Gitea Actions

Security scanning in Gitea Actions.

Warning Current as of writing (Vulnetix CLI v3.55.2). If a snippet no longer works, open an issue with the CLI version you are on.

Before You Start

Credentials come from Repository or organization Actions secrets, read as ${{ secrets.NAME }}.

VariableValue
VULNETIX_ORG_IDOrganization UUID
VULNETIX_API_KEYApiKey hex digest

Environment variables authenticate on their own. Do not run vulnetix auth login on an ephemeral runner — see Authentication in CI/CD.

Quick Start

.gitea/workflows/vulnetix.yml:

name: Vulnetix
on: [push, pull_request]
jobs:
  vulnetix:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh
        export PATH=$PATH:$HOME/.local/bin
        vulnetix auth verify
        vulnetix scan --severity high
      env:
        VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}

vulnetix auth verify on the first line fails the build immediately when the credential is missing or revoked, rather than halfway through a scan.

Note Gitea Actions is largely GitHub-Actions-compatible, but the Vulnetix/cli composite action is not resolvable from a Gitea instance. Install the CLI with the script instead.

Running Individual Scans

Each subcommand runs standalone and uploads its own findings. Swap vulnetix scan for any of them:

vulnetix sca --severity high -o dist/sbom.cdx.json     # dependencies
vulnetix sast --severity high -o dist/sast.sarif       # source code
vulnetix secrets -o dist/secrets.sarif                 # hardcoded credentials
vulnetix license --allow MIT,Apache-2.0                # SPDX policy
vulnetix cbom --output-file dist/cbom.cdx.json         # cryptography, PQC posture
vulnetix aibom --output-file dist/aibom.cdx.json       # AI agents, SDKs, models

Note the flag split: the scan family takes -o <path>, while cbom, aibom, and malscan take --output-file. license takes neither. The full table is in the Subcommand Reference.

Keeping the Report

actions/upload-artifact, if your Gitea instance runs a compatible artifact server.

The SARIF-producing scans write their file only when there are findings, so a clean run leaves nothing behind. Tolerate the missing path rather than failing on it.

Quality Gates

Gates are opt-in; without a gate flag the command reports and exits 0.

vulnetix scan --severity high --block-malware --block-eol --exploits active

To surface a breach without blocking the merge: continue-on-error: true on the step.

Full gate list in the Subcommand Reference.

Uploading Third-Party Artifacts

The scans upload themselves. upload is for reports produced by other tools:

vulnetix upload --file reports/semgrep.sarif --format sarif

Accepted formats: cyclonedx, spdx, sarif, openvex, csaf_vex.

See Also