Google Cloud Build

Cloud Build runs the scanner image directly as a build step, no plugin, no Docker-in-Docker, and it works in restricted pools with no egress. Your code never leaves the build.

01 · Setup

2 steps.

01Add the build step

Reference the scanner image as a step in your cloudbuild.yaml. Cloud Build runs it directly, no Docker-in-Docker.

steps:
  - name: "ghcr.io/nirvahana/dpdp-scan@sha256:e0f57fe4eb8e507a994302b6cbf61e310a727ccc1af3f4a06265dd6b87eedd78"
    args: ["scan", ".", "--no-ai",
           "--frameworks", "dpdpa,hipaa",
           "--fail-on", "high",
           "--sarif-output", "scrutora.sarif"]

02Archive the report (optional)

Publish the SARIF to a GCS bucket with the build artifacts block so the report is kept alongside your build.

artifacts:
  objects:
    location: "gs://YOUR_BUCKET/scrutora/"
    paths: ["scrutora.sarif"]

02 · What you get

After the first run.

Native build step

The scanner image is the step. No plugin, no Docker-in-Docker.

Build gating

A non-zero fail-on severity fails the build and blocks the pipeline.

SARIF to GCS

Archive the report to a bucket via the artifacts block.

Works in restricted pools

Fully offline, so it runs in VPC-SC and private pools with no egress.

03 · Questions

The ones people actually ask.

Does it work in private / VPC-SC pools?

Yes. The scan runs entirely offline inside the step, so it works in restricted build pools with no outbound access.

Which frameworks are supported?

DPDPA, HIPAA, GDPR, PCI-DSS, RBI and more, set the --frameworks flag.

Is it free?

Yes, the CI scanning is free with no API key or account.

View config on GitHub

04 · Try itPUBLIC REPOSITORIES

Wire it into a build.

A public repository, read once and not kept. You get the data map: every personal-data field, where it lands, and who receives it. Or run the container on your own runner, and the source never reaches us.