Vulkro on CircleCI

Add Vulkro to a project's .circleci/config.yml as a job that installs the CLI, runs vulkro scan ci, archives the SARIF and JUnit reports, and gates pull requests against a base ref. The config below is self-contained.

Minimal config

version: 2.1

jobs:
  vulkro:
    docker:
      - image: cimg/base:current
    # VULKRO_ACCOUNT_TOKEN: a project environment variable (or context)
    # holding your CI key
    steps:
      - checkout
      - run:
          name: Install Vulkro
          command: curl -fsSL https://dist.vulkro.com/install.sh | bash
      - run:
          name: Sign in with the CI key
          command: vulkro login
      - run:
          name: Scan
          environment:
            VULKRO_OFFLINE: "1"
          command: |
            vulkro scan ci . --format sarif --output vulkro.sarif
            vulkro scan ci . --format junit --output vulkro.junit.xml
      - store_artifacts:
          path: vulkro.sarif
      - store_test_results:
          path: vulkro.junit.xml
      - run:
          name: Gate on new findings
          command: vulkro gate --base origin/main

workflows:
  security:
    jobs:
      - vulkro

What each step does

• The install step downloads the Vulkro CLI for the executor's platform.
• vulkro login exchanges the CI key in VULKRO_ACCOUNT_TOKEN for a lease. Every machine that scans needs an active trial or Pro, CI runners included: create a CI key in the customer portal (app.vulkro.com) and store it as a project environment variable or in a context. A CI key works for the 14-day trial and for paid plans, uses no device seat, and can be revoked. Without it, the scan step fails with exit code 1 and license_required. An air-gapped executor uses VULKRO_LICENSE_B64 (the base64 of a .lic licence file) instead, with no vulkro login step. See Accounts and licensing.
• vulkro scan ci runs the scan in CI mode and writes the requested format to the --output path. Run it once per format you want to publish.
• store_artifacts and store_test_results surface the SARIF artefact and the JUnit report in the CircleCI UI.
• vulkro gate fails the build only on findings that are new relative to the base ref, so pre-existing debt never blocks a build. See vulkro gate.

VULKRO_OFFLINE=1 on the scan step keeps the scanner from making outbound calls (it is not set on the sign-in step, which needs the network). Remove it if a pipeline needs live CVE-feed updates inside the scan.

Exit codes

Code	Meaning
0	Clean: no findings or gate cleared.
1	Findings present or gate failed, or no licence (license_required). The workflow step fails.
2	Internal error. The workflow step fails.