# Takumi Runner Now Integrates with cicd-sensor

Takumi now integrates with [cicd-sensor](https://github.com/cicd-sensor/cicd-sensor), an open-source eBPF runtime security sensor. You can now **collect trace logs from CI/CD jobs that run outside Takumi Runner's dedicated runners**, such as on GitHub-hosted runners and GitLab CI/CD, and manage them in Takumi.

![Comparison of the Takumi Runner and cicd-sensor setups](/docs/_md-assets/d9dbbee619-integration-patterns.svg)

cicd-sensor trace logs also work with the [threat detection](/docs/r/202608-takumi-runner-threat-detection) feature released today.

## Background

Takumi Runner collects eBPF traces — process executions, network connections, DNS queries, and file accesses — by running jobs on Takumi's dedicated runners. On the other hand, moving jobs to Takumi Runner is sometimes difficult, whether due to execution environment constraints or the effort of migrating.

For those cases, we now provide a way to use cicd-sensor, which requires no migration of the execution environment. Add cicd-sensor to a CI/CD pipeline and specify Takumi's Manager endpoint and credentials, and the trace logs will be sent to Takumi.

As the architecture figure above shows, Takumi Runner collects trace logs by running CI/CD jobs on dedicated runners that we operate. The cicd-sensor integration instead adds cicd-sensor to the environment you already use — GitHub-hosted runners, self-hosted runners you operate yourself, and so on — and sends the logs traced there to Takumi.

## Benefits

Trace logs collected through cicd-sensor are managed the same way as Takumi Runner trace logs, so trace log visualization, search, and threat detection are all available for them.

**Trace log visualization**

You can review the [visualized trace data](/docs/t/runner/features/trace-visualization) in the Shisho Cloud console.

![Network tab](/docs/_md-assets/1e994e7420-job-network.png)

**Trace log search**

Shisho Cloud lets you [search the contents of the collected trace logs](/docs/t/runner/features/trace-search). You can check whether the CI/CD jobs that ran during a supply-chain incident were affected.

![Search results](/docs/_md-assets/3755e92b24-trace-search-results.png)

**Threat detection**

[Threat detection](/docs/r/202608-takumi-runner-threat-detection) proactively investigates the impact of a supply-chain incident based on the trace logs and notifies you if you are affected. Since it removes the need to investigate yourself, it addresses gaps in expertise and the risk of missing an incident.

![Responding to a supply-chain incident: before vs. with threat detection](/docs/_md-assets/66bdd0c4dc-threat-detection-before-after.svg)

## Supported CI/CD pipelines

The cicd-sensor integration does not depend on the execution environment, so as a rule it supports the CI/CD pipelines that cicd-sensor supports. At the time of writing, GitHub Actions and GitLab CI/CD are supported. For GitLab CI/CD, self-hosted GitLab Runners (Docker executor) are covered.

## Getting Started

The cicd-sensor integration takes three steps:

1. Add cicd-sensor to the CI/CD job
2. Set Takumi's Manager as cicd-sensor's `manager-url`
3. Set the credentials as cicd-sensor's `manager-token`

### GitHub-hosted runners

Add the cicd-sensor step at the beginning of the job and specify the Manager endpoint in the `manager-url` parameter.

```yaml
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: cicd-sensor/cicd-sensor-action@a803a7bc1890f85d3f2feb7c29b74b5c730da6c2 # v0.0.37
        with:
          manager-url: https://manager.cicdsensor.cloud.shisho.dev
          manager-token: ${{ secrets.SHISHO_CICD_SENSOR_TOKEN }}
```

Authentication (`manager-token`) is performed through a Shisho Cloud bot. For how to set up authentication, including creating the bot, see the [user guide](/docs/t/runner/features/cicdsensor-integration).

Once the job execution completes, the job and its traces are reflected in the Shisho Cloud console.

### GitHub self-hosted runners and GitLab CI/CD

In these environments, cicd-sensor runs on the runner's host, so installing cicd-sensor and configuring the Manager endpoint happen on the host rather than in the pipeline. For how to set this up, see the [cicd-sensor documentation](https://cicd-sensor.github.io/user-guide/self-hosted-install.html).

Takumi's Manager endpoint is `https://manager.cicdsensor.cloud.shisho.dev`.

For the credentials, issue an API key in Shisho Cloud and specify it as the `manager-token`. For details on creating a bot and API keys, see the [user guide](/docs/t/runner/features/cicdsensor-integration).

## Pricing {#pricing}

The cicd-sensor integration requires the Takumi Runner base plan.

Within the base plan, we accept trace logs for up to a total of 3,000 minutes of job run time per month. From September 1, 2026, accepting logs for job runs beyond 3,000 minutes incurs a per-minute fee.

:::info
Until August 31, 2026, we accept trace logs with no 3,000-minute cap.
:::

For details on the cicd-sensor integration pricing, see [Pricing](/docs/t/runner/billing/pricing).

## Getting Started with Takumi Runner

To use Takumi Runner, including the cicd-sensor integration, you need a Takumi subscription and Runner enabled.

1. Go to [https://cloud.shisho.dev/hello/takumi](https://cloud.shisho.dev/hello/takumi) and sign in
2. Register your organization and subscribe to Takumi
3. Open **Runner** > **Settings** from the sidebar on the left
4. Click the "Enable" button to enable Runner

![Runner setup screen](/docs/_md-assets/3e39412f90-ui-runner-settings.png)

Once Runner is enabled, follow the [cicd-sensor integration user guide](/docs/t/runner/features/cicdsensor-integration) to complete the setup.