Installation Guide

1 Get Your RSOLV API Key

1. Visit rsolv.dev/signup and create an account
2. Complete email verification
3. Navigate to your dashboard at rsolv.dev/portal
4. Copy your API key from the API Keys section

2 Add API Key to GitHub Secrets

Store your RSOLV API key securely as a GitHub Secret:

1. Go to your repository on GitHub
2. Click Settings → Secrets and variables → Actions
3. Click New repository secret
4. Set the name to: RSOLV_API_KEY
5. Paste your API key in the value field
6. Click Add secret

3 Create GitHub Actions Workflow

Create a new file in your repository at:

.github/workflows/rsolv-security.yml

Option A: Recommended Default (Scan + Matrix Process)

On first push, RSOLV scans for vulnerabilities, then validates up to 2 of them by writing behavioral tests that prove the vulnerability is real and opening pull requests with the fix. The cap keeps free-tier first runs well within the 5 validations/month quota while producing enough proof artifacts to evaluate the tool.

name: RSOLV Security Pipeline

on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  scan:
    runs-on: ubuntu-latest
    outputs:
      pipeline_run_id: ${{ steps.rsolv.outputs.pipeline_run_id }}
      issue_numbers: ${{ steps.rsolv.outputs.issue_numbers }}
    permissions:
      contents: write
      issues: write
    steps:
      - uses: actions/checkout@v4
      - name: Scan for vulnerabilities
        id: rsolv
        uses: RSOLV-dev/RSOLV-action@v4
        with:
          rsolvApiKey: ${{ secrets.RSOLV_API_KEY }}
          max_issues: '2'

  process:
    needs: scan
    if: needs.scan.outputs.issue_numbers != '[]'
    strategy:
      matrix:
        issue_number: ${{ fromJSON(needs.scan.outputs.issue_numbers) }}
      fail-fast: false
      max-parallel: 1
    runs-on: ubuntu-latest
    permissions:
      contents: write
      issues: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - name: Validate and fix issue
        uses: RSOLV-dev/RSOLV-action@v4
        with:
          rsolvApiKey: ${{ secrets.RSOLV_API_KEY }}
          mode: 'process'
          pipeline_run_id: ${{ needs.scan.outputs.pipeline_run_id }}
          issue_number: ${{ matrix.issue_number }}

Option B: Evaluation-Only (Scan to CI Artifact)

For evaluation runs, large monorepos, or teams that want zero issue/PR creation while assessing fit: scan only and emit a JSON report as a workflow artifact. No GitHub issues, no PRs, no validation cost.

name: RSOLV Security Scan (Report Only)

on:
  workflow_dispatch:

jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4
      - name: RSOLV Security Scan
        uses: RSOLV-dev/RSOLV-action@v4
        with:
          rsolvApiKey: ${{ secrets.RSOLV_API_KEY }}
          mode: 'scan'
          scan_output: 'report'

4 Commit and Verify Installation

Commit the workflow file

git add .github/workflows/rsolv-security.yml
git commit -m "Add RSOLV security workflow"
git push origin main

Verify the workflow runs

1. Go to your repository's Actions tab
2. You should see one of: "RSOLV Security Pipeline" (Option A) running with a scan job followed by one process job per issue (up to the 2 cap), OR "RSOLV Security Scan (Report Only)" (Option B) running a single scan job
3. Click on the workflow run to view progress
4. Wait for completion (typically 5-15 minutes for Option A's full pipeline; under a minute for Option B's report-only)

Check the results

• Option A: Navigate to your Pull Requests tab — look for PRs from rsolv-fix/* branches. Each PR contains a failing behavioral test (RED) demonstrating the vulnerability and the fix that makes it pass (GREEN). The matching GitHub issue (in the Issues tab, labeled security and rsolv ) is referenced from the PR body.
• Option B: Navigate to the workflow run's Summary page and download the rsolv-scan-report artifact. Contains a JSON report and a markdown summary of all findings, with no GitHub issues or PRs created.

Common Installation Issues