Agent Skills › asamassekou10/ship-safe › ship-safe-ci

ship-safe-ci

GitHub

辅助用户在 CI/CD 流水线中集成 Ship Safe 安全门禁，执行扫描并解释结果。支持 GitHub Actions 和 GitLab CI 的自动化配置，提供 SARIF 报告上传及基线管理建议，确保代码与依赖安全。

claude-code-plugin/skills/ship-safe-ci/SKILL.md asamassekou10/ship-safe

Trigger Scenarios

设置 CI/CD 安全门禁测试流水线配置集成安全扫描工具

Install

npx skills add asamassekou10/ship-safe --skill ship-safe-ci -g -y

More Options

Non-standard path

npx skills add https://github.com/asamassekou10/ship-safe/tree/main/claude-code-plugin/skills/ship-safe-ci -g -y

Use without installing

npx skills use asamassekou10/ship-safe@ship-safe-ci

指定 Agent (Claude Code)

npx skills add asamassekou10/ship-safe --skill ship-safe-ci -a claude-code -g -y

安装 repo 全部 skill

npx skills add asamassekou10/ship-safe --all -g -y

预览 repo 内 skill

npx skills add asamassekou10/ship-safe --list

SKILL.md

Frontmatter

{
    "name": "ship-safe-ci",
    "description": "Run Ship Safe in CI mode — compact output, exit codes, SARIF generation. Use when the user wants to set up CI\/CD security gates or test their pipeline configuration.",
    "argument-hint": "[path] [--threshold <score>] [--fail-on <severity>] [--sarif <file>]"
}

Ship Safe — CI Pipeline Mode

You are helping the user set up Ship Safe as a security gate in their CI/CD pipeline.

Step 1: Run CI scan

npx ship-safe@latest ci $ARGUMENTS 2>/dev/null

Default: pass/fail based on score >= 75.

Options:

--threshold 60 — custom passing score
--fail-on critical — only fail on critical findings
--fail-on high — fail on critical or high
--sarif results.sarif — SARIF output for GitHub Code Scanning
--baseline — only check new findings
--json — JSON output for custom integrations
--no-deps — skip dependency audit

Step 2: Interpret results

The command outputs a compact one-line summary:

[ship-safe] Score: 82/100 (B) | Findings: 12 (0C 3H 9M) | CVEs: 2 | 4.2s
[ship-safe] PASS

Or on failure:

[ship-safe] Score: 58/100 (C) | Findings: 25 (3C 8H 14M) | CVEs: 5 | 6.1s
[ship-safe] FAIL: Score 58 < threshold 75

Exit code 0 = pass, exit code 1 = fail.

Step 3: Help set up CI integration

Based on the user's CI platform, offer to create or update their workflow file:

GitHub Actions

- name: Security Scan
  run: npx ship-safe@latest ci . --threshold 75 --sarif results.sarif

- name: Upload SARIF
  if: always()
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif

GitLab CI

security-scan:
  script:
    - npx ship-safe@latest ci . --threshold 75 --json > security-report.json
  artifacts:
    reports:
      sast: security-report.json

Generic CI

npx ship-safe@latest ci . --threshold 75 || exit 1

Step 4: Suggest baseline workflow

If there are many findings:

Create a baseline: npx ship-safe baseline .
Use --baseline in CI to only catch new vulnerabilities
Gradually fix baselined issues over time

Important Notes

CI mode suppresses all spinners and color for clean log output
The SARIF file can be uploaded to GitHub Code Scanning for inline PR annotations
Use --fail-on critical for a gradual rollout — start strict only for critical issues