# Connect Drata to GitHub > Connect Drata and GitHub to continuously monitor repositories, enforce compliance controls, and get rid of manual evidence collection before your next audit. **Canonical page:** https://tray.ai/connectors/drata-github-integrations/ **Drata connector:** https://tray.ai/connectors/drata-integrations/ **Drata documentation:** https://tray.ai/documentation/connectors/service/drata **GitHub connector:** https://tray.ai/connectors/github-integrations/ **GitHub documentation:** https://tray.ai/documentation/connectors/service/github ## Overview Drata is a security and compliance automation platform that continuously monitors your infrastructure and workflows against frameworks like SOC 2, ISO 27001, and HIPAA. GitHub is where engineering teams manage source code, review pull requests, and ship software. Connecting Drata with GitHub lets security and engineering teams automatically pull compliance evidence from repositories, enforce branch protection rules, and catch policy violations without slowing developers down. GitHub is where most of the work happens — which means it's also where most of the compliance evidence lives. The problem is that collecting it manually is a grind. Verifying branch protection settings, auditing access controls, confirming code review policies — it's tedious, error-prone, and doesn't scale. By connecting Drata and GitHub through tray.ai, compliance teams can automatically gather repository-level evidence, trigger alerts when controls drift, and keep audit trails current without chasing down engineers for screenshots. Security governance and day-to-day development stop fighting each other. ## Use cases ### Automated Branch Protection Policy Monitoring Drata continuously checks GitHub repositories to verify that branch protection rules — required code reviews, status checks, restrictions on force pushes — are actually enforced. When a repository falls out of compliance, Drata flags it immediately. No more manually auditing dozens or hundreds of repositories the week before an audit. - Real-time detection of missing or misconfigured branch protection rules - Automatic evidence collection mapped to SOC 2 and ISO 27001 controls - Reduced risk of unauthorized code merges reaching production ### GitHub Access Control Auditing and Evidence Collection Tracking who has access to which GitHub repositories is a core requirement for nearly every compliance framework, and it changes constantly. This integration automatically pulls organization member lists, team permissions, and repository collaborators from GitHub into Drata so access control evidence stays current. Quarterly access reviews go from a painful scramble to a routine task. - Continuous visibility into repository and organization-level permissions - Automated evidence logs ready for SOC 2 CC6 and ISO 27001 A.9 controls - Faster, more accurate access reviews for security teams ### Pull Request Review Enforcement and Audit Trail Sync Most compliance frameworks require proof that code changes are peer-reviewed before hitting production. By connecting GitHub with Drata via tray.ai, teams can automatically capture pull request approval data and surface it as compliance evidence. Auditors get a verifiable, timestamped record of every code review — no screenshots required. - Automated collection of pull request review and approval records - Clear audit trail demonstrating segregation of duties in the development process - No more manual screenshot gathering for code review evidence ### Repository Vulnerability Scanning Alert Routing GitHub's Dependabot and code scanning features surface security vulnerabilities directly in repositories, but that data often stays siloed away from the compliance team. This integration forwards GitHub security alerts into Drata so open vulnerabilities are tracked as control exceptions, with clear ownership and remediation timelines tied to policy. - Centralized visibility into open GitHub security alerts within Drata - Automated mapping of vulnerabilities to relevant compliance controls - SLA tracking for vulnerability remediation tied to your security policies ### New Repository Compliance Onboarding When a new repository gets created in GitHub, it should have the right security configurations applied immediately — not two weeks later when someone notices. This integration triggers an automated onboarding workflow that checks new repositories for required settings, applies default branch protections, and registers them as monitored assets in Drata. - Instant compliance coverage for every new repository at creation time - Consistent security configuration applied without manual DevOps intervention - Complete asset inventory in Drata with no gaps from newly created repos ### Offboarding Engineers and Revoking GitHub Access When an employee leaves, revoking their GitHub access promptly isn't optional — it's a compliance requirement. This integration ensures that offboarding events detected in Drata, or triggered from your HR system, automatically kick off GitHub access removal workflows, with evidence of the revocation captured back in Drata. - Timely, documented removal of GitHub access during employee offboarding - Automatic evidence capture of access revocation for audit purposes - Reduced risk of unauthorized access from former employees ### Continuous Compliance Status Reporting for Engineering Leaders Engineering managers and CISOs need ongoing visibility into their team's compliance posture without logging into multiple platforms. This integration pulls GitHub control statuses from Drata and delivers scheduled compliance health reports, giving leadership a single view of repository security, open findings, and audit readiness. - Scheduled compliance health digests delivered to engineering leadership - GitHub-related control