Droidwatch GitHub Action Integration

Automatically scan APKs in your CI/CD pipeline and fail builds when threat thresholds are exceeded. The action is published on the GitHub Marketplace as Omar1123/droidwatch-scan@v1.

Full example workflow

Create .github/workflows/apk-security-scan.yml in your repository:

name: APK Security Scan

on:
  push:
    branches: [main, develop]
    paths:
      - '**.apk'
      - 'app/build/**'
  pull_request:
    branches: [main]
  workflow_dispatch:
    inputs:
      apk_path:
        description: 'Path to APK file'
        required: false
        default: 'app/build/outputs/apk/release/app-release.apk'

jobs:
  droidwatch-scan:
    name: Droidwatch APK Analysis
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Build APK
        run: ./gradlew assembleRelease

      - name: Droidwatch Security Scan
        id: scan
        uses: Omar1123/droidwatch-scan@v1
        with:
          apk_path: app/build/outputs/apk/release/app-release.apk
          api_key: ${{ secrets.DROIDWATCH_API_KEY }}
          fail_on_verdict: "Malicious|High Risk"

      - name: Print scan summary
        if: always()
        run: |
          echo "Verdict : ${{ steps.scan.outputs.verdict }}"
          echo "Score   : ${{ steps.scan.outputs.score }}"
          echo "Report  : ${{ steps.scan.outputs.report_url }}"

Inputs

Input Required Default Description
apk_path Yes — Path to the artifact relative to the workspace root: .apk / .aab / .xapk / .dex / .ipa (iOS, static analysis)
api_key Yes — API key with upload permissions (dw_...). Generate one in My Profile → API Keys
server_url No https://droidwatch.app Base URL of the Droidwatch API to call
fail_on_verdict No Malicious Pipe-separated verdicts that fail the build, e.g. Malicious\|High Risk\|Suspicious
timeout_seconds No 300 How long to wait for the analysis to complete before aborting

Outputs

Output Description
verdict Analysis verdict: Malicious, High Risk, Suspicious, or Benign
score Numeric risk score (0–100)
run_id Droidwatch run ID for the full report
report_url Public share URL to the full interactive report

How to get an API key

  1. Log in to droidwatch.app (or your instance)
  2. Go to My Profile → API Keys
  3. Click Generate new key
  4. Copy the key — it starts with dw_ and is shown only once

API keys are scoped to your account's plan limits and require a plan with API access. Enterprise keys have no daily upload limits.

How to configure secrets

Never put your API key in the workflow YAML file directly. Store it as a GitHub Actions encrypted secret:

  1. In your GitHub repository, go to Settings → Secrets and variables → Actions
  2. Click New repository secret
  3. Create DROIDWATCH_API_KEY with the dw_... key from My Profile → API Keys

For organisation-wide pipelines, use Organisation secrets so every repository can share the key without duplicating it.

fail_on_verdict reference

Value Fails when verdict is...
Malicious Malicious only
Malicious\|High Risk Malicious or High Risk
Malicious\|High Risk\|Suspicious Anything but Benign

For fintech compliance pipelines, Malicious|High Risk|Suspicious is recommended. For general CI use, Malicious|High Risk balances security with false-positive noise.

Data handling

The action uploads your build artifact to the configured Droidwatch server for analysis — the file leaves the GitHub Actions runner. Analysis runs in an isolated sandbox and retention follows your plan's policy. Submitted binaries are never shared, and files can be encrypted at rest with AES-256-GCM.

Pointing at another environment

server_url defaults to https://droidwatch.app. Change it only when Droidwatch has provided the address of a different environment.