> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/integrate-ci-tools/github-actions.md).

# GitHub Actions

Integrate Cortex Cloud Application Security with GitHub Actions to allow dynamic, automated, and context-specific scans within your development workflow. This includes continuous scanning of your workflows whenever changes are pushed or triggered, integrating security checks, and detecting issues as soon as they are introduced.

## Prerequisite

Before you begin:

* **User permissions**: Ensure the user performing the integration has permissions to edit pipeline configurations (such as YAML files) and manage secrets/credentials within the CI platform to store the Cortex Cloud API key securely

## Onboarding steps

1. On the Cortex Cloud console:
   1. Navigate to **Settings** → **Data Sources & Integrations** → **+ Add New**.
   2. Search for and hover over **GitHub Actions**, and click **Add**, or **Add Another Instance** if an instance is already onboarded.
2. On the **Add Environment Variables** step of the wizard.
   1. Select Generate API key.

      The API key secret and API key ID values are generated and populate their respective fields.
   2. Optional: Change the default system architecture detected by the system.
   3. Click Next.
3. Store your Cortex Cloud API key and API key ID in the GitHub Actions Secrets credential store.

{% tabs %}
{% tab title="I have an API key" %}

1. Copy the **CORTEX\_API\_KEY** and **CORTEX\_API\_KEY\_ID** variable names from their respective fields in the wizard.
2. Add the **CORTEX\_API\_KEY** and **CORTEX\_API\_KEY\_ID** and their corresponding values as separate environment variables (secrets) to the GitHub Actions Secrets credential store.
   {% endtab %}

{% tab title="I don't have an API key" %}

1. Select **Generate API key**, then copy the **CORTEX\_API\_KEY** and **CORTEX\_API\_KEY\_ID** values from their respective fields.
2. Add the **CORTEX\_API\_KEY** and **CORTEX\_API\_KEY\_ID** and their corresponding values as separate environment variables (secrets) to the GitHub Actions Secrets credential store.
   {% endtab %}
   {% endtabs %}

{% hint style="info" %}
Do not change the names of the environment variables provided by Cortex Cloud. They are required for proper integration and functionality.
{% endhint %}

For more information on passing secrets as environment variables to GitHub Actions, refer to [Using secrets in GitHub Actions](https://docs.github.com/actions/security-guides/encrypted-secrets).

4\. Copy and paste the pre-populated sample code from the **Configure Job** step of the integration wizard into your GitHub Actions job configuration → **Done**

{% hint style="info" %}
The code is only a reference. Replace the placeholder values with your build-specific values.
{% endhint %}

5\. Ensure that the **Connector Created Successfully** message is displayed in the final step of the wizard, and click **Close**.

## Verify integration

1. On the **Data Sources & Integrations** page, search for GitHub Actions in the search bar.
2. Hover over the resulting entry and click View Details.
3. Locate your instance and verify that the status is **Connected**.

## Next steps

View scan results and mitigate issues.

### GitHub Actions code scan workflow template

Use the [GitHub Actions code scan workflow template](/application-security/application-security/onboard-data-sources/integrate-ci-tools/github-actions/github-actions-code-scan-workflow-template.md) to configure Cortex CLI code scanning in your workflow.

## Manage the integration

#### Instance-level actions

1. Navigate to **Settings** → **Data Sources & Integrations** and search for **GitHub Actions**.
2. Select the matching result.
3. Locate your instance from the displayed list. Right-click it, then select an option:
   * **Edit instance**: Opens the onboarding wizard, where you can change the instance configuration.
   * **Delete instance**: Deletes the instance and previous scan data.
   * **Copy entire row**: Copies all row values to the clipboard.

#### Repository-level actions

Right-click a connected repository to **Set Scanned Branches**, run a manual scan through **Scan Repository**, modify the **Scan Configuration**, or **Remove Repository**. In **Scan Configuration**, you can toggle scanners and manage pull request behavior.

1. Locate your instance. See [Instance-level actions](#instance-level-actions).
2. Select the instance. A list of connected repositories appears.
3. Right-click a repository, select the required action, then select **Save**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/integrate-ci-tools/github-actions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.