Implement Code Report in GitHub Actions

Code Report can run in CI and send security findings to the GitOps project that owns a service. The GitOps CLI runs the local scanners and reports their status and results through the Code Report API.

Prerequisites

• A GitOps project with Code Report enabled.
• A project-scoped server key with permission to create Code Report reports.
• The GitOps CLI installed as gops.
• A GitHub repository where the workflow will run.

Configure repository secrets

In the GitHub repository, add these Actions secrets:

• GITOPS_API_URL: the GitOps API base URL, for example https://cloud.getgitops.com/api.
• GITOPS_API_KEY: the project-scoped server key.

The key is sent as a bearer token. Keep it scoped to the project that owns the service and rotate it if it is exposed.

Add the workflow

Create .github/workflows/code-report.yml:

name: Code Report

on:
  push:
    branches: [main]
  pull_request:

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Install GitOps CLI
        run: npm install --global @getgitops/cli

      - name: Run Code Report scan
        env:
          API_URL: ${{ secrets.GITOPS_API_URL }}
          API_KEY: ${{ secrets.GITOPS_API_KEY }}
        run: >-
          gops creport scan
          --api-url "$API_URL"
          --api-key "$API_KEY"
          --service my-service
          --project my-project
          --git-branch "${GITHUB_REF_NAME}"
          --git-repo-url "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}"
          --git-author "${GITHUB_ACTOR}"
          --git-commit "${GITHUB_SHA}"
          --tags github-actions ci

Replace my-service and my-project with the slugs configured in GitOps.

How the scan works

When the command starts, the CLI authenticates against the API with the project server key and identifies the project and service. The API finds the service or creates it when it does not exist.

The CLI then asks the API which Code Report tools are enabled for that project. For each returned tool it:

1. Starts an analysis and sends the Git metadata.
2. Runs the scanner locally in the GitHub Actions runner.
3. Uploads the completed JSON report.
4. Sends a failed status and error details if the scanner exits unsuccessfully.

The current scanners are Trivy, Syft/SBOM, and Gitleaks when enabled by the project.

Review the report

Open the project in GitOps after the workflow completes to review the analysis and findings. Use the commit, branch, service, and version metadata to connect a report to the exact GitHub Actions run that produced it.

Run the same command locally when debugging a workflow, but never print API_KEY or any report containing secrets to the Actions log.