statuses in one place without manual reporting - Concrete data to prioritize remediation before audits ## Templates ### Sync GitHub Branch Protection Status to Drata Controls This template queries GitHub repository settings on a schedule and pushes branch protection compliance data into Drata, updating control evidence and flagging any repositories that don't meet your defined policies. Connectors used: Drata, GitHub ### Enroll New GitHub Repositories in Drata Monitoring Automatically When a new repository is created in GitHub, this template triggers a workflow that applies baseline security configurations and registers the repository as a monitored asset in Drata, so there are no gaps in compliance coverage. Connectors used: GitHub, Drata ### Route GitHub Dependabot Alerts to Drata as Control Exceptions This template listens for new Dependabot or code scanning alerts in GitHub and automatically creates corresponding control exceptions or findings in Drata, so vulnerabilities are tracked and remediated within your policy-defined SLAs. Connectors used: GitHub, Drata ### Automate GitHub Access Review Evidence Collection in Drata This template periodically pulls GitHub organization membership and repository permission data and uploads it to Drata as evidence for access control reviews, cutting out the manual work that piles up during quarterly reviews and audits. Connectors used: GitHub, Drata ### Revoke GitHub Access and Log Evidence in Drata on Employee Offboarding This template removes GitHub organization access when an employee is offboarded and captures timestamped evidence of the revocation in Drata, satisfying compliance requirements for timely access termination. Connectors used: Drata, GitHub ### Deliver Weekly GitHub Compliance Health Report from Drata This template pulls GitHub-related control statuses and open findings from Drata every week and delivers a formatted compliance health report to engineering leadership and the security team via email or Slack. Connectors used: Drata, GitHub ## Challenges Tray.ai solves ### Keeping Repository Compliance Evidence Fresh Without Manual Work GitHub repositories change constantly — new repos get created, branch protections get modified, access permissions shift. Maintaining accurate, up-to-date compliance evidence by hand is nearly impossible. Point-in-time snapshots go stale fast and often don't reflect what your environment actually looks like when an auditor shows up. **How Tray.ai helps:** tray.ai supports continuous scheduled polling of GitHub repository data alongside real-time webhook-triggered workflows, so Drata always has current evidence. Automated data pipelines replace manual collection, keeping your compliance records in sync with your live GitHub environment. ### Mapping GitHub Technical Data to Compliance Framework Controls GitHub outputs raw technical data — API responses with repository metadata, permission objects, alert payloads — that has to be transformed and mapped to specific controls inside Drata. Without a dedicated integration layer, that translation falls on engineers or compliance analysts who end up doing it by hand every review cycle. **How Tray.ai helps:** tray.ai's workflow builder has data transformation built in, so teams can normalize and map GitHub API responses to the exact format and control identifiers Drata expects. Build the transformation logic once and reuse it across all your GitHub compliance workflows — no custom code needed. ### Managing Compliance Across Hundreds of GitHub Repositories at Scale Organizations with large engineering teams may manage hundreds or thousands of GitHub repositories. Manually verifying compliance settings for each one isn't realistic. A single misconfigured repository can be a material control failure, and there's no way to catch them all without automation. **How Tray.ai helps:** tray.ai supports bulk operations and iterative workflow logic, so a single automated workflow can loop through every repository in a GitHub organization, check compliance settings, and report results to Drata in one run. As your repository count grows, the automation keeps up — no extra manual effort required. ### Handling GitHub API Rate Limits During Large Evidence Collection Runs When collecting compliance evidence across a large GitHub organization, workflows can hit GitHub's API rate limits quickly — causing evidence collection to fail mid-run and leaving Drata with incomplete data. This gets especially painful during pre-audit sprints when you need a lot of data gathered fast. **How Tray.ai helps:** tray.ai's workflow engine has built-in rate limit handling, retry logic, and pagination, so large GitHub evidence collection runs finish successfully even when API limits kick in. Workflows throttle requests automatically and pick up where they left off, delivering complete evidence sets to Drata every time. ### Ensuring Timely Offboarding and Access Revocation Across GitHub SOC 2 and similar frameworks require access to be revoked within a defined window after someone leaves. Without automation, GitHub offboarding steps get delayed, done inconsistently, or poorly documented — which is real audit risk, plus the more immediate problem of former employees who technically still have access. **How Tray.ai helps:** tray.ai connects your HR system or identity provider to GitHub and Drata in a single end-to-end offboarding workflow. When a termination event is detected, access removal happens automatically and evidence is captured in Drata — no manual steps, no delays, no gaps in the audit trail. ## Learn more - Intelligent Integration: https://tray.ai/platform/intelligent-ipaas/ - Merlin Agent Builder: https://tray.ai/platform/merlin-agent-builder/ - Agent Gateway for MCP: https://tray.ai/platform/agent-gateway/ - Book a demo: https://tray.ai/contact/