Results and workflow security
Use PR comments, SARIF, badges, and gates with the minimum required permissions.
PR comments and SARIF
The PR comment gives reviewers a concise score and finding summary. SARIF sends source-mapped results to GitHub Code Scanning, where supported findings can appear as security alerts and annotations.
Keep the generated report artifact when a deeper review is needed. The comment is a summary, not the complete evidence record.
Badges and score gates
The Action can update a Shields.io endpoint file on the branch. A score gate can fail the job below min-score. Use both as current status signals, not as security certification.
Use least-privilege permissions
- Grant contents: write only when the workflow updates the badge file.
- Grant pull-requests: write only when it posts or updates a PR comment.
- Grant security-events: write only when it uploads SARIF.
- Keep all other repository permissions at their restrictive defaults.
Protect forked pull requests
Do not expose repository secrets to untrusted fork code. Avoid pull_request_target unless the workflow has been designed and reviewed for that trust boundary. Keep shell commands free of untrusted expressions.
Send a report to Platform
When a domain is linked through Platform, the workflow can use its one-time integration setup to ingest the Action report. This adds repository history to the workspace but does not replace a managed audit of the deployed domain.
Continue with VICE
See how VICE runs security checks in continuous integration.