GitHub Actions

Run full repository scans. To enforce security policies before deployment, use the CI security pipeline example.

1. Add your token

Connect your repository and enable SAST, SCA, and secrets in Analysis Configuration.
Create a CodeAnt token with the Codeant CI/CD role and access to this repository.
In GitHub, open Settings → Secrets and variables → Actions → New repository secret. Save it as CODEANT_TOKEN.

2. Add the workflow

Save as .github/workflows/codeant-scan.yml. Replace main with your target branch.

.github/workflows/codeant-scan.yml

name: CodeAnt full repository scan

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  scan:
    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
      - name: Run CodeAnt scan
        uses: CodeAnt-AI/codeant-ci-scan-action@v0.0.6
        with:
          access_token: ${{ secrets.CODEANT_TOKEN }}
          scanners: sast,sca,secrets
          scan_timeout: '1200'
      - name: Save reports
        if: ${{ always() }}
        uses: actions/upload-artifact@v4
        with:
          name: codeant-results
          retention-days: 14
          if-no-files-found: error
          path: |
            results.json
            codeant.sarif
            codeant-qg.xml

To block deployment, configure full-code quality gates and set quality_gate: 'true'. Fork PRs are skipped because GitHub does not provide repository secrets.

3. Run and download

Merge the workflow onto your default branch.
Open Actions → CodeAnt full repository scan → Run workflow.
Open the completed run. Under Artifacts, download codeant-results.

The archive contains JSON findings, SARIF, and JUnit XML. The action does not generate CSV/PDF.

Inputs

Input	Set it to	Default
`access_token`	`${{ secrets.CODEANT_TOKEN }}`; required	None
`scanners`	`sast`, `sca`, `secrets`, `iac`, `antipatterns`, or `all`; comma-separated	`sast,sca`
`quality_gate`	`'true'` to fail when configured quality gates fail or results time out	`'false'`
`scan_timeout`	Seconds to wait for results	`300`
`include_paths`	Patterns such as `src/,lib/`	All files
`exclude_paths`	Patterns such as `tests/,vendor/`	None
`api_base`	Your CodeAnt API URL	`https://api.codeant.ai`

Enable the selected analyses in CodeAnt; scanners selects returned results. antipatterns returns duplicate-code results. Include patterns take precedence over exclusions.

Runner data flow

The runner sends the token, repository, commit, branch, provider URL, and file filters to CodeAnt over HTTPS. CodeAnt fetches the repository server-side and returns reports. The action does not upload the runner’s source checkout or local Docker image.

Troubleshooting

Error	Action
`401`	Check `CODEANT_TOKEN` exists and is active.
`403`	Check the token’s organization, role, and repository scope.
Incomplete results	Enable the required analyses and increase `scan_timeout`.
No artifacts	Open the failed scan step’s logs. Early failures may produce no reports.

Get Started

AI Code Review

Code Security

Cloud Security

Code Quality

Engineering Metrics

IDE, CLI & CI/CD

Rule Reference

Resources