CI Integration

CI integration

GitHub Action

From v0.1.3 the repository is a GitHub Action. Pin it, like every third-party action, to a full commit SHA.

name: pandaward
on: [pull_request]
permissions:
  contents: read
  security-events: write
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@<sha> # v4
        with:
          persist-credentials: false
      - id: pandaward
        uses: ratomirjovanovic/pandaward@<sha> # v0.2.0
        with:
          fail-on: high        # empty to never fail on findings
          new-only: "true"     # gate only on findings the pull request introduces
      - if: always()
        uses: github/codeql-action/upload-sarif@<sha> # v3
        with:
          sarif_file: ${{ steps.pandaward.outputs.sarif-file }}

The action downloads the release binary for the runner (Linux and macOS on amd64 and arm64, Windows on amd64), refuses it if it does not match SHA256SUMS, runs pandaward init when needed and a passive scan, and writes SARIF, HTML, Markdown and JSON reports to pandaward-report/.

Input	Default	Meaning
version	the action's release	Pandaward release to download, without the leading v
working-directory	.	project to scan
fail-on	high	fail on open, non-hypothesis findings at or above this severity; empty never fails on findings
new-only	false	with a base ref, gate and summarize only findings that are not present at the base
base-ref	pull request base	commit or ref to compare against when new-only is true
output-dir	pandaward-report	report directory, relative to the workspace
summary	counts	job summary: counts, full (lists findings with file and line) or none

With new-only, the base commit is scanned in a separate git worktree with hooks disabled, and only findings whose fingerprints are new count. Job summaries of public repositories are public, so summary: full shows file names and lines to everyone. All inputs and outputs are in action.yml.

Without the action

The same in plain steps, for GitHub Actions or any other CI. Pin third-party actions to a full commit SHA.

name: pandaward
on: [pull_request]
permissions:
  contents: read
  security-events: write
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@<sha> # v4
        with:
          persist-credentials: false
      - name: Install Pandaward
        run: |
          v=v0.2.0
          curl -fsSLO https://github.com/ratomirjovanovic/pandaward/releases/download/$v/pandaward-linux-amd64
          curl -fsSLO https://github.com/ratomirjovanovic/pandaward/releases/download/$v/SHA256SUMS
          sha256sum --ignore-missing -c SHA256SUMS
          install -m 0755 pandaward-linux-amd64 /usr/local/bin/pandaward
      - run: pandaward init
      - run: pandaward scan --fail-on high
      - if: always()
        run: pandaward report --format sarif,html --out pandaward-report
      - if: always()
        uses: github/codeql-action/upload-sarif@<sha> # v3
        with:
          sarif_file: pandaward-report

Pin the version and check the checksum, as above, so a CI run never picks up an unreviewed binary. go install github.com/ratomirjovanovic/pandaward/cmd/pandaward@v0.2.0 with actions/setup-go works as well.

--fail-on counts only open findings that are not hypotheses. Exit code 4 means the gate was reached; 1 means an error.

Do not upload the HTML report as a public artifact in public repositories; it describes weaknesses.

Before each commit

With pre-commit, add this to .pre-commit-config.yaml and run pandaward init once in the project:

repos:
  - repo: https://github.com/ratomirjovanovic/pandaward
    rev: v0.2.0
    hooks:
      - id: pandaward-system   # uses the pandaward on your PATH

Hook	Needs
pandaward-system	pandaward on your PATH (plugin, package or release binary)
pandaward	Go 1.23 or later; pre-commit builds Pandaward from the pinned rev

Both run pandaward scan --quiet --fail-on high once per commit and block it when open high or critical findings exist. The scan reads the working tree, not only the staged files.