GitHub Integration Guide

The GitHub Action runs the Shadow AI scanner inside your CI, so new AI dependencies are caught at pull-request time — before they reach production unclassified.

Setup

Add a workflow file to your repository, e.g. .github/workflows/guardia.yml:

name: EU AI Act Compliance Check
on: [pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: read
    steps:
      - uses: GharbiiAhmed/guardia-ai-action@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          guardia-api-key: ${{ secrets.GUARDIA_API_KEY }}
          fail-on-prohibited: 'true'
          fail-on-high-risk: 'false'

Create the GUARDIA_API_KEY secret in your repo settings with a key from Dashboard → API Keys (optional — the scan runs without it; the key connects results to your dashboard). Findings are posted as a PR comment, and fail-on-prohibited blocks merges that introduce prohibited AI practices.

What it detects

AI packages and SDKs across JavaScript/TypeScript, Python, Go, Java, Ruby, and Rust (package manifests like package.json, requirements.txt, go.mod, pom.xml, Gemfile, Cargo.toml), plus AI config files.

GitLab users

The equivalent component is published in the GitLab CI/CD Catalog:

include:
  - component: gitlab.com/guardia-ai/gitlab-component/scan@1.1.0
    inputs:
      fail_on_prohibited: 'true'
      fail_on_high_risk: 'false'
      guardia_api_key: '$GUARDIA_API_KEY'

The in-app CI/CD Integration page generates both snippets ready to copy. CI/CD scanning is a Pro-plan feature (included in the trial).