Three analyses on every push and pull request: infrastructure as code (Terraform, Kubernetes manifests, Dockerfiles), secrets, dependencies. Each posts a comment updated on every commit and a status on the commit. Per family, you choose whether a finding above a threshold fails the status; you then decide, in GitHub, whether that status blocks the merge.
Comment and status per family: IaC, secrets, dependencies
Blocking thresholds adjustable per family
Labelling pull request and .ctadel.yaml file to attach the repository to a project
Issues
From the detail panel of a finding, the “Create a ticket” button opens a ticket in this system with the title, severity, resource, rule and fix. The ticket is linked to the finding; Ctadel follows its state for thirty days by polling the system every five minutes, and shows it in the History tab.
How to connect it
From “Settings”, “Integrations” tab, “Git (IaC)” sub-tab, install the Ctadel app on your organisation and choose the repositories. Webhooks are delivered automatically. For issues, connect GitHub in the “Ticketing” sub-tab with a personal token, the owner and the repository.
Limits
github.com only, not GitHub Enterprise Server. Helm templates and Kustomize overlays are not analysed.
See it on your accounts
The online demonstration is open to all, on fictitious data. For an instance on your own accounts, request a demonstration.
