// ============================================ // Reliq — GitHub Action page // Public route: /github-action // ============================================ // Read GitHub URL constants from window (defined in reliq-state.jsx). // Fallback strings are used during early load before reliq-state.jsx executes. const GA_REPO_URL = () => window.RELIQ_GITHUB_REPO_URL || "https://github.com/reliq-dev/reliq"; const GA_MARKETPLACE_URL = () => window.RELIQ_GITHUB_MARKETPLACE_URL || "https://github.com/marketplace/actions/reliq-scan"; const GitHubActionPage = ({ go }) => { const [toastVisible, setToastVisible] = React.useState(false); const toastTimer = React.useRef(null); const [authed, setAuthed] = React.useState(() => window.reliqAuth ? window.reliqAuth.isAuthed() : false ); React.useEffect(() => { const onAuth = (e) => setAuthed(!!e.detail); window.addEventListener("reliq-auth-change", onAuth); return () => window.removeEventListener("reliq-auth-change", onAuth); }, []); // ── Canonical workflow YAML ─────────────────────────────────────────────── // This is the exact snippet shown on the page and available to copy. // Secret name: RELIQ_KEY (not RELIQ_API_KEY). // File: ./build/app-release.aab (AAB preferred for Play Store). // Stores: play_store,app_store (full enum values — not shorthand play/app). const YAML = `name: Reliq on: push: branches: [main] pull_request: jobs: scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Run Reliq scan uses: reliq/scan@v1 with: api_key: \${{ secrets.RELIQ_KEY }} file: ./build/app-release.aab target_stores: play_store,app_store fail_on: critical pr_comment: true`; const copyWorkflow = () => { navigator.clipboard.writeText(YAML).then(() => { clearTimeout(toastTimer.current); setToastVisible(true); toastTimer.current = setTimeout(() => setToastVisible(false), 2500); }).catch(() => {}); }; const goToDocSection = () => { try { sessionStorage.setItem("reliq_scroll_to", "docs-github-action"); } catch (_) {} go("/docs"); }; // ── API key CTA routing ─────────────────────────────────────────────────── // Docs page is always public; API key creation requires auth + active plan. // Route the user to the appropriate step based on their current product state. const getApiKeyPath = () => { if (!authed) return "/signin"; const state = window.reliqSubscription?.getProductState?.() || ""; if (state === "authenticated_pending_payment") return "/payment"; if (state === "authenticated_past_due" || state === "authenticated_canceled") return "/billing"; return "/api"; }; const getApiKeyLabel = () => { if (!authed) return "Create API key"; const state = window.reliqSubscription?.getProductState?.() || ""; if (state === "authenticated_pending_payment") return "Activate plan"; if (state === "authenticated_past_due") return "Update billing"; if (state === "authenticated_canceled") return "Renew subscription"; return "Manage API keys"; }; // ── Value bullets ───────────────────────────────────────────────────────────── const bullets = [ "Catches policy blockers before human review — not after rejection.", "Posts a scan summary as a PR comment with score, verdict, and critical issues.", "Fails the workflow on critical findings so bad builds never reach the store.", "Generates a PDF report artifact you can attach to releases or share with legal.", ]; // ── Setup steps ────────────────────────────────────────────────────────────── const steps = [ { ic:"key", n:"01", h:"Create an API key", d:"Go to Settings → API & Webhooks in your Reliq dashboard and generate a key with scan write permission." }, { ic:"lock", n:"02", h:"Add the secret", d:"In your GitHub repo, navigate to Settings → Secrets → Actions and add RELIQ_KEY with your key value." }, { ic:"code", n:"03", h:"Add the workflow", d:"Copy the YAML above into .github/workflows/reliq.yml. Adjust the file path to match your build output." }, { ic:"refresh", n:"04", h:"Push and watch", d:"Open a pull request or push to main. Reliq runs automatically and posts results directly to your PR." }, ]; // ── Config table rows ───────────────────────────────────────────────────────── const config = [ { key:"api_key", req:true, def:"—", desc:"Your Reliq API key. Store it as a GitHub Actions secret — never hard-code it." }, { key:"file", req:true, def:"—", desc:"Relative path to the APK, AAB, or IPA to scan. Glob patterns are supported." }, { key:"target_stores", req:false, def:"play_store,app_store", desc:"Comma-separated list of stores to check against. Options: play_store, app_store, or both." }, { key:"fail_on", req:false, def:"critical", desc:"Minimum severity that fails the workflow. Options: critical, warning, info, never." }, { key:"pr_comment", req:false, def:"true", desc:"Post a scan summary as a pull-request comment when triggered by a PR event." }, { key:"report", req:false, def:"none", desc:"Generate a report artifact. Options: pdf, json, none. Uploaded to workflow artifacts." }, { key:"timeout_minutes", req:false, def:"10", desc:"Maximum minutes to wait for the scan to complete before the step fails." }, ]; // ── Shared style constants ──────────────────────────────────────────────────── const D = { eyebrow: { fontFamily:"var(--font-mono)", fontSize:11, letterSpacing:"0.14em", textTransform:"uppercase", color:"var(--teal)", marginBottom:10, display:"block", }, h1: { fontFamily:"var(--font-display)", fontSize:34, fontWeight:700, letterSpacing:"-0.025em", margin:"0 0 10px", color:"var(--fg-0)", lineHeight:1.2, }, h2: { fontFamily:"var(--font-display)", fontSize:22, fontWeight:700, letterSpacing:"-0.02em", margin:"0 0 10px", color:"var(--fg-0)", }, h3: { fontFamily:"var(--font-display)", fontSize:14, fontWeight:600, letterSpacing:"-0.005em", margin:"20px 0 6px", color:"var(--fg-0)", }, p: { fontSize:14.5, color:"var(--fg-1)", lineHeight:1.78, margin:"0 0 12px", }, inlineCode: { fontFamily:"var(--font-mono)", fontSize:13, color:"var(--teal)", background:"var(--bg-2)", padding:"1px 5px", borderRadius:4, }, note: { background:"var(--teal-bg)", border:"1px solid var(--line-3)", borderRadius:"var(--r-sm)", padding:"12px 16px", fontSize:13.5, color:"var(--fg-1)", lineHeight:1.65, marginBottom:14, }, divider: { borderTop:"1px solid var(--line-1)", margin:"52px 0 44px", }, }; return ( {/* ── Clipboard toast ── */}
Workflow copied ✓
{/* ── Hero ── */}
GitHub Action

