SETUP GUIDE

Change Risk with GitHub Actions

Run deterministic analysis for selected static files from a pull request. AntOps does not run Docker builds, start containers or apply Terraform.

Before you start

  • A workspace API key
  • Repository administrator access
  • A GitHub Actions-enabled repository

Setup

  1. Create a workspace API key in AntOps.
  2. In the repository, add it as the Actions secret named ANTOPS_API_KEY.
  3. Create .github/workflows/antops-change-risk.yml from the workflow shown in the AntOps Change Risk page.
  4. List supported files such as Dockerfile, compose.yaml, main.tf and openapi.yaml.
  5. Open or update a pull request and review the AntOps result or check run.

Verify and expected result

A workflow run sends only the selected static inputs for analysis. The API key remains a GitHub secret, never YAML source.

A completed analysis appears in Change Risk. Findings are deterministic analysis results, not a deployment action.

Common safe checks

Authentication failed

Check that the repository secret is named ANTOPS_API_KEY and has not been pasted into the workflow file.

No analysis

Confirm the workflow trigger and that at least one selected supported file changed in the pull request.

Security and revocation

Treat the workspace API key like a password. Store it only in GitHub Actions secrets and rotate or revoke it if exposure is suspected.

Remove the repository secret and delete or disable the workflow. Revoke the associated workspace API key in AntOps if it is no longer needed.