L16. Automated Security Scanning: GitHub Advanced Security, Defender for Cloud DevOps & Dependabot
CodeQL finds vulnerability patterns through data-flow modeling, push protection blocks a secret before it ever reaches the remote, and Defender for Cloud DevOps Security correlates code risk with the cloud resource it ships to.
What Is Automated Security Scanning?
Automated security scanning in a pipeline typically spans four distinct categories, each catching a different class of risk:
| Category | Purpose | Tools |
|---|---|---|
| Dependency scanning | Identify known-vulnerable open-source libraries | Dependabot, Snyk |
| Code/SAST scanning | Find vulnerability patterns through code analysis | CodeQL, Checkmarx |
| Secret scanning | Detect exposed API keys, tokens, credentials | GitHub secret scanning |
| Licensing scanning | Flag incompatible or restricted-use licenses | FOSSA, BlackDuck |
GitHub Advanced Security (GHAS)
GitHub Advanced Security bundles three essential scanning tools: CodeQL is a semantic code-scanning engine that models data flow to find vulnerability patterns, going far beyond simple text or regex matching. It understands how data flows through your code and detects subtle patterns like unsafe SQL construction even when the vulnerable code and input source are far apart. Secret scanning detects patterns matching known credential formats (AWS keys, GitHub tokens, private keys). With push protection enabled, GitHub can block a commit containing a detected secret pattern before it is even pushed to the remote repository. This prevents the secret from ever being recorded in the repository's history. Without push protection, GitHub only alerts after the fact. Dependabot flags known-vulnerable dependencies and can automatically open pull requests that bump a vulnerable dependency to the first available patched version, giving your team a ready-made fix rather than just an alert.GitHub Advanced Security for Azure DevOps
GitHub Advanced Security for Azure DevOps (GHAzDO) brings CodeQL, secret scanning, and Dependabot to Azure Repos pipelines, extending these capabilities beyond GitHub-hosted repositories.Defender for Cloud DevOps Security
Microsoft Defender for Cloud DevOps Security connects GitHub, Azure DevOps, and GitLab repositories to Azure's Defender for Cloud. This creates a unified security posture view spanning source code and cloud infrastructure. A vulnerable dependency flagged in a GitHub repository is surfaced alongside the Azure resource it's deployed to, correlating code-level and cloud-level risk in one place.Integrating GitHub Advanced Security with Defender for Cloud allows CodeQL findings to flow directly into Defender for Cloud's unified recommendations, eliminating the need to switch between tools.
Container Scanning and Dependabot Updates
Automated container scanning checks for known-vulnerable packages in a container image's base layers and application dependencies, catching risks before deployment. Configuring a GitHub Action to run CodeQL analysis on code running inside a container build extends SAST to containerized workloads. Dependabot alerts passively flag a known vulnerability. Dependabot security updates go further by automatically opening a pull request that bumps the dependency to the first patched version, transforming a passive alert into an active, ready-to-merge fix.
The Scanning Mindset
Automated security scanning works best when you treat scanning results as part of your definition of done, not as an optional extra step. Tools can flag issues, but humans must decide whether to fix, suppress, or accept the risk.
- ✓Automated security scanning in a pipeline generally spans four categories: dependency scanning, code/SAST scanning, secret scanning, and license scanning, each catching a different class of risk
- ✓CodeQL (part of GitHub Advanced Security) is a semantic code-scanning engine that models data flow to find vulnerability patterns, going beyond simple text/pattern matching
- ✓GitHub secret scanning with push protection can block a commit containing a detected secret pattern before it is even pushed, rather than only alerting after the fact
- ✓Microsoft Defender for Cloud DevOps Security connects GitHub, Azure DevOps, and GitLab to give a unified security posture view spanning source code and cloud resources, and can surface GitHub Advanced Security findings inside its own recommendations
- ✓Dependabot alerts passively flag a known-vulnerable dependency, while Dependabot security updates go further by automatically opening a pull request that bumps the dependency to the first available patched version
1. A developer accidentally types a live cloud API key into a file and attempts to commit and push it to a GitHub repository with secret scanning push protection enabled. What happens?
2. A security team wants one place to see both a vulnerable open-source dependency flagged in a GitHub repository and the Azure resource it's actually deployed to, correlating code-level and cloud-level risk. What service is designed for this?
3. What is the difference between a Dependabot alert and a Dependabot security update for the same vulnerable dependency?
Recommended: Pluralsight
This free course covers the theory. Pluralsight adds structured DevOps Engineer Expert learning paths, hands-on Azure Pipelines and GitHub Actions labs, and timed practice exams to make it stick before exam day.