DepWarden for GitLab CI, Jenkins, CircleCI and Azure Pipelines

There is no dedicated marketplace package for these four — the same @lowdep/depwarden npm CLI that powers the GitHub Action runs as a plain build step anywhere Node is available, which is every one of them out of the box. Below is a working step for each, using the CLI's real, documented flags.

Prerequisites

Node.js ≥ 18 available on the runner/agent (already true for GitLab's, CircleCI's and Azure's standard images; Jenkins agents typically need a NodeJS tool/plugin configured)
An API key stored as that platform's own secret/credential mechanism — never inlined in the pipeline file

Install and run

GitLab CI (.gitlab-ci.yml)

security_scan:
  image: node:20
  stage: test
  script:
    - npx @lowdep/depwarden --fail-on-error true
  variables:
    APP_API_KEY: $DEPWARDEN_API_KEY

Add DEPWARDEN_API_KEY under Settings → CI/CD → Variables (masked, protected). Omit the variables block entirely to run anonymous SCA with no key.

Jenkins (Jenkinsfile, declarative)

pipeline {
  agent any
  environment {
    APP_API_KEY = credentials('depwarden-api-key')
  }
  stages {
    stage('Security scan') {
      steps {
        sh 'npx @lowdep/depwarden --fail-on-error true'
      }
    }
  }
}

credentials('depwarden-api-key') binds a Jenkins Credentials-store secret text entry of that ID to the APP_API_KEY env var for this stage only.

CircleCI (.circleci/config.yml)

version: 2.1
jobs:
  security-scan:
    docker:
      - image: cimg/node:20.11
    steps:
      - checkout
      - run: npx @lowdep/depwarden --fail-on-error true
workflows:
  main:
    jobs:
      - security-scan

CircleCI injects Project Settings → Environment Variables into every job automatically — set APP_API_KEY there, no explicit binding needed.

Azure Pipelines (azure-pipelines.yml)

trigger:
  - main
pool:
  vmImage: 'ubuntu-latest'
steps:
  - task: NodeTool@0
    inputs:
      versionSpec: '20.x'
  - script: npx @lowdep/depwarden --fail-on-error true
    displayName: 'DepWarden security scan'
    env:
      APP_API_KEY: $(DEPWARDEN_API_KEY)

Define DEPWARDEN_API_KEY as a secret pipeline variable (Pipeline → Edit → Variables → keep this value secret), then map it explicitly via env: — Azure does not auto-inject secret variables the way CircleCI does.

Configuration

--api-key / APP_API_KEY — Your DepWarden API key. Use DEMO for three free full-fidelity scans, or omit entirely for anonymous SCA.
--fail-on-error (default true) — Exit 1 when the server-side gate result is "fail". Pass false to run advisory-only and never block the build.
--formats (default html) — Comma-separated report formats: html, pdf, xlsx, json, csv.
--out (default depwarden-reports) — Directory where reports are written — publish this as a build artifact on each platform to keep the reports.
--api-url (default https://depwarden.in) — Override API base URL for self-hosted deployments.

Failing the build

Same server-side gate verdict as the npm CLI docs above (driven by your workspace's Policy rules): exits 1 when the gate result is "fail", or 0 with --fail-on-error false for advisory-only runs. This is the identical CLI underneath all four platforms — nothing platform-specific about the gating behaviour.

Report formats

HTML (default)
PDF
Excel (XLSX)
JSON (CycloneDX SBOM)
CSV

Every scan can also export a CycloneDX SBOM.