A template repository demonstrating how to integrate the Threagile agile threat modeling tool into GitHub workflows for automated risk assessment and compliance auditing.
Example of how to integrate Threagile into GitHub workflows
This repository serves as a practical example for security teams and DevOps engineers to automate threat modeling within their CI/CD pipelines using GitHub Actions. It is designed to trigger threat model analysis and generate comprehensive security reports whenever the threat model input file changes, enabling continuous risk assessment and governance compliance.
This repository is a template and does not contain a real project source code; users should replace the example threagile.yaml with their actual threat model input. The workflow depends on the open-source run-threagile-action available in the GitHub Actions marketplace. Best practice is to customize the workflow and threat model input to fit the specific security governance and compliance requirements of your project.
Fork or clone this example repository
Modify or replace the threagile.yaml file with your own threat model input
Customize the GitHub workflow (.github/workflows/main.yaml) if needed
Commit and push changes to trigger the workflow automaticallyPush changes to threagile.yaml
Triggers the GitHub workflow to run the run-threagile-action and generate threat modeling outputs