GitHub Actions

Overview

The Auxilh/secuprobe-scan-action GitHub Action integrates SecuProbe into your CI/CD pipeline. It triggers a security scan on every pull request or deployment, waits for the result, fails the job when a finding reaches the severity you choose, uploads the SARIF report to the Security tab and keeps one pull request comment up to date.

Prerequisites

1. A SecuProbe account. The Free plan includes 10 API scans; the Security tab upload and the pull request comment start with the Starter plan.
2. An API key with the scans:create and scans:read scopes, created in Settings → API.
3. The key stored as a GitHub repository secret named SECUPROBE_API_KEY.
4. The domain to scan, added to your account and validated. An API key can only scan a validated domain of its own account.

Basic usage

# .github/workflows/security.yml
name: Security Scan

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read
  pull-requests: write      # pull request comment
  security-events: write    # SARIF upload to the Security tab

jobs:
  secuprobe:
    runs-on: ubuntu-latest
    steps:
      - name: Run SecuProbe Scan
        uses: Auxilh/secuprobe-scan-action@v1.1.0
        with:
          api_key: ${{ secrets.SECUPROBE_API_KEY }}
          url: https://staging.your-app.com
          fail-on: high

Inputs

Outputs

Advanced usage

Give the step an identifier to reuse its outputs later in the job, for example to print the score or the number of new findings. The timeout input raises the maximum wait when you scan a large application.

- name: Run SecuProbe Scan
  id: scan
  uses: Auxilh/secuprobe-scan-action@v1.1.0
  with:
    api_key: ${{ secrets.SECUPROBE_API_KEY }}
    url: ${{ vars.STAGING_URL }}
    fail-on: medium
    timeout: '900'
    sarif_artifact: src/app.ts

- name: Print scan result
  if: always()
  run: |
    echo "SecuScore: ${{ steps.scan.outputs.secu_score }}"
    echo "New findings: ${{ steps.scan.outputs.new_findings }}"
    echo "Report: ${{ steps.scan.outputs.report_url }}"

Failure threshold

The fail-on input sets the severity from which the job fails: critical, high, medium, low, or none to only report. The step exits with a non-zero code as soon as one finding reaches that level. Findings you marked as accepted risk or false positive in SecuProbe, and findings that could not be confirmed, do not fail the job.

Security tab

The action downloads the scan as SARIF 2.1.0 and sends it to GitHub code scanning, so findings appear in the Security tab with their severity and CWE. Give the job the security-events: write permission. GitHub attaches every alert to a file of the repository: choose it with sarif_artifact. The report contains no request or response evidence, which stays in SecuProbe.

Pull request comment

On a pull request, the action posts one comment and updates it on each run instead of adding a new one. It lists the findings that are new since the previous scan, those that were fixed, and links to the full report. Give the job the pull-requests: write permission, or set comment to false to turn it off.

GitHub job summary

The action writes a summary to the GitHub Actions job page with the SecuScore, the number of vulnerabilities by severity and a link to the full report. Reviewers see the result without leaving the pull request.

Good practices

• Scan a staging environment that mirrors production and validate the ownership of that domain once: the action can only scan a validated domain.
• Start with fail-on set to critical, then lower the threshold to high once existing findings are fixed.
• Never write the API key in the workflow file. Store it as a secret and rotate it from the SecuProbe settings if it is exposed.
• Run the scan on pull requests and deployments, and keep a nightly schedule for what changes outside your code, such as a certificate or a newly published CVE.