GuideStablev3.7.0

Add Fendix to CI

Make the scan, decision, exit behavior, and evidence lifecycle explicit before provider syntax.

On this page

What should a Fendix CI gate guarantee?

Define the decision boundary first

Choose the release threshold and required coverage before writing provider YAML. CI should preserve the report even when the gate fails so reviewers can inspect why.

Start with one reproducible command

Exit 1 means a finding reached BLOCK. Exit 2 means the requested scan or coverage contract was not fulfilled. Upload the report in both cases.

terminal

fendix scan \
  --code . \
  --fail-on HIGH \
  --fail-on-coverage-gap \
  --format sarif \
  --output results.sarif

Apply provider-specific wiring

Use the supported CI/CD and integrations page for GitHub Actions, GitLab CI, SARIF upload, Jira, notifications, and customer-hosted runners. Avoid copying provider credentials into repository policy.

Why does this work this way?

Read The Fendix decision model and Coverage. Process behavior is in Exit codes, and exact flags are in the scan reference.