01 Install

Five minutes to a Check on the next PR.

Recommended path: GitHub App → policy on default branch → smoke PR. Need your own CI boundary? Use the Action. Local dogfood? CLI.

Install GitHub App Build config

1 · Install the GitHub App

Recommended

Hosted analyzer. Check name: Norekt. No self-hosted runner.

Open install
web3shield-pilot.fly.dev/install or the GitHub install page. Pick org or user, then the frontend repo.
Approve permissions
Contents: read · Pull requests: read · Checks: write. We never ask for contents write.

Install on GitHub Next: config

2 · Build policy (.web3shield.yml)

Default branch

Commit this file on main (or your default). Head cannot disable scanners via config alone. Toggle scanners and enforce, then copy the YAML.

Mode

Scanners

Shadow reports without failing non-enforced scanners. Secrets often stay enforce: true even in shadow.

3 · Open a smoke PR

Verify

Push a deliberate signal
A fake ghp_ string, a small protected-package bump, or any real frontend change.
Open Checks → Norekt
Use the Files tab for line annotations when path/line is known.

4 · You’re set

Success

You’re set when you see Norekt on the PR

A Check named Norekt on the pull request—pass with no findings, or findings with codes like W3-SEC-* / W3-DEP-*.

App installed on the frontend repo
.web3shield.yml on the default branch
At least one PR with a Norekt Check run

Alt · GitHub Action

Your runners

Same engine. Engine lives outside the scanned tree. Always materialize the PR base.

# .github/workflows/norekt.yml
name: Norekt
on:
  pull_request:
    branches: [main, master, develop]

permissions:
  contents: read

jobs:
  norekt:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          fetch-depth: 0

      # Pin a full 40-char commit SHA. Tags alone are not enough.
      - uses: protectaurus/norekt/action@FULL_COMMIT_SHA

Private analyzer: base-owned install with NOREKT_READ_TOKEN and a reviewed engine SHA— never checkout under the workspace as .norekt. install-action.md

Alt · CLI

Local

cd /path/to/norekt
PYTHONPATH=. python3 -m shield check /path/to/your-frontend
PYTHONPATH=. python3 -m shield check ./head --base ./base --format json

Exit	Meaning
0	Clean, or only non-enforced findings
1	One or more enforced findings
2	Runtime / config error (fail-closed)

Install on GitHub

Pick the frontend repo. Paste config on main. Open a smoke PR.

Open install Repository