GitHub Code Scanning (SARIF)

ekmire can output findings in SARIF format. Combined with the github/codeql-action/upload-sarif action, findings appear directly in GitHub Security → Code scanning, with inline annotations on pull requests.

This template runs the deep scan on every push and PR, uploads results to GitHub Code Scanning, and optionally breaks the build on critical/high findings.

Copy the template below into .github/workflows/ekmire-sarif.yml in your repository. The template is also available in the backend repo.

# .github/workflows/ekmire-sarif.yml
name: ekmire Security Scan

on:
  push:
    branches: [main, master]
  pull_request:
  schedule:
    - cron: "0 3 * * *"   # daily at 03:00 UTC

jobs:
  ekmire-scan:
    name: ekmire — Build Guard
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
    steps:
      - uses: actions/checkout@v4

      - name: Install ekmire CLI
        run: pip install ekmire

      - name: Run deep scan (SARIF output)
        env:
          EKMIRE_API_KEY: ${{ secrets.EKMIRE_API_KEY }}
        run: ekmire scan --deep . --output sarif --fail-on high > ekmire-results.sarif
        continue-on-error: true

      - name: Upload SARIF to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: ekmire-results.sarif
          category: ekmire

The EKMIRE_API_KEY secret is optional. Without it, the scan runs in offline mode — deterministic rules only, no telemetry sent to the dashboard. With it, findings are also sent to your ekmire dashboard in real time.

To add the secret: GitHub repo → Settings → Secrets and variables → Actions → New repository secret. Name: EKMIRE_API_KEY.

The --fail-on high flag exits 1 when any critical or high finding is present. Combined with continue-on-error: true, this means the SARIF upload always runs, but the overall job is marked failed when the scan finds something serious.

Remove --fail-on to treat scan findings as informational only (the job always passes; findings still appear in Code Scanning).

The schedule trigger runs the scan daily at 03:00 UTC. This catches new rules added to the ekmire threat feed that might match code already in the repository — code that passed the original PR scan but is now covered by a newly-shipped rule.