stackhawk-hawkscan-ci

HawkScan CI Skill

This skill graduates a working local HawkScan setup into a CI/CD pipeline. It is a wrapper around the local-scan path the hawkscan skill owns — it never generates stackhawk.yml, never picks auth recipes, never parses findings. Its scope is the pipeline file alone.

Hand-off rule: if stackhawk.yml doesn't exist or doesn't validate, the agent must invoke the hawkscan skill first. This skill does not onboard apps from scratch.

---

Step 0: Hand-off Check

Before doing anything CI-specific, confirm the local scan path is in place. Run:

test -f stackhawk.yml || echo "MISSING_CONFIG"
timeout 30 hawk validate config stackhawk.yml 2>&1 | head -20

If stackhawk.yml is missing, validation fails, or applicationId is still a placeholder (${APP_ID} with no real value, or literal your-app-id):

"I need a working local scan first. Run the hawkscan skill (or invoke it explicitly) to generate and validate stackhawk.yml, then come back here."

Stop. Do not proceed. That message is the entire output: do not preview the pipeline (no action names, images, secrets, triggers, or workflow snippets) — the provider and shape are decided only once stackhawk.yml validates.

---

Step 1: Detect the CI Provider

Glob the repo for known CI config locations:

ls .github/workflows/*.yml .github/workflows/*.yaml 2>/dev/null
ls .gitlab-ci.yml 2>/dev/null
ls Jenkinsfile* 2>/dev/null
ls .circleci/config.yml 2>/dev/null
ls azure-pipelines*.yml 2>/dev/null
ls bitbucket-pipelines.yml 2>/dev/null
ls .buildkite/pipeline.yml 2>/dev/null
ls .travis.yml 2>/dev/null
ls -d bamboo-specs 2>/dev/null
ls concourse/*.yml 2>/dev/null
ls -d harness 2>/dev/null
ls appspec.yml buildspec.yml 2>/dev/null

Match	Provider
.github/workflows/*.yml, *.yaml	GitHub Actions
.gitlab-ci.yml	GitLab CI/CD
Jenkinsfile, Jenkinsfile.*	Jenkins
.circleci/config.yml	CircleCI
azure-pipelines*.yml	Azure Pipelines
bitbucket-pipelines.yml	Bitbucket Pipelines
.buildkite/pipeline.yml	Buildkite
.travis.yml	Travis CI
bamboo-specs/	Bamboo
appspec.yml, buildspec.yml	AWS CodeBuild / CodeDeploy
concourse/*.yml (heuristic — confirm with user)	Concourse
harness/	Harness