Skip to main content

Add repository secret

In your repo: Settings → Secrets and variables → Actions → New repository secret.Name: GARNET_API_TOKEN · Value: your token from app.garnet.ai → Settings → API Tokens.

Add Garnet to your workflow

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest

    permissions:
      contents: read
      pull-requests: write

    steps:
      - uses: actions/checkout@v4

      - name: Garnet Monitor
        uses: garnet-org/action@9e819143e63d6dda04bca2e90ac85e3cf0e5289d # v2
        with:
          api_token: ${{ secrets.GARNET_API_TOKEN }}

      # your existing build, test, and deploy steps continue here
The agent runs in the background and profiles all subsequent steps.

Verify

Push or open a PR. Your run appears at app.garnet.ai within seconds — with a behavioral profile and check results.

​
Pinning

Floating tags like @v2 can move after you adopt them. For supply-chain hygiene, pin to the commit SHA of the latest release. The canonical SHA is always available at garnet.ai/pins (human-readable) and garnet.ai/pins.txt (machine-readable). Both auto-update when a new release ships. 
# Recommended: pinned to release commit SHA
- uses: garnet-org/action@9e819143e63d6dda04bca2e90ac85e3cf0e5289d # v2

# Quick start (floating tag — tracks latest v2.x.x):
- uses: garnet-org/action@v2

​
Configuration

InputDescriptionRequiredDefault
api_tokenGarnet API token from app.garnet.aiYes—
github_tokenGitHub token for PR commentsNo${{ github.token }}
api_urlGarnet API base URLNohttps://api.garnet.ai
garnetctl_versionGarnet CLI version (1.2.3 or latest)Nolatest
jibril_versionJibril sensor version (v2.10.8 or latest)Noauto
debugEnable debug mode and upload logs as artifactsNofalse

​
Outputs

OutputDescription
profile_resultCheck result for this run: pass or fail
report_urlLink to the full run report on app.garnet.ai
agent_idIdentifier for the Jibril sensor instance that ran

​
Permissions

PermissionRequiredWhy
contents: readYesAccess workflow context and repository metadata
pull-requests: writeRecommendedPost the runtime profile as a PR comment
The action does not require contents: write, actions: write, or access to any repository secrets beyond the ones you explicitly pass.

​
Job Summary

Garnet writes a Runtime Report to the GitHub Actions Job Summary automatically — check results, egress summary, and a link to the full run profile.
GitHub Actions Job Summary showing Garnet Runtime Report

​
Why sudo

Jibril attaches eBPF programs at the kernel level — this requires sudo during install. ubuntu-latest runners include it by default. See Architecture for the safety model.

​
Troubleshooting

Verify GARNET_API_TOKEN is set. Check workflow logs for the Garnet step.
Requires sudo for eBPF. ubuntu-latest includes it by default.
Use the pinned v2 SHA from garnet.ai/pins — the SHA must match the latest release.
Grant pull-requests: write in your workflow’s permissions block. The action uses github_token (defaults to ${{ github.token }}) to post comments.
- uses: garnet-org/action@9e819143e63d6dda04bca2e90ac85e3cf0e5289d # v2
  with:
    api_token: ${{ secrets.GARNET_API_TOKEN }}
    debug: true