Set up GitHub

On GitHub, MopokeHQ runs as a GitHub Actions workflow in your repository today. It runs the same scanner image and CLI as the GitLab setup, and needs no access to your GitHub account.

1. Add the token

In MopokeHQ, make a CI token: organisation menu, CI tokens, kind CI pipeline (Tokens and keys).
In GitHub, on the repository: Settings, Secrets and variables, Actions, New repository secret. Name MOPOKE_TOKEN, value the token.

To cover every repository at once, add it as an organisation secret instead (the organisation’s Settings, Secrets and variables, Actions) and give the repositories access.

2. Add the workflow

Save MopokeHQ’s workflow file as .github/workflows/mopoke.yml:

mkdir -p .github/workflows
curl -fsSL -o .github/workflows/mopoke.yml https://app.mopokehq.com/ci/github.yml

Commit it and push to the default branch. The MopokeHQ workflow runs, and the repository appears in MopokeHQ. That first default-branch scan is the baseline: what it finds is existing work, listed and prioritised, but never counted against a pull request.

The workflow:

runs on pushes to the default branch, on tags and on pull requests, and from the Run workflow button;
runs in the scanner image gitlab.boosoft.com.au:5050/mopokehq/scanner:1, which needs no login, with read-only repository permissions;
checks dependencies, code, secrets, infrastructure files and licences (see Scanners), then uploads the results;
on pull requests, fetches the pull request’s own commits too, so a secret added and removed within it is still caught;
never fails unless you enforce the merge gate (below). A scanner or upload problem shows as a warning.

Options

Set these as repository or organisation variables (the Variables tab next to Secrets):

Variable	Use
`MOPOKE_SCANNERS`	Which scanners run: a list like `sbom,secrets`, or removals like `-licence`.
`MOPOKE_GATE`	`enforce`: a pull request that fails the merge gate fails the workflow.
`MOPOKE_SCANNER_IMAGE`	Your mirror of the scanner image. If the mirror needs a login, add the secrets `MOPOKE_REGISTRY_USER` and `MOPOKE_REGISTRY_PASSWORD`.

Pull requests and the merge gate

Each pull request is compared with the branch it targets, and the Scan step’s log shows the merge gate result: pass, warn or fail, with the reasons. Only what the pull request adds counts; existing problems stay on the Now list.

To block a pull request that fails the gate:

In MopokeHQ, set the project’s merge gate to Enforce (Settings, Projects).
Set the variable MOPOKE_GATE to enforce.

The workflow then fails on a failed gate, and nothing else. Make it a required status check in your branch protection rules to stop merges.

Report deployments

MopokeHQ needs to know what is live: a problem in a deployed build is confirmed live, and a fix closes on its own only once MopokeHQ sees it deployed (see Priorities and deadlines). After your deploy succeeds, run mopoke deploy with the environment’s name. For example, as a job after your deploy job:

  mopoke-deploy:
    needs: deploy
    runs-on: ubuntu-latest
    container:
      image: gitlab.boosoft.com.au:5050/mopokehq/scanner:1
    env:
      MOPOKE_TOKEN: ${{ secrets.MOPOKE_TOKEN }}
    steps:
      - run: mopoke deploy --env production || echo "MopokeHQ: deploy not recorded"

It reads the repository and commit from GitHub’s own variables and needs no checkout. Use the environment names you deploy to (production, staging). If you deploy from Vercel, Netlify or a similar host rather than from Actions, run mopoke deploy from a job that starts after the host reports a successful deploy, and pass the deployed commit with --commit.

Scan a built image

To scan a container image your workflow builds, run the scanner again after the image is pushed, with only the container scanner:

  mopoke-image:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
    container:
      image: gitlab.boosoft.com.au:5050/mopokehq/scanner:1
    env:
      MOPOKE_TOKEN: ${{ secrets.MOPOKE_TOKEN }}
      MOPOKE_SCANNERS: container
      # the image your build job pushed
      MOPOKE_IMAGE: ghcr.io/acme/shop:${{ github.sha }}
      MOPOKE_REGISTRY_USER: ${{ github.actor }}
      MOPOKE_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - run: mopoke scan . || true

The registry login is passed to the scanners in their environment, never on a command line. See Scanners for what an image scan finds.

Fixing what it finds

Fix pull requests come with the GitHub App. Until then, each action on the Now screen names the version to upgrade to and every repository that needs it; make the change in your usual way, and the next default-branch scan and deploy report close it.

If you build with an AI assistant, connect it to MopokeHQ over MCP so it can read the fix list and work through it.