security
GitHub Actions Integration
ziploom/scan-action gates every merge — security in the pipeline, not just at deploy.
What you get
Shift-left security
A vulnerability caught in CI is cheaper to fix than one caught in production. The GitHub Actions integration runs the same security scan as the deploy-time check, but earlier — in the pull request, before the code is merged.
Configurable fail conditions
fail-on: high blocks the merge on critical vulnerabilities. fail-on: medium is more conservative. fail-on: none runs the scan for visibility without blocking. Each PR gets a scan report in the Actions tab.
No CI credentials to manage
The action authenticates to ZipLoom with a project-scoped API key. No Snyk token, no Grype installation, no vulnerability database to update. The scan infrastructure is hosted by ZipLoom.
Setup
- 1
Generate an API key in Settings → API Keys → CI/CD.
- 2
Add it to your GitHub repository as a secret named ZIPLOOM_API_KEY.
- 3
Add the action to your workflow: `uses: ziploom/scan-action@v1` with your project ID and fail-on setting.
- 4
Every pull request now gets a security scan. Results appear as a check in the PR status.
What this check inspects
Workflow permissions — the default write-all token scope that turns a pull request into a supply-chain risk.
Third-party actions pinned to a moving tag rather than a commit SHA.
Secrets exposed to workflows triggered by pull requests from forks.
Steps that echo environment variables or tokens into build logs.
What it means when this fails
Your CI pipeline has credentials for your repository and often for production. A compromised or over-permissioned workflow is a direct path to both, and it runs automatically on code you didn't write when the trigger comes from a fork.
Questions
- Why does pinning an action matter?
- A tag can be moved to point at new code. Pinning to a commit SHA means the action you reviewed is the action that runs.
- Is this the same as scanning my app code?
- No. This is the pipeline that builds and ships the app — a separate attack surface with its own credentials.
- Does it change my workflows?
- It reports the findings and the fix. You apply the change.
What it replaces
GitHub Advanced Security (both)
Code Security + Secret Protection together, per active committer.
Snyk Team
Per contributing developer, 5-seat minimum (~$1,500/yr entry). Code + dependency scanning; does not deploy your app.
Semgrep Team
SAST with a strong free OSS engine; rules and triage are yours to maintain.
ZipLoom Solo — all 28 features included
Deploy, security scan, and monitoring in one flat price. Guild $40/mo · Studio $70/mo · Business $299/mo.
Related features