GitHub Action

The action is not on the Marketplace yet. Until it is published, point uses at the copy in this repository.

Workflow

The plan needs the api feature. Store the key as SCANDAR_API_KEY. The server URL is https://scandar.dev.

name: Scandar
on:
  pull_request:
  push:
    branches: [main]
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ./packages/scandar-action
        # After publication: OWNER/scandar-action@v1
        with:
          api-key: ${{ secrets.SCANDAR_API_KEY }}
          api-url: https://scandar.dev
          fail-on: high
          annotations: true
          comment-on-pr: true
          github-token: ${{ github.token }}

Inputs and outputs

  • api-key (required) — masked with ::add-mask:: before any other log line.
  • api-url — base URL of the Scandar server. Use https://scandar.dev.
  • fail-on — default high.
  • working-directory — default ..
  • repo — optional owner/name for ignore rules.
  • annotations — default true. One ::error per failing advisory, on the lockfile path.
  • comment-on-pr — one comment, created or updated. The marker is <!-- scandar-action -->.
  • continue-on-error-on-api-failure — default false. When true, a network failure or HTTP 429/5xx exits 0. A policy failure still exits 1.

Outputs: passed, failing-count, report. The job summary is written to the step summary.

Exit codes

  • 0 — passed, or the API was unreachable and continue-on-error-on-api-failure is true.
  • 1 — an advisory failed the threshold (or malware, or an exploited advisory, unless fail-on is none).
  • 2 — missing key, placeholder URL, or no lockfile.
  • 3 — network or API failure.

Forks

A pull request from a fork does not receive secrets. The action then has no key. That is expected. Do not switch the workflow to pull_request_target to work around it: that event runs with the base branch’s secrets in a checkout an outside contributor can influence.

The action only reads manifest and lockfile names. It does not install dependencies and does not execute files from the pull request. Limits are 40 files and 15 MB. Scores use reachability unknown. Explanations stay off: the action never sends explain=1.

Other CI systems can run the CLI or the curl example.