Penetrify GitHub Action

AI-driven autonomous penetration testing in your CI/CD pipeline. Scan your application for real-world vulnerabilities and report findings directly in GitHub's Security tab — in minutes, not days.

Penetrify covers SQL injection, XSS, authentication flaws, broken access control, API security issues, and more. No agents to install. No configuration files required to get started.

Quick start

Add this step to any GitHub Actions workflow. Results appear in Security → Code scanning within minutes.

# .github/workflows/security.yml
- name: Run Penetrify Scan
  uses: penetrify/penetrify-action@v1
  with:
    api-key: ${{ secrets.PENETRIFY_API_KEY }}
    target: 'https://staging.your-app.com'

1. Sign up at app.penetrify.cloud and create an API key under Settings → API Keys.
2. Add the key as a GitHub Secret: Settings → Secrets and variables → Actions → New secret. Name it PENETRIFY_API_KEY.
3. Add the workflow step above to your pipeline.
4. Push — findings appear in your repository's Security → Code scanning tab.

How it works

The action integrates Penetrify's AI scanning engine into your workflow in four steps:

1. Triggers a scan against your target URL via the Penetrify API using your API key.
2. Polls for results until the scan completes or the configured timeout is reached.
3. Generates a SARIF report from the findings and uploads it to GitHub Code Scanning.
4. Fails the build if any finding meets or exceeds your configured severity-threshold.

Scans run entirely on Penetrify's infrastructure — your workflow runner only needs outbound HTTPS access to the Penetrify API. Nothing is installed on your application's servers.

Inputs

Outputs

Access outputs in subsequent steps via ${{ steps.<step-id>.outputs.<name> }}.

- name: Run Penetrify Scan
  id: penetrify
  uses: penetrify/penetrify-action@v1
  with:
    api-key: ${{ secrets.PENETRIFY_API_KEY }}
    target: 'https://staging.myapp.com'

- name: Post scan summary
  run: |
    echo "Scan ID: ${{ steps.penetrify.outputs.scan-id }}"
    echo "Findings: ${{ steps.penetrify.outputs.findings-count }}"
    echo "Critical: ${{ steps.penetrify.outputs.critical-count }}"
    echo "Report: ${{ steps.penetrify.outputs.report-url }}"

Severity levels

The severity-threshold input controls when the action fails the build. Setting it to a level will fail on that level and above.

Examples

name: Security Scan
on:
  push:
    branches: [main]

jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: penetrify/penetrify-action@v1
        with:
          api-key: ${{ secrets.PENETRIFY_API_KEY }}
          target: 'https://staging.myapp.com'
          severity-threshold: 'high'

name: PR Security Check
on:
  pull_request:
    branches: [main]

jobs:
  quick-scan:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: penetrify/penetrify-action@v1
        with:
          api-key: ${{ secrets.PENETRIFY_API_KEY }}
          target: 'https://preview-${{ github.event.pull_request.number }}.myapp.com'
          scan-type: 'quick'
          severity-threshold: 'critical'

name: Weekly Security Audit
on:
  schedule:
    - cron: '0 6 * * 1'

jobs:
  audit:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: penetrify/penetrify-action@v1
        with:
          api-key: ${{ secrets.PENETRIFY_API_KEY }}
          target: 'https://app.mycompany.com'
          scan-type: 'full'
          severity-threshold: 'medium'
          timeout: '3600'

- uses: penetrify/penetrify-action@v1
  with:
    api-key: ${{ secrets.PENETRIFY_API_KEY }}
    target: 'https://staging.myapp.com'
    wait-for-results: false

GitHub Security integration

When upload-sarif is enabled (default), findings are uploaded in SARIF format and appear natively throughout GitHub:

API key setup

1. Sign up or log in at app.penetrify.cloud.
2. Navigate to Settings → API Keys and create a new key. Give it a descriptive name like github-actions.
3. Copy the key immediately — it won't be shown again.
4. In your GitHub repository, go to Settings → Secrets and variables → Actions → New repository secret.
5. Name the secret PENETRIFY_API_KEY and paste your key as the value.

Troubleshooting