security
GitHub Actions Integration
ziploom/scan-action gates every merge — security in the pipeline, not just at deploy.
What you get
Shift-left security
A vulnerability caught in CI is cheaper to fix than one caught in production. The GitHub Actions integration runs the same security scan as the deploy-time check, but earlier — in the pull request, before the code is merged.
Configurable fail conditions
fail-on: high blocks the merge on critical vulnerabilities. fail-on: medium is more conservative. fail-on: none runs the scan for visibility without blocking. Each PR gets a scan report in the Actions tab.
No CI credentials to manage
The action authenticates to ZipLoom with a project-scoped API key. No Snyk token, no Grype installation, no vulnerability database to update. The scan infrastructure is hosted by ZipLoom.
Setup
- 1
Generate an API key in Settings → API Keys → CI/CD.
- 2
Add it to your GitHub repository as a secret named ZIPLOOM_API_KEY.
- 3
Add the action to your workflow: `uses: ziploom/scan-action@v1` with your project ID and fail-on setting.
- 4
Every pull request now gets a security scan. Results appear as a check in the PR status.
Related features