Run agentgg in GitHub Actions

Add a workflow that checks out a pull request’s head commit, then scans only what it changed against its base branch. See Scan a pull request for the --diff syntax this relies on.

Add a provider secret

Add your provider’s credential as a repository secret first. This example uses ANTHROPIC_API_KEY. See Providers for the full list.

The workflow file

Save this as .github/workflows/agentgg.yml.

GitHub does not expose repository secrets to a pull_request workflow triggered from a fork. The if guard below skips the scan for a fork pull request. Without it, the scan would run with an empty API key and fail. Do not switch to pull_request_target to work around this: it runs the fork’s code with your secrets and is a known security risk.

fetch-depth: 0 is required. Without full history, git cannot compute the merge base for the three-dot range, and the scan fails.

name: agentgg

on:
  pull_request:

permissions:
  contents: read

jobs:
  scan:
    if: github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    steps:
      - name: Check out the pull request head
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Install agentgg
        run: npm install -g agentgg

      - name: Scan the pull request diff
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          agentgg scan . \
            --diff "origin/${{ github.event.pull_request.base.ref }}...${{ github.event.pull_request.head.sha }}" \
            -o ./scan-results \
            --provider anthropic \
            --api-key "$ANTHROPIC_API_KEY"

      - name: Upload the findings
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: agentgg-findings
          path: scan-results

What to expect

The job uploads scan-results as a build artifact on every run, pass or fail. Download it from the workflow run page to read summary.md and the per-finding files under findings/. See Resume and reports for their shape. A pull request from a fork skips the job. No scan runs and nothing uploads for it. Full flag list: Scan flags.

Get started

Concepts

Guides

Providers

Reference

Help

Run agentgg in GitHub Actions

Add a provider secret

The workflow file

What to expect

​Add a provider secret

​The workflow file

​What to expect

Add a provider secret

The workflow file

What to expect