Prerequisites
XEIZE Token
Obtain an XEIZE_TOKEN to use XEIZE with GitHub Actions.
GitHub Actions permissions
To post comments through GitHub Actions, add the following permissions as shown in the examples.
- checks: write
- contents: read
- pull-requests: write
Pass ${{ secrets.GITHUB_TOKEN }} as XEIZE_GITHUB_API_TOKEN, as shown below.
Scan result language
Add LANG to the job's env to choose the language of SAST, Secret, and IaC findings and comments on the pull request.
yaml
env:
LANG: EN
Supported values are KO (Korean), EN (English), and JP (Japanese). Korean is the default when LANG is unset.
Examples
SAST
yaml
name: XEIZE SAST Workflow
on:
pull_request:
jobs:
sast:
name: xez-sast
runs-on: ubuntu-latest
permissions:
checks: write
contents: read
pull-requests: write
env:
XEIZE_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
XEIZE_TOKEN: ${{ secrets.XEIZE_TOKEN }}
LANG: EN
steps:
- name: Checkout code
uses: actions/checkout@v7
- name: Run XEZ SAST
run: |
curl -L -o xez_ci "https://download.xeize.dev/ci/ci_linux_x64" -H "X-XEZ-TOKEN: $XEIZE_TOKEN" && chmod +x xez_ci
./xez_ci
Secret
yaml
name: XEIZE SECRET Workflow
on:
pull_request:
jobs:
secret:
name: xez-secret
runs-on: ubuntu-latest
permissions:
checks: write
contents: read
pull-requests: write
env:
XEIZE_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
XEIZE_TOKEN: ${{ secrets.XEIZE_TOKEN }}
MODE: secret
LANG: EN
steps:
- name: Checkout code
uses: actions/checkout@v7
- name: Run XEZ Secret
run: |
curl -L -o xez_ci "https://download.xeize.dev/ci/ci_linux_x64" -H "X-XEZ-TOKEN: $XEIZE_TOKEN" && chmod +x xez_ci
./xez_ci
IaC
yaml
name: XEIZE IaC Workflow
on:
pull_request:
jobs:
iac:
name: xez-iac
runs-on: ubuntu-latest
permissions:
checks: write
contents: read
pull-requests: write
env:
XEIZE_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
XEIZE_TOKEN: ${{ secrets.XEIZE_TOKEN }}
MODE: iac
LANG: EN
steps:
- name: Checkout code
uses: actions/checkout@v7
- name: Run XEZ IaC
run: |
curl -L -o xez_ci "https://download.xeize.dev/ci/ci_linux_x64" -H "X-XEZ-TOKEN: $XEIZE_TOKEN" && chmod +x xez_ci
./xez_ci
Blocking merges with LEVEL
yaml
name: XEIZE Workflow
on:
pull_request:
jobs:
sast:
name: xez-sast
runs-on: ubuntu-latest
permissions:
checks: write
contents: read
pull-requests: write
env:
XEIZE_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
XEIZE_TOKEN: ${{ secrets.XEIZE_TOKEN }}
LEVEL: high
steps:
- name: Checkout code
uses: actions/checkout@v7
- name: Run XEZ SAST
run: |
curl -L -o xez_ci "https://download.xeize.dev/ci/ci_linux_x64" -H "X-XEZ-TOKEN: $XEIZE_TOKEN" && chmod +x xez_ci
./xez_ci
Filtering findings with AUDIT LEVEL
yaml
name: XEIZE Workflow
on:
pull_request:
jobs:
iac:
name: xez-iac
runs-on: ubuntu-latest
permissions:
checks: write
contents: read
pull-requests: write
env:
XEIZE_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
XEIZE_TOKEN: ${{ secrets.XEIZE_TOKEN }}
MODE: iac
AUDIT_LEVEL: low
steps:
- name: Checkout code
uses: actions/checkout@v7
- name: Run XEZ IaC
run: |
curl -L -o xez_ci "https://download.xeize.dev/ci/ci_linux_x64" -H "X-XEZ-TOKEN: $XEIZE_TOKEN" && chmod +x xez_ci
./xez_ci
Push workflow without a PR
This runs SAST, Secret, and IaC with MODE=all when code is pushed to develop, then builds and deploys after a successful scan. Add XEIZE_TOKEN as an Actions secret.
yaml
name: XEIZE push security
on:
push:
branches: [develop]
permissions:
contents: read
jobs:
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
with:
fetch-depth: 0
- name: Scan pushed changes
env:
XEIZE_TOKEN: ${{ secrets.XEIZE_TOKEN }}
MODE: all
LEVEL: medium
run: |
curl -fsSL -H "X-XEZ-TOKEN: $XEIZE_TOKEN" https://download.xeize.dev/ci/ci_linux_x64 -o /tmp/xez_ci
chmod +x /tmp/xez_ci
/tmp/xez_ci
build:
needs: [security]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- run: ./ci/build.sh
deploy:
needs: [build]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- run: ./ci/deploy.sh
Replace the build and deployment commands for your project while preserving the security → build → deploy dependencies. See common settings for scan scope and error handling.