GitHub is usually the first system a team connects to Safeguard, because that is where the code and the pull requests already live. There are two documented ways to use it, and they work together: connect the repository from the console, and run the CLI in GitHub Actions.
This post sticks to what the Safeguard docs describe. Where the docs are silent, it says so.
What it is
Safeguard lists GitHub under Source Code Management on the Integrations page, next to Bitbucket, GitLab and a generic Git URL. The docs say SCM integrations support both public and private repositories. GitHub Actions is also listed as a supported CI/CD pipeline.
Connecting a repository generates an SBOM for it and creates a project you can track. After that, all projects are scanned daily for newly disclosed vulnerabilities.
How to use it
The documented workflow is the same for every SCM provider.
- Open Integrations from the sidebar.
- Select the integration type. The Source Code (SCM) filter narrows the cards.
- Click Connect on the GitHub card.
- Configure access: credentials for a private repository, or the URL for a public one.
- Review and connect: pick the repositories, then set project options.
- Find the result under Projects.
The generation options on the review step are Project Name, Version (auto-detected from git tags), Branch/Tag, Include Dev Dependencies and Deep Analysis, which turns on Griffin AI deep analysis.
The docs give step by step screens for Bitbucket only. They do not list the exact credential type or permissions GitHub needs, so check the card in your own console and ask your admin which account to use.
Scan in GitHub Actions
The CI/CD docs show a workflow that runs on push and pull request. It uses ubuntu-latest with permissions: security-events: write, checks out the code, installs the CLI, runs detect, and uploads the SARIF file.
on: [push, pull_request]
permissions:
security-events: write
steps:
- uses: actions/checkout@v4
- run: curl -fsSL https://cli.safeguard.sh/install | SAFEGUARD_VERSION=<version> bash
- run: safeguard detect --format sarif --output safeguard.sarif
- uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: safeguard.sarif
Pin the CLI version so a new release does not change your builds. The docs also note that there is no published Safeguard GitHub Action yet and that the CLI has no severity threshold flag. Enforcement happens through platform policy gates.
Triggers
Besides the daily scan, the docs list On Push (every commit to monitored branches), Scheduled (daily, weekly or custom) and On Release (when new tags are created).
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the CLI fail a GitHub Actions build on a severity threshold?
No. The docs say the CLI has no severity threshold flag. Enforcement happens through platform policy gates.
Which options appear when you review a connected repository?
Project Name, Version, Branch/Tag, Include Dev Dependencies and Deep Analysis.
