> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentgg.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Run agentgg in GitHub Actions

> Scan every pull request automatically, restricted to the files it changed, with one workflow file.

Add a workflow that checks out a pull request's head commit, then scans only what it changed against its base branch. See [Scan a pull request](/cli/guides/scan-a-pull-request) for the `--diff` syntax this relies on.

## Add a provider secret

Add your provider's credential as a repository secret first. This example uses `ANTHROPIC_API_KEY`. See [Providers](/cli/providers) for the full list.

## The workflow file

Save this as `.github/workflows/agentgg.yml`.

<Warning>
  GitHub does not expose repository secrets to a `pull_request` workflow triggered from a fork. The `if` guard below skips the scan for a fork pull request. Without it, the scan would run with an empty API key and fail. Do not switch to `pull_request_target` to work around this: it runs the fork's code with your secrets and is a known security risk.
</Warning>

<Warning>
  `fetch-depth: 0` is required. Without full history, git cannot compute the merge base for the three-dot range, and the scan fails.
</Warning>

```yaml theme={null}
name: agentgg

on:
  pull_request:

permissions:
  contents: read

jobs:
  scan:
    if: github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    steps:
      - name: Check out the pull request head
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Install agentgg
        run: npm install -g agentgg

      - name: Scan the pull request diff
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          agentgg scan . \
            --diff "origin/${{ github.event.pull_request.base.ref }}...${{ github.event.pull_request.head.sha }}" \
            -o ./scan-results \
            --provider anthropic \
            --api-key "$ANTHROPIC_API_KEY"

      - name: Upload the findings
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: agentgg-findings
          path: scan-results
```

## What to expect

The job uploads `scan-results` as a build artifact on every run, pass or fail. Download it from the workflow run page to read `summary.md` and the per-finding files under `findings/`. See [Resume and reports](/cli/resume-and-reports) for their shape.

A pull request from a fork skips the job. No scan runs and nothing uploads for it.

Full flag list: [Scan flags](/cli/reference/scan-flags).