# Getting Started with Secure Repo

#### **Step 1:** Navigate to [Secure Repo](https://app.stepsecurity.io/secure-repo)

#### Step 2: Enter Your GitHub Repository

* Click on the **"Enter Your GitHub Repository"** field.
* Type or paste the URL of your GitHub repository.

{% hint style="info" %}
If you don’t have repositories with workflows, you can fork and experiment with this [vulnerable repository](https://github.com/step-security/github-actions-goat)
{% endhint %}

<figure><img src="https://ajeuwbhvhr.cloudimg.io/colony-recorder.s3.amazonaws.com/files/2025-02-12/821f73df-8302-45b2-b13f-a9b90630993a/ascreenshot.jpeg?tl_px=0,0&#x26;br_px=2266,1538&#x26;force_format=jpeg&#x26;q=100&#x26;width=1120.0&#x26;wat=1&#x26;wat_opacity=1&#x26;wat_gravity=northwest&#x26;wat_url=https://colony-recorder.s3.amazonaws.com/images/watermarks/8B5CF6_standard.png&#x26;wat_pad=472,115" alt="Screenshot of StepSecurity’s GitHub Actions Security Secure Repo, allowing users to analyze and secure their GitHub repositories. The interface features an input field labeled “Enter Your GitHub Repository”, followed by a disabled “Analyze Repository” button and a “Create Pull Request” button in purple."><figcaption><p>StepSecurity Secure Repo Page</p></figcaption></figure>

#### Step 3: Analyze the Repository

* Click the **"Analyze Repository"** button.
* Secure Repo will scan your repository and suggest security improvements.

<figure><img src="https://ajeuwbhvhr.cloudimg.io/colony-recorder.s3.amazonaws.com/files/2025-02-12/d31a27d6-7e6c-4998-a38c-1babb80c0779/user_cropped_screenshot.jpeg?tl_px=0,0&#x26;br_px=2266,1538&#x26;force_format=jpeg&#x26;q=100&#x26;width=1120.0&#x26;wat=1&#x26;wat_opacity=1&#x26;wat_gravity=northwest&#x26;wat_url=https://colony-recorder.s3.amazonaws.com/images/watermarks/8B5CF6_standard.png&#x26;wat_pad=697,108" alt="Screenshot of StepSecurity’s GitHub Actions Security Secure Repo, allowing users to analyze and secure their GitHub repositories. The interface features an input field labeled “Enter Your GitHub Repository”, followed by a disabled “Analyze Repository” button and a “Create Pull Request” button in purple."><figcaption><p>StepSecurity Secure Repo Page</p></figcaption></figure>

{% hint style="warning" %}
You must be a contributor to this repository to Preview Changes / Create a Pull Request.

**Check if you're listed as a contributor by visiting:**\
`https://github.com/OWNER/REPO/graphs/contributors`\
\&#xNAN;*Example:* <https://github.com/step-security/harden-runner/graphs/contributors>
{% endhint %}

#### Step 4: Preview the Changes

* Click **"Preview Changes"** to review the security enhancements.

#### Step 5: Review commit message

* Review the commit message generated by Secure Repo.
* Click **"Preview Changes"** again to proceed.

<figure><img src="https://ajeuwbhvhr.cloudimg.io/colony-recorder.s3.amazonaws.com/files/2025-02-12/f869f895-6943-4a88-87cd-7b8c7eb73d50/user_cropped_screenshot.jpeg?tl_px=300,518&#x26;br_px=2266,1617&#x26;force_format=jpeg&#x26;q=100&#x26;width=1120.0&#x26;wat=1&#x26;wat_opacity=1&#x26;wat_gravity=northwest&#x26;wat_url=https://colony-recorder.s3.amazonaws.com/images/watermarks/8B5CF6_standard.png&#x26;wat_pad=666,277" alt="Screenshot of StepSecurity’s Commit Message dialog box for securing GitHub Actions workflows. The dialog prompts the user to provide a remediation commit message, with a pre-filled message: ”[StepSecurity] ci: Harden GitHub Actions”, signed off by StepSecurity Bot bot@stepsecurity.io. Below the message input field, a “Preview Changes” button is highlighted in purple. The background contains security recommendations related to GitHub Action tags and Docker tags, emphasizing the importance of pinning actions to full-length commit SHAs to mitigate security risks."><figcaption><p>StepSecurity Secure Repo Page</p></figcaption></figure>

