GitHub Action Setup

Add H2 Security Scanner to your CI/CD pipeline with our official GitHub Action.

Basic Usage

- uses: h2security/scanner@v1

Full Configuration

name: H2 Security Scan

on:
  push:
    branches: [main, develop]
  pull_request:

jobs:
  security:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write  # Required for SARIF upload

    steps:
      - uses: actions/checkout@v4

      - name: Run H2 Security Scanner
        uses: h2security/scanner@v1
        with:
          # Scan types (all enabled by default)
          scan-secrets: true
          scan-dependencies: true
          scan-containers: true
          scan-sast: true
          scan-iac: true

          # Failure threshold
          fail-on: critical  # critical, high, medium, low, none

          # Output format
          output: markdown  # markdown, sarif, json

          # Pro tier (optional)
          h2-api-key: ${{ secrets.H2_API_KEY }}

      # Optional: Upload SARIF to GitHub Security tab
      - name: Upload SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: h2-scanner-results.sarif

Inputs

Input	Description	Default
scan-secrets	Enable secret detection	true
scan-dependencies	Enable dependency scanning	true
scan-containers	Enable Dockerfile analysis	true
scan-sast	Enable static analysis	true
scan-iac	Enable IaC scanning	true
fail-on	Fail threshold	critical
output	Output format	markdown
h2-api-key	Pro tier API key	-
path	Path to scan	.

Outputs

Output	Description
findings-count	Total number of findings
critical-count	Number of critical findings
high-count	Number of high findings
medium-count	Number of medium findings
low-count	Number of low findings
sarif-file	Path to SARIF file (if output=sarif)
exit-code	0 if passed, 1 if failed

Examples

Scan only secrets and dependencies

- uses: h2security/scanner@v1
  with:
    scan-secrets: true
    scan-dependencies: true
    scan-containers: false
    scan-sast: false
    scan-iac: false

Fail on high or above

- uses: h2security/scanner@v1
  with:
    fail-on: high

Upload to GitHub Security tab

- uses: h2security/scanner@v1
  with:
    output: sarif

- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: h2-scanner-results.sarif

Use with Pro tier

- uses: h2security/scanner@v1
  with:
    h2-api-key: ${{ secrets.H2_API_KEY }}