GitHub Actions

Scan every pull request with the Musha Security Scan action. It authenticates with OIDC, so there is no API key to store.

Set it up

1. In Musha, open your project > Integration > Pull request scan.
2. Enter the repository as owner/repo, optionally pin a branch or ref, and click Connect repository.
3. Commit the workflow file shown there to your repository.

The file looks like this:

# .github/workflows/musha.yml
name: Musha Security Scan
on: [pull_request]

permissions:
  id-token: write   # required to mint the OIDC token
  contents: read

jobs:
  musha-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0   # lets Musha scan only what the PR changed
      - uses: mushasec/scan-action@v1
        with:
          project-id: <your-project-id>

The guide fills in your real project ID. Copy it from there instead of typing it.

What the action does

1. GitHub issues a signed OIDC token that proves the job runs in your repository.
2. The action exchanges it for a short-lived Musha token.
3. It uploads the code and waits for the result.
4. Results appear in the app under CI scans, Musha comments on the pull request, and the job fails if the scan is blocked by your policy.

Musha accepts the token only if you connected that repository to that project in the Integration guide. A copy of the action in someone else's repository can't scan anything of yours.

Requirements

Requirement	Why
permissions: id-token: write	GitHub can't issue the OIDC token without it
fetch-depth: 0 on checkout	Lets the action compute which lines the pull request added. Without it the scan still runs, but every finding is treated as new
The repository connected to the project	Otherwise the token exchange is rejected

Inputs

Input	Required	Description
project-id	Yes	Your Musha project ID, shown in the project's Integration guide

The scan type and the blocking threshold are not inputs. They live in your Musha settings and are applied on the server, so changing them never requires a workflow edit.

Pull requests only

The action is pull-request only on purpose. A push without a pull request would only spend quota. To track the whole repository over time, connect it for full-repository scanning instead.

Pinning the action

@v1 always points at the latest v1.x release. For the strongest supply-chain guarantee, pin to a full 40-character commit SHA, which can't be re-pointed:

- uses: mushasec/scan-action@<full-commit-sha>  # v1.x.y
  with:
    project-id: <your-project-id>

The trade-off is that a pinned workflow does not update on its own. Tools like Dependabot can keep SHA pins current.

Troubleshooting

The token exchange fails. The repository isn't connected to the project, or the connected branch or ref doesn't match the one running. Check Settings > CI / Pipeline for the list of connected repositories.

Every finding is treated as new. The checkout didn't fetch history. Set fetch-depth: 0.

The job fails with a 429. You reached your plan's hourly or monthly scan limit. See Limits.

No pull request comment. See Troubleshooting.