What does the Code Radar GitHub Actions gate do?
It runs Radar in the GitHub Actions runner, produces SARIF-ready evidence, and can fail a pull request when findings meet the configured severity threshold.
GitHub Actions SARIF
GitHub Actions security scanner with SARIF output.
Run the same local SAST rules in GitHub Actions, upload SARIF to GitHub code scanning, annotate pull requests, and enforce a merge threshold.
Summary
GitHub Actions security scanner with SARIF output
Run the same local SAST rules in GitHub Actions, upload SARIF to GitHub code scanning, annotate pull requests, and enforce a merge threshold.
Does the CI workflow upload source code to Code Radar?
No. The scan runs in the runner environment. The paid workflow validates entitlement and repository slots, while source files and generated reports remain where the command runs.
When is a repository slot worth paying for?
A repository slot is worth paying for when local findings are trusted enough to become shared reviewer evidence and a merge gate for a real repository.
Which proof should be reviewed before rollout?
Review the local scan result, SARIF output, fail-on threshold, and sample report before making the GitHub Actions gate block merges.
Deterministic PR gates
Use severity thresholds and policy files to turn security scan output into a clear pass/fail signal for pull requests, fail PRs on vulnerabilities, and upload SARIF in GitHub Actions.
- PR security gate
- Pull request security scanner
- CI security scanner
- Fail-on thresholds
Minimal workflow
Add the action and pass the license key through repository secrets.
uses: T-and-T-soft/code-radar@v1
with:
license-key: ${{ secrets.RADAR_LICENSE_KEY }}
fail-on: highGitHub Actions scanner FAQ
Confirm the runner boundary, SARIF evidence, severity threshold, and repository entitlement before the workflow blocks merges.
What does the Code Radar GitHub Actions gate do?
It runs Radar in the GitHub Actions runner, produces SARIF-ready evidence, and can fail a pull request when findings meet the configured severity threshold.
Does the CI workflow upload source code to Code Radar?
No. The scan runs in the runner environment. The paid workflow validates entitlement and repository slots, while source files and generated reports remain where the command runs.
When is a repository slot worth paying for?
A repository slot is worth paying for when local findings are trusted enough to become shared reviewer evidence and a merge gate for a real repository.
Which proof should be reviewed before rollout?
Review the local scan result, SARIF output, fail-on threshold, and sample report before making the GitHub Actions gate block merges.