---
title: "GitHub Action"
description: "The QWED GitHub Action scans for secrets, unsafe code and dangerous shell scripts on the runner, with SARIF output for GitHub code scanning."
url: https://qwedai.com/platform/github-action
---

GitHub Action

# QWED checks in your own CI workflows.

A GitHub Action that scans for leaked secrets, unsafe code and dangerous shell scripts on the runner, and can verify model output against a QWED API.

[Read the documentation](https://github.com/marketplace/actions/qwed-protocol-verification) [Source on GitHub](https://github.com/QWED-AI/qwed-verification-action)

At a glance

Use

QWED-AI/qwed-verification-action@v1

Listed on

GitHub Marketplace, verified publisher

Output

Text, JSON, SARIF or a Verification Context

Data

Scan modes never leave the runner

Licence

Apache-2.0

## Modes

-   scan-secrets

    ### Leaked secrets

    API keys, tokens and SSH keys.

-   scan-code

    ### Unsafe code

    eval(), exec(), subprocess and unsafe imports.

-   verify-shell

    ### Dangerous scripts

    curl | bash, rm -rf and sudo escapes.

-   verify

    ### Model output

    Math, logic, SQL and code in model output, checked by a QWED API.

-   verify-process

    ### Reasoning steps

    Traces must follow Issue, Rule, Application, Conclusion and hit the milestones you list.

## Get started

.github/workflows/qwed.yml

```
name: QWED Verification
on: [pull_request]

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: QWED-AI/qwed-verification-action@v1
        with:
          action: scan-secrets
          paths: "**/*.env,**/*.json"
          output_format: sarif
          fail_on_findings: "true"
```

[Documentation](https://github.com/marketplace/actions/qwed-protocol-verification) [Repository](https://github.com/QWED-AI/qwed-verification-action)

Good to know

-   scan-secrets, scan-code, verify-shell and verify-process run entirely inside the runner.
-   verify calls a QWED API: pass an api\_key, or point api\_url at your own deployment.

[**Use case: Software delivery** QWED Security checks every code change on GitHub before it merges.](https://qwedai.com/solutions/software-delivery)

## More developer tools

-   [QWED Security](https://qwedai.com/platform/security)
-   [Docker image](https://qwedai.com/platform/docker)
-   [Every package](https://qwedai.com/ecosystem)