GitHub Actions

GitHub Actions

Use these steps if your repositories are on GitHub.com or GitHub Enterprise Cloud. The scan runs on a GitHub-hosted runner and connects to the Lineaje SaaS MCP endpoint.

Choose an MCP Server configuration

Choose the MCP Server configuration for this workflow.

Lineaje-hosted MCP Server

Use the existing Lineaje SaaS MCP endpoint configuration below.

https://mcp-code.v2.prod.veedna.com/mcp

Customer-hosted Hybrid MCP Server

Configure the workflow to use your Hybrid UnifAI MCP Server endpoint:

https://<CUSTOMER_VM_OR_FQDN>/mcp

Before configuring this option:

• The Hybrid UnifAI MCP Server must already be deployed.

• The MCP Server health check must succeed.

• The GitHub Actions runner must be able to reach the configured MCP endpoint.

Deploy and verify the server first in Deploy UnifAI on Azure.

Lineaje-hosted MCP Server

Before You Start

• A GitHub.com account, with permission to add repository or organization secrets and to enable GitHub Actions.

• A Lineaje PAT (Personal Access Token).

1

Generate a Lineaje PAT

A Lineaje PAT authenticates the GitHub Action to Lineaje.

Follow these steps to generate a Lineaje PAT from your Lineaje account. The token grants the Action access to the Lineaje scan service:

1. Log in at app.veedna.com and navigate to SBOM360 → Integrations → Deploy Private Cloud → Personal Access Token.

2. Click the link in the box.

3. Click Generate Token. A Lineaje login webpage opens.

4. Authenticate and click Yes. You are returned to the Integrations page.

5. Copy the PAT displayed on the Integrations page.

2

Add the Lineaje PAT to Your GitHub Repository or Organization

Store the Lineaje PAT as an encrypted secret so the GitHub Action can read it at runtime.

1. In GitHub, go to your repository (or organization) Settings → Secrets and variables → Actions.

2. Click New repository secret (or New organization secret). The secret form opens.

3. In the Name field, enter LINEAJE_PAT_TOKEN.

4. In the Secret field, paste the Lineaje PAT from Step 1. Click Add secret. The secret appears in the list, masked.

To scan many repositories under one organization, add the token as an organization secret and grant access to the relevant repositories. Every repository then reuses the same LINEAJE_PAT_TOKEN.

3

Use default GITHUB_TOKEN or generate custom token

By default, the GitHub Actions workflow authenticates using GITHUB_TOKEN. The sample GitHub Actions workflow below uses the default token.

Depending on the repository settings or organization settings, you might have to enable GitHub Actions to create Pull Requests.

Alternatively, use a personal access token, create a token and replace secrets.GITHUB_TOKEN with your token name.

4

Copy script to .github folder

Download the following script and place it in the same repository under the .github folder.

scm_unifai_scan_hybrid.py

262KB

Open

5

Copy GitHub Actions workflow file to central repository

Copy the below script and place it in a new file in the central repository under the .github/workflows folder. This file can be named lineaje-unifai-scan.yaml.

The on: events can be modified to trigger off new commits, new pull requests, etc. In the following example, the workflow is configured to run manually.

name: Lineaje UnifAI Scan

on:
  workflow_dispatch:
    inputs:
      create_fix_pr:
        description: "Open a remediation PR with the suggested fixes"
        type: boolean
        default: true
      mcp_server_url:
        description: "UnifAI MCP Server URL"
        type: string
        required: true
        default: "https://mcp.v2.prod.veedna.com/mcp"
      skip_tls_verify:
        description: "Skip TLS verification (use only for a Hybrid MCP Server with a self-signed certificate)"
        type: boolean
        default: false

permissions:
  contents: write
  pull-requests: write

jobs:
  lineaje-scan:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install dependencies
        run: pip install mcp==1.27.1 httpx

      - name: Prepare scanner
        run: |
          cp .github/scm_unifai_scan_hybrid.py /tmp/scm_unifai_scan_hybrid.py
          rm -rf .github .git
          # Optional: Exclude test or other folders to scan only what you want UnifAI to analyze
          # rm -rf tests/ temp/

      - name: Run Lineaje AI policy scan
        env:
          LINEAJE_PAT_TOKEN: ${{ secrets.LINEAJE_PAT_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          MCP_TLS_INSECURE_SKIP_VERIFY: ${{ inputs.skip_tls_verify && '1' || '0' }}
        run: |
          python /tmp/scm_unifai_scan_hybrid.py \
            --source-path . \
            --repo "${{ github.repository }}" \
            --branch "${{ github.ref_name }}" \
            --head-sha "${{ github.sha }}" \
            --mcp-server-url "${{ inputs.mcp_server_url }}" \
            ${{ inputs.create_fix_pr && '--create-fix-pr' || '' }} >> "$GITHUB_STEP_SUMMARY"

6

Run the GitHub Actions workflow

Run the GitHub Actions workflow and discover AI Assets using UnifAI. Based on the trigger setup, the workflow may be triggered automatically.