> For the complete documentation index, see [llms.txt](https://docs.veedna.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veedna.com/unifai/setting-up/scm-integrations/github-actions.md).

# GitHub Actions

## GitHub Actions

Use these steps if your repositories are on GitHub.com or GitHub Enterprise Cloud. The scan runs on a GitHub-hosted runner and connects to the Lineaje SaaS MCP endpoint.

### Choose an MCP Server configuration

Choose the MCP Server configuration for this workflow.

#### Lineaje-hosted MCP Server

Use the existing Lineaje SaaS MCP endpoint configuration below.

```
https://mcp-code.v2.prod.veedna.com/mcp
```

#### Customer-hosted Hybrid MCP Server

Configure the workflow to use your Hybrid UnifAI MCP Server endpoint:

```
https://<CUSTOMER_VM_OR_FQDN>/mcp
```

Before configuring this option:

* The Hybrid UnifAI MCP Server must already be deployed.
* The MCP Server health check must succeed.
* The GitHub Actions runner must be able to reach the configured MCP endpoint.

Deploy and verify the server first in [Deploy UnifAI on Azure](/unifai/setting-up/deploy-unifai-on-azure.md).

### Lineaje-hosted MCP Server

#### Before You Start

* A GitHub.com account, with permission to add repository or organization secrets and to enable GitHub Actions.
* A Lineaje PAT (Personal Access Token).

{% stepper %}
{% step %}

### Generate a Lineaje PAT

A Lineaje PAT authenticates the GitHub Action to Lineaje.

Follow these steps to generate a Lineaje PAT from your Lineaje account. The token grants the Action access to the Lineaje scan service:

1. Log in at app.veedna.com and navigate to **SBOM360** → **Integrations** → **Deploy Private Cloud** → **Personal Access Token**.
2. Click the link in the box.
3. Click **Generate Token**. A Lineaje login webpage opens.
4. Authenticate and click **Yes**. You are returned to the **Integrations** page.
5. Copy the **PAT** displayed on the Integrations page.
   {% endstep %}

{% step %}

### Add the Lineaje PAT to Your GitHub Repository or Organization

Store the Lineaje PAT as an encrypted secret so the GitHub Action can read it at runtime.

1. In GitHub, go to your repository (or organization) **Settings** → **Secrets and variables** → **Actions**.
2. Click New repository secret (or New organization secret). The secret form opens.
3. In the **Name** field, enter `LINEAJE_PAT_TOKEN`.
4. In the **Secret** field, paste the Lineaje PAT from Step 1. Click **Add secret**. The secret appears in the list, masked.

{% hint style="info" %}
To scan many repositories under one organization, add the token as an organization secret and grant access to the relevant repositories. Every repository then reuses the same `LINEAJE_PAT_TOKEN`.
{% endhint %}
{% endstep %}

{% step %}

### Use default GITHUB\_TOKEN or generate custom token

By default, the GitHub Actions workflow authenticates using `GITHUB_TOKEN`. The sample GitHub Actions workflow below uses the default token.

Depending on the repository settings or organization settings, you might have to [enable GitHub Actions to create Pull Requests](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#preventing-github-actions-from-creating-or-approving-pull-requests).

Alternatively, use a personal access token, create a token and replace `secrets.GITHUB_TOKEN` with your token name.
{% endstep %}

{% step %}

### Copy script to .github folder

Download the following script and place it in the same repository under the `.github` folder.

{% file src="/files/Uv6gmxpQLSrcFiXSHS7u" %}
{% endstep %}

{% step %}

### Copy GitHub Actions workflow file to central repository

Copy the below script and place it in a new file in the central repository under the `.github/workflows` folder. This file can be named `lineaje-unifai-scan.yaml`.

The `on:` events can be modified to trigger off new commits, new pull requests, etc. In the following example, the workflow is configured to run manually.

```yaml
name: Lineaje UnifAI Scan

on:
  workflow_dispatch:
    inputs:
      create_fix_pr:
        description: "Open a remediation PR with the suggested fixes"
        type: boolean
        default: true
      mcp_server_url:
        description: "UnifAI MCP Server URL"
        type: string
        required: true
        default: "https://mcp.v2.prod.veedna.com/mcp"
      skip_tls_verify:
        description: "Skip TLS verification (use only for a Hybrid MCP Server with a self-signed certificate)"
        type: boolean
        default: false

permissions:
  contents: write
  pull-requests: write

jobs:
  lineaje-scan:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install dependencies
        run: pip install mcp==1.27.1 httpx

      - name: Prepare scanner
        run: |
          cp .github/scm_unifai_scan_hybrid.py /tmp/scm_unifai_scan_hybrid.py
          rm -rf .github .git
          # Optional: Exclude test or other folders to scan only what you want UnifAI to analyze
          # rm -rf tests/ temp/

      - name: Run Lineaje AI policy scan
        env:
          LINEAJE_PAT_TOKEN: ${{ secrets.LINEAJE_PAT_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          MCP_TLS_INSECURE_SKIP_VERIFY: ${{ inputs.skip_tls_verify && '1' || '0' }}
        run: |
          python /tmp/scm_unifai_scan_hybrid.py \
            --source-path . \
            --repo "${{ github.repository }}" \
            --branch "${{ github.ref_name }}" \
            --head-sha "${{ github.sha }}" \
            --mcp-server-url "${{ inputs.mcp_server_url }}" \
            ${{ inputs.create_fix_pr && '--create-fix-pr' || '' }} >> "$GITHUB_STEP_SUMMARY"
```

{% endstep %}

{% step %}

### Run the GitHub Actions workflow

Run the GitHub Actions workflow and discover AI Assets using UnifAI. Based on the trigger setup, the workflow may be triggered automatically.
{% endstep %}
{% endstepper %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.veedna.com/unifai/setting-up/scm-integrations/github-actions.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.