Scan from CI/CD

In a pipeline, Socket runs as the Python CLI socketcli. It scans the checkout, comments on the pull or merge request, and exits non-zero when a change introduces an alert your policy sets to Block.

On GitHub, use the GitHub App or a pipeline on a given repository, not both, so developers don't get two sets of comments.

Set it up

Socket's docs have a setup guide for each platform, under CI-CD Integrations. Each one covers the API token, the secret to store it in, and a pipeline to copy.

To make a failed scan block the merge, mark the Socket job as required in your platform's merge settings. On GitHub, that's the branch protection step in Tune policy and enforce.

Gradle, Kotlin and sbt projects need the build tool to resolve dependencies before the scan. Follow Gradle setup instructions.

One-off scan from a workstation

To baseline a repository from any source control system without touching its pipeline, scan a checkout and mark it as the default branch, so it feeds the Alerts page:

cd /path/to/your-repo
socket login
socket scan create --org=your-org --repo="your-repo" --branch="main" --default-branch --no-interactive .

The scan ends with:

✔ Scan completed successfully!
View report at: https://socket.dev/dashboard/org/your-org/sbom/<scanId>

Always pass --org and --no-interactive in scripts. Without them the CLI prompts for an org, or waits for an answer to "open in browser?", and hangs.

Verify

• The job runs on every push and on every pull or merge request
• A Socket comment appears on a pull or merge request that changes a manifest
• A dependency your policy blocks fails the job with a non-zero exit
• The scan appears under the repository in the dashboard