Advanced Options & Configuration

Scan Modes

By default, the action tries to autodetect everything. This can fail in more complicated setups (such as monorepos). Safety Action supports 3 scan modes, which can be mixed and matched depending on your exact project structure.

Scanning a built Docker image

Safety Action can scan into any Docker image that exists on the action runner. This is most useful when you're using GitHub workflows to build and publish Docker images as part of your pipeline.

To use this mode, set scan to docker. You can also specify an image to scan using docker-image. This mode requires /bin/sh to be present in the image you're scanning, as well as the command python -m pip list --format=freeze to be runnable:

env:
  IMAGE_URL: ghcr.io/example/example:${{ github.sha }}

jobs:
  safety:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/[email protected]

      - name: Build image
        run: DOCKER_BUILDKIT=1 docker buildx build -t ${{ env.IMAGE_URL }} .

      # Scan the built image using Safety
      - uses: pyupio/[email protected]
        with:
          api-key: ${{secrets.SAFETY_API_KEY}}
          scan: 'docker'
          docker-image: ${{ env.IMAGE_URL }}

Scanning the workflow environment

Safety Action can scan your current workflow environment. This is most useful when you're also using actions/setup-python and perhaps packaging up a wheel.

To use this mode, set scan to env. No options are available - if pythonLocation has been set by actions/setup-python, this Python environment will automatically be scanned, otherwise the environment of the worker image (eg, ubuntu-latest will be scanned):

jobs:
  safety:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/[email protected]

      - uses: actions/[email protected]
        with:
          python-version: '3.10'
          architecture: 'x64'

      - run: python -m pip install requirements.txt

      # Scans the Python env setup by setup-python.
      - uses: pyupio/[email protected]
        with:
          api-key: ${{secrets.SAFETY_API_KEY}}
          scan: 'env'

Scanning a requirements file

Safety Action can scan a requirements.txt or Poetry / Pipfile lockfile in your repo. Scanning a file is not recommended unless you're using a lock file that specifies all dependencies, and are confident that no other packages are installed in the environment.

To use this mode, set scan to file. You can also specify a path to the requirements file to scan using requirements:

jobs:
  safety:
    runs-on: ubuntu-latest
    steps:
      # Scans the root poetry.lock in the repo
      - uses: pyupio/[email protected]
        with:
          api-key: ${{secrets.SAFETY_API_KEY}}
          scan: 'file'
          requirements: 'poetry.lock'

      # Scans Pipfile.lock under services/microservice-example. Useful for monorepo setups.
      - uses: pyupio/[email protected]
        with:
          api-key: 'your-pyup-api-key-here'
          scan: 'file'
          requirements: 'services/microservice-example/Pipfile.lock'

Running without failing the pipeline

It's possible to run the Safety action, without failing the pipeline if a vulnerability is found, but checking this status in a next step:

jobs:
  insecure-test:
    runs-on: ubuntu-latest

    steps:
      - uses: pyupio/[email protected]
        id: scan-1
        continue-on-error: true
        with:
          api-key: ${{secrets.SAFETY_API_KEY}}

      - if: steps.scan-1.outcome != 'failure'
        run: echo 'Safety failed to run, but the next step in the pipeline continued.' && exit 1

Action options

Option

Default

Required?

Description

api-key

N/A

Yes

Your PyUp API key

scan

auto

No

Scan mode to use. One of auto / docker / env / file

docker-image

Autodetects the last built, tagged image on the runner

No

Tag or hash of the Docker Image to scan.

requirements

poetry.lock followed byPipfile.lock followed by requirements.txt (first match wins)

No

Path of requirements file to scan

continue-on-error

No

No

By default, Safety will exit with a non-zero exit code if it detects any vulnerabilities. Set this to non-empty value to not error out.

output-format

'screen'

No

Output format for returned data. One of screen / text / json / bare

args

''

No

Any additional CLI arguments to pass to safety


Did this page help you?