How to Configure SkillSpector for GitHub Actions: Complete CI/CD Integration Guide

To configure SkillSpector for GitHub Actions, use the official nvidia/skillspector-action repository, which executes the scanner inside your CI pipeline and generates SARIF reports for the GitHub Security Dashboard.

NVIDIA/SkillSpector is an open-source code analysis tool that integrates seamlessly with GitHub Actions through its dedicated action repository. When you configure SkillSpector for GitHub Actions, the workflow automatically pulls the latest scanner package from src/skillspector/cli.py, installs Python dependencies, and executes the skillspector scan command against your codebase. The integration reads LLM provider credentials from GitHub Secrets and outputs standardized SARIF files that populate your repository's security dashboard.

Repository Structure and Key Components

Understanding the source code structure helps when configuring advanced options. The src/skillspector/cli.py file implements the core skillspector scan command-line interface that the action invokes internally. Configuration defaults and provider constants reside in src/skillspector/constants.py, while the actual LLM provider implementations live in src/skillspector/providers/*. According to the documentation in README.md (line 711), the action wraps these components to provide a zero-config experience for CI/CD pipelines.

Basic Workflow Configuration

Static Analysis Only

For repositories that do not require LLM-based analysis, configure the action with the no_llm flag set to true. This corresponds to the --no-llm CLI flag defined in docs/DEVELOPMENT.md (lines 14-19).

name: SkillSpector Scan
on:
  push:
    branches: [main]
  pull_request:
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Run SkillSpector
        uses: nvidia/skillspector-action@v1
        with:
          format: sarif
          output: skill-report.sarif
          no_llm: true

Enabling LLM Analysis

To enable optional LLM analysis, omit the no_llm parameter and provide provider credentials via environment variables. The action reads OPENAI_API_KEY or ANTHROPIC_API_KEY from GitHub Secrets and injects them into the runtime environment.

name: SkillSpector Scan
on:
  push:
    branches: [main]

jobs:
  scan:
    runs-on: ubuntu-latest
    env:
      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
    steps:
      - uses: actions/checkout@v4

      - name: Run SkillSpector with LLM
        uses: nvidia/skillspector-action@v1
        with:
          format: sarif
          output: skill-report.sarif

Configuring LLM Providers

The scanner supports multiple providers defined in src/skillspector/constants.py, including openai, anthropic, and nv_build. Override the default nv_build provider using the provider input.

env:
  ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
steps:
  - uses: actions/checkout@v4
  - name: Run SkillSpector with Anthropic
    uses: nvidia/skillspector-action@v1
    with:
      provider: anthropic
      format: sarif
      output: skill-report.sarif

Uploading Results to GitHub Security

The action generates a skill-report.sarif file that you must upload to enable security scanning alerts. Use the github/codeql-action/upload-sarif action to publish results to the GitHub Security Dashboard.

      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: skill-report.sarif

Summary

• Use the official action: Reference nvidia/skillspector-action@v1 in your workflow files to execute the scanner without manual installation.
• Control LLM usage: Set no_llm: true for static-only scans, or provide OPENAI_API_KEY/ANTHROPIC_API_KEY secrets via the env block for AI-enhanced analysis.
• Customize providers: Override the default nv_build provider by setting the provider input to anthropic or openai as defined in src/skillspector/constants.py.
• Enable security alerts: Upload the generated skill-report.sarif file using github/codeql-action/upload-sarif to populate the GitHub Security Dashboard.

Frequently Asked Questions

How do I disable LLM analysis in SkillSpector GitHub Actions?

Set the no_llm input to true in your workflow configuration. This maps to the --no-llm CLI flag implemented in src/skillspector/cli.py and documented in docs/DEVELOPMENT.md, allowing the scanner to run static analysis only without invoking external LLM providers.

What file format does SkillSpector output for GitHub Actions?

By default, the action produces SARIF (Static Analysis Results Interchange Format) files. Configure the output format using the format: sarif input, which generates a skill-report.sarif file suitable for upload to the GitHub Security Dashboard via github/codeql-action/upload-sarif.

Where does SkillSpector read API credentials from in GitHub Actions?

The action reads LLM provider credentials from GitHub Secrets configured at the repository or organization level. Map these secrets to environment variables such as OPENAI_API_KEY or ANTHROPIC_API_KEY in the env section of your job, which the scanner then accesses via the provider implementations in src/skillspector/providers/*.

Can I use Anthropic Claude instead of OpenAI with SkillSpector?

Yes. Set the provider input to anthropic and provide the ANTHROPIC_API_KEY secret. This overrides the default nv_build provider specified in src/skillspector/constants.py and routes analysis requests through Anthropic's Claude models instead of OpenAI's GPT models.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}