Secure Repo
Last updated
Was this helpful?
Last updated
Was this helpful?
The Secure Repo feature in StepSecurity allows you to apply security best practices across all GitHub Actions workflows in your repository. It automates security improvements by scanning workflows, suggesting fixes, and generating a pull request for seamless integration.
Automated Security Enhancements: Analyzes and applies security best practices to all workflow files.
One-Click PR Creation: Generates a pull request with security fixes for easy review and merging.
GitHub Best Practices Compliance: Ensures workflow permissions, dependencies, and secrets follow industry standards.
Minimal Manual Intervention: StepSecurity automatically enforces security measures with minimal user effort.
Orchestrate Custom Workflows: Define and enforce standardized GitHub Actions workflows across repositories by specifying mandatory template workflows that must be included in every repository. Learn how to use this feature .
Visit or navigate to “Secure Repo” under the Orchestrate Security section in your StepSecurity dashboard.
Click on the "Enter Your GitHub Repository" field.
Type or paste the URL of your GitHub repository.
For Private repositories, you need to provide a Personal Access Token (PAT)
Click the "Analyze Repository" button.
Secure Repo will scan your repository and suggest security improvements.
Click "Preview Changes" to review the security enhancements.
Review the commit message generated by Secure Repo.
Click "Preview Changes" again to proceed.
Click on the "read-only preview" to review the proposed changes before creating a pull request
Ensure the proposed changes align with your repository’s security need
Click "Create Pull Request".
Confirm the pull request details and click "Create Pull Request" again.
Secure Repo will generate a confirmation message.
Click the provided link to view your pull request on GitHub.
Once you've reviewed the changes, click the "Merge Pull Request" button to apply the fixes to your repository.
After merging, confirm that the security fixes have been successfully applied by viewing the updated repository.
You can also re-analyze the repository in StepSecurity to verify the changes.
Workflow templates allow you to define standardized workflows that can be used across all repositories in your organization. Setting up workflow templates is simple—just follow these steps:
Click on your user profile picture in the StepSecurity dashboard.
Select "User Settings" from the dropdown menu.
Navigate to the Workflow Templates section under User Settings.
Enter the repository link containing the GitHub workflow templates.
Click "Update Templates Repository" to save your changes.
Go to Secure Repo under the Orchestrate Security section.
Enter the link to a repository in your organization.
Click "Analyze Repository" to review security configurations.
Review the suggested changes in the repository.
The system will automatically apply the specified workflow templates.
