Docs

Code ScansBeta

GitHub Actions workflow security analysis — hardcoded secrets, unpinned actions, excessive permissions.

Code scans analyze your GitHub Actions workflows (.github/workflows/*.yml) for security issues in your CI/CD pipeline: hardcoded secrets, unpinned third-party actions, excessive permissions, and dangerous patterns.

#Setting It Up

  • 1

    Connect GitHub

    Go to Integrations and click Connect on the GitHub card. You'll be redirected to GitHub to authorize Vergate with repository access.
  • 2

    Link a repository

    Link a GitHub repository URL to your project (when creating a project or via project settings). Code scans run against that repo's workflows.
  • 3

    Run a scan

    Trigger a scan from the Code Scans page, or run all scans on the project — code scanning is included automatically when GitHub is connected.

    • #How Scans Trigger

    Code scans run automatically when your team pushes code or opens a pull request (via the GitHub App webhook), and can be triggered manually at any time. Results appear in the Code Scans page and are reported back to GitHub as Check Runs.

    #What It Detects

    IssueExample
    Hardcoded secretsGH_TOKEN`, `AWS_SECRET_ACCESS_KEY`, `sk_live_...` in workflow YAML or `env:` block
    Unpinned actionsactions/checkout@v3` instead of a full SHA-pinned commi
    Excessive permissionspermissions: write-all` or `contents: write` on pull_request event
    Dangerous patternsUsing `${{ github.token }}` outside safe contexts, curl-pipe-bash installs

    #Reports

    Each completed scan row has a Report button that downloads a PDF (or JSON via ?format=json) with the full findings, severity breakdown, and the diff between runs (new vs. fixed findings).

    Tip. Pin every third-party action to a full commit SHA — not a tag like @v4 — to prevent supply-chain tampering between releases.