GitHub Action
Sec1 Foss Security
This GitHub Actions workflow integrates Sec1 to conduct vulnerability scans on your GitHub projects. Sec1 is a powerful tool that helps identify security vulnerabilities within your codebase.
Below is an example of using the Sec1 Security Action in your GitHub Actions workflow. This example runs the Sec1 scan on each push to the repository.
name: Example workflow using Sec1 Security
on: push
jobs:
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- name: Run Sec1 Scan to check for vulnerabilities
uses: sec0ne/actions/security@main
with:
apikey: ${{ secrets.SEC1_API_KEY }}
Sec1 scan supports setting up threshold values. If the scan reports vulnerabilities exceeding the specified thresholds, Sec1 Security will mark the build as failed. You can set threshold values for different severities such as critical, high, medium, and low.
name: Example workflow using Sec1 Security
on: push
jobs:
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- name: Run Sec1 Scan to check for vulnerabilities and with threshold values
uses: sec0ne/actions/security@main
with:
apikey: ${{ secrets.SEC1_API_KEY }}
scanThreshold: critical=1 high=1
To use Sec1 in your workflow, you need to obtain an API key. Follow these steps:
-
Navigate to Sec1 Website:
- Visit Sec1 portal and log in using your GitHub credentials.
-
Generate API Key:
- In the "Settings" section, locate the "API key" and click on "Generate API key."
-
Copy the API Token:
- Copy the generated API token.
-
Add API Key to GitHub Repository Secrets:
-
Add the copied API key to your GitHub repository secrets. Refer to GitHub's documentation for creating secrets at the repository level.
-
If you are working at the organization level, follow the instructions here to create secrets for your organization.
-
-
Set API Key Variable in GitHub Actions:
-
In your GitHub Actions workflow file (e.g.,
.github/workflows/main.yml
), set theapikey
variable using the secret you created:env: apikey: ${{ secrets.SEC1_API_KEY }}
-
Now, your GitHub Actions workflow is set up to leverage Sec1 for continuous security checks in your projects.