Nuclei Template Validation Pipeline

How the automated Helix → Nuclei pipeline validates CVE researcher-generated detection templates against real targets before they reach the detection fleet.

Overview

CVE researcher-generated Nuclei templates are automatically validated against real targets when a pull request is opened in the Nuclei templates repository. Only templates that successfully detect the vulnerability on a live target are permitted to merge. This eliminates the manual validation step that previously existed between template authorship and fleet deployment.

How the pipeline works

1. Pull request triggers validation

When a researcher opens a PR against the Nuclei templates repository, the pipeline starts automatically. No manual action is required to initiate validation.

2. Target retrieval from Helix

The pipeline reads the Linear ticket associated with the PR and retrieves the affected target hostname from the ticket metadata in Attack Helix. This removes any manual handoff between the research workflow and the validation environment — the target context flows directly from Helix into the pipeline.

3. Template execution against a real target

The Nuclei template is run against the hostname retrieved in the previous step. Validation uses a real, affected target rather than a synthetic or mocked environment, so results reflect actual detection behavior.

4. Merge gate enforcement

  • Validation passes — the PR is cleared to merge and the template proceeds to the detection fleet.

  • Validation fails — the PR is blocked from merging automatically. The researcher is expected to review the template, address any issues, and push an updated commit to re-trigger validation.

Researcher workflow

Step

Action

Author template

Write the Nuclei template for the CVE under research.

Open PR

Push the template and open a pull request in the Nuclei templates repo.

Await pipeline result

The pipeline runs automatically; no manual trigger is needed.

Review failure details

If the merge gate blocks the PR, inspect the pipeline output for the specific failure reason.

Revise and re-push

Push a corrected commit to re-run validation.

Merge

Once validation passes, merge proceeds normally.

Prerequisites

For the pipeline to retrieve a target hostname, the following must be true before the PR is opened:

  • A Linear ticket for the CVE exists and is linked to the PR.

  • The ticket contains a valid target hostname in its Helix-sourced metadata.

  • The target host is reachable from the validation environment at the time the pipeline runs.

If any of these conditions are not met, the pipeline will be unable to resolve a target and the PR will be blocked until the ticket metadata is corrected.

Related modules