Add CI pipeline examples

README.md

@@ -197,6 +197,19 @@ directly on pull requests and in the Security tab:
 which report formats you've selected, since it targets CI/Code Scanning rather than
 local reading.
 
+### CI/CD Integration
+
+Ready-to-adapt pipeline examples live in `examples/`:
+
+- `examples/github-actions.yml` builds an image, runs the DockSec GitHub Action, uploads generated reports as an artifact, and uploads SARIF to GitHub Code Scanning.
+- `examples/gitlab-ci.yml` runs DockSec from a Docker-in-Docker GitLab job and saves the report directory as a job artifact.
+- `examples/jenkins/Jenkinsfile` builds the image, runs the CLI, and archives the generated reports.
+
+For AI-powered analysis, store your provider key as a CI secret such as
+`OPENAI_API_KEY` and pass it to DockSec through the action input or environment. Use
+`--fail-on`/`fail_on` to choose the minimum severity that should fail the build, and set
+`--output-dir`/`output_dir` to a directory your CI system uploads after the scan.
+
 ### CycloneDX SBOM
 
 `--sbom` writes a CycloneDX software bill of materials (`<image>.cdx.json`) of the

examples/github-actions.yml

@@ -0,0 +1,51 @@
+name: DockSec Container Security Scan
+
+on:
+  push:
+    branches: [main, master]
+    paths:
+      - "Dockerfile*"
+      - ".github/workflows/docksec.yml"
+  pull_request:
+    branches: [main, master]
+    paths:
+      - "Dockerfile*"
+
+jobs:
+  docksec-scan:
+    name: Docker security analysis
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Build Docker image
+        run: docker build -t myapp:${{ github.sha }} .
+
+      - name: Run DockSec
+        uses: OWASP/DockSec@main
+        with:
+          dockerfile: Dockerfile
+          image: myapp:${{ github.sha }}
+          output_dir: results
+          format: json,html,csv
+          sarif: "true"
+          fail_on: high
+          openai_api_key: ${{ secrets.OPENAI_API_KEY }}
+
+      - name: Upload scan results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: docksec-security-report
+          path: results/
+
+      - name: Upload SARIF to GitHub Code Scanning
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results

examples/gitlab-ci.yml

@@ -0,0 +1,23 @@
+docksec-scan:
+  image: docker:27
+  stage: security
+  services:
+    - docker:27-dind
+  variables:
+    DOCKER_TLS_CERTDIR: "/certs"
+    IMAGE_TAG: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHA"
+  before_script:
+    - apk add --no-cache py3-pip
+    - python3 -m pip install --break-system-packages docksec
+  script:
+    - docker build -t "$IMAGE_TAG" .
+    - docksec Dockerfile -i "$IMAGE_TAG" --fail-on high --format json,html,csv --output-dir gl-security-report
+  artifacts:
+    when: always
+    paths:
+      - gl-security-report/
+    expire_in: 1 week
+  rules:
+    - changes:
+        - Dockerfile*
+        - .gitlab-ci.yml

examples/jenkins/Jenkinsfile

@@ -0,0 +1,31 @@
+pipeline {
+    agent any
+
+    environment {
+        IMAGE_TAG = "myapp:${env.BUILD_NUMBER}"
+    }
+
+    stages {
+        stage('Build image') {
+            steps {
+                sh 'docker build -t "$IMAGE_TAG" .'
+            }
+        }
+
+        stage('DockSec security scan') {
+            environment {
+                OPENAI_API_KEY = credentials('openai-api-key')
+            }
+            steps {
+                sh 'python3 -m pip install --user docksec'
+                sh '$HOME/.local/bin/docksec Dockerfile -i "$IMAGE_TAG" --fail-on high --format json,html,csv --output-dir results'
+            }
+        }
+    }
+
+    post {
+        always {
+            archiveArtifacts artifacts: 'results/**', allowEmptyArchive: true
+        }
+    }
+}