Safety 2 (formerly PyUp)
  • Welcome to Safety 2
  • 2023 Rebrand from PyUp to Safety Cybersecurity
  • Safety 2.x Basics
    • Getting started with Safety 2.x
    • Running a Safety Scan
    • License Scanning
  • Safety CLI 2 Scanner
    • Installation & Quick Start - Safety 2
    • Docker Containers
    • Inputs
    • Output Formats
    • Policy File
    • Applying Security Updates to Requirements Files
    • Exit Codes
    • Help and Support
    • Safety v1 to v2 Breaking Changes
  • Securing Git SCM Pipelines
    • Securing Git Repositories
    • GitHub Actions
      • Advanced Options: GitHub Actions
    • BitBucket Pipelines
    • Gitlab Pipelines
    • GitHub Integration
    • Scanning Development Environments with Git Post-Commit Hook
  • Troubleshooting
    • Invalid API Key Error
Powered by GitBook
On this page
  • Step 1: Get your Safety API Key
  • Step 2: Set up a GitHub Actions workflow on your repository (If you don't have one already)
  • Step 3: Configure your GitHub workflow YAML file to run Safety scans
  1. Securing Git SCM Pipelines

GitHub Actions

PreviousSecuring Git RepositoriesNextAdvanced Options: GitHub Actions

Last updated 1 year ago

This is a guide to setting up and configuring Safety to scan your GitHub repositories for dependency security vulnerabilities using Safety as a GitHub Action. This enables you to configure security and compliance scans on your repositories on new commits, new branches, pull requests, and more.

Safety is available as an action in the .

Step 1: Get your Safety API Key

To scan any systems for security vulnerabilities, you first need a Safety API key. You can create a Safety account and get your API key .

On your GitHub repository, navigate to Settings -> Secrets -> Actions, and add your Safety API key as a secret that matches the variable name you've used in the workflow YAML file (SAFETY_API_KEY in all the examples here). Once added, it should look similar to the screenshot below:

Step 2: Set up a GitHub Actions workflow on your repository (If you don't have one already)

GitHub Actions are an easy and powerful way to run CI/CD processes on your codebases hosted on GitHub. Adding Safety security scans to your repositories is as easy as adding a few lines of code to your Github Action workflow configuration file to run Safety.

We've created some full pipeline examples below if you don't have one set up yet. If you need help configuring your Python workflow, you can read more on .

Step 3: Configure your GitHub workflow YAML file to run Safety scans

GitHub Actions are configured using YAML workflow files in a special .github/workflows/ folder. Here is an example YAML file that runs Safety to scan your project for security vulnerabilities. This will scan in auto-detect mode, which will try and scan the most appropriate thing automatically.

You can read more about Safety's scan modes and different options.

YAML

# This workflow will run Safety security scans on all dependencies that are installed into the environment.
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions
# Saved to `.github/workflows/safety.yml`

name: Safety Security Scan

on:
  push: # Run on every push to any branch
  pull_request: # Run on new pull requests

jobs:
  safety:
    runs-on: ubuntu-latest
    steps:
      - uses: safety/safety@2.3.4
        with:
          api-key: ${{secrets.SAFETY_API_KEY}}
GitHub Marketplace
here
getting startup with GitHub workflows in Python