cyclonedx.SBOMInventory{
Packages: []cyclonedx.SBOMPackage{{
Name: "example",
Version: "1.2.3",
Ecosystem: "golang",
Scope: "production",
SourceFile: "go.mod",
SourceType: "manifest",
IsDirect: true,
}},
}, cyclonedx.SBOMOptions{
SpecVersion: "1.7",
ToolName: "my-builder",
ToolVersion: "1.0.0",
})
if err != nil {
panic(err)
}
_ = os.WriteFile("sbom.cdx.json", bom, 0o644)
}
BuildSBOM can also merge AIDetections and CryptoDetections so a single
CycloneDX file carries package SBOM, AIBOM and CBOM components, accepts a resolved
dependency graph via SBOMInventory.Dependencies, and takes an optional
SBOMOptions.CanonicalSPDXID hook so recognised licenses are emitted as
license.id instead of free text. The builder validates the output against the
bundled CycloneDX schema before returning JSON.
vulnetix cdx (alias vulnetix sbom) is the CLI front end for this: it discovers packages from
manifests, installed package trees, container package databases, Dockerfiles,
CI/CD pipeline files, shell scripts and the metadata compiled into Go, Rust and
JVM artefacts, then writes one validated CycloneDX file offline.
Documentation
