cicd-sensor: eBPF Runtime Security for CI/CD Pipelines

What it is

cicd-sensor is an open-source, eBPF-powered runtime security sensor for GitHub Actions and GitLab CI/CD, created and maintained by Hiroki Suezawa (@rung), author of the Common Threat Matrix for CI/CD Pipeline. It is pre-release and under active development — the key fact the summary omits, and the one that decides whether you deploy it in production now or only trial it.

How it works

Detection rules watch process ancestry (e.g. credential access from a process descended from npm install) and correlate signals across a job (e.g. multiple credential categories read in one run). It ships with baseline rules that are opt-out — you can disable them and keep only the collected logs and evidence, or write your own. Rule definitions live in rules/. Logs are routed through a separate cicd-sensor Manager component to cloud sinks (S3, GCS, Pub/Sub); the action can also emit a graphical report and a build attestation per run.

Preconditions / Affected

• Linux kernel 5.15+ on amd64, 6.1+ on arm64.
• Works on public and private repositories, no third-party SaaS dependency.
• Self-hosted GitHub Actions or GitLab CI/CD require following the User Guide (the one-line install below is GitHub-hosted only).

What to do

On GitHub-hosted runners, add the action as the first step in the workflow:

jobs:
  build:
    runs-on: ubuntu-24.04
    steps:
      - uses: cicd-sensor/cicd-sensor-action@6511eb44c91d71b2b93d71193b1bf2cb18352f66 # v0.0.38

Caveats

The project itself never sends data to servers it operates — but the trust boundary shifts if you point it at a third-party hosted manager. Takumi Runner by GMO Flatt Security is one such commercial hosted Manager; when configured, your logs and events go to that vendor.

flowchart TD
    A[cicd-sensor in job] --> B{Manager destination?}
    B -->|self-run S3/GCS/Pub-Sub| C[Data stays under your control]
    B -->|third-party hosted e.g. Takumi Runner| D[Logs sent to vendor service]

The Harden-Runner comparison on the page covers only StepSecurity's free tier; their paid platform adds private-repo/self-hosted support, dashboards, and policy management, so it is not a like-for-like feature comparison. Comparison data is stated as accurate "as of May 2026."