CI Security: Artifact Integrity and Runtime Scanning Boundaries

CI needs explicit dependency, artifact, secret, and permission controls. Scanner input and failure policy must match the job.

1-SEC can inspect supplied security events and package-related evidence. Read a command's contract before passing source code, payloads, or artifacts.

The scan command is not a universal repository vulnerability audit. Check known-positive/benign cases, exit behavior, and the operations a CI gate actually prevents.

Check collector wiring, the current event schema, and the enforcing component before relying on a response. Preserve the original event and verify the result on your actual deployment. An emitted alert does not prove that the initiating operation was stopped.