Drata Compliance as Code Action (Scoville fork)

Fork notice. This is Scoville's fork of drata/compliance-as-code-action, forked at upstream v1.0.1.

Change 1 - region: APAC. Upstream's buildApiUrl maps only EU to a dedicated host and sends every other region — APAC included — to the US host public-api.drata.com, where an APAC-tenant pipeline key is rejected with "The api key is invalid or expired." This fork adds an apac branch returning public-api.apac.drata.com.

Upstream publishes no sources (only a prebuilt dist/, generated from a private repo), so the patch is applied directly to the vendored dist/index.js bundle.

Change 2 - the findings actually get reported. Upstream reads the documented verboseLogging input into its config and then never uses it, so findings are only ever visible in the Drata console - the build log gets bare severity counts. This fork emits them three ways: per-finding lines in the build log, a Markdown table on the workflow run summary, and a findingsMarkdown step output a workflow can post as a PR comment. Every severity renders collapsed behind its own <details> block, and long sections are capped at 50 rows to stay under GitHub's 65 KB comment limit.

Note publishResults is now async (it awaits the summary write), and its call site awaits it. That await matters: without it the actionResult === false gate compares against a Promise and the action would stop failing on findings.

Retire this fork as soon as upstream supports APAC natively and reports findings.

Known remaining gap: the run permalink printed to the build log is still built against *.drata.com and will be wrong for APAC tenants. Cosmetic only.

Use the Drata Compliance as Code action to scan for infrastructure-as-code findings in your pipeline. By utilizing this GitHub action in your workflow, you can automatically start to find, fix and monitor for compliance related configuration errors in Terraform.

Highlighted Features

Using this Action provides the following features:

• App Security Design
• Infrastructure-as-Code Security Checks
• Automated Security Design Integration
• Security Design Enforcement
• Security Design Change Management
• Out of the box compliance regulations including: SOC 2, PCI DSS, ISO 27001, GDPR, CCPA HIPAA, HI TECH, State Regulations, NIS SP 800- 53

Requirements

To run a scan on your code, you need access to Drata platform.

Usage

The following is an example GitHub Actions workflow:

on: push
jobs:
    drata-iac-scan:
    runs-on: ubuntu-latest
    name: compliance-as-code-action
    steps:
    - name: Checkout repo
        uses: actions/checkout@v4
    - name: Drata Github Action
        id: drata
        uses: drata/compliance-as-code-action@v1.0.0
        env:
            DRATA_API_TOKEN: ${{ secrets.DRATA_IAC_PIPELINE_KEY }}
            GITHUB_REPOSITORY: $GITHUB_REPOSITORY
            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
            minimumSeverity: 'CRITICAL'

Parameters

• minimumSeverity - (Required) The threshold at which a detected findings will cause your workflow to fail. One of none, low, moderate, high, or critical.
• workspaceId - (Optional) Your Drata platform workspace Id. Defaults to 1.
• region - (Optional) Your Drata platform region. One of 'US' or 'EU'. Defaults to 'US'.
• verboseLogging - (Optional) An indicator of whether you'd like any detected findings output to the GitHub Actions build log. Defaults to false.
• timeoutSeconds - (Optional) Time in seconds to wait for Drata tests to complete before failing. Defaults to 600

Secrets

• DRATA_API_TOKEN - (Required) This is the API key for your Drata Compliance as Code action workflow. The pipeline key can be created in Drata
• GITHUB_REPOSITORY: $GITHUBREPOSITORY - **(Optional)_** Your GitHub Repository referenced in the Pipeline.
• GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - (Optional) Your GitHub Token.
• Platform.

License

This project is released under the Apache 2.0 License.