Step 1
Add the workflow
Create .github/workflows/cognium-scan.yml. The action definition follows the public repository's main branch, while version: latest installs the newest published CLI.
cognium-scan.ymlyaml
name: Cognium security scan
on:
push:
branches: [main]
pull_request:
permissions:
contents: read
security-events: write
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Cognium SAST
uses: cogniumhq/cognium-dev/packages/cli@main
with:
path: ./src
severity: high
format: sarif
output: cognium-results.sarif
exclude-tests: 'true'
upload-sarif: 'true'
version: latestPublic references: Both
cogniumhq/cognium-dev and its packages/cli/action.yml are publicly accessible. There is no private repository dependency.Step 2
Understand the gate
severity: highreports high and critical findings.exclude-tests: 'true'skips common test and fixture paths.upload-sarif: 'true'publishes results under Security → Code scanning.- The step exits with code 1 when matching security findings are present.
GitHub may restrict security-events: write for pull requests from forks. In that case, keep scanning enabled but disable SARIF upload for the untrusted fork workflow.
Step 3
Start advisory, then enforce
Use advisory mode while establishing a baseline. Remove continue-on-error when the team is ready for findings to block merges.
advisory modeyaml
- name: Cognium SAST (advisory)
uses: cogniumhq/cognium-dev/packages/cli@main
continue-on-error: true
with:
path: ./
severity: high
format: sarif
output: cognium-results.sarif
upload-sarif: 'true'
version: latestStep 4
Use the manual form when needed
The composite action exposes the common controls. A manual workflow is useful when additional CLI flags are required.
manual workflow stepsyaml
- uses: actions/setup-node@v4
with:
node-version: '20.19.0'
- run: npm install -g cognium-dev
- run: cognium-dev scan ./src --format sarif --output results.sarif --severity high
- uses: github/codeql-action/upload-sarif@v3
if: always()
with:
sarif_file: results.sarif