# How to Configure SkillSpector for GitHub Actions: Complete CI/CD Integration Guide

> Integrate SkillSpector into your GitHub Actions CI/CD pipeline using the official nvidia skillspector action. Generate SARIF reports for the GitHub Security Dashboard seamlessly.

- Repository: [NVIDIA Corporation/SkillSpector](https://github.com/NVIDIA/SkillSpector)
- Tags: how-to-guide
- Published: 2026-06-14

---

**To configure SkillSpector for GitHub Actions, use the official `nvidia/skillspector-action` repository, which executes the scanner inside your CI pipeline and generates SARIF reports for the GitHub Security Dashboard.**

NVIDIA/SkillSpector is an open-source code analysis tool that integrates seamlessly with GitHub Actions through its dedicated action repository. When you configure SkillSpector for GitHub Actions, the workflow automatically pulls the latest scanner package from [`src/skillspector/cli.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/cli.py), installs Python dependencies, and executes the `skillspector scan` command against your codebase. The integration reads LLM provider credentials from GitHub Secrets and outputs standardized SARIF files that populate your repository's security dashboard.

## Repository Structure and Key Components

Understanding the source code structure helps when configuring advanced options. The [`src/skillspector/cli.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/cli.py) file implements the core `skillspector scan` command-line interface that the action invokes internally. Configuration defaults and provider constants reside in [`src/skillspector/constants.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/constants.py), while the actual LLM provider implementations live in `src/skillspector/providers/*`. According to the documentation in [`README.md`](https://github.com/NVIDIA/SkillSpector/blob/main/README.md) (line 711), the action wraps these components to provide a zero-config experience for CI/CD pipelines.

## Basic Workflow Configuration

### Static Analysis Only

For repositories that do not require LLM-based analysis, configure the action with the `no_llm` flag set to `true`. This corresponds to the `--no-llm` CLI flag defined in [`docs/DEVELOPMENT.md`](https://github.com/NVIDIA/SkillSpector/blob/main/docs/DEVELOPMENT.md) (lines 14-19).

```yaml
name: SkillSpector Scan
on:
  push:
    branches: [main]
  pull_request:
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Run SkillSpector
        uses: nvidia/skillspector-action@v1
        with:
          format: sarif
          output: skill-report.sarif
          no_llm: true

```

### Enabling LLM Analysis

To enable optional LLM analysis, omit the `no_llm` parameter and provide provider credentials via environment variables. The action reads `OPENAI_API_KEY` or `ANTHROPIC_API_KEY` from GitHub Secrets and injects them into the runtime environment.

```yaml
name: SkillSpector Scan
on:
  push:
    branches: [main]

jobs:
  scan:
    runs-on: ubuntu-latest
    env:
      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
    steps:
      - uses: actions/checkout@v4

      - name: Run SkillSpector with LLM
        uses: nvidia/skillspector-action@v1
        with:
          format: sarif
          output: skill-report.sarif

```

## Configuring LLM Providers

The scanner supports multiple providers defined in [`src/skillspector/constants.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/constants.py), including `openai`, `anthropic`, and `nv_build`. Override the default `nv_build` provider using the `provider` input.

```yaml
env:
  ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
steps:
  - uses: actions/checkout@v4
  - name: Run SkillSpector with Anthropic
    uses: nvidia/skillspector-action@v1
    with:
      provider: anthropic
      format: sarif
      output: skill-report.sarif

```

## Uploading Results to GitHub Security

The action generates a `skill-report.sarif` file that you must upload to enable security scanning alerts. Use the `github/codeql-action/upload-sarif` action to publish results to the GitHub Security Dashboard.

```yaml
      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: skill-report.sarif

```

## Summary

- **Use the official action**: Reference `nvidia/skillspector-action@v1` in your workflow files to execute the scanner without manual installation.
- **Control LLM usage**: Set `no_llm: true` for static-only scans, or provide `OPENAI_API_KEY`/`ANTHROPIC_API_KEY` secrets via the `env` block for AI-enhanced analysis.
- **Customize providers**: Override the default `nv_build` provider by setting the `provider` input to `anthropic` or `openai` as defined in [`src/skillspector/constants.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/constants.py).
- **Enable security alerts**: Upload the generated `skill-report.sarif` file using `github/codeql-action/upload-sarif` to populate the GitHub Security Dashboard.

## Frequently Asked Questions

### How do I disable LLM analysis in SkillSpector GitHub Actions?

Set the `no_llm` input to `true` in your workflow configuration. This maps to the `--no-llm` CLI flag implemented in [`src/skillspector/cli.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/cli.py) and documented in [`docs/DEVELOPMENT.md`](https://github.com/NVIDIA/SkillSpector/blob/main/docs/DEVELOPMENT.md), allowing the scanner to run static analysis only without invoking external LLM providers.

### What file format does SkillSpector output for GitHub Actions?

By default, the action produces **SARIF** (Static Analysis Results Interchange Format) files. Configure the output format using the `format: sarif` input, which generates a `skill-report.sarif` file suitable for upload to the GitHub Security Dashboard via `github/codeql-action/upload-sarif`.

### Where does SkillSpector read API credentials from in GitHub Actions?

The action reads LLM provider credentials from **GitHub Secrets** configured at the repository or organization level. Map these secrets to environment variables such as `OPENAI_API_KEY` or `ANTHROPIC_API_KEY` in the `env` section of your job, which the scanner then accesses via the provider implementations in `src/skillspector/providers/*`.

### Can I use Anthropic Claude instead of OpenAI with SkillSpector?

Yes. Set the `provider` input to `anthropic` and provide the `ANTHROPIC_API_KEY` secret. This overrides the default `nv_build` provider specified in [`src/skillspector/constants.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/constants.py) and routes analysis requests through Anthropic's Claude models instead of OpenAI's GPT models.