mirror of
https://github.com/usestrix/strix.git
synced 2026-09-15 23:31:27 +00:00
0ab7244807
Add Claude Fable 5.1, Gemini 3.7 Flash, and Z.ai GLM-5.3 / GLM-5.3-Flash to RECOMMENDED_MODEL_NAMES, add a Z.ai GLM frontier family so GLM-5.x is accepted through OpenRouter and Novita routes, and drop the superseded GPT-5.4, GPT-5.3-codex, Opus 4.8, Sonnet 4.6, Gemini 3.6 Flash, and Qwen3.7 entries. Update the README, docs provider pages, quickstart, and CLI hint strings to the same current models, including DeepSeek V4, Kimi K3, and GLM-5.3.
66 lines
1.6 KiB
Text
66 lines
1.6 KiB
Text
---
|
|
title: "GitHub Actions"
|
|
description: "Run Strix security scans on every pull request"
|
|
---
|
|
|
|
Integrate Strix into your GitHub workflow to catch vulnerabilities before they reach production.
|
|
|
|
## Basic Workflow
|
|
|
|
```yaml .github/workflows/security.yml
|
|
name: Security Scan
|
|
|
|
on:
|
|
pull_request:
|
|
|
|
jobs:
|
|
strix-scan:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Install Strix
|
|
run: curl -sSL https://strix.ai/install | bash
|
|
|
|
- name: Run Security Scan
|
|
env:
|
|
STRIX_LLM: ${{ secrets.STRIX_LLM }}
|
|
LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
|
|
run: strix -n -t ./ --scan-mode quick
|
|
```
|
|
|
|
## Required Secrets
|
|
|
|
Add these secrets to your repository:
|
|
|
|
| Secret | Description |
|
|
|--------|-------------|
|
|
| `STRIX_LLM` | Model name (e.g., `openai/gpt-5.6`) |
|
|
| `LLM_API_KEY` | API key for your LLM provider |
|
|
|
|
## Exit Codes
|
|
|
|
The workflow fails when vulnerabilities are found:
|
|
|
|
| Code | Result |
|
|
|------|--------|
|
|
| 0 | Pass — No vulnerabilities |
|
|
| 2 | Fail — Vulnerabilities found |
|
|
|
|
## Scan Modes for CI
|
|
|
|
| Mode | Duration | Use Case |
|
|
|------|----------|----------|
|
|
| `quick` | Minutes | Every PR |
|
|
| `standard` | ~30 min | Nightly builds |
|
|
| `deep` | 1-4 hours | Release candidates |
|
|
|
|
<Tip>
|
|
Use `quick` mode for PRs to keep feedback fast. Schedule `deep` scans nightly.
|
|
</Tip>
|
|
|
|
<Note>
|
|
For pull_request workflows, Strix automatically uses changed-files diff-scope in CI/headless runs. If diff resolution fails, ensure full history is fetched (`fetch-depth: 0`) or set `--diff-base`.
|
|
</Note>
|