From 8fc2fa525a35137d5cfb975f8f10c4ec638ac8db Mon Sep 17 00:00:00 2001
From: ahfoysal <ahfoysal30@gmail.com>
Date: Mon, 6 Jul 2026 00:39:00 +0600
Subject: [PATCH] Add CI pipeline examples

---
 README.md                    | 13 +++++++++
 examples/github-actions.yml  | 51 ++++++++++++++++++++++++++++++++++++
 examples/gitlab-ci.yml       | 23 ++++++++++++++++
 examples/jenkins/Jenkinsfile | 31 ++++++++++++++++++++++
 4 files changed, 118 insertions(+)
 create mode 100644 examples/github-actions.yml
 create mode 100644 examples/gitlab-ci.yml
 create mode 100644 examples/jenkins/Jenkinsfile

diff --git a/README.md b/README.md
index a15f782..e83412f 100644
--- a/README.md
+++ b/README.md
@@ -197,6 +197,19 @@ directly on pull requests and in the Security tab:
 which report formats you've selected, since it targets CI/Code Scanning rather than
 local reading.
 
+### CI/CD Integration
+
+Ready-to-adapt pipeline examples live in `examples/`:
+
+- `examples/github-actions.yml` builds an image, runs the DockSec GitHub Action, uploads generated reports as an artifact, and uploads SARIF to GitHub Code Scanning.
+- `examples/gitlab-ci.yml` runs DockSec from a Docker-in-Docker GitLab job and saves the report directory as a job artifact.
+- `examples/jenkins/Jenkinsfile` builds the image, runs the CLI, and archives the generated reports.
+
+For AI-powered analysis, store your provider key as a CI secret such as
+`OPENAI_API_KEY` and pass it to DockSec through the action input or environment. Use
+`--fail-on`/`fail_on` to choose the minimum severity that should fail the build, and set
+`--output-dir`/`output_dir` to a directory your CI system uploads after the scan.
+
 ### CycloneDX SBOM
 
 `--sbom` writes a CycloneDX software bill of materials (`<image>.cdx.json`) of the
diff --git a/examples/github-actions.yml b/examples/github-actions.yml
new file mode 100644
index 0000000..f16828f
--- /dev/null
+++ b/examples/github-actions.yml
@@ -0,0 +1,51 @@
+name: DockSec Container Security Scan
+
+on:
+  push:
+    branches: [main, master]
+    paths:
+      - "Dockerfile*"
+      - ".github/workflows/docksec.yml"
+  pull_request:
+    branches: [main, master]
+    paths:
+      - "Dockerfile*"
+
+jobs:
+  docksec-scan:
+    name: Docker security analysis
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Build Docker image
+        run: docker build -t myapp:${{ github.sha }} .
+
+      - name: Run DockSec
+        uses: OWASP/DockSec@main
+        with:
+          dockerfile: Dockerfile
+          image: myapp:${{ github.sha }}
+          output_dir: results
+          format: json,html,csv
+          sarif: "true"
+          fail_on: high
+          openai_api_key: ${{ secrets.OPENAI_API_KEY }}
+
+      - name: Upload scan results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: docksec-security-report
+          path: results/
+
+      - name: Upload SARIF to GitHub Code Scanning
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results
diff --git a/examples/gitlab-ci.yml b/examples/gitlab-ci.yml
new file mode 100644
index 0000000..e37e265
--- /dev/null
+++ b/examples/gitlab-ci.yml
@@ -0,0 +1,23 @@
+docksec-scan:
+  image: docker:27
+  stage: security
+  services:
+    - docker:27-dind
+  variables:
+    DOCKER_TLS_CERTDIR: "/certs"
+    IMAGE_TAG: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHA"
+  before_script:
+    - apk add --no-cache py3-pip
+    - python3 -m pip install --break-system-packages docksec
+  script:
+    - docker build -t "$IMAGE_TAG" .
+    - docksec Dockerfile -i "$IMAGE_TAG" --fail-on high --format json,html,csv --output-dir gl-security-report
+  artifacts:
+    when: always
+    paths:
+      - gl-security-report/
+    expire_in: 1 week
+  rules:
+    - changes:
+        - Dockerfile*
+        - .gitlab-ci.yml
diff --git a/examples/jenkins/Jenkinsfile b/examples/jenkins/Jenkinsfile
new file mode 100644
index 0000000..27023bc
--- /dev/null
+++ b/examples/jenkins/Jenkinsfile
@@ -0,0 +1,31 @@
+pipeline {
+    agent any
+
+    environment {
+        IMAGE_TAG = "myapp:${env.BUILD_NUMBER}"
+    }
+
+    stages {
+        stage('Build image') {
+            steps {
+                sh 'docker build -t "$IMAGE_TAG" .'
+            }
+        }
+
+        stage('DockSec security scan') {
+            environment {
+                OPENAI_API_KEY = credentials('openai-api-key')
+            }
+            steps {
+                sh 'python3 -m pip install --user docksec'
+                sh '$HOME/.local/bin/docksec Dockerfile -i "$IMAGE_TAG" --fail-on high --format json,html,csv --output-dir results'
+            }
+        }
+    }
+
+    post {
+        always {
+            archiveArtifacts artifacts: 'results/**', allowEmptyArchive: true
+        }
+    }
+}