CircleCI

This page explains how to integrate HoundDog.ai’s code scanner with CircleCI.

Defining the Required Pipeline Variables

First, follow the steps in API Keys to generate a HoundDog.ai organization API key. Then follow the steps in the CircleCI documentation to create an environment variable named HOUNDDOG_API_KEY using the value of your key. The examples below use the implicit build job, which reads project-level environment variables. To store the key in a context instead, add an explicit workflow so the context can be attached:

workflows:
  hounddog:
    jobs:
      - build:
          context: hounddog

Defining the Scan Step in .circleci/config.yml

Next, add a new step in the .circleci/config.yml file of your repository. Here is an example which scans your repository and uploads the results to the HoundDog.ai Cloud Platform:

version: 2.1
jobs:
  build:
    docker:
      - image: hounddogai/hounddog
    steps:
      - checkout
      - run:
          name: Run HoundDog.ai Scan
          command: hounddog scan

Note that the HOUNDDOG_API_KEY variable is not referenced explicitly — CircleCI automatically injects environment variables into the build environment.

Blocking the Pipeline Upon Detecting Vulnerabilities

By default the scanner exits with code 0 (success) even when risky dataflows are found. To halt the pipeline upon detecting vulnerabilities, provide the --fail-severity-threshold option to the hounddog scan command:

version: 2.1
jobs:
  build:
    docker:
      - image: hounddogai/hounddog
    steps:
      - checkout
      - run:
          name: Run HoundDog.ai Scan
          # Fail if a risky dataflow with severity "medium" or higher is detected.
          command: hounddog scan --fail-severity-threshold=medium

The scan results still upload to the Cloud Platform before the job fails, so the platform always reflects the latest scan.

To view all available command-line options for the hounddog scan command, see Scanner Configuration.