Skip to content

Configuration

Learn how to configure Sentinel CI for your CI/CD platform.

Environment Variables

Sentinel CI uses environment variables for configuration. Copy .env.example to .env:

cp .env.example .env

Platform Configuration

Prerequisites

  • Jenkins 2.x or higher
  • Plugins: wfapi (for Pipeline), junit (for tests)
  • API token with read permissions

Configuration

CI_PLATFORM=jenkins
JENKINS_URL=https://jenkins.example.com
JENKINS_TOKEN=username:api_token_here

Getting Your Token

  1. Log into Jenkins
  2. Click your username (top right)
  3. Click Configure
  4. Under API Token, click Add new Token
  5. Give it a name (e.g., "sentinel-ci")
  6. Copy the token (format: username:token)

Testing Connection

curl -u username:token https://jenkins.example.com/api/json

Prerequisites

  • GitHub repository with Actions enabled
  • Personal Access Token or GitHub App

Configuration

CI_PLATFORM=github-actions
GITHUB_TOKEN=ghp_xxxxxxxxxxxxxxxxxxxx
GITHUB_OWNER=your-organization
GITHUB_REPO=your-repository

Getting Your Token

  1. Go to Settings → Developer settings → Personal access tokens
  2. Click Generate new token (fine-grained)
  3. Select repository access
  4. Grant permissions:
  5. actions:read
  6. contents:read
  7. metadata:read
  8. Generate and copy token

Testing Connection

curl -H "Authorization: Bearer $GITHUB_TOKEN" \
     https://api.github.com/repos/owner/repo/actions/runs

Prerequisites

  • GitLab instance (GitLab.com or self-hosted)
  • Project access token or personal access token

Configuration

CI_PLATFORM=gitlab-ci
GITLAB_URL=https://gitlab.com
GITLAB_TOKEN=glpat-xxxxxxxxxxxxxxxxxxxx
GITLAB_PROJECT_ID=12345

Getting Your Token

  1. Go to Settings → Access Tokens
  2. Create token with name "sentinel-ci"
  3. Select scopes: read_api
  4. Click Create project access token
  5. Copy token

Finding Project ID

Project ID is shown at the top of your project's main page, or:

# Using project path
GITLAB_PROJECT_ID=group/project
# Or numeric ID
GITLAB_PROJECT_ID=12345

Testing Connection

curl -H "PRIVATE-TOKEN: $GITLAB_TOKEN" \
     https://gitlab.com/api/v4/projects/12345

Advanced Configuration

Cache Settings

# Cache TTL in seconds (default: 120)
CACHE_TTL=120

# Maximum cache size (default: 1000)
CACHE_MAX_SIZE=1000

Logging

# Log level: DEBUG, INFO, WARNING, ERROR, CRITICAL
LOG_LEVEL=INFO

# Log format: json or text
LOG_FORMAT=text

Security

# Enable secret redaction (default: true)
REDACTION_ENABLED=true

# Custom redaction patterns (comma-separated regex)
CUSTOM_REDACTION_PATTERNS=

MCP Server

# Server transport: stdio or http
MCP_TRANSPORT=stdio

# HTTP settings (if MCP_TRANSPORT=http)
MCP_HTTP_PORT=8000
MCP_HTTP_HOST=localhost

Multiple Platforms

To use multiple platforms, create separate configuration files:

# jenkins.env
CI_PLATFORM=jenkins
JENKINS_URL=...
JENKINS_TOKEN=...

# github.env
CI_PLATFORM=github-actions
GITHUB_TOKEN=...

Run with different configs:

# Terminal 1: Jenkins
export $(cat jenkins.env | xargs)
python -m sentinel_ci.server

# Terminal 2: GitHub
export $(cat github.env | xargs)
python -m sentinel_ci.server --port 8001

Configuration Validation

Test your configuration:

# Run health check
PYTHONPATH=. python -c "
from sentinel_ci.server import client
result = client.health_check()
print(result)
"

Expected output: 

{
  "status": "healthy",
  "platform": "jenkins",
  "timestamp": "2026-01-23T10:30:00Z"
}

Security Best Practices

Never Commit Credentials

  • Add .env to .gitignore (already done)
  • Use environment variables
  • Rotate tokens regularly (every 90 days)

Use Read-Only Tokens

Grant minimal permissions: - Jenkins: Job/Read, Job/Workspace - GitHub: actions:read, contents:read - GitLab: read_api only

Production Deployment

For production: - Use secret management (AWS Secrets Manager, Vault) - Enable audit logging - Monitor token usage - Set up alerting

Troubleshooting

Connection Refused
  • Check URL format (no trailing slash)
  • Verify network connectivity
  • Check firewall/VPN settings
  • Test with curl
Authentication Failed
  • Verify token format
  • Check token hasn't expired
  • Ensure correct permissions
  • Test token manually
Rate Limit Exceeded
  • GitHub: Check rate limit status
  • Increase cache TTL
  • Use GitHub App instead of PAT

Next Steps