Getting started
Quickstart
One command installs the scanner and signs your machine in. A second one runs your first scan. The same scan runs in CI with a Workspace Token.
Install and sign in
The installer prints a link and opens it in your browser. Sign in with GitHub if you have not yet (your personal workspace is created for you), check that the page shows the same code as your terminal, pick the workspace your scans go to when the page lists more than one, and approve. The installer then downloads the build for your machine and stores the sign-in on this machine.
macOS, Linux, WSL:
curl -fsSL https://atmoslab.dev/install.sh | bash
Windows PowerShell:
irm https://atmoslab.dev/install.ps1 | iex
Then open a new terminal, where atmos is on your PATH.
The scanner installs to ~/.local/bin (%LOCALAPPDATA%\Atmos\bin on Windows). To install a specific version, older releases included, pass it to the macOS and Linux script as bash -s 1.2.3. In PowerShell, run:
& ([scriptblock]::Create((irm https://atmoslab.dev/install.ps1))) -Target 1.2.3
Over SSH, or when no browser opens, copy the printed link into any browser.
If the macOS and Linux script stops with the download's signature could not be checked, install ssh-keygen (OpenSSH 8.1 or later) or openssl (OpenSSL 3.0 or later) and run the script again. To install anyway, run the script as bash -s -- --allow-unverified or with ATMOS_ALLOW_UNVERIFIED=1 set. The script still verifies the checksum and prints that the signature was not checked.
To confirm the install worked, run:
atmos --version
From here on, atmos self-update keeps the binary current, and atmos logout signs the machine out. Every machine you sign in on is listed on the Tokens page on the platform, where you can revoke it.
Run your first scan
cd your-project atmos scan .
atmos scan checks your code and your dependencies in one run and closes with one summary. Findings appear in your terminal and on the Findings page on the platform, and the first scan adds the repository to your workspace. Atmos names the repository after its git origin remote, and --repo names one without it. To run one check alone, use atmos sast . or atmos sca .
Add Atmos to CI
CI runs the same scan with a Workspace Token instead of a sign-in. Copy a GitHub Actions or GitLab CI job from CI and pull requests.