Run Reliq before every release.

Add one workflow step and Reliq will scan every build, post a compliance summary to your PR, and fail the job if critical issues are found — before any human reviewer sees your app.

{/* ── Value bullets ── */}
{bullets.map((b, i) => (
{b}
))}
{/* ── YAML quick-install block ── */}

Quick install

Copy the workflow below into .github/workflows/reliq.yml in your repository. Replace the file path with the build artifact produced by your CI.

{/* Terminal chrome */}
.github/workflows/reliq.yml
{/* YAML code */} 
{YAML}
{/* Action buttons */}
GitHub Marketplace View on GitHub
{/* ── Setup steps ── */}

Set up in four steps.

From zero to automated compliance checks in under five minutes.

{steps.map(s => (
{s.n}

{s.h}

{s.d}

))}
{/* ── Config reference ── */}

Configuration reference

All inputs are passed under the with: block of the action step.

{/* Table header */}
Input Required Default Description
{config.map((row, i) => (
{row.key} {row.req ? "Yes" : "No"} {row.def} {row.desc}
))}
{/* ── CI failure behaviour ── */}

How CI failures work

When fail_on is set, Reliq exits with a non-zero status code if the scan finds any finding at or above that severity. This causes the GitHub Actions step — and the entire job — to fail, blocking merges that require status checks to pass.

Pair it with pr_comment: true so contributors see the exact blockers without leaving GitHub: 

{`      - name: Run Reliq scan
        uses: reliq/scan@v1
        with:
          api_key: \${{ secrets.RELIQ_KEY }}
          file: ./build/app-release.aab
          fail_on: critical        # block the job on any critical finding
          pr_comment: true         # post the summary as a PR comment`}
Tip: Use fail_on: warning during early development and tighten to fail_on: critical as you approach your release branch. You can also set fail_on: never to run in observation-only mode.
{/* ── PR comment preview ── */}

Here's what the PR comment looks like when findings are present:

{/* Comment header */}
reliq-bot commented just now
{/* Comment body */}
{/* Score row */}
78/100
NEEDS FIXES
1 critical · 4 warnings · 5 info
{/* Critical blocker */}
CRITICAL
android:debuggable="true" detected in release manifest — Play Store will reject this build.
{/* Report link */}
{/* ── Supported files ── */}

Supported build files

Point the file input at any of the following artifact types. Glob patterns let you match the output of any build variant.

{[ { ext:"APK", label:"Android APK", eg:"*.apk", note:"Universal + split APKs supported" }, { ext:"AAB", label:"Android App Bundle", eg:"*.aab", note:"Recommended for Play Store" }, { ext:"IPA", label:"iOS App Archive", eg:"*.ipa", note:"Simulator builds excluded" }, ].map(f => (
{f.ext}
{f.label}
{f.eg}
{f.note}
))}
{/* ── Bottom CTA ── */}

Ready to automate compliance?

Add Reliq to your pipeline today and stop finding out about rejections from App Review.

); }; Object.assign(window, { GitHubActionPage });