Use Tolmo in CI/CD

Use an organization API key to run Tolmo without browser login. Create the key in Settings → API keys, then store it as TOLMO_API_TOKEN in your CI provider’s secret store. Set TOLMO_ORG_SLUG to your organization slug.

GitHub Actions

This workflow installs the CLI into a known directory and prints open critical findings:

.github/workflows/security.yml

name: Review security findings
on: [push, workflow_dispatch]
jobs:
  tolmo-check:
    runs-on: ubuntu-latest
    steps:
      - name: Install Tolmo
        run: |
          curl -fsSL https://tolmo.com/install.sh | TOLMO_INSTALL_DIR="$HOME/.local/bin" sh
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
      - name: List critical findings
        env:
          TOLMO_API_TOKEN: ${{ secrets.TOLMO_API_TOKEN }}
          TOLMO_ORG_SLUG: ${{ secrets.TOLMO_ORG_SLUG }}
        run: tolmo findings list --status open --severity critical --json

Listing findings exits successfully even when findings exist. To fail the job when the filtered list is non-empty, replace the last run value with:

run: |
  tolmo findings list --status open --severity critical --json > findings.json
  jq -e 'length == 0' findings.json

The CLI collects all matching pages before returning the array. The gate requires jq on the runner.

GitLab CI

Store the API key and organization slug in Settings → CI/CD → Variables. Mark the API key as masked.

.gitlab-ci.yml

security-check:
  image: ubuntu:24.04
  before_script:
    - apt-get update && apt-get install -y ca-certificates curl tar
    - curl -fsSL https://tolmo.com/install.sh | TOLMO_INSTALL_DIR="$HOME/.local/bin" sh
    - export PATH="$HOME/.local/bin:$PATH"
  script:
    - tolmo findings list --status open --severity critical --json

Configuration

TOLMO_API_TOKEN bypasses saved profiles. Set TOLMO_API_URL if you need an API URL other than https://api.tolmo.com. See Environment variables for precedence. API keys can read published findings and create drafts. User-only operations, including evidence attachments, require a user token and are not available with an organization API key.

Get started

Core commands

Platform features

Security agents

Configuration

Guides

Use Tolmo in CI/CD

GitHub Actions

GitLab CI

Configuration

​GitHub Actions

​GitLab CI

​Configuration

GitHub Actions

GitLab CI

Configuration