GitHub Actions

Integrate netbobr firewall rule analysis into GitHub Actions workflows. A step fails on any non-zero exit code, and the SARIF output integrates with GitHub Code Scanning.

Basic Analysis

A minimal workflow that fails on high or critical findings:

name: netbobr Firewall Analysis
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  analyze:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20

      - run: npx --yes @netbobr/cli@2 analyze firewall-rules.json --fail-on high

With --fail-on high, the step fails with exit code 2 when a flow has a high or critical finding or a DENY verdict. Medium findings pass. It fails with exit code 1 on an error, such as a missing file, an invalid config or an invalid flow.

SARIF Upload to Code Scanning

Upload findings to the GitHub Security tab so they appear as Code Scanning alerts alongside your code:

name: netbobr Firewall Analysis
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Run netbobr analysis
        run: npx --yes @netbobr/cli@2 analyze firewall-rules.json --fail-on high --output sarif --output-file results.sarif

      - name: Upload SARIF to Code Scanning
        if: ${{ !cancelled() && hashFiles('results.sarif') != '' }}
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif

• --output-file writes the report before netbobr sets its exit code, so continue-on-error is not needed.
• The analysis step stays red on a policy failure (2) or an error (1).
• The upload step still runs whenever a report exists.

How netbobr's SARIF maps to Code Scanning:

• Run netbobr from the repository root, as in the example. Every alert then points at the analyzed file by a path relative to the repository.
• For CSV input, the alert is on the flow's line. For JSON and cloud input, it is on line 1, with the flow and cloud resource named in the message.
• Alerts keep their identity when rows are reordered.
• Alert severity comes from security-severity: critical findings show as Critical, high as High, and so on.
• For input piped through stdin, add --stdin-filename <repo-relative-path> so alerts point at the right file.

Findings appear in Security > Code Scanning alerts on your repository.

Report-only variant

To publish alerts without ever failing the build on findings, use --fail-on none. Errors still fail the step (exit 1).

      - name: Run netbobr analysis (report only)
        run: npx --yes @netbobr/cli@2 analyze firewall-rules.json --fail-on none --output sarif --output-file results.sarif

With Configuration

Load a netbobr session saved in the web app to apply zones and zone policies, custom rules, zone attributes and disabled rules. A flow between zones whose policy is Deny, or one matched by a custom rule with a DENY override, fails the gate at any --fail-on level except none.

To override the default risk score weights or thresholds, add flat weights and thresholds keys to the config file (see Thresholds). A session's old riskWeights block is ignored with a warning.

      - name: Run netbobr analysis
        run: npx --yes @netbobr/cli@2 analyze rules.json --config netbobr-config.json --fail-on medium

Export your configuration from the netbobr web app using Session Control > Save and commit the JSON file to your repository. An unreadable or invalid config fails the step with exit code 1.

Cloud Format Analysis

Analyze cloud provider security groups directly. This example fetches AWS Security Groups and analyzes them:

      - name: Export security groups
        run: aws ec2 describe-security-groups > sgs.json

      - name: Analyze security groups
        run: npx --yes @netbobr/cli@2 analyze sgs.json --cloud-format aws-sg --fail-on high --output sarif --output-file results.sarif

      - name: Upload SARIF to Code Scanning
        if: ${{ !cancelled() && hashFiles('results.sarif') != '' }}
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif

The supported cloud formats are:

• aws-sg
• azure-nsg
• gcp-fw
• tf-plan (terraform show -json output)
• tf-hcl (Terraform .tf source)
• k8s-netpol
• auto for automatic detection

Terraform source needs no plan step:

      - name: Analyze Terraform security rules
        run: cat infra/*.tf | npx --yes @netbobr/cli@2 analyze - --cloud-format tf-hcl --stdin-filename infra/main.tf --fail-on high

Rules that cannot be fully resolved are reported as parser warnings in the output and never dropped silently. Examples are security-group references and placeholders substituted with 0.0.0.0/0.

PDF Report as Artifact

Generate a PDF compliance report and upload it as a build artifact:

      - name: Generate PDF report
        run: npx --yes @netbobr/cli@2 analyze rules.json --fail-on none --output pdf --output-file report.pdf

      - name: Upload report
        if: ${{ !cancelled() && hashFiles('report.pdf') != '' }}
        uses: actions/upload-artifact@v4
        with:
          name: security-report
          path: report.pdf

The PDF report is downloadable from the workflow run's Artifacts section. It lists invalid flows and parser warnings on an "Input issues" page.

Exit Code Reference

Use --fail-on <level> to control the threshold (default medium):