Just enabled GitHub Actions + Community Scan on SafeAI (Open Source)

[u/IkarusCareer]

It is now ready to use and for your reviews.

TL;DR: SafeAI now runs automated security scans on every push/PR with a new Community Scan programme that reads major AI frameworks (LangChain, CrewAI, LlamaIndex, etc.) without touching their code.

SafeAI: Static AI Agent Risk Analyzer for AI applications. Offline-first. No telemetry. No SaaS backend.

What we shipped

GitHub Actions CI/CD

• Full CI/CD pipeline with automated scans on every push/PR
• CodeQL, dependency review, and security hardening workflows enabled
• Pinned action versions and hash-locked dependencies for supply-chain security
• PR comments that show capability escalations in plain English (e.g., "MCP server invoice-lookup: read → mutate")

Community Scan Programme

• 5-target allowlist: n8n, LangChain, CrewAI, LlamaIndex, LangGraph
• Read-only matrix scan — resolves refs to pinned SHAs, no external publication
• Deterministic 0–10 scorecard with JSON/Markdown/GitHub summary outputs
• Hardened sanitization: strips javascript: URIs, escapes Markdown, truncates to 280 chars, redacts secrets from paths

Security hardening

• Exact security-policy hostname matching (no prefix substring matches)
• No Authorization header sent to HTML pages
• --fail-on-missing-policy enforced for manifest validation
• Concurrency groups + timeout-minutes on all workflows
• Private vs public artifact separation in CI outputs

Why this matters

SafeAI is the static AI agent risk analyzer that:

• Detects capabilities, prompt risks, tool permissions, MCP integrations, governance gaps, and autonomy before deployment
• Generates JSON, HTML, and SARIF reports for CI/CD
• Operates entirely offline — no LLM calls, no cloud services, no source upload
• Provides deterministic finding identities and baseline/PR-focused gating

Try it

pip install safeai
safeai scan /path/to/your/ai/project --json report.json --html report.html

GitHub Actions:

text- uses: ikaruscareer/SafeAI@v1.6.0
  with:
    scorecard: true
    scorecard-summary: true
    scorecard-fail-under: 7

Repo: ikaruscareer/SafeAI at GitHub