Current self-managed CI supports Scan only. The universal Shipmoor 0.10.0 binary runs the Scan on your runner and uses a scan-scoped SHIPMOOR_TOKEN for non-interactive account authorization.
Claim Check, Review, Test Evidence, and Blast Radius are not currently supported in self-managed CI. Do not use an interactive device credential or a broader token to work around that boundary.
Create a Scan token
From an authorized interactive environment:
shipmoor auth token create --name github-my-repo --scope scanStore the result in your CI secret named SHIPMOOR_TOKEN. Expose it to the Shipmoor process through the environment only. The token is revocable and is never copied to disk or logs by Shipmoor.
Run Scan
shipmoor scan --diff origin/main...HEAD \
--sarif --output shipmoor.sarif \
--fail-on highScan is unlimited on Free and Pro. The analysis runs locally on your runner. Shipmoor contacts the service for machine-token authorization and entitlements, but source, diffs, repository content, findings, and SARIF are not uploaded to Shipmoor by default.
You may explicitly upload the generated SARIF to your CI provider. That upload goes to the provider you configure, not to Shipmoor.
Exit codes
| Code | Meaning | CI handling |
|---|---|---|
0 | Clean | Pass |
1 | Findings met the configured gate | Fail the check; keep the completed report |
2 | Usage or configuration error | Fix the invocation |
3 | Scan failed | Treat as a tooling error |
See GitHub Actions for a complete token-authenticated workflow and SARIF & code scanning for report upload handling.
Team and Enterprise managed CI and PR checks are coming soon/contact-only and are not part of the current self-managed contract.