GitHub Integration

# Public repository — no token needed
zenveil scan github torvalds/linux

# Full URL format
zenveil scan github https://github.com/owner/repo

# Private repository
zenveil scan github owner/private-repo --token ghp_your_token

# Specific branch or tag
zenveil scan github owner/repo --ref develop

# Specific commit
zenveil scan github owner/repo --ref abc123def456

export GITHUB_TOKEN="ghp_your_token_here"

# Fix a secret finding and open a PR
zenveil fix ZG-A1B2C3 --auto-pr --repo owner/repo

# The PR is opened instantly — no AI needed for secret redaction

zenveil scan github owner/repo --auto-pr-low

# .github/workflows/security.yml
name: Security Scan

on:
  pull_request:
    branches: [main, develop]
  push:
    branches: [main]

jobs:
  security:
    name: ZenVeil Security Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install ZenVeil
        run: pip install zenveil

      - name: Run security scan
        env:
          ZENVEIL_API_KEY: ${{ secrets.ZENVEIL_API_KEY }}
        run: zenveil scan repo . --json security-results.json

      - name: Upload scan results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: security-scan
          path: security-results.json

- name: Run security scan with CVE checks
  env:
    ZENVEIL_API_KEY: ${{ secrets.ZENVEIL_API_KEY }}
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  run: zenveil scan repo . --check-cves --json security-results.json

- name: Auto-fix low-severity issues
  env:
    ZENVEIL_API_KEY: ${{ secrets.ZENVEIL_API_KEY }}
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  run: |
    zenveil scan github ${{ github.repository }} \
      --token ${{ secrets.GITHUB_TOKEN }} \
      --auto-pr-low

zenveil scan repo .
# Exits 0: no CRITICAL or HIGH findings — build passes
# Exits 1: CRITICAL or HIGH found — build fails
# Exits 2: scan error — check logs

- name: Security gate
  run: |
    zenveil scan repo . || {
      echo "Security issues found — see artifact for details"
      exit 1
    }