Policy Driven PRs

Available for Enterprise Tier only

This allows you to automate security remediation across your repositories by either creating GitHub Issues to track vulnerabilities or automatically generating Pull Requests to fix them.

With this setting, you can configure how StepSecurity responds when security misconfigurations or vulnerabilities are detected in your workflows or repositories.

Policy-based PRs page

Remediation Options

Choose how StepSecurity should remediate the vulnerabilities:

• Pull Requests: Automatically generates PRs that fix security issues (e.g., hardening actions, updating tags).

GitHub Issues: Automatically creates GitHub Issues to track and discuss detected security vulnerabilities.

Controls

These controls enable automatic detection and remediation of specific risks:

• Harden GitHub-Hosted Runner: Ensures Harden-Runner is installed on GitHub-hosted runners to:

  • Prevent exfiltration of credentials

  • Monitor the build process

  • Detect compromised dependencies

• Pin Actions to Full-Length Commit SHA: GitHub Action tags and Docker tags are mutable, which poses a security risk. GitHub’s Security Hardening Guide recommends pinning actions to full-length commit SHAs for better security.

  • You can exempt specific actions using the Exempted Actions input (e.g., actions/checkout@v3 or actions/*).

• Restrict GitHub Token Permissions: GitHub Actions workflows have read/write permissions by default, which can pose a security risk. It is recommended to restrict permissions to the minimum required.

• Replace third party actions with StepSecurity maintained actions: Use secure, audited GitHub actions maintained by StepSecurity to reduce supply chain risks.

• Enable GitHub Advanced Security Alerts: Provides additional security alerts alongside GitHub Issues, helping to identify and address vulnerabilities more effectively.

Repository Selection

Once you enable this feature on your repositories, automated Issues/Pull Requests should appear within 24 hours

Specify which repositories should use this configuration by selecting them from the list.

You can search for repositories and apply the configuration individually by checking the corresponding box under Configuration Applied.

Repository Selection for Policy Driven PRs