ciSystem foundation
ciSystem is the field LGTM Security stamps on every finding to record which CI provider the file belongs to — github-actions, gitlab-ci, circleci, azure-pipelines, jenkins, bitbucket-pipelines, or generic. It's the multi-CI data-model foundation.
Why a stamped field
LGTM Security ships detectors for 4 CI systems today (GitHub Actions, GitLab CI, CircleCI, Azure Pipelines) with more on the roadmap. Users need to be able to filter their findings by CI provider — 'show me all the shell-injection findings on GitLab' — without every dashboard query having to re-classify files.
So every finding gets a ciSystem stamp at insert time via pathToCiSystem(f.file). The classifier is the single source of truth: detectors don't set ciSystem themselves. This means adding a new CI system is a rules-file plus a path-pattern in one place, not a schema migration.
The design invariant
Rules in gitlab-ci.ts, circleci.ts, azure-pipelines.ts, and future CI detector files MUST NOT set ciSystem on their own findings. runAllRules() post-hoc stamps every finding via pathToCiSystem(f.file). This is single-source derivation — if a detector authored to a new CI system copy-pasted from an existing one and forgot to update the stamp, findings would land in the wrong bucket.
Where it shows up
The audit log stores ciSystem on every SecurityAuditLog row. A compound index on (repoId, ciSystem, detectedAt) makes CI-scoped queries fast. The upcoming dashboard 'filter by CI system' picker uses it. The CLI's `lgtm audit --ci gitlab-ci` flag uses it.
The seven allowed values: github-actions, gitlab-ci, circleci, azure-pipelines, jenkins, bitbucket-pipelines, generic. 'Generic' is the fallback for files whose path pattern doesn't match any known CI (e.g. source files that fire secrets.hardcoded).
See the CI system support matrix
Detector coverage per CI provider
Go to the product pageFAQs
Do all 36 detectors run on every CI file?
No — detectors are CI-specific by shape. GitHub Actions gets 21 workflow-YAML detectors; GitLab/CircleCI/Azure each get 5 CI-specific detectors. secrets.hardcoded is CI-agnostic and fires on every CI file type.
What CI systems are on the roadmap?
Per-CI parity with the full GitHub Actions detector suite is the next Phase for GitLab / CircleCI / Azure. Jenkins and Bitbucket Pipelines currently only fire secrets.hardcoded — full detector suites are on the roadmap but not scheduled.
Related terms
CI/CD security
CI/CD security covers the attack surface introduced by your build and deploy pipelines: GitHub Actions workflows, Dockerfiles, IaC configs, dependency management, and secret handling. Distinct from (and complementary to) application-layer AppSec.
Organization policy
An organization policy is a shared LGTM Security policy that applies to every repository attached to an organization. Repos can layer their own overrides on top, except on rules the org marks as Enforced.