---
title: "GitHub Actions Integration | ShipSafe"
description: "Automate ShipSafe scans on every pull request. Block merges on critical vulnerabilities with our GitHub Action."
doc_version: 2026-09-21
last_updated: 2026-09-21T19:15:49.792Z
canonical: https://ship-safe.co/docs/github-actions
---

# GitHub Actions Integration | ShipSafe

● GitHub Actions

# Block bad PRs. Automatically.

Scans run on every pull request and fail the check on critical findings, so the merge button stays disabled until you fix them.

▸ SETUP

## Quick Setup

1

### Get your CLI token

Run this in your terminal to authenticate and get a token:

TERMINAL

Copy

```bash
npx @ship-safe/cli login
```

2

### Add the secret to your repo

Go to your repo → Settings → Secrets → Actions → New repository secret. Name it SHIPSAFE\_TOKEN and paste your token.

3

### Add the workflow file

Create .github/workflows/shipsafe.yml with one of the configs below:

▸ WORKFLOW EXAMPLES

## Workflow Configs

Basic ScanPR BlockingFull Setup

TERMINAL·.github/workflows/shipsafe.yml

Copy

```yaml
name: ShipSafe Security Scan

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run ShipSafe scan
        run: npx @ship-safe/cli scan . --ci
        env:
          SHIPSAFE_TOKEN: ${{ secrets.SHIPSAFE_TOKEN }}
```

▸ FAILING CRITERIA

## CLI Flags for CI

| Flag                | Description                                              |
| ------------------- | -------------------------------------------------------- |
| \--ci               | Exit code 1 on high/critical findings                    |
| \--severity <level> | Minimum severity to fail on: critical, high, medium, low |
| \--output sarif     | Output SARIF format for GitHub Security tab integration  |
| \--output json      | JSON output for custom CI scripts                        |

▸ FALSE POSITIVES

## Suppressing False Positives

If a finding is a false positive, suppress it so it doesn't block your PRs:

TERMINAL

Copy

```bash
# Suppress a specific rule
npx @ship-safe/cli ignore secrets/generic-api-key -r "Test API key, not real"

# Findings suppressed via .shipsafeignore still show in the dashboard as "suppressed"
# To re-enable a rule:
npx @ship-safe/cli unignore secrets/generic-api-key
```

[← PreviousSecurity Rules](https://ship-safe.co/docs/rules)[Next →GitHub App](https://ship-safe.co/docs/github-app)

## Sitemap

Every page of this site, in markdown: [https://ship-safe.co/sitemap.md](https://ship-safe.co/sitemap.md)