We automated Drata's code scanning evidence collection via GitHub Actions. The out-of-box integration is fine for basic commits, but we needed to scan specific branches and report on pull requests. Here's the workflow that worked.
Key parts:
* Use the official `drata/evidence-collector-action`
* Set it to trigger on PR merge to main *and* on a nightly schedule for the main branch.
* Filter the evidence by policy name in the action's `policies` input.
```yaml
name: Drata Code Scan Evidence
on:
push:
branches: [ main ]
schedule:
- cron: '0 2 * * *' # Daily 2 AM UTC
workflow_dispatch:
jobs:
collect-evidence:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v3
- name: Run Drata Evidence Collector
uses: drata/evidence-collector-action@v1
with:
drata-api-token: ${{ secrets.DRATA_API_TOKEN }}
policies: 'Code Scanning,SAST'
branch: 'main'
```
Gotchas:
* The API token needs the "Evidence Write" permission.
* The action runs `git` commands, so a full checkout is required.
* Policy names must match exactly what's in your Drata framework.
This cut our manual evidence upload time to zero. For teams using multiple repos, you can centralize this in a reusable workflow.
—cp
—cp
Is there a cost for using that action? Like, does Drata charge per evidence submission from the API? I'm trying to avoid surprise fees.
Also, "needs the 'Evidence Write' permission" is a good catch. Their docs don't make that clear enough.
> Is there a cost for using that action?
Oh, you sweet summer child. You think the *action* is the thing they'll charge you for? The action is the free bait. The hook is the Drata subscription itself, which last I checked costs more than a decent dinner out per seat per month. And if you're on the "growth" plan, they'll happily count each evidence submission as a "feature" you're already paying for. Surprise fees usually come from overages on other limits, not per-evidence API calls.
But if you really want to avoid the whole vendor lock-in song and dance, you can just dump the raw scan results into a JSON file, timestamp it, and self-host your own evidence repo. No API, no permissions, no Drata at all. But then you'd have to actually explain to an auditor what a "SHA256 hash" means, so I get why people pay for the shiny button.
FOSS advocate
That's a solid baseline configuration, but you're missing the crucial `evidence-type` parameter. Without it, you're defaulting to generic "commit" evidence, which won't tie the results back to a specific tool like CodeQL or Snyk. The policy filter works, but the evidence card in Drata will be less useful for auditors.
You should add `evidence-type: 'Code Scanning'` to the action's `with` block. Also, consider adding `fail-on-error: false` if you don't want a transient GitHub API blip to break your deployment pipeline. I've seen that happen with scheduled runs.
For PR reporting, you'd need a separate workflow trigger on `pull_request: types: [closed]` and then a conditional check that the PR was merged, not just closed. Your current push trigger to main will catch the merge commit, but you lose the PR context and number.
Garbage in, garbage out.