← Back to all integrations
Create an inventory of your code repos and run checks to ensure PRs and repos are configured correctly
Install

Integration Details

Aptible’s Github integration keeps your asset inventory up to date, triggers recurring security activities, and ensures your repo security settings are compliant.

Up-to-date asset inventory

Not all of your code repos will be in scope of your ISMS. By maintaining this list over time, you’ll be able to more quickly react to requests from auditors and customers when they are investigating your SDLC policies. Additionally, you can leverage Ticket Templates to automatically trigger processes when code repos are added or removed from Github (e.g. conduct a risk analysis when a code repo is created or remove sensitive data the code repo was utilizing after it’s removed).

Ensure secure settings

When syncing your code repos, we automatically check them for secure settings. See the Checks section below for more details.

Automatic SDLC evidence

Comply will automatically record every Pull Request merged as an event and then process them using pre-configured checks to provide evidence that your SDLC policies are being followed and visibility into when they are not being followed. The Checks that come with integration will generate healthy evidence for "Approved" and "CI Success" tagged events and unhealthy evidence for all others.

How to use Aptible and GitHub

  • Run automated checks on security configuration and changes to repos
  • Trigger notifications to designated asset owners when changes are made to security configurations and when repos are created without the required permissions.
  • Automatically collect evidence of changes, issues, and remediations.

Assets synced
  • Code Repositories
Controls Automated
  • Secure System Development
EVIDENCE CHECKS PERFORMED
Change Management

Approval status for each closed pull request is logged as evidence

Automated Testing

CI status for each closed pull request is logged as evidence

Branch Protection Enabled

Branch protection means that code requires a review before merging - that’s an important Change Management control that your auditor will want to see when investigating your Secure Software Development Lifecycle procedures.

Integration scopes
  • Read: All repos
  • Read: All teams
  • Read: All pull request events
  • Permissions: Read Only