Shift-left¶

Shift-left is not a plugin. It is the same core scan you run locally, executed in CI against a Terraform plan or a repository. Plugins collect infrastructure; CI runs the analysis and publishes findings.

One command¶

cs ci init

This writes .github/workflows/cloudslash.yml, which:

1. installs CloudSlash,
2. builds tfplan.json when the repository has Terraform,
3. runs cs scan --plan=tfplan.json --format=sarif,
4. uploads cloudslash.sarif to GitHub code scanning.

Commit it and open a pull request. No provider credential is needed for a plan scan.

The workflow it writes¶

name: CloudSlash shift-left
on: [pull_request]
permissions:
  contents: read
  security-events: write
jobs:
  cloudslash:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: curl -fsSL https://get.cloudslash.dev | sh
      - run: |
          terraform init -input=false
          terraform plan -out=tfplan
          terraform show -json tfplan > tfplan.json
      - run: cs scan --plan=tfplan.json --format=sarif --output cloudslash.sarif
      - uses: github/codeql-action/upload-sarif@v3
        with: { sarif_file: cloudslash.sarif }

GitLab, CircleCI, Jenkins, and Azure Pipelines use the same command; only the YAML wrapper changes. See CI/CD.

Live scans in CI¶

A plan scan needs no account. To scan a live environment and sync it to Horizon, provide a CI session token as a secret and use the CLI login that never prompts:

export CLOUDSLASH_TOKEN="$CLOUDSLASH_TOKEN"   # repository secret
cs login
cs scan
cs sync

The token is scoped to the organization. The CLI never reads a password and never asks for a URL form.

What shift-left does not do¶

• It does not execute remediation. Plans are still reviewed and run locally.
• It does not replace a source plugin. The plugin supplies observations; the core supplies heuristics, policies, and findings.
• It does not require the TUI. The TUI is a view of the same core.