ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 13:01:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(repository): add new check repository_default_branch_protection_enabled (#6161)

Browse Source 
Co-authored-by: MrCloudSec <hello@mistercloudsec.com>
Co-authored-by: Andoni A. <14891798+andoniaf@users.noreply.github.com>
This commit is contained in:
Hugo Pereira Brito
2025-05-14 13:42:59 +02:00
committed by César Arroba
parent f1c165a89d
commit 2b4bb7f805
8 changed files with 190 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/providers/github/services/repository/repository_code_changes_multi_approval_requirement/repository_code_changes_multi_approval_requirement_test.py
+3
View File
@@ -35,6 +35,7 @@ class Test_repository_code_changes_multi_approval_requirement:
id=1,
name=repo_name,
full_name="account-name/repo1",
default_branch_protection=False,
default_branch="main",
private=False,
securitymd=False,
@@ -76,6 +77,7 @@ class Test_repository_code_changes_multi_approval_requirement:
id=1,
name=repo_name,
full_name="account-name/repo1",
default_branch_protection=False,
default_branch="master",
private=False,
securitymd=False,
@@ -117,6 +119,7 @@ class Test_repository_code_changes_multi_approval_requirement:
id=1,
name=repo_name,
full_name="account-name/repo1",
default_branch_protection=True,
default_branch="master",
private=False,
securitymd=True,
tests/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled_test.py
+110
View File
@@ -0,0 +1,110 @@
from unittest import mock
from prowler.providers.github.services.repository.repository_service import Repo
from tests.providers.github.github_fixtures import set_mocked_github_provider
class Test_repository_default_branch_protection_enabled_test:
def test_no_repositories(self):
repository_client = mock.MagicMock
repository_client.repositories = {}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_github_provider(),
),
mock.patch(
"prowler.providers.github.services.repository.repository_default_branch_protection_enabled.repository_default_branch_protection_enabled.repository_client",
new=repository_client,
),
):
from prowler.providers.github.services.repository.repository_default_branch_protection_enabled.repository_default_branch_protection_enabled import (
repository_default_branch_protection_enabled,
)
check = repository_default_branch_protection_enabled()
result = check.execute()
assert len(result) == 0
def test_without_default_branch_protection(self):
repository_client = mock.MagicMock
repo_name = "repo1"
default_branch = "main"
repository_client.repositories = {
1: Repo(
id=1,
name=repo_name,
full_name="account-name/repo1",
default_branch=default_branch,
private=False,
default_branch_protection=False,
securitymd=False,
),
}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_github_provider(),
),
mock.patch(
"prowler.providers.github.services.repository.repository_default_branch_protection_enabled.repository_default_branch_protection_enabled.repository_client",
new=repository_client,
),
):
from prowler.providers.github.services.repository.repository_default_branch_protection_enabled.repository_default_branch_protection_enabled import (
repository_default_branch_protection_enabled,
)
check = repository_default_branch_protection_enabled()
result = check.execute()
assert len(result) == 1
assert result[0].resource_id == 1
assert result[0].resource_name == "repo1"
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Repository {repo_name} does not enforce branch protection on default branch ({default_branch})."
)
def test_default_branch_protection(self):
repository_client = mock.MagicMock
repo_name = "repo1"
default_branch = "main"
repository_client.repositories = {
1: Repo(
id=1,
name=repo_name,
full_name="account-name/repo1",
private=False,
default_branch=default_branch,
default_branch_protection=True,
securitymd=True,
),
}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_github_provider(),
),
mock.patch(
"prowler.providers.github.services.repository.repository_default_branch_protection_enabled.repository_default_branch_protection_enabled.repository_client",
new=repository_client,
),
):
from prowler.providers.github.services.repository.repository_default_branch_protection_enabled.repository_default_branch_protection_enabled import (
repository_default_branch_protection_enabled,
)
check = repository_default_branch_protection_enabled()
result = check.execute()
assert len(result) == 1
assert result[0].resource_id == 1
assert result[0].resource_name == "repo1"
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Repository {repo_name} does enforce branch protection on default branch ({default_branch})."
)
tests/providers/github/services/repository/repository_service_test.py
+2
View File
@@ -13,6 +13,7 @@ def mock_list_repositories(_):
id=1,
name="repo1",
full_name="account-name/repo1",
default_branch_protection=True,
default_branch="main",
private=False,
securitymd=True,
@@ -41,6 +42,7 @@ class Test_Repository_Service:
assert repository_service.repositories[1].name == "repo1"
assert repository_service.repositories[1].full_name == "account-name/repo1"
assert repository_service.repositories[1].private is False
assert repository_service.repositories[1].default_branch == "main"
assert repository_service.repositories[1].securitymd
assert repository_service.repositories[1].require_pull_request
assert repository_service.repositories[1].approval_count == 2