Droidwatch GitHub Action Integration

Automatically scan APKs in your CI/CD pipeline and fail builds when threat
thresholds are exceeded. The action is published on the
GitHub Marketplace
as Omar1123/droidwatch-scan@v1.

Full example workflow

Create .github/workflows/apk-security-scan.yml in your repository:

name: APK Security Scan

on:
  push:
    branches: [main, develop]
    paths:
      - '**.apk'
      - 'app/build/**'
  pull_request:
    branches: [main]
  workflow_dispatch:
    inputs:
      apk_path:
        description: 'Path to APK file'
        required: false
        default: 'app/build/outputs/apk/release/app-release.apk'

jobs:
  droidwatch-scan:
    name: Droidwatch APK Analysis
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Build APK
        run: ./gradlew assembleRelease

      - name: Droidwatch Security Scan
        id: scan
        uses: Omar1123/droidwatch-scan@v1
        with:
          apk_path: app/build/outputs/apk/release/app-release.apk
          api_key: ${{ secrets.DROIDWATCH_API_KEY }}
          fail_on_verdict: "Malicious|High Risk"

      - name: Print scan summary
        if: always()
        run: |
          echo "Verdict : ${{ steps.scan.outputs.verdict }}"
          echo "Score   : ${{ steps.scan.outputs.score }}"
          echo "Report  : ${{ steps.scan.outputs.report_url }}"

Inputs

Input Required Default Description
apk_path Yes — Path to the artifact relative to the workspace root: .apk / .aab / .xapk / .dex / .ipa (iOS, static analysis)
api_key Yes — API key with upload permissions (dw_...). Generate one in My Profile → API Keys
server_url No https://droidwatch.app Base URL — point at your self-hosted Droidwatch instance if you run one
fail_on_verdict No Malicious Pipe-separated verdicts that fail the build, e.g. Malicious\|High Risk\|Suspicious
timeout_seconds No 300 How long to wait for the analysis to complete before aborting

Outputs

Output Description
verdict Analysis verdict: Malicious, High Risk, Suspicious, or Benign
score Numeric risk score (0–100)
run_id Droidwatch run ID for the full report
report_url Public share URL to the full interactive report

How to get an API key

  1. Log in to droidwatch.app (or your instance)
  2. Go to My Profile → API Keys
  3. Click Generate new key
  4. Copy the key — it starts with dw_ and is shown only once

API keys are scoped to your account's plan limits and require a plan with
API access. Enterprise keys have no daily upload limits.

How to configure secrets

Never put your API key in the workflow YAML file directly. Store it as a
GitHub Actions encrypted secret:

  1. In your GitHub repository, go to Settings → Secrets and variables → Actions
  2. Click New repository secret
  3. Create DROIDWATCH_API_KEY with the dw_... key from My Profile → API Keys

For organisation-wide pipelines, use Organisation secrets so every
repository can share the key without duplicating it.

fail_on_verdict reference

Value Fails when verdict is...
Malicious Malicious only
Malicious\|High Risk Malicious or High Risk
Malicious\|High Risk\|Suspicious Anything but Benign

For fintech compliance pipelines, Malicious|High Risk|Suspicious is
recommended. For general CI use, Malicious|High Risk balances security
with false-positive noise.

Data handling

The action uploads your build artifact to the configured Droidwatch server
for analysis — the file leaves the GitHub Actions runner. Analysis runs in an
isolated sandbox and retention follows your plan's policy. If your artifact
must not leave your infrastructure, set server_url to a self-hosted
instance (quickstart).

Self-hosted Droidwatch

Set server_url: to your on-prem instance URL — no other changes needed.
The same action works against any Droidwatch deployment.