GitHub Action quickstart

Add the workflow

Create a workflow in .github/workflows and use the official VICE v3 Action. The example enables the default report features, so it declares the corresponding GitHub permissions.

1name: VICE Security
2 
3on:
4  pull_request:
5  push:
6    branches: [main]
7 
8permissions:
9  contents: write
10  pull-requests: write
11  security-events: write
12 
13jobs:
14  audit:
15    runs-on: ubuntu-latest
16    steps:
17      - uses: actions/checkout@v4
18      - uses: Webba-Creative-Technologies/vice@v3
19        with:
20          min-score: 70

Understand the defaults

• Audit the repository root.
• Require a minimum VICE score of 70 and fail below it.
• Comment on pull requests when the event supports it.
• Update .github/vice-badge.json.
• Upload SARIF to GitHub Code Scanning.

Review the first run

Open the workflow job, read the VICE summary, then review the PR comment and Code Scanning results. Confirm coverage and versions before changing the threshold.

Tune after local review

Run the CLI locally with the same repository path before making the Action blocking. Baseline only reviewed findings and keep the threshold explicit in the workflow.

Choose a release policy

Use @v3 for compatible updates within the major release. Pin an exact published release or trusted commit when strict reproducibility is required, then plan how updates will be reviewed.