GitHub Actions

This is a guide to setting up and configuring Safety to scan your GitHub repositories for dependency security vulnerabilities using Safety as a GitHub Action. This enables you to configure security and compliance scans on your repositories on new commits, new branches, pull requests, and more.

Safety is available as an action in the GitHub Marketplace.

Step 1: Get your Safety API Key

To scan any systems for security vulnerabilities, you first need a Safety API key. You can create a Safety account and get your API key here.

On your GitHub repository, navigate to Settings -> Secrets -> Actions, and add your Safety API key as a secret that matches the variable name you've used in the workflow YAML file (SAFETY_API_KEY in all the examples here). Once added, it should look similar to the screenshot below:

Step 2: Set up a GitHub Actions workflow on your repository (If you don't have one already)

GitHub Actions are an easy and powerful way to run CI/CD processes on your codebases hosted on GitHub. Adding Safety security scans to your repositories is as easy as adding a few lines of code to your Github Action workflow configuration file to run Safety.

We've created some full pipeline examples below if you don't have one set up yet. If you need help configuring your Python workflow, you can read more on getting startup with GitHub workflows in Python.

Step 3: Configure your GitHub workflow YAML file to run Safety scans

GitHub Actions are configured using YAML workflow files in a special .github/workflows/ folder. Here is an example YAML file that runs Safety to scan your project for security vulnerabilities. This will scan in auto-detect mode, which will try and scan the most appropriate thing automatically.

You can read more about Safety's scan modes and different options.

YAML

# This workflow will run Safety security scans on all dependencies that are installed into the environment.
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions
# Saved to `.github/workflows/safety.yml`

name: Safety Security Scan

on:
  push: # Run on every push to any branch
  pull_request: # Run on new pull requests

jobs:
  safety:
    runs-on: ubuntu-latest
    steps:
      - uses: safety/safety@2.3.4
        with:
          api-key: ${{secrets.SAFETY_API_KEY}}