Scanner Quickstart

Run the open-source scanner in GitHub Actions without a FlagShark account. It reports detected flags; hosted migration and cleanup are separate workflows.

Add the workflow

Create .github/workflows/flagshark.yml in a repository where you can manage Actions:

name: FlagShark
on: [pull_request]

permissions:
  contents: read
  pull-requests: write

jobs:
  flagshark:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: FlagShark/flagshark@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Full history lets the scanner calculate flag age and resolve the PR diff. The write permission is for its PR comment. Repository and fork permission policies can limit comment delivery; the Actions run remains the first place to inspect diagnostics. Do not use a privileged trigger to execute untrusted pull-request code.

@v2 follows the v2 Action line; pin an approved full version or commit if your dependency policy requires it. See the Action guide for input/output contracts and permission details.

Run a scan

Open or update a pull request that changes supported feature-flag usage. The default scan covers changed files. Inspect the job summary and, when permitted, the PR comment. To request a repository scan, add with: { scan: full } to the FlagShark step.

Detected usage and age are inventory signals. They do not prove which value a provider serves or authorize deletion. Provider signals require a configured integration; unsupported or dynamically constructed calls may need investigation.

Choose the next step

• Run locally with the CLI.
• Describe custom detection patterns in configuration.
• Request a scoped OpenFeature migration.
• Connect the hosted GitHub App for supported hosted workflows and cleanup PRs.

The free Action does not automatically enroll a repository into hosted migration or cleanup.