DEDUPED Hot AI repos, turned into use cases Get the Monday 5

How to fail CI builds on high-severity dependency findings with Forge Guardian

Add a GitHub Actions step that scans on every run, fails at high severity, and uploads SARIF to GitHub Security.

Remote script. The CI step downloads and runs install.sh from the main branch, so pin a release or review the script if your pipeline requires it.

Who it is forA platform or DevOps engineer who maintains a GitHub Actions pipeline and must stop risky dependencies from merging.

The problemVulnerable or malicious dependencies reach main because no automated check runs on pull requests.

The outcomeEach CI run scans the project, blocks the build at high severity, and posts findings to the GitHub Security tab.

What you need first

  • A terminal (bash on Linux or macOS, or PowerShell on Windows), or Docker
  • A project directory with dependencies to scan
  • Git and make only if building from source

Steps

  1. Add a step that runs curl -sSfL https://raw.githubusercontent.com/Mah3Sec/ForgeGuardian/main/install.sh | bash and appends $HOME/.local/bin to GITHUB_PATH
  2. Add a scan step with fgctl scan . --ci --fail-on=high --format=sarif > results.sarif
  3. Add the github/codeql-action/upload-sarif@v3 step with sarif_file: results.sarif
  4. Commit the workflow and open a test pull request to confirm the scan runs
  5. Check that the build fails when a high-severity finding is present

Prompt for your agent

For the repo Mah3Sec/ForgeGuardian, add the README's GitHub Actions snippet to the workflow file <workflow-path> in <target-repo>. Expected output is a workflow that runs `fgctl scan . --ci --fail-on=high --format=sarif` and uploads results.sarif. Verify the YAML parses and the upload step references results.sarif.

Caveat. The README shows the SARIF upload step but does not say which GitHub permissions it needs, so check your repository settings before the first run.

Use this in your AI agent

Ask your agent

Using the Deduped MCP, get the setup steps for Mah3Sec/ForgeGuardian and "Fail CI builds on high-severity dependency findings"

Add Deduped to Claude Code once

claude mcp add --transport http deduped https://dedupedai.com/mcp

Cursor, ChatGPT, others

Share: X LinkedIn Hacker News Email Copy link

Third-party repos we don't own. AI-written use cases can be wrong. Disclaimer