Design a strategy for security and compliance scanning

Four scan types, four different questions:

Where each belongs

The two ends matter most:

• Push protection blocks a secret before it enters history. Detecting it afterwards means rotating the credential, because the commit is permanent even if you delete the branch.
• Continuous alerting catches vulnerabilities disclosed after your code stopped changing. A repository that has not been committed to for six months can become vulnerable overnight — which is why a "scan on commit only" strategy has a hole in it, and why a nightly scan needs always: true.

Blocking versus reporting

Block on what is unambiguous and fixable — a committed secret, a known-critical vulnerability with a patched version available. Report on what needs judgement, or you train people to bypass the gate. A scanner that blocks the build on every medium-severity finding gets switched off within a month.

Primary sources

• https://docs.github.com/en/code-security/dependabot
• https://docs.github.com/en/code-security/code-scanning
• https://docs.github.com/en/code-security/secret-scanning