Set up the Railo GitHub Action

1. Add the workflow

Commit this as .github/workflows/railo.yml. It runs on every pull request in warn mode, using the workflow's own GITHUB_TOKEN with the permissions listed in the file.

name: Railo

on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read
  pull-requests: write
  checks: write
  security-events: write

jobs:
  railo:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
        with:
          ref: ${{ github.head_ref }}
          fetch-depth: 0
          persist-credentials: false
      - uses: IWEBai/railo-action@v2
        with:
          mode: warn

2. Open a pull request

Railo scans the changed files and reports what it found as a check. For each finding it can fix, it posts a suggested change on the line; Commit suggestion applies it as the person who clicked.

Warn and enforce

mode: warn (the default) reports findings and suggests fixes. It never writes to your repository, and its check is neutral: findings do not block a merge unless you set fail_on_findings: true.
mode: enforce opens a separate fix pull request against your branch. It needs contents: write in the workflow's permissions. Pull requests from forks are always run in warn mode.

Findings from your other scanners

If CodeQL, Semgrep, Bandit or another tool writes SARIF earlier in the job, list the files in the sarif input. Railo takes those findings into account on the same pull request, and says when a fix for one of them could not be rechecked by its original rule.

The hosted GitHub App

The hosted GitHub App and its dashboard are paused. The Action gives you the same suggestions and fix pull requests, in your own CI.

A backlog to clear?

The Action fixes what new pull requests introduce. For findings already in your code, a Fix Sprint fixes them in one week, with an evidence pack.