A GitHub Action that runs lsec — the Laravel security audit CLI — against your repository, uploads results to GitHub Code Scanning as SARIF, and posts a summary comment on pull requests.

lsec ships 61 rules across 8 categories: env, auth, injection, http, storage, deps, secrets, logging. See the lsec README for the full rule list.

# .github/workflows/lsec.yml
name: lsec

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read
  security-events: write   # required for SARIF upload
  pull-requests: write     # required for the PR summary comment

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: AfaanBilal/lsec-action@v1

That defaults to scanning the repository root, failing on high or above, uploading SARIF, and commenting on pull requests.

Code Scanning is free on public repositories. Private repositories require GitHub Advanced Security.

- uses: AfaanBilal/lsec-action@v1
  with:
    path: ./api

- uses: AfaanBilal/lsec-action@v1
  with:
    fail-on: critical

- uses: AfaanBilal/lsec-action@v1
  with:
    version: 0.1.4

- uses: AfaanBilal/lsec-action@v1
  with:
    baseline: ci/lsec-baseline.json

Generate the baseline locally with lsec baseline write . and commit it.

- uses: AfaanBilal/lsec-action@v1
  with:
    only: env,secrets,deps

- uses: AfaanBilal/lsec-action@v1
  with:
    skip: logging

- uses: AfaanBilal/lsec-action@v1
  with:
    upload-sarif: false

- uses: AfaanBilal/lsec-action@v1
  id: lsec
  continue-on-error: true
  with:
    fail-on: info

- run: echo "lsec found ${{ steps.lsec.outputs.findings-count }} issue(s)"

- uses: AfaanBilal/lsec-action@v1
  id: lsec

- name: Notify on critical findings
  if: steps.lsec.outputs.critical-count != '0'
  run: ./notify-security.sh "${{ steps.lsec.outputs.critical-count }} critical findings"

1. Install — downloads the matching lsec release binary into $RUNNER_TEMP/lsec-bin/ and adds it to PATH.
2. Scan (JSON) — runs lsec scan ... --ci --format json. The lsec exit code is the source of truth for pass / fail.
3. Scan (SARIF) — runs lsec scan ... --format sarif (only when upload-sarif: true).
4. Upload SARIF — hands the report to github/codeql-action/upload-sarif@v3 so findings appear inline on PRs and in the Security tab.
5. PR comment — posts (or updates) a single sticky comment with the severity table and top findings.
6. Enforce — exits non-zero when result == fail, failing the job.

This action follows semantic versioning. Pin to:

• @v1 — latest 1.x release (recommended).
• @v1.2.3 — exact release.
• @main — bleeding edge (not recommended for production).

The version input controls which lsec CLI release is downloaded; it is independent of the action version.

MIT — see lsec for the upstream tool.

Action authored by Afaan Bilal.