Governor Action

GitHub Action for running Governor security audits on your codebase.

Usage

name: Security Audit
on: [push, pull_request]

permissions:
  security-events: write  # Required for SARIF upload

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ulsc/governor-action@v1

Examples

Fail on high severity findings

- uses: ulsc/governor-action@v1
  with:
    fail-on: high

SARIF upload to GitHub Code Scanning

SARIF upload is enabled by default. Findings appear in the Security tab of your repository.

permissions:
  security-events: write

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ulsc/governor-action@v1

Pin a specific Governor version

- uses: ulsc/governor-action@v1
  with:
    version: v0.1.0

Rule-based checks only (no AI, fully offline)

- uses: ulsc/governor-action@v1
  with:
    args: '--only-check prompt_injection --only-check hardcoded_credentials --only-check command_injection --only-check path_traversal --only-check insecure_crypto'

Audit a subdirectory

- uses: ulsc/governor-action@v1
  with:
    path: ./apps/backend

Skip SARIF upload

- uses: ulsc/governor-action@v1
  with:
    upload-sarif: 'false'

Use findings count in subsequent steps

- uses: ulsc/governor-action@v1
  id: audit
- run: echo "Found ${{ steps.audit.outputs.findings-count }} findings"

Inputs

Input	Description	Default
path	Path to source directory or zip to audit	.
version	Governor version to install (v0.1.0, latest)	latest
fail-on	Severity threshold for non-zero exit: critical|high|medium|low|info	(none)
upload-sarif	Upload SARIF results to GitHub Code Scanning	true
args	Additional arguments passed to governor audit	(none)

Outputs

Output	Description
report-dir	Path to the directory containing audit artifacts
findings-count	Total number of findings

Artifacts

The action automatically uploads audit artifacts (Markdown, JSON, HTML, SARIF reports) as a workflow artifact named governor-audit-report.

Permissions

For SARIF upload to work, the workflow needs security-events: write permission:

permissions:
  security-events: write

License

MIT