GitHub Actions

GitHub Actions is a self-managed CI environment, so the current Shipmoor integration supports Scan only. The job requires a scan-scoped machine token in SHIPMOOR_TOKEN.

Create the repository secret

From an authorized environment, create the token:

shipmoor auth token create --name github-my-repo --scope scan

Add the result as the repository or organization secret SHIPMOOR_TOKEN. Do not print it, write it to a file, or pass it as a command-line argument.

Workflow

name: Shipmoor Scan

on:
  pull_request:
  push:
    branches: [main]

jobs:
  shipmoor:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    env:
      SHIPMOOR_TOKEN: ${{ secrets.SHIPMOOR_TOKEN }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Install Shipmoor 0.10.0
        run: |
          curl -fsSL https://dl.shipmoor.dev/install.sh | SHIPMOOR_VERSION=0.10.0 bash
          echo "$HOME/.shipmoor/bin" >> "$GITHUB_PATH"
      - name: Run Shipmoor Scan
        run: |
          shipmoor scan --diff origin/main...HEAD \
            --sarif --output shipmoor.sarif \
            --fail-on high
      - name: Upload SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: shipmoor.sarif

The Scan runs on the GitHub-hosted runner. Shipmoor does not upload source, the diff, repository content, findings, or SARIF by default. The explicit upload-sarif step sends the report to GitHub code scanning.

if: always() lets the SARIF upload run after exit code 1, which means the configured Scan gate found a blocking result and still produced a complete report.

Claim Check, Review, Test Evidence, and Blast Radius are not currently supported in this self-managed CI flow. Team and Enterprise managed CI is coming soon/contact-only.