#### Step 6: Review Read-Only Preview

* Click on the "**read-only preview**" to review the proposed changes before creating a pull request

<figure><img src="https://ajeuwbhvhr.cloudimg.io/colony-recorder.s3.amazonaws.com/files/2025-02-12/2ed30cda-cad5-42b8-b9b6-d79e4063676c/user_cropped_screenshot.jpeg?tl_px=0,0&#x26;br_px=1965,1098&#x26;force_format=jpeg&#x26;q=100&#x26;width=1120.0&#x26;wat=1&#x26;wat_opacity=1&#x26;wat_gravity=northwest&#x26;wat_url=https://colony-recorder.s3.amazonaws.com/images/watermarks/8B5CF6_standard.png&#x26;wat_pad=439,236" alt="Screenshot of StepSecurity’s GitHub Actions Security Orchestration interface displaying a repository analysis. The repository URL is partially blurred in the input field, with an “Analyze Repository” button next to it. A green notification banner states that a read-only preview of security best practices has been created, instructing the user to review changes and click “Create Pull Request” to apply them."><figcaption><p>StepSecurity Secure Repo Page</p></figcaption></figure>

#### Step 7: Inspect the Code Changes

* Ensure the proposed changes align with your repository’s security need

<figure><img src="https://ajeuwbhvhr.cloudimg.io/colony-recorder.s3.amazonaws.com/files/2025-02-12/2d52a24f-7da1-4b6c-87d7-bc828a0675ec/ascreenshot.jpeg?tl_px=300,224&#x26;br_px=2266,1323&#x26;force_format=jpeg&#x26;q=100&#x26;width=1120.0&#x26;wat=1&#x26;wat_opacity=1&#x26;wat_gravity=northwest&#x26;wat_url=https://colony-recorder.s3.amazonaws.com/images/watermarks/8B5CF6_standard.png&#x26;wat_pad=101,526" alt="Screenshot of a GitHub pull request diff view showing changes to the .github/workflows/toc-tou.yml file. The interface indicates 1 file changed with +13 additions and -3 deletions. A section of the YAML workflow file is displayed, highlighting modifications to GitHub Actions security settings. 	•	Removed: uses: actions/checkout@v4 	•	Added: 	•	A new step named “Harden the runner” using step-security/harden-runner@v2.10.4 with an egress policy set to audit outbound calls. 	•	The actions/checkout step now uses a pinned commit SHA (@11bd719...) for improved security."><figcaption><p>Preview of changes in GitHub</p></figcaption></figure>

#### Step 8: Create a Pull Request

1. Click **"Create Pull Request"**.
2. Confirm the pull request details and click **"Create Pull Request"** again.

<figure><img src="https://ajeuwbhvhr.cloudimg.io/colony-recorder.s3.amazonaws.com/files/2025-02-12/5250603b-733a-4d8d-b469-c9869db5db21/user_cropped_screenshot.jpeg?tl_px=300,0&#x26;br_px=2266,1098&#x26;force_format=jpeg&#x26;q=100&#x26;width=1120.0&#x26;wat=1&#x26;wat_opacity=1&#x26;wat_gravity=northwest&#x26;wat_url=https://colony-recorder.s3.amazonaws.com/images/watermarks/8B5CF6_standard.png&#x26;wat_pad=925,137" alt="Screenshot of StepSecurity’s GitHub Actions Security Secure Repo , displaying an option to create a pull request for security best practices. The repository URL input field is partially blurred, with an “Analyze Repository” button next to it. A green notification banner confirms that a read-only preview of security best practices has been created."><figcaption><p>StepSecurity Secure Repo Page</p></figcaption></figure>

#### Step 9: Final Confirmation

* Secure Repo will generate a confirmation message.
* Click the provided link to view your pull request on GitHub.

