Python Security Scan Workflow Example

This guide shows how to configure HenKaiPan security scans for a Python project.

1. Create an API Token

Follow the GitHub Actions Setup Guide to create an API token and add it as a GitHub Secret.

2. Add the Workflow

Create .github/workflows/security.yml in your repository:

name: Python Security Scan

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: "pip"

      - name: Install dependencies
        run: |
          pip install -r requirements.txt --upgrade pip

      - name: Run HenKaiPan Security Scan
        uses: dyallab/henkaipan-action@v1
        with:
          api-url: ${{ secrets.HENKAIPAN_API_URL }}
          api-key: ${{ secrets.HENKAIPAN_API_KEY }}
          project-id: ${{ secrets.HENKAIPAN_PROJECT_ID }}
          scanners: "semgrep,trivy,gitleaks"
          fail-on-severity: high

What Gets Scanned

Configuration Tips

Fast SAST Scan (no dependency check)

scanners: semgrep
fail-on-severity: medium

Full Scan (SAST + SCA + secrets)

scanners: all
fail-on-severity: high

Using a requirements.txt freeze

- name: Install dependencies
  run: pip install -r requirements.txt

Poetry or PDM

- name: Install dependencies
  uses: PDM action/setup-pdm@v3
  with:
    python-version: "3.12"
- name: Install project
  run: pdm install

Excluding Files

Add a .semgrepignore file to exclude paths from scanning:

venv/
.venv/
__pycache__/
*.pyc
.env
.env.local
.git/
.eggs/

CI/CD Variables Reference

See Also

• GitHub Actions Setup
• GitLab CI Setup
• Jenkins Setup
• Docker Scan