GitHub App & Action

Inspector offers two ways to integrate with GitHub to automatically evaluate the security posture of pull requests:

1. GitHub App - The recommended approach with automatic updates and the simplest setup
2. GitHub Action - A reusable workflow for organizations that cannot install GitHub Apps

GitHub App​

The GitHub App is the recommended approach for most users as it provides the best experience with automatic updates and the simplest setup.

Installing the GitHub App​

1. Go to the Kusari Inspector GitHub app
2. Click Configure and select the organization you want to install Inspector for
3. Select All repositories or Only select repositories to enable Inspector for and click Install & Authorize
4. Click Authorize kusaridev

Using the GitHub App​

By default, Inspector will only make a comment when it recommends not proceeding with a pull request or if the check fails. To keep the existing behavior, set the post_comment_on_success configuration option to true. To disable comments entirely, set the post_comment_on_failure configuration option to false.

Open a pull request in any repository with Kusari Inspector enabled. Within seconds, you will see a comment from Kusari-Inspector[bot] with a recommendation on whether or not to proceed with the pull request, along with information supporting the recommendation and suggested mitigations. For readability, some content may be collapsed under a “Click to expand for details and specific link to issues” heading.

Kusari Inspector will provide a table of dependency changes and list concerns with licenses, vulnerabilities, workflows, and other issues. When relevant, Kusari Inspector will add comments to specific lines in the pull request with suggested remediations.

Kusari Inspector will re-run when the pull request changes. You can also manually trigger re-analysis with @kusari-inspector rerun comment in your PR.

Scan results from the past 30 days are available in the Kusari PLatform.

Running Immediately After Installation​

Or, if you have just installed the app on a given repo, you can comment @kusari-inspector run on an open PR on that repo to trigger a run on the PR.

Leaving Feedback for Kusari​

To let us know if a review was helpful, add a thumbs up or thumbs down reaction to the GitHub comment. If you have more detailed feedback, type @kusari-inspector feedback [your message]. For example:

@kusari-inspector feedback This saved me so much time!

See Configuring the Inspector for configuration details.

GitHub Action​

If you cannot install the GitHub App, you can use our reusable GitHub Actions workflow to integrate Inspector into your CI/CD pipeline. This workflow runs security scans on pull requests and posts results as comments.

Quick Start​

Create a workflow file .github/workflows/kusari-scan.yml in your repository:

name: Kusari Security Scan

on:
  pull_request:
    branches: [main, master]

jobs:
  kusari-scan:
    uses: kusaridev/kusari-ci-templates/.github/workflows/kusari-scan-v1.yml@v1
    permissions:
      contents: read
      pull-requests: write  # Required for PR comments
    secrets:
      KUSARI_CLIENT_ID: ${{ secrets.KUSARI_CLIENT_ID }}
      KUSARI_CLIENT_SECRET: ${{ secrets.KUSARI_CLIENT_SECRET }}
    with:
      fail_on_issues: false  # Optional: fail workflow on security issues
      post_comment: true     # Optional: post results as PR comment

Setup Instructions​

1. Add GitHub Secrets: Navigate to your repository Settings → Secrets and variables → Actions and add:

   • KUSARI_CLIENT_ID: Your Kusari client ID
   • KUSARI_CLIENT_SECRET: Your Kusari client secret

2. Set Permissions: The workflow requires these permissions (specified in the example above):

   • contents: read - Required to checkout code
   • pull-requests: write - Required to post PR comments

Version Tagging​

This repository uses major version tags for easy updates:

• Use @v1 to always get the latest v1.x.x release (recommended)
• Use @v1.0.1 to pin to a specific version

Configuration Options​

The reusable workflow supports the following optional inputs:

Example with custom configuration:

jobs:
  kusari-scan:
    uses: kusaridev/kusari-ci-templates/.github/workflows/kusari-scan-v1.yml@v1
    permissions:
      contents: read
      pull-requests: write
    secrets:
      KUSARI_CLIENT_ID: ${{ secrets.KUSARI_CLIENT_ID }}
      KUSARI_CLIENT_SECRET: ${{ secrets.KUSARI_CLIENT_SECRET }}
    with:
      fail_on_issues: true  # Fail on security issues
      post_comment: true

For more details and advanced configuration options, see the kusari-ci-templates repository.

GitHub Permissions​

Kusari Inspector uses the following GitHub permissions:

• Repository: read access to code and metadata
• Repository: read and write access to checks, issues, and pull requests
• User: read access to email addresses
• User: Read access to public repositories, public organization, information, and public user profile data