Custom pattern dry runs move to GA in GitHub Advanced Security
GitHub Advanced Security's secret scanning already recognizes more than 180 secret types, but many organizations handle credentials that fall outside those built-in definitions. Since June 2021, GitHub has supported custom patterns to catch those organization-specific risks. The dry-run workflow for testing those patterns is now generally available.
The feature has evolved through several releases based on community feedback. Dry runs were introduced in public preview in February 2022, followed by the ability to add additional match requirements, edit existing patterns, and log custom pattern changes in the audit log. Since dry runs became available in preview, adoption of custom patterns among customers has grown by nearly 50%.
Testing patterns before they go live
Custom patterns can be defined at the enterprise, organization, or repository level. The quotas are generous: up to 500 custom patterns per organization or enterprise account, and up to 100 per repository. To create one, navigate to the custom patterns section under secret scanning on the security tab of your repository.
After defining the pattern's requirements, you can run a dry run without generating any alerts. The dry run executes across all of your repositories and typically takes only a few seconds. If you leave the page before it completes, the pattern is saved as a draft and you'll get an email when results are ready for review—no other notifications are sent.
Only when you're satisfied with the dry-run results do you publish the pattern. Publishing turns on real secret scanning alerts across your repositories. Historical matches found during the backfill trigger notifications to admins, while new alerts from that point forward notify both admins and commit authors.
More about GitHub Advanced Security
In addition to secret scanning, GitHub Advanced Security includes code scanning, supply chain security, Dependabot security updates, and forever-free Dependabot alerts. For further details, see:
