Drata now supports GitHub organizational rulesets in our GitHub integration for Version Control. Follow these steps to enable the Drata Autopilot system access to your organizational rulesets and apply these rulesets to the Formal Code Review Process test.
Note: Due to recent GitHub updates, Drata can now access both organizational and repository rulesets with Read-only permissions, eliminating the need for elevated access. Organization and repository rulesets are supported.
Prerequisite
To use GitHub rulesets, ensure your setup meets the following requirements:
Drata supports both organization and repository rulesets.
You must include ALL branches or the Default Branch. Default branches must be directly targeted, as paths are not supported.
One or more approvers must be specified.
Grant Administration Read permissions under Organization permissions.
Grant Administration Read permissions
To grant Administration Read permissions under Organization permissions:
Log into Github as an Admin.
Select your organization within Github.
You can access your organizations by selecting your user icon and then Your organization.
Select the Settings tab and then App settings.
Select Permissions & events. On the Permissions page, expand the Organization permissions section and then select Read-only for Administration permission.
Save your changes
Set up organizational rulesets in GitHub
To configure organizational:
Log in as an Admin in GitHub and select Your organizations.
Select the relevant organization.
Navigate to Settings.
Expand Repository and select Repository rulesets.
Here, you can start to configure your rulesets.
Create a repository ruleset
To create or edit a ruleset:
Select the New branch ruleset or select an existing ruleset to edit.
Enter a Ruleset Name.
Set Enforcement Status to Active.
Bypass list is optional.
Choose Target repositories to be one of the following:
All repositories
Dynamic list by name
Select repositories
If selected, continue and add specific repositories.
Note: Some configurations, such as Target: Dynamic list by property, are currently not supported.
Under Target branches, choose Include default branch or Include all branches.
Note: Default branches must be directly targeted. Paths (such as
/not/supported/*/main) are not supported.
Configure Branch protections:
Require a pull request before merging.
Specify Required approvals (must be 1 or more).
Save changes.
Troubleshooting
If issues arise, use the JSON results from the Formal Code Review monitoring test to identify any failed repositories. Only repositories with failures are displayed; passing repositories will not appear in this list.