# GitHub Action Integration

The HiddenLayer Model Scanner GitHub Action adds automated model security scanning directly into your GitHub CI/CD workflows. Integrating this Action helps your team identify potential security issues in machine learning models early in development, reducing risk before models are merged or deployed.

## Use Cases

This integration is ideal for teams that want to:

- Shift-left model security by scanning models as part of pull request validations.
- Prevent unsafe models from advancing in CI/CD pipelines.
- Surface actionable scan results in GitHub Actions or PR comments.
- Operate within existing developer workflows without manual intervention.


## How It Works

When included in a GitHub workflow, the Model Scanner Action:

1. Invokes the HiddenLayer Model Scanner via the HiddenLayer API.
2. Sends model artifacts to the HiddenLayer API for analysis.
3. Outputs a human-readable summary (for example, checkmark or detection indicators) into the GitHub Actions job summary or other configured outputs.


You can further extend this by:

- Posting results into a pull request via additional workflow steps.
- Exporting SARIF results for use in GitHub's Security tab.
- Failing a workflow when threats are detected.


## Prerequisites

Before using the Action:

- Enable GitHub Actions in the repository.
- Create an API key in the [HiddenLayer Console](/docs/products/console/apikey_aisec_platform#api-permission-related-to-products).
- Store the `clientID` and `clientSecret` as GitHub Secrets.
- Assign only the necessary API permissions based on the principle of least privilege.


## Setup

For full setup details and example workflows, see the Action page on the GitHub Marketplace.

## Best Practices

- **Fail early:** Configure the workflow to fail if unsafe models are detected.
- **Visibility:** Use SARIF outputs or pull request comments to make scan outcomes visible to developers.
- **Runner capacity:** GitHub-hosted runners have 14 GB of default disk space. Large models may exceed this limit and cause the Action to fail. Use the GitHub Runner Sizing Guide to choose an appropriately sized runner.