SiteShadow Scan

Scan changed files in your PRs for security vulnerabilities using SiteShadow SAST.

Repository Role

This repository is the public GitHub Action distribution surface for SiteShadow. It is not the scanner engine or hosted API source of truth.

• Scanner engine, rules, taint analysis, SARIF behavior, benchmark policy, CLI behavior, VS Code extension source, hosted API behavior, and release gates live in hisopo/siteshadow-product.

• This repository should contain only the installable action wrapper, public action documentation, release tags, and packaging metadata for uses: hisopo/siteshadow-scan@....

• Scanner-quality fixes must be implemented and reviewed in hisopo/siteshadow-product, then published here as a release artifact.

• 2,000+ security rules

• Taint tracking across functions (SQL injection, XSS, command injection, SSRF)

• SARIF upload to GitHub Code Scanning

• PR comments with findings summary

• Configurable fail threshold

Usage

name: Security Scan
on:
  pull_request:

jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      security-events: write
    steps:
      - uses: actions/checkout@v4

      - uses: hisopo/siteshadow-scan@v1
        with:
          api-key: ${{ secrets.SITESHADOW_API_KEY }}

Inputs

Input	Description	Default
api-key	SiteShadow API key (required)	—
fail-on	Fail if findings at this severity or above: critical, high, medium, low, none	critical
comment	Post a PR comment with findings summary	true
sarif	Upload SARIF to GitHub Code Scanning	true

Outputs

Output	Description
findings-count	Total number of findings
critical-count	Number of critical findings
high-count	Number of high findings
sarif-file	Path to the SARIF output file

Supported Languages

Python, JavaScript, TypeScript, Java, C#, Go, Ruby, PHP, PowerShell, GraphQL, gRPC/Proto, Dockerfile, Kubernetes YAML, Terraform.

How It Works

1. Gets the list of changed files in the PR
2. Sends each file to the SiteShadow API for analysis
3. Collects findings with severity, CWE, and remediation guidance
4. Posts a summary comment on the PR
5. Uploads SARIF to GitHub Code Scanning
6. Fails the check if findings exceed the configured threshold

Only changed files are scanned — not the entire repo. This keeps scans fast and focused.

Get an API Key

Email hello@siteshadow.com or sign up at siteshadow.com.