GitHub Actions

1. Add the secret

Create a secret key in Safeguard under Settings → Developer with the scopes scans:trigger and scans:read. In GitHub, add it under Settings → Secrets and variables → Actions → New repository secret with the name SAFEGUARD_API_KEY. An organisation secret works too.

2. Add the workflow

Save this as .github/workflows/safeguard.yml (download):

name: Safeguard
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - name: Safeguard scan
        env:
          SAFEGUARD_API_KEY: ${{ secrets.SAFEGUARD_API_KEY }}
          SAFEGUARD_INSTALL_DIR: ${{ runner.temp }}/safeguard-bin
        run: |
          set -eu
          curl -fsSL https://cli.safeguard.sh/install | bash
          "$SAFEGUARD_INSTALL_DIR/safeguard" ci scan --wait --fail-on critical

No checkout step is needed: Safeguard clones the repository. Push, and the run shows the scan's result and a link to it in Safeguard.

Choose the branches

• on.push.branches lists the branches whose pushes are scanned.
• on.pull_request.branches lists the target branches of pull requests that are scanned. Delete the pull_request block to scan pushes only.

Wildcards work, for example [main, 'release/**']. On a pull request the head branch is scanned and the version is named after its head commit.

Options

Troubleshooting

• Pull requests from forks fail. GitHub gives fork pull requests no secrets. Scan pushes only, or use pull_request_target with care: it runs with your secrets, so never run the fork's code in that job.
• Other errors: see Troubleshooting.