Home Docs GitHub Action

GitHub Action CI/CD Integration

Run automated security audits on Pull Requests and export SARIF 2.1.0 reports directly to GitHub Code Scanning.

1. GitHub Action Workflow Setup

Add .github/workflows/frapast.yml to your Frappe app repository to trigger automated security audits on every pull request and push to main branches.

name: frapAST Security Audit

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]

jobs:
  security-audit:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Run frapAST Security Engine
        uses: pratheep-bit/frapast@v0.1.0
        with:
          path: '.'
          fail-on: 'critical'
          upload-sarif: 'true'

      - name: Upload SARIF to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: 'frapast-results.sarif'

2. Configuration Inputs Reference

The action accepts the following configurable input parameters:

Input Parameter	Required	Default	Description
path	No	.	Root or subfolder path of the Frappe app to audit.
fail-on	No	critical	Minimum severity to fail the CI job (`critical`, `high`, `medium`, `none`).
upload-sarif	No	true	Generate and save standard SARIF 2.1.0 log for GitHub Code Scanning alerts.

3. SARIF 2.1.0 Code Scanning Alerts

When upload-sarif: 'true' is enabled, findings populate the Security → Code scanning alerts tab on GitHub, with exact source line annotations and remediation guidance on pull requests.