GitHub Actions

Configuración previa

Añade las siguientes variables en Settings → Secrets and variables → Actions de tu repositorio:

| Tipo | Nombre | Descripción | |---|---|---| | Secret | GERION_API_KEY | API key M2M de tu organización | | Variable | GERION_API_URL | URL del Gerion API Gateway |

Workflows

Scan → API

El resultado se envía directamente al dashboard de Gerion. Copia este archivo en .github/workflows/gerion-scan.yml:

name: Gerion Security Scan

on:
  push:
    branches: [main, master, develop]
  pull_request:
  workflow_dispatch:

jobs:
  gerion-scan:
    name: Security Scan
    runs-on: ubuntu-latest
    permissions:
      contents: read
    container:
      image: ghcr.io/gerion-appsec/gerion-cli:latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Run full security scan
        env:
          GERION_API_URL: ${{ vars.GERION_API_URL }}
          GERION_API_KEY: ${{ secrets.GERION_API_KEY }}
        run: gerion scan-all /github/workspace

Scan → SARIF

Sube los resultados a GitHub Advanced Security para verlos en la pestaña Security del repositorio y en los checks de Pull Request.

name: Gerion Security Scan (SARIF)

on:
  push:
    branches: [main, master, develop]
  pull_request:
  workflow_dispatch:

jobs:
  gerion-scan:
    name: Security Scan → SARIF
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Run full security scan
        run: |
          docker run --rm \
            -v "$GITHUB_WORKSPACE:/code" \
            -e GITHUB_REPOSITORY \
            -e GITHUB_REF_NAME \
            -e GITHUB_SHA \
            -e GITHUB_ACTOR \
            ghcr.io/gerion-appsec/gerion-cli:latest \
            gerion scan-all /code \
              --format sarif \
              --output-file /code/gerion-results.sarif
      - name: Upload SARIF to GitHub Advanced Security
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: gerion-results.sarif
          category: gerion
      - name: Archive SARIF artifact
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: gerion-sarif-${{ github.run_number }}
          path: gerion-results.sarif
          retention-days: 30

Nota

GitHub Advanced Security está disponible en repositorios públicos y en GitHub Enterprise. Requiere el permiso security-events: write.

Nightly + PDF

Ejecución nocturna con generación de informe PDF como artifact descargable.

name: Gerion Nightly Security Report

on:
  schedule:
    - cron: "0 2 * * *"  # Cada día a las 02:00 UTC
  workflow_dispatch:

jobs:
  gerion-scan:
    name: Nightly Scan
    runs-on: ubuntu-latest
    permissions:
      contents: read
    container:
      image: ghcr.io/gerion-appsec/gerion-cli:latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Run full security scan
        env:
          GERION_API_URL: ${{ vars.GERION_API_URL }}
          GERION_API_KEY: ${{ secrets.GERION_API_KEY }}
        run: gerion scan-all /github/workspace

  gerion-report:
    name: Generate PDF Report
    runs-on: ubuntu-latest
    needs: gerion-scan
    container:
      image: ghcr.io/gerion-appsec/gerion-cli:latest
    steps:
      - uses: actions/checkout@v4
      - name: Generate PDF report
        env:
          GERION_API_URL: ${{ vars.GERION_API_URL }}
          GERION_API_KEY: ${{ secrets.GERION_API_KEY }}
        run: |
          gerion report \
            --format pdf \
            --output-file /github/workspace/gerion-report.pdf \
            --severity HIGH \
            --active-only
      - uses: actions/upload-artifact@v4
        with:
          name: gerion-report-${{ github.run_number }}
          path: gerion-report.pdf
          retention-days: 90

Reusable Action

Puedes usar la Action oficial de Gerion directamente en cualquier workflow sin copiar el YAML del contenedor:

- uses: gerion-appsec/gerion-cli-action@v1
  with:
    api-url: ${{ vars.GERION_API_URL }}
    api-key: ${{ secrets.GERION_API_KEY }}

Parámetros disponibles

| Parámetro | Defecto | Descripción | |---|---|---| | scan-type | all | all | secrets | sca | iac | sast | | code-path | . | Subdirectorio a escanear (relativo al workspace) | | api-url | — | URL del Gerion API Gateway | | api-key | — | API key M2M | | output-format | — | json | markdown | sarif | | output-file | — | Fichero de salida (relativo al workspace) | | log-level | info | debug | info | warning | error | | timeout | 180 | Timeout por escáner en segundos |

Salidas

| Salida | Descripción | |---|---| | findings-file | Ruta absoluta al fichero de salida (si se configuró output-file) | | exit-code | Código de salida del CLI (0 = éxito, 1 = error de ejecución) |

Notas

• Gerion CLI detecta automáticamente GITHUB_REPOSITORY, GITHUB_REF_NAME y GITHUB_SHA. No es necesario configurar metadatos manualmente.
• Los container jobs montan $GITHUB_WORKSPACE en /github/workspace automáticamente.
• El CLI retorna código de salida 0 aunque encuentre vulnerabilidades. Usa report --severity o parsea el JSON para implementar quality gates.