StackShield + GitHub Actions: Security Scans in Your CI/CD Pipeline

Features

• Trigger StackShield scans from any GitHub Actions workflow using a simple cURL step or the StackShield API
• Gate deployments by failing the workflow if critical or high-severity findings are detected
• Scan staging or preview environments automatically after deployment to catch issues before promoting to production
• View scan results directly in the GitHub Actions log output with links to your StackShield dashboard for details
• Support for matrix builds to scan multiple sites or environments in a single workflow run

Setup Guide

1. 1

   Generate a StackShield API Token

   In your StackShield dashboard, go to Settings and then API. Generate a new API token with scan permissions. Copy the token and the site-specific trigger URL.

2. 2

   Add the Token as a GitHub Secret

   In your GitHub repository, go to Settings, then Secrets and variables, then Actions. Create a new secret called STACKSHIELD_API_TOKEN and paste your API token. Create another secret called STACKSHIELD_TRIGGER_URL with your scan trigger URL.

3. 3

   Add the Scan Step to Your Workflow

   Add a step to your GitHub Actions workflow YAML that calls the StackShield trigger endpoint using cURL. Pass the API token as a Bearer token in the Authorization header. The endpoint returns the scan results as JSON, which you can parse to determine pass or fail status.

4. 4

   Configure Failure Thresholds

   Decide which severity levels should cause the workflow to fail. You can parse the JSON response and use a conditional step to fail the job if findings exceed your threshold (for example, fail on any critical or high-severity finding).

Ideal Use Case

Frequently Asked Questions