diff --git a/pyproject.toml b/pyproject.toml
index 8ae7dd2..5734b33 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.1.27"
+version = "2.1.28"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 20fd0d8..fce5d74 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,2 +1,2 @@
 __author__ = 'socket.dev'
-__version__ = '2.1.27'
+__version__ = '2.1.28'
diff --git a/socketsecurity/core/scm/github.py b/socketsecurity/core/scm/github.py
index fa40afb..1b4fa0e 100644
--- a/socketsecurity/core/scm/github.py
+++ b/socketsecurity/core/scm/github.py
@@ -47,7 +47,13 @@ def from_env(cls, pr_number: Optional[str] = None) -> 'GithubConfig':
         # Add debug logging
         sha = os.getenv('GITHUB_SHA', '')
         log.debug(f"Loading SHA from GITHUB_SHA: {sha}")
-        
+        event_action = os.getenv('EVENT_ACTION', None)
+        if not event_action:
+            event_path = os.getenv('GITHUB_EVENT_PATH')
+            if event_path and os.path.exists(event_path):
+                with open(event_path, 'r') as f:
+                    event = json.load(f)
+                    event_action = event.get('action')
         repository = os.getenv('GITHUB_REPOSITORY', '')
         owner = os.getenv('GITHUB_REPOSITORY_OWNER', '')
         if '/' in repository:
@@ -74,7 +80,7 @@ def from_env(cls, pr_number: Optional[str] = None) -> 'GithubConfig':
             env=os.getenv('GITHUB_ENV', ''),
             token=token,
             owner=owner,
-            event_action=os.getenv('EVENT_ACTION'),
+            event_action=event_action,
             headers={
                 'Authorization': f"Bearer {token}",
                 'User-Agent': 'SocketPythonScript/0.0.1',