<figure><img src="https://ajeuwbhvhr.cloudimg.io/colony-recorder.s3.amazonaws.com/files/2025-02-12/85f7f064-1225-4472-9164-f9fd4eb3c1dc/user_cropped_screenshot.jpeg?tl_px=300,0&#x26;br_px=2266,1098&#x26;force_format=jpeg&#x26;q=100&#x26;width=1120.0&#x26;wat=1&#x26;wat_opacity=1&#x26;wat_gravity=northwest&#x26;wat_url=https://colony-recorder.s3.amazonaws.com/images/watermarks/8B5CF6_standard.png&#x26;wat_pad=709,736" alt="Screenshot of StepSecurity’s GitHub Actions Security Secure Repo message after securing a repository. The screen displays a congratulatory message: “You are awesome [blurred name] for prioritizing security!” Below, a notification confirms that a pull request has been created with a clickable link labeled “PR-2.” "><figcaption><p>StepSecurity Secure Repo Page</p></figcaption></figure>

#### **Step 10: Merge the Pull Request**

* Once you've reviewed the changes, click the "Merge Pull Request" button to apply the fixes to your repository.

<figure><img src="https://ajeuwbhvhr.cloudimg.io/colony-recorder.s3.amazonaws.com/files/2025-01-27/bb59495d-db96-4bad-97e6-4a9cdf5086da/ascreenshot.jpeg?tl_px=0,498&#x26;br_px=1965,1597&#x26;force_format=jpeg&#x26;q=100&#x26;width=1120.0&#x26;wat=1&#x26;wat_opacity=1&#x26;wat_gravity=northwest&#x26;wat_url=https://colony-recorder.s3.amazonaws.com/images/watermarks/8B5CF6_standard.png&#x26;wat_pad=242,532" alt="Screenshot of a GitHub pull request review page showing a StepSecurity commit titled ”[StepSecurity] Apply security best practices,” signed off by StepSecurity Bot (bot@stepsecurity.io). The commit is verified with a green label. Below, a merge request panel confirms that “This branch has no conflicts with the base branch,” allowing for automatic merging."><figcaption><p>GitHub PR created by StepSecurity Repo</p></figcaption></figure>

#### **Step 11: Verify Security Fixes**

* After merging, confirm that the security fixes have been successfully applied by viewing the updated repository.&#x20;
* You can also re-analyze the repository in StepSecurity to verify the changes.

<figure><img src="https://ajeuwbhvhr.cloudimg.io/colony-recorder.s3.amazonaws.com/files/2025-01-28/8481e744-a0cb-48f1-a8e8-3c608f41c647/user_cropped_screenshot.jpeg?tl_px=0,210&#x26;br_px=1528,1065&#x26;force_format=jpeg&#x26;q=100&#x26;width=1120.0&#x26;wat=1&#x26;wat_opacity=1&#x26;wat_gravity=northwest&#x26;wat_url=https://colony-recorder.s3.amazonaws.com/images/watermarks/8B5CF6_standard.png&#x26;wat_pad=69,-56" alt="Screenshot of a merged GitHub pull request titled ”[StepSecurity] Apply security best practices #1.” The pull request (PR) was merged into the repository from the step-security-bot branch. The interface shows 1 commit, 29 files changed, and 0 checks.  A comment from step-security-bot provides a summary, stating that the PR was created by StepSecurity at the request of a user (blurred name) to incorporate security enhancements. The message instructs the user to tag the requestor in case of any questions. A section titled “Security Fixes” follows, though its content is not fully visible."><figcaption><p>GitHub PR created by StepSecurity Repo</p></figcaption></figure>