Skip to content

Results and workflow security

Use PR comments, SARIF, badges, and gates with the minimum required permissions.


PR comments and SARIF

The PR comment gives reviewers a concise score and finding summary. SARIF sends source-mapped results to GitHub Code Scanning, where supported findings can appear as security alerts and annotations.

Keep the generated report artifact when a deeper review is needed. The comment is a summary, not the complete evidence record.

Badges and score gates

The Action can update a Shields.io endpoint file on the branch. A score gate can fail the job below min-score. Use both as current status signals, not as security certification.

README badge
![VICE Security](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/USERNAME/REPO/main/.github/vice-badge.json)

Use least-privilege permissions

  • Grant contents: write only when the workflow updates the badge file.
  • Grant pull-requests: write only when it posts or updates a PR comment.
  • Grant security-events: write only when it uploads SARIF.
  • Keep all other repository permissions at their restrictive defaults.

Protect forked pull requests

Do not expose repository secrets to untrusted fork code. Avoid pull_request_target unless the workflow has been designed and reviewed for that trust boundary. Keep shell commands free of untrusted expressions.

Treat workflow code as supply chain code
Pin trusted versions, review updates, and keep write access unavailable to untrusted pull-request execution.

Send a report to Platform

When a domain is linked through Platform, the workflow can use its one-time integration setup to ingest the Action report. This adds repository history to the workspace but does not replace a managed audit of the deployed domain.


Continue with VICE

See how VICE runs security checks in continuous integration.

Explore GitHub scanning