Flare for GitHub Actions
See what an infrastructure change could expose, why it matters, and what to fix. Bring Flare into the workflow your team already uses.
Four open-source Actions. A Flare account is required.
PR review works without connecting a cloud account.
− role = "roles/viewer"+ role = "roles/editor"Editor expands this identity’s potential permissions. Effective access still depends on resource policies and other controls.
Next stepRestore the narrower role and add only the permissions the workload needs.
Illustrations of expected behavior, not a live scan. See this example’s production review.
Start with one Action. Add the others where they fit your team’s security workflow.
Review Terraform, CloudFormation and IAM changes. Get findings with file references, explanations and suggested fixes in a pull request comment.
Queue a comparison of cloud audit activity before and after a deployment. Flare waits for post-deploy activity to accumulate before analysis.
Choose an audit-log time window and request an analysis with an event timeline, findings and questions to investigate.
Create a daily or weekly account of changes in Google Cloud audit logs, with a summary your team can review in GitHub.
Create an account, then open Settings → API Keys.
In GitHub, open Settings → Secrets and variables → Actions. Save the key as FLARE_API_KEY.
Save this example as .github/workflows/flare.yml. Start with fail-on: none to review findings without blocking merges.
The example pins a release version. For stronger supply-chain control, pin Actions to a verified full commit SHA. Adjust file paths to match your repository.
See all inputs and severity thresholdsRead the 8-point GitHub Actions security review →name: Flare security review
on:
pull_request:
paths:
- '**/*.tf'
- '**/*.tfvars'
- '**/*-policy.json'
- '**/*-role.json'
- '**/cloudformation/**'
- '**/k8s/**'
- '**/helm/**'
permissions:
contents: read
pull-requests: write
jobs:
review:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: tryflare-ai/pr-security-check@v1.1.1
with:
token: ${{ secrets.FLARE_API_KEY }}
api-url: https://tryflare.ai/api/webhooks/pr-check
fail-on: none
These Actions call Flare’s hosted service. Their source code is public; the analysis runs in Flare.
Read our privacy policyThe Action sends relevant file diffs, filenames and repository/PR metadata to Flare. Flare redacts recognizable secrets from the diff before sending it to Anthropic for analysis. Redaction is not a guarantee that every sensitive value is removed. Flare saves the analysis result, and the Action can post it as a PR comment.
You choose the severity threshold with fail-on. The setup example uses none so your team can assess findings first. Findings are review assistance, not proof of exploitability or a substitute for security testing.
Fork pull requests and Dependabot runs without the Flare secret skip the review. Use pull_request; do not switch to pull_request_target to expose secrets to untrusted code.
The Actions are MIT-licensed. Hosted analysis requires a Flare account and uses service quotas. PR checks and incident analysis share the daily analysis allowance. Deploy and changelog requests also have connector-specific limits. See current early-access terms and each Action’s README.
No. These Actions review code changes or invoke cloud analysis from workflows. GitHub organization audit reports are a separate integration for organization activity.
Add the PR check, inspect the findings, and decide what your team wants to gate.