Skip to main content

:::tip Looking for the recipe? See Workflows → Gate CI on quality for the task-driven guide. This page is the reference. :::

GitHub Action

Add zuit to GitHub Actions to scan every PR and post findings to GitHub code scanning. The action installs zuit, scans your code, and uploads findings as a SARIF report — which then appears in the Security tab and as inline annotations on pull requests.

Complete workflow​

Copy this into .github/workflows/zuit.yml:

name: zuit

on:
  push:
    branches: [main]
  pull_request:

jobs:
  zuit:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - uses: shubhamkaushal765/zuit@main
        with:
          path: "."
          fail-on: "medium"

The security-events: write permission is required so the action can upload the SARIF report to GitHub.

Inputs​

InputRequiredDefaultDescription
pathno.Root path to scan, relative to the repository root.
formatnosarifOutput format. Use sarif to upload to code scanning, or json for an artifact.
fail-onnomediumFail the job when findings at this severity or higher are found.
versionnolatestVersion of zuit to install (latest or a semver string such as 0.1.0).

How findings reach GitHub​

After the action runs, findings appear both in the repository's Security > Code scanning tab and as inline annotations on the pull request diff.

Common recipes​

Gate on severity​

Fail the job only for high-severity and above, but still upload all findings to code scanning:

- uses: shubhamkaushal765/zuit@main
  with:
    fail-on: "high"

Save a JSON report as an artifact instead of uploading to code scanning​

Set format: json to write a JSON report file and skip the SARIF upload:

- uses: shubhamkaushal765/zuit@main
  with:
    path: "."
    format: "json"
    fail-on: "high"
- uses: actions/upload-artifact@v4
  with:
    name: zuit-report
    path: zuit-results.json

Pin a specific version​

Pin to a known zuit version to avoid unexpected changes when new rules are released:

- uses: shubhamkaushal765/zuit@main
  with:
    version: "0.1.0"
    fail-on: "high"

See also​