Draugr and GitHub Advanced Security

GitHub Advanced Security is GitHub's own security tooling, packaged as GitHub Secret Protection, which finds credentials committed to a repository and blocks them at push, and GitHub Code Security, which runs code scanning with CodeQL, Copilot Autofix and dependency review.

Draugr is an open-source CLI that runs the scanners a repository needs from one descriptor file, ranks every finding by the component it belongs to, and returns a pass or fail. It writes SARIF 2.1.0, the format code scanning reads, so on GitHub its findings appear in the Security tab beside CodeQL's.

At a glance#

Where Draugr stands out#

What both do#

✓ yespartly in part, or in a narrower form— no

What each covers#

A scanner uploading SARIF is one somebody chooses, installs and keeps current in a workflow of their own, and code scanning shows its results under that tool's name with that tool's severities. Draugr's descriptor names those scanners in one place, and draugr tools install fetches pinned builds of every one of them except Prowler and Mend, and verifies each before installing it.

How a finding is ranked and gated#

Code scanning ranks an alert by the severity its tool assigned, using a CVSS-based security severity where the tool provides one. A ruleset can block a merge when a required tool reports an alert at or above a threshold chosen per tool.

Draugr ranks every finding P1 to P4 by combining the scanner's severity with the component's exposure (who can reach it) and criticality (what the business loses when it stops), both declared in the descriptor. The same CVE can be P1 on a public, business-critical service and P3 on a restricted, supporting one. Where the descriptor turns on exploitability feeds, a CVE in CISA's Known Exploited Vulnerabilities catalog or with a high EPSS score ranks higher, and where it names govulncheck, a Go finding with no call path from your code ranks one band lower.

The gate is one band across every scanner:

- uses: draugr-dev/draugr@v0
  with:
    saga: draugr.saga.yaml
    tools: true
    fail-on-new: P1

On a pull request the action runs a diff, posts it as a comment and fails the check only on a P1 the change introduces. On a push it runs a full scan, which fails on any open P1. The GitHub Action guide covers both.

Using both#

Draugr's findings in code scanning. The descriptor's github publisher uploads Draugr's SARIF to code scanning on each push, so every scanner Draugr runs appears in the Security tab as one tool. A finding accepted in the descriptor is dismissed there as won't fix, with the reason and the exclusion's file and line as the comment, and the git history of that line names who accepted it.

config:
  publishers:
    - kind: github

On a pull request the action posts its own comment rather than uploading, which keeps the pull request from collecting two overlapping summaries. Publish to GitHub code scanning covers the token and the upload.

CodeQL's findings in Draugr's gate. Draugr does not run CodeQL. Where you already do, a component can import the SARIF file CodeQL writes, and its findings are ranked by the component's exposure and criticality and counted toward the same gate as everything else:

components:
  - name: api
    exposure: public
    criticality: critical
    imports:
      - control: sast
        file: reports/codeql.sarif

The file comes from CodeQL's advanced setup, a workflow you control, where the github/codeql-action/analyze step writes SARIF to its output directory. Draugr's upload carries the imported findings as its own, so set that step's upload to never when Draugr publishes to code scanning, or each CodeQL alert appears twice, once under each tool. Import another scanner's SARIF covers binding the file to the commit it scanned.

What stays with GitHub. Push protection stops a credential before GitHub accepts the push, and Dependabot opens the pull requests that update a vulnerable dependency. Both run inside GitHub, outside any pipeline. Draugr gates on the credentials and vulnerable dependencies already in the repository, on every pull request and every push.

Availability#

Code scanning, secret scanning and dependency review are available on every public repository, and Dependabot alerts on every repository. On a private repository, secret scanning needs GitHub Secret Protection, and code scanning, CodeQL, AI Scan and dependency review need GitHub Code Security, on GitHub Team or GitHub Enterprise.

Draugr is Apache-2.0 and runs in your own pipeline. Its upload to code scanning follows the same rule as any other tool's, so on a private repository the Security tab needs GitHub Code Security, while the scan, the pull-request comment and the gate do not.

The quickstart goes from install to a first scan.

Checked on 2026-10-25 against GitHub's About GitHub Advanced Security, GitHub security features, About code scanning alerts, Set code scanning merge protection, About dependency review, About open source license compliance, About Dependabot security updates, GitHub Advanced Security for Azure DevOps, the 2026-10-16 announcement of open source license compliance, the CodeQL analyze action's inputs and source, and the 2026-10-15 announcement of AI Scan for pull requests.