rorixrorix
sign in →

GitHub Actions

Public preview: rorix-io/rorix-scan-action@v1 and rorix-io/rorix-pentest@v1 are publicly available. Pin a full commit SHA if your repository requires immutable third-party Actions.

The official Rorix GitHub Action scans NuGet or npm dependencies as part of your CI/CD pipeline. Its release smoke installed the public CLI on a clean GitHub runner and checked the Action's exit-code propagation on a clean scan. It did not verify a failing vulnerability, policy, or missing-manifest case.

CI gate warning: the public Action v1 pins Rorix.Cli 0.1.1. Its CLI source has the same affected exit-code return path as public 0.1.2, so blocking findings can report success. Keep this Action advisory-only until it installs a corrected public CLI and failing-case Action checks pass. Do not make it a required pull-request security check yet.

After both integrations are public, the Rorix GitHub App will be the default for repository-level protection. The Action is intended for teams that need workflow-owned scanning, custom runners, explicit SARIF upload, or branch-specific CI policy.

Recommended Rollout

  1. Run one scan locally or from the dashboard so you understand the current baseline
  2. Create a .rorix.yml policy that reflects what should actually block a build
  3. Start with advisory scans if the team is still calibrating noise
  4. Turn on policy gating after the corrected public CLI is installed by the Action, failing-case checks pass, and the baseline looks right

Basic Usage

name: Security Scan
on: [push, pull_request]
 
jobs:
  rorix:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Rorix Scan
        uses: rorix-io/rorix-scan-action@v1
        with:
          api-key: ${{ secrets.RORIX_API_KEY }}

With Policy Enforcement

Use this example only after the corrected Action release and failing-case checks described above.

name: Security Scan
on: [push, pull_request]
 
jobs:
  rorix:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Rorix Policy Check
        uses: rorix-io/rorix-scan-action@v1
        with:
          api-key: ${{ secrets.RORIX_API_KEY }}
          command: scan
          policy-file: .rorix.yml

After those release checks pass, this configuration can make pull requests fail on policy violations.

SARIF Upload to GitHub Security Tab

name: Security Scan
on: [push, pull_request]
 
jobs:
  rorix:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@v4
 
      - name: Rorix Scan
        uses: rorix-io/rorix-scan-action@v1
        id: rorix
        with:
          api-key: ${{ secrets.RORIX_API_KEY }}
          format: sarif
 
      - name: Upload SARIF
        if: ${{ always() && steps.rorix.outputs.sarif-file != '' }}
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.rorix.outputs.sarif-file }}

The upload step runs when a completed scan finds blocking vulnerabilities or policy violations, so GitHub receives the SARIF results while the job still fails. It skips upload when the CLI could not produce a SARIF file.

Inputs

| Input | Required | Default | Description | | --- | --- | --- | --- | | api-key | Yes | — | Your Rorix API key (use a repository secret) | | command | No | scan | Command to run: scan or sbom | | format | No | table | Output format: table, json, or sarif | | policy-file | No | — | Path to a .rorix.yml policy file | | path | No | . | Path to the project or solution file |

Outputs

| Output | Description | | --- | --- | | sarif-file | Path to the generated SARIF file (when format is sarif) | | exit-code | Exit code returned by the installed CLI; the current public CLI can incorrectly return 0 for blocking findings |

Setting Up the API Key

  1. Go to your Rorix dashboard and create an API key
  2. In your GitHub repository, go to Settings then Secrets and variables then Actions
  3. Click New repository secret
  4. Name it RORIX_API_KEY and paste your key

Pentesting a Verified Staging Target

Rorix Pentesting uses a separate target-based Action. Create and DNS-verify the target in Rorix first, then create an API key with pentest.run and pentest.read. CI cannot override the stored URL or scope.

The public pentest bundle is validated for self-containment and fail-closed credential handling. Exercise it against your own verified non-production target before making the check required.

name: Staging Pentest
on:
  workflow_dispatch:
  deployment_status:
 
jobs:
  pentest:
    if: github.event_name == 'workflow_dispatch' || github.event.deployment_status.state == 'success'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: rorix-io/rorix-pentest@v1
        with:
          api-key: ${{ secrets.RORIX_API_KEY }}
          target-id: ${{ vars.RORIX_PENTEST_TARGET_ID }}
          threshold: high
          enforce: "false"

Start with enforce: "false". Once the current baseline is triaged, set it to "true" to fail only on new or regressed findings at or above the threshold. Accepted-risk and false-positive findings do not block.

GitHubAzure DevOps