DepWarden for GitHub Actions

The Rushabh5000/depwarden-action is a composite GitHub Action that runs SCA (dependency) and SAST (source-code) scans as separate, independent steps — set file for SCA, sast-dir for SAST, or both in one job. No API key is required: without one, SCA scans run fully anonymous (no account, same as the public scanner).

Prerequisites

Nothing required to try it — an API key (as a GitHub secret) is optional, needed only to route scans through your workspace's Policy/Exceptions rules

Install and run

1. (Optional) store your API key as a secret

# In your repo: Settings → Secrets and variables → Actions → New repository secret
# Name: APP_API_KEY
# Value: dw_xxxxxxxxxxxxxx

Without a key, SCA scans run anonymously against the public API and only the --fail-on threshold gates the build. With a key, scans go through your workspace's governed /api/v1 contract, so Policy/Exceptions rules apply too.

2. Add the scan step

name: Security scan

on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: Rushabh5000/depwarden-action@v1
        with:
          file: package-lock.json     # SCA: path to manifest/lockfile/SBOM
          fail-on: high
          sast-dir: src               # SAST: directory (or file) to scan
          sast-fail-on: high
        env:
          APP_API_KEY: ${{ secrets.APP_API_KEY }}

Leave file empty to skip SCA, or sast-dir empty to skip SAST — set either or both.

3. Block PRs on HIGH+ findings

      - uses: Rushabh5000/depwarden-action@v1
        with:
          file: package-lock.json
          fail-on: high          # Fails the step → PR check fails
        env:
          APP_API_KEY: ${{ secrets.APP_API_KEY }}

Combine with a required status check in Branch protection rules to enforce the gate.

4. Comment findings on the PR

name: Security scan
on: [pull_request]
permissions:
  pull-requests: write   # required — GitHub does not grant this by default
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: Rushabh5000/depwarden-action@v1
        with:
          file: package-lock.json
          sast-dir: src
          pr-comment: true

Posts a findings summary as a PR comment using this job's own GITHUB_TOKEN — no DepWarden GitHub App, no token DepWarden ever sees. The comment updates in place on every push instead of piling up a new one. Missing the permission, or a run with no open PR, just skips the comment and logs why — it never fails the build on its own.

Configuration

file — Path to the manifest/lockfile/SBOM to scan. Leave empty to skip SCA.
fail-on (default high) — SCA: fail when a finding at or above this severity is present (critical, high, medium, low, never).
sast-dir — Directory (or single file) to scan with SAST — source code, IaC, and secret-bearing config. Leave empty to skip SAST.
sast-fail-on (default high) — SAST: fail when a finding at or above this severity is present.
sast-name (default ${{ github.repository }}) — Project name shown in the SAST report.
api-key — Your DepWarden API key, via ${{ secrets.* }} — never inlined in the workflow YAML. Optional: SCA runs anonymously without one.
pr-comment (default false) — Post (and update in place on each push) a findings summary as a PR comment, using this job's own GITHUB_TOKEN. Requires permissions: pull-requests: write on the workflow or job. Never affects the pass/fail exit code.
api (default https://depwarden.in) — Override API base URL for self-hosted deployments.

Failing the build

SCA and SAST gate independently: fail-on fails the step when an SCA finding at or above that severity is present, and sast-fail-on does the same for SAST findings. Values: critical, high, medium, low, never.

Report formats

Human-readable console output (default)
Structured JSON (via the underlying CLI's --json flag)