Skip to content
LyraShield AIOpen beta

Updated

GitHub Action

The LyraShield GitHub Action runs security checks in your CI pipeline on every pull request. It is the recommended integration for teams using cloud editors and for any workflow that needs automated, auditable security checks without an AI editor present.

Step 1 — Add your API key as a secret

Go to your GitHub repository Settings → Secrets and variables → Actions and add a repository secret:

  • Name: LYRASHIELD_API_KEY
  • Value: your lsk_-prefixed workspace key
Key scope: The GitHub Action requires a read-and-write key if you want it to submit findings to your LyraShield workspace. A read-only key is sufficient for reporting-only runs.

Step 2 — Create the workflow file

Create .github/workflows/lyrashield.yml in your repository with the following content. Adjust the on: triggers and inputs to match your project.

name: LyraShield security checks

on:
  pull_request:
    branches: [main, master]
  push:
    branches: [main, master]

jobs:
  lyrashield:
    name: Run security checks
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: LyraShield check
        uses: lyrashield/action@v1
        with:
          api-key: ${{ secrets.LYRASHIELD_API_KEY }}
          # Optional: target URL or workspace scope
          # target: "https://your-staging-url.example.com"
          # Optional: fail the workflow if findings are detected
          # fail-on-findings: "true"

Workflow inputs reference

InputRequiredDescription
api-keyYesYour lsk_ workspace API key
targetNoURL or workspace scope to check
fail-on-findingsNoSet to true to block the PR on findings (default: false)

Cloud editor complement

For teams using cloud editors like Lovable, Bolt.new, Replit, or v0, the GitHub Action provides automated CI checks on the synced repository. The action runs independently of the editor's MCP connection and works even if the editor does not support custom remote MCP.