CI/CD Integration
Add a safety gate to your pipeline. Before deploying, call the validate endpoint to check if the target cluster is safe.GitHub Actions
- name: ChangeGuard Safety Check
run: |
RESULT=$(curl -s -X POST https://api.changeguard.ai/api/validate \
-H "X-API-Key: ${{ secrets.CHANGEGUARD_KEY }}" \
-H "Content-Type: application/json" \
-d '{
"cluster_id": "production",
"resource": "deployment/${{ github.event.repository.name }}",
"namespace": "default",
"action": "image_update",
"image": "${{ env.IMAGE_TAG }}",
"user": "${{ github.actor }}",
"source": "github-actions"
}')
DECISION=$(echo $RESULT | jq -r '.decision')
SCORE=$(echo $RESULT | jq -r '.csc_score')
echo "CSC Score: $SCORE — Decision: $DECISION"
if [ "$DECISION" = "BLOCK" ]; then
echo "::error::Deployment blocked — CSC score too low ($SCORE)"
exit 1
fi
ArgoCD PreSync Hook
Add a Job with the PreSync annotation to validate before every sync:apiVersion: batch/v1
kind: Job
metadata:
name: changeguard-check
annotations:
argocd.argoproj.io/hook: PreSync
spec:
template:
spec:
containers:
- name: validate
image: curlimages/curl
command: ["sh", "-c"]
args:
- |
RESULT=$(curl -sf -X POST https://api.changeguard.ai/api/validate \
-H "X-API-Key: $(cat /secret/api-key)" \
-H "Content-Type: application/json" \
-d '{"cluster_id":"production","resource":"argocd-sync","source":"argocd"}')
DECISION=$(echo $RESULT | grep -o '"decision":"[^"]*"' | cut -d'"' -f4)
[ "$DECISION" = "BLOCK" ] && exit 1 || exit 0
restartPolicy: Never