Integrate LiveAPISec with GitHub Actions

1. Add the repository secret

In GitHub, open Settings → Secrets and variables → Actions → New repository secret and create LIVEAPISEC_KEY with your las_dev_... key. Never commit the key to the repository.

2. Add the workflow

The workflow installs the CLI, pushes your endpoints, and fails the job on high or critical findings. PROJECT_ID and API_BASE_URL can be repository variables (Settings → Variables) or literals.

name: api-security

on:
  push:
    branches: [main]
  pull_request:

jobs:
  security-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install LiveAPISec CLI
        run: pip install liveapisec

      - name: Push API endpoints
        env:
          LIVEAPISEC_API_KEY: ${{ secrets.LIVEAPISEC_KEY }}
        run: |
          liveapisec push \
            --name my-api \
            --base-url "${{ vars.API_BASE_URL }}" \
            --openapi-url "${{ vars.API_BASE_URL }}/openapi.json"

      - name: Run security gate
        env:
          LIVEAPISEC_API_KEY: ${{ secrets.LIVEAPISEC_KEY }}
        run: |
          liveapisec scan \
            --project "${{ vars.PROJECT_ID }}" \
            --branch "${GITHUB_REF#refs/heads/}" \
            --commit "$GITHUB_SHA" \
            --wait --fail-on high

3. Gate on regressions only

If you already have accepted findings, --fail-on high would fail every run. Compare against a baseline instead and fail only on new findings.

      - name: Regression gate
        env:
          LIVEAPISEC_API_KEY: ${{ secrets.LIVEAPISEC_KEY }}
          BASELINE_SCAN_ID: ${{ vars.BASELINE_SCAN_ID }}
        run: |
          liveapisec verdict \
            --project "${{ vars.PROJECT_ID }}" \
            --scan "$NEW_SCAN_ID" \
            --baseline "$BASELINE_SCAN_ID" \
            --fail-on high

Capture NEW_SCAN_ID from the scan output or the API response, then update BASELINE_SCAN_ID after a green run on main.

4. Upload a report artifact

Use liveapisec all with --format md and if: always() so the report is uploaded even when the gate fails. Reviewers can see every new finding without opening the dashboard.

      - name: Full pipeline report
        if: always()
        env:
          LIVEAPISEC_API_KEY: ${{ secrets.LIVEAPISEC_KEY }}
        run: |
          liveapisec all --project "${{ vars.PROJECT_ID }}" \
            --format md --report-out security-report.md

      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: api-security-report
          path: security-report.md

5. Run a deep scan nightly

Keep the baseline suite on every push and run the full deep suite on a schedule. This catches drift between deploys without slowing down pull requests.

on:
  schedule:
    - cron: "0 3 * * *"
  workflow_dispatch:

Troubleshooting the workflow

• 401 from the API — LIVEAPISEC_KEY is missing, revoked or expired. Run liveapisec whoami locally with the same key.
• Step fails immediately on push — check API_BASE_URL and that the OpenAPI document is publicly reachable from the runner.
• No findings but the gate is red — inspect the exit code: 2 means an API/usage error, not a vulnerability.
• Localhost target — GitHub runners cannot reach your machine. Use liveapisec connect + --tunnel, or test staging.

FAQ

Is there an official LiveAPISec GitHub Action?

The supported integration installs the CLI with pip inside the workflow and runs `liveapisec` commands directly. That keeps the workflow explicit and version-pinnable; a composite action can wrap the same steps.

How do I fail a pull request on new API vulnerabilities only?

Use `liveapisec verdict` with a baseline scan from `main`. It fails only when new findings reach `--fail-on`, so existing accepted findings do not block pull requests.

Does the scan need access to my database or internal network?

No. The scanner works over HTTP(S) against your API. For a target reachable only from the runner (localhost or a private network), start `liveapisec connect` and pass `--tunnel` to the scan.