Threatless

CI / GitHub Actions

Scan build artifacts from GitHub Actions or any CI runner.

Threatless has no GitHub App. CI integration is the Scan API: store an API key as a secret, then POST the artifact.

GitHub Actions

  1. Create a key named github-actions in API Key.
  2. Add repository secrets:
    • THREATLESS_API_KEY
    • THREATLESS_API_URL (optional, defaults to the hosted API)
scan.yml
name: Malware scan

on:
  push:
    branches: [main]
  pull_request:

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build artifact
        run: echo "replace with your build" && tar -czf dist.tar.gz README.md

      - name: Scan with Threatless
        env:
          THREATLESS_API_KEY: ${{ secrets.THREATLESS_API_KEY }}
          THREATLESS_API_URL: ${{ secrets.THREATLESS_API_URL }}
        run: |
          API_URL="${THREATLESS_API_URL:-https://api.trythreatless.com}"
          RESPONSE="$(curl -sS -X POST "$API_URL/api/v1/scans" \
            -H "X-API-KEY: $THREATLESS_API_KEY" \
            -F "file=@dist.tar.gz")"
          echo "$RESPONSE"
          echo "$RESPONSE" | grep -q '"infected":false\|"infected": false'

Fail the job if infected is true, or if curl exits non-zero (-f plus a 429/400).

Quota in CI

GitHub-hosted runners sharing one account will share the hourly limit. For busy pipelines, use Starter or above, and retry on 429 using Retry-After.

The same curl form works in GitLab CI, CircleCI, and Jenkins. Only the secret store changes.
Previous

Docker

Run the Threatless web app and API with Docker Compose.

Next