GitHub Actions + GeekWala Dependency Scanning
Gate pull requests and pushes on known dependency vulnerabilities — EPSS exploit probability and CISA KEV status surface in your GeekWala dashboard.
Add geekwala/scan-action@v1 to any GitHub Actions workflow to scan your dependency manifest or lockfile for known vulnerabilities on every push and pull request. Findings are reported to the repository's Security tab via SARIF, with a configurable severity gate to fail the step whenever a scan turns up a finding at or above your chosen threshold.
GeekWala scans against the OSV database — the same open source vulnerability feed covering npm, PyPI, Maven, Packagist, Go, crates.io, RubyGems, and NuGet. The same scan also uploads full results to your GeekWala project, where every finding is additionally enriched with EPSS exploit-probability scoring and CISA Known Exploited Vulnerabilities (KEV) status — in the GeekWala dashboard and the CLI's own table output — so you can triage which findings actually matter most instead of working through a flat list by CVSS score alone. (GitHub's Security tab only ever sees the uploaded SARIF file, which carries severity but not EPSS/KEV; the severity gate below is CVSS-severity-based, and EPSS/KEV triage context lives in GeekWala itself, not separate gate inputs.)
Setup
Add this job to a workflow file (e.g. .github/workflows/security-scan.yml). Store your GeekWala API token as a repository or organization secret — never commit it to the workflow file.
geekwala/scan-action@v1 is not yet published to the GitHub Marketplace and no release tag has been cut. Pin a commit SHA instead of @v1, or vendor the action directly from packages/github-action in the GeekWala repository, until a tagged release ships.name: Security Scan
on: [push, pull_request]
jobs:
scan:
runs-on: ubuntu-latest
permissions:
contents: read
security-events: write # required for upload-sarif
steps:
- uses: actions/checkout@v4
- name: GeekWala Security Scan
# Not yet tagged on the Marketplace — pin a commit SHA in place of @v1 (see the
# "Publish status" note above) until a tagged release ships.
uses: geekwala/scan-action@v1
id: scan
with:
manifest-path: package-lock.json
project-id: ${{ vars.GEEKWALA_PROJECT_ID }}
api-token: ${{ secrets.GEEKWALA_TOKEN }}
fail-on: high
- name: Upload SARIF to GitHub
uses: github/codeql-action/upload-sarif@v3
if: always()
with:
sarif_file: ${{ steps.scan.outputs.sarif-path }}What Gets Scanned
The action resolves your full dependency tree from the manifest or lockfile you point it at — including transitive dependencies, which account for the majority of most projects' actual attack surface — and checks every package version against known advisories. Configure it with the inputs below; use the outputs to wire results into later workflow steps like a Slack notification or a GitHub issue.
Inputs
Configure the action with these inputs.
| Input | Required | Description |
|---|---|---|
| manifest-path | Yes | Path (relative to the repo root) to the manifest or lockfile to scan, e.g. package-lock.json, composer.lock, go.mod. |
| project-id | Yes | The GeekWala project ID to scan into. |
| api-token | Yes | GeekWala personal access token (scan:write + project:write abilities). Always source this from a secret — never hardcode it in the workflow file. |
| fail-on | No (report-only) | Fail the step if a finding at or above this severity exists: critical|high|medium|low. Leave unset to always succeed. |
Outputs
Use these in later workflow steps.
| Output | Description |
|---|---|
| findings-count | Total number of vulnerability findings (SARIF results) reported by the scan. |
| sarif-path | Absolute path to the generated SARIF 2.1.0 report file. Feed this into github/codeql-action/upload-sarif to surface findings in the GitHub Security tab. |
Severity Gate Configuration
The fail-on input controls whether the step fails the job:
- Unset (default): report-only — the step always succeeds. SARIF results still upload to the Security tab so you can review findings without blocking merges.
critical/high/medium/low: fails the step if any finding is at or above that severity — start withhighand tighten once the team is comfortable triaging findings.
The severity gate above is CVSS-based only, and it's what GitHub's Security tab sees via SARIF. The same scan also uploads full results to your GeekWala project, where every finding is additionally annotated with EPSS exploit prediction scoring and flagged when it's on the CISA KEV catalog — in the GeekWala dashboard and the CLI's own table output — so you can triage a raw CVSS score's real-world urgency without reaching for a second tool, even though EPSS/KEV live in GeekWala itself and don't change whether the step itself fails.
Frequently Asked Questions
How long does this add to my GitHub Actions pipeline?
Scanning a typical lockfile (500–1,000 packages) takes 15–30 seconds. Network latency to the vulnerability database is the main variable — OSV queries are fast, but self-hosted mirrors eliminate that dependency if speed is critical.
What's the difference between the GitHub Actions action and the geekwala CLI?
The action is a thin wrapper around the same geekwala CLI used everywhere else — no scanning logic is duplicated. Use the action for a drop-in GitHub Actions step; use the CLI directly on any other CI platform (GitLab CI, Jenkins, CircleCI) with the same inputs and the same EPSS/KEV enrichment.
Can I use this on GitLab CI or Jenkins instead?
Yes — run the geekwala CLI directly in your pipeline config with the same PR-gate-plus-scheduled-scan architecture. See our GitLab CI and Jenkins setup guide for copy-paste .gitlab-ci.yml and Jenkinsfile configs.
Learn More
Get a GeekWala API token
Sign up free, create a project, and generate a token with scan:write + project:write abilities to wire up the workflow above.
The free tier covers a limited number of projects with persistent scan history; Pro adds unlimited projects, a longer history window, and scheduled scans so new CVEs disclosed against your existing dependencies surface without waiting for the next push. No credit card required to get a token and run your first scan.