Any CI

The ingest script works anywhere bash, curl, and jq are available. Context that the GitHub Action auto-detects is supplied through environment variables instead.

What gets sent

Step	Endpoint	When
exec-start	POST /api/v1/ingest/executions (status running)	Before the plan or apply
plan	POST /api/v1/ingest/terraform-plans	After terraform show -json
exec-finish	POST /api/v1/ingest/executions (final status)	After the plan or apply

Both endpoints are idempotent on (source, external_id), so re-running a pipeline never creates duplicates.

Generic CI

export CRITIAS_API_URL=https://api.example.com
export CRITIAS_TOKEN="$CRITIAS_INGEST_TOKEN"
export CRITIAS_SOURCE=gitlab_ci # or jenkins / codebuild / other
export CRITIAS_REPOSITORY="$CI_PROJECT_PATH"
export CRITIAS_EXTERNAL_ID="$CI_PIPELINE_ID"
export CRITIAS_EXTERNAL_URL="$CI_PIPELINE_URL"
export CRITIAS_COMMIT_SHA="$CI_COMMIT_SHA"
export CRITIAS_BRANCH="$CI_COMMIT_REF_NAME"

./scripts/critias-ingest.sh exec-start
terraform plan -out=tfplan
terraform show -json tfplan > tfplan.json
./scripts/critias-ingest.sh plan tfplan.json
./scripts/critias-ingest.sh exec-finish succeeded

The variables above are GitLab CI’s; substitute your system’s equivalents. The full list of recognised variables is documented at the top of scripts/critias-ingest.sh.

Atlantis

Atlantis custom workflows run shell steps. Call the script after plan, and again after apply with CRITIAS_KIND=apply. Vendor the script into your infrastructure repository, or curl it in the step.

# atlantis.yaml (repo-level custom workflow)
workflows:
  critias:
    plan:
      steps:
        - init
        - plan
        - run: terraform show -json $PLANFILE > $PLANFILE.json
        - env:
            name: CRITIAS_SOURCE
            command: 'echo atlantis'
        - run: |
            CRITIAS_EXTERNAL_ID="atlantis-$HEAD_COMMIT-$WORKSPACE" \
            CRITIAS_REPOSITORY="$BASE_REPO_OWNER/$BASE_REPO_NAME" \
            CRITIAS_PROJECT_PATH="$PROJECT_NAME" \
            CRITIAS_WORKSPACE="$WORKSPACE" \
            CRITIAS_COMMIT_SHA="$HEAD_COMMIT" \
            CRITIAS_PR_NUMBER="$PULL_NUM" \
            ./scripts/critias-ingest.sh plan "$PLANFILE.json"

Set CRITIAS_API_URL and CRITIAS_TOKEN in the Atlantis server environment rather than in the repository configuration.

Requirements

• bash, curl, and jq on the runner.
• Network egress from the runner to your Aletheia API URL.
• An ingest token. See Ingest tokens.

Payload size

Plans larger than the configured maximum (32 MiB by default) are rejected with HTTP 413. terraform show -json output is typically well under this.

Where to go next

• GitHub Actions if you use GitHub Actions.
• API for calling the ingest endpoints directly.