GitHub Actions SAST Gate with cognium-dev

Step 1

Add the workflow

Create .github/workflows/cognium-scan.yml. The action definition follows the public repository's main branch, while version: latest installs the newest published CLI.

cognium-scan.ymlyaml

name: Cognium security scan

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read
  security-events: write

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Cognium SAST
        uses: cogniumhq/cognium-dev/packages/cli@main
        with:
          path: ./src
          severity: high
          format: sarif
          output: cognium-results.sarif
          exclude-tests: 'true'
          upload-sarif: 'true'
          version: latest

Public references: Both cogniumhq/cognium-dev and its packages/cli/action.yml are publicly accessible. There is no private repository dependency.

Step 2

Understand the gate

severity: high reports high and critical findings.
exclude-tests: 'true' skips common test and fixture paths.
upload-sarif: 'true' publishes results under Security → Code scanning.
The step exits with code 1 when matching security findings are present.

GitHub may restrict security-events: write for pull requests from forks. In that case, keep scanning enabled but disable SARIF upload for the untrusted fork workflow.

Step 3

Start advisory, then enforce

Use advisory mode while establishing a baseline. Remove continue-on-error when the team is ready for findings to block merges.

advisory modeyaml

- name: Cognium SAST (advisory)
  uses: cogniumhq/cognium-dev/packages/cli@main
  continue-on-error: true
  with:
    path: ./
    severity: high
    format: sarif
    output: cognium-results.sarif
    upload-sarif: 'true'
    version: latest

Step 4

Use the manual form when needed

The composite action exposes the common controls. A manual workflow is useful when additional CLI flags are required.

manual workflow stepsyaml

- uses: actions/setup-node@v4
  with:
    node-version: '20.19.0'
- run: npm install -g cognium-dev
- run: cognium-dev scan ./src --format sarif --output results.sarif --severity high
- uses: github/codeql-action/upload-sarif@v3
  if: always()
  with:
    sarif_file: results.sarif

Next: Cursor MCP Back: First scan

Gate pull requests in GitHub Actions.

Add the workflow

Understand the gate

Start advisory, then enforce

Use the manual form when needed