Skip to main content

​
GitHub Actions Integration

Automate security testing in your GitHub workflows with AIPTx’s official GitHub Action.

​
Quick Start

Add security scanning to any workflow: 
name: Security Scan
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run AIPTx Security Scan
        uses: aiptx/scan-action@v1
        with:
          api-key: ${{ secrets.AIPTX_API_KEY }}
          target: https://staging.example.com
          mode: quick

​
Installation

​
1. Get Your API Key

  1. Log in to the AIPTx Dashboard
  2. Navigate to Settings → API Keys
  3. Generate a new key with appropriate permissions

​
2. Add Secret to GitHub

  1. Go to your repository Settings → Secrets and variables → Actions
  2. Click New repository secret
  3. Name: AIPTX_API_KEY
  4. Value: Your AIPTx API key

​
3. Create Workflow File

Create .github/workflows/security.yml: 
name: Security Scan

on:
  push:
    branches: [main, develop]
  pull_request:
    types: [opened, synchronize]
  schedule:
    - cron: '0 2 * * 1' # Weekly on Monday at 2 AM

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run AIPTx Scan
        uses: aiptx/scan-action@v1
        with:
          api-key: ${{ secrets.AIPTX_API_KEY }}
          target: ${{ vars.STAGING_URL }}
          mode: standard
          fail-on: high

​
Configuration Options

​
Action Inputs

InputDescriptionRequiredDefault
api-keyAIPTx API keyYes-
targetTarget URL to scanYes-
modeScan mode: quick, standard, deepNostandard
typeScan type: web, api, network, fullNoweb
openapiPath to OpenAPI spec fileNo-
fail-onFail build on severity: critical, high, medium, lowNocritical
timeoutScan timeout in minutesNo60
waitWait for scan completionNotrue
configPath to aiptx.yaml config fileNo-

​
Action Outputs

OutputDescription
scan-idThe ID of the created scan
scan-urlURL to view scan results
findings-criticalNumber of critical findings
findings-highNumber of high findings
findings-mediumNumber of medium findings
findings-lowNumber of low findings
statusScan status

​
Common Workflows

​
Pull Request Scanning

Scan preview deployments on pull requests: 
name: PR Security Check

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  wait-for-preview:
    runs-on: ubuntu-latest
    outputs:
      preview-url: ${{ steps.get-url.outputs.url }}
    steps:
      - name: Wait for Vercel Preview
        uses: patrickedqvist/[email protected]
        id: get-url
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          max_timeout: 300

  security-scan:
    needs: wait-for-preview
    runs-on: ubuntu-latest
    steps:
      - name: Run Security Scan
        uses: aiptx/scan-action@v1
        id: scan
        with:
          api-key: ${{ secrets.AIPTX_API_KEY }}
          target: ${{ needs.wait-for-preview.outputs.preview-url }}
          mode: quick
          fail-on: high

      - name: Comment PR with Results
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `## 🔒 Security Scan Results

              | Severity | Count |
              |----------|-------|
              | Critical | ${{ steps.scan.outputs.findings-critical }} |
              | High | ${{ steps.scan.outputs.findings-high }} |
              | Medium | ${{ steps.scan.outputs.findings-medium }} |
              | Low | ${{ steps.scan.outputs.findings-low }} |

              [View Full Report](${{ steps.scan.outputs.scan-url }})`
            })

​
Scheduled Deep Scan

Run comprehensive scans weekly: 
name: Weekly Security Audit

on:
  schedule:
    - cron: '0 2 * * 0' # Sunday at 2 AM UTC

jobs:
  deep-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Deep Scan
        uses: aiptx/scan-action@v1
        id: scan
        with:
          api-key: ${{ secrets.AIPTX_API_KEY }}
          target: https://app.example.com
          mode: deep
          timeout: 480 # 8 hours

      - name: Generate Report
        run: |
          curl -X POST "https://api.aiptx.io/v1/reports" \
            -H "Authorization: Bearer ${{ secrets.AIPTX_API_KEY }}" \
            -H "Content-Type: application/json" \
            -d '{"scan_id": "${{ steps.scan.outputs.scan-id }}", "format": "pdf", "template": "executive"}'

      - name: Notify Team
        uses: slackapi/slack-github-action@v1
        with:
          channel-id: 'security-alerts'
          slack-message: |
            Weekly security scan completed!
            Critical: ${{ steps.scan.outputs.findings-critical }}
            High: ${{ steps.scan.outputs.findings-high }}
            View: ${{ steps.scan.outputs.scan-url }}

​
Multi-Environment Scanning

Scan multiple environments in parallel: 
name: Multi-Environment Scan

on:
  workflow_dispatch:

jobs:
  scan:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        environment:
          - name: staging
            url: https://staging.example.com
            mode: standard
          - name: production
            url: https://app.example.com
            mode: quick
    steps:
      - name: Scan ${{ matrix.environment.name }}
        uses: aiptx/scan-action@v1
        with:
          api-key: ${{ secrets.AIPTX_API_KEY }}
          target: ${{ matrix.environment.url }}
          mode: ${{ matrix.environment.mode }}

​
With OpenAPI Specification

- name: Run API Scan
  uses: aiptx/scan-action@v1
  with:
    api-key: ${{ secrets.AIPTX_API_KEY }}
    target: https://api.example.com
    type: api
    openapi: ./openapi.yaml

​
Security Gates

Block deployments based on findings: 
deploy:
  needs: security-scan
  if: ${{ needs.security-scan.outputs.findings-critical == '0' && needs.security-scan.outputs.findings-high == '0' }}
  runs-on: ubuntu-latest
  steps:
    - name: Deploy to Production
      run: ./deploy.sh

​
Troubleshooting

Increase the timeout value or use quick mode for CI/CD:
timeout: 120
mode: quick
Ensure your target is accessible from GitHub’s runners. For internal applications, consider using self-hosted runners or deploying a preview environment.
Verify the secret is correctly named and the API key has appropriate permissions in the AIPTx dashboard.