CI/CD Operations

Define the pipeline contract

Pin the Magebean CLI version, identify the Magento root explicitly, choose a profile, disable interaction and ANSI output, and retain the job log. The CLI exits 0 when a scan completes without confirmed findings and 1 for invalid input, target/configuration errors, or confirmed findings.

php magebean.phar scan \
  --path="$CI_PROJECT_DIR" \
  --profile=basic \
  --no-interaction \
  --no-ansi

Because exit 1 has more than one cause, preserve the output and review the reported status before classifying the job as a security finding or an execution failure.

GitHub Actions

Use pipefail so writing the log with tee does not mask the Magebean exit status. Upload the log even when the scan fails.

name: magebean-security
on:
  pull_request:
  workflow_dispatch:

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install PHP and Magebean CLI
        run: |
          # Install a supported PHP version.
          curl --fail --location https://magebean.com/files/magebean.phar --output magebean.phar
      - name: Run Magebean
        shell: bash
        run: |
          set -o pipefail
          php magebean.phar scan --path=. --profile=basic --no-interaction --no-ansi \
            | tee magebean-scan.log
      - name: Retain scan log
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: magebean-scan-log
          path: magebean-scan.log

GitLab CI

magebean_scan:
  stage: test
  image: php:8.3-cli
  before_script:
    - curl --fail --location https://magebean.com/files/magebean.phar --output magebean.phar
  script:
    - set +e
    - php magebean.phar scan --path="$CI_PROJECT_DIR" --profile=basic --no-interaction --no-ansi > magebean-scan.log 2>&1
    - status=$?
    - cat magebean-scan.log
    - exit $status
  artifacts:
    when: always
    paths:
      - magebean-scan.log

Choose an image and extensions compatible with both Magebean CLI and the Magento project. Do not place credentials or Magento secrets in job output.

Generic shell pipeline

#!/usr/bin/env bash
set -euo pipefail

php magebean.phar agent:doctor
php magebean.phar scan \
  --path="${MAGENTO_ROOT:?MAGENTO_ROOT is required}" \
  --profile="${MAGEBEAN_PROFILE:-basic}" \
  --no-interaction \
  --no-ansi \
  | tee magebean-scan.log

agent:doctor is useful when the host is paired with the Security Dashboard. For a standalone scan job, validate PHP, the target path, and required filesystem access using the pipeline’s normal setup checks.

Pull requests, release gates, and schedules

Retain enough metadata to identify the CLI version, target, profile, commit or release, execution time, and result. A log is supporting evidence, not an assessment approval.

Handle approved exceptions without hiding them

Do not append || true to every scan. If an authorized process excludes a rule from a CI policy, record the rule, rationale, owner, scope, expiration, and review trigger. Use a version-controlled custom profile or explicit exclusion only when that change represents the approved pipeline policy.

Risk acceptance in the Dashboard documents a decision; it does not alter the technical result. Keep the underlying finding visible and review the exception before it expires.

Troubleshooting CI failures

• Run the same pinned command locally in a disposable environment.
• Confirm the Magento root contains the expected project files.
• Use -vvv temporarily, then review logs for sensitive environment data.
• Check that pipes preserve the Magebean exit status.
• Use the CLI troubleshooting reference for supported diagnostic options.