CI and Automation

Runtime scans run in server and CI environments. Keep the runner process running until the hosted workflow completes.

const controller = new AbortController();

const { report } = await zeroleaks.runtimeScans.run(target, {
  signal: controller.signal,
  timeoutMs: 45 * 60 * 1000,
  eventConcurrency: 4,
  workerStallTimeoutMs: 6 * 60_000,
  onPoll: ({ currentPhase }) => console.log(currentPhase),
});

if (report.overallScore < 80) {
  process.exitCode = 1;
}

Recommended workflowCopy Anchor Link

1. Build the production agent with test credentials and isolated dependencies.
2. Run unit and integration tests first.
3. Start a ZeroLeaks runtime scan.
4. Upload or retain the returned report as a CI artifact.
5. Gate releases on score, vulnerability level, component scores, or finding severity.

Each scan tests the agent's current behavior. After you fix a finding, the next CI run repeats the attacks so that a regression fails the release gate.

Plan throughputCopy Anchor Link

Scans are unlimited on paid plans. Each plan caps how many scans run at once and how many start in a rolling hour, counted across runtime, endpoint, prompt, and skill scans. Starting a scan past either cap returns 429 with code SCAN_CONCURRENCY_LIMIT or SCAN_HOURLY_LIMIT and a message saying when the next scan can start. Serialize scans across parallel CI jobs, or use a plan with more concurrent scans. See pricing for each plan's limits.

CancellationCopy Anchor Link

Abort signals and local timeouts trigger best-effort cancellation of the hosted workflow. You can also cancel explicitly:

await zeroleaks.runtimeScans.cancel(runtimeScanId);

If a runner exits unexpectedly, the current relay event eventually times out and the scan is marked failed rather than silently producing a partial success. Version 0.2.2 also detects a hosted worker that stops making progress and cancels the run instead of polling indefinitely.