From 3658e85cfcd90edf54b4f7fff94062ec4b2ca6fc Mon Sep 17 00:00:00 2001 From: Sergio Garcia Date: Mon, 26 May 2025 14:34:44 +0200 Subject: [PATCH] chore(github): add `Branch` class (#7838) --- ...pository_branch_delete_on_merge_enabled.py | 8 +- ...sitory_default_branch_deletion_disabled.py | 4 +- ...ory_default_branch_disallows_force_push.py | 12 +-- ...ult_branch_protection_applies_to_admins.py | 4 +- ...itory_default_branch_protection_enabled.py | 8 +- ...fault_branch_requires_codeowners_review.py | 4 +- ...branch_requires_conversation_resolution.py | 12 +-- ..._default_branch_requires_linear_history.py | 8 +- ...ault_branch_requires_multiple_approvals.py | 4 +- ..._default_branch_requires_signed_commits.py | 8 +- ...y_default_branch_status_checks_required.py | 8 +- .../repository_inactive_not_archived.py | 4 +- .../services/repository/repository_service.py | 58 +++++++----- ...ory_branch_delete_on_merge_enabled_test.py | 68 ++++++++++---- ...y_default_branch_deletion_disabled_test.py | 44 ++++++++- ...efault_branch_disallows_force_push_test.py | 56 +++++++++--- ...ranch_protection_applies_to_admins_test.py | 48 ++++++++-- ..._default_branch_protection_enabled_test.py | 48 ++++++++-- ..._branch_requires_codeowners_review_test.py | 52 ++++++++--- ...h_requires_conversation_resolution_test.py | 50 +++++++++-- ...ult_branch_requires_linear_history_test.py | 48 ++++++++-- ...branch_requires_multiple_approvals_test.py | 77 ++++++++++++---- ...ult_branch_requires_signed_commits_test.py | 62 ++++++++++--- ...ault_branch_status_checks_required_test.py | 42 ++++++++- ...sitory_dependency_scanning_enabled_test.py | 42 +++++++-- .../repository_has_codeowners_file_test.py | 42 +++++++-- .../repository_inactive_not_archived_test.py | 90 +++++++++++++++++-- ...ository_public_has_securitymd_file_test.py | 44 +++++++-- ...repository_secret_scanning_enabled_test.py | 42 +++++++-- .../repository/repository_service_test.py | 56 +++++++----- 30 files changed, 820 insertions(+), 233 deletions(-) diff --git a/prowler/providers/github/services/repository/repository_branch_delete_on_merge_enabled/repository_branch_delete_on_merge_enabled.py b/prowler/providers/github/services/repository/repository_branch_delete_on_merge_enabled/repository_branch_delete_on_merge_enabled.py index 98cacd4394..145e4261e1 100644 --- a/prowler/providers/github/services/repository/repository_branch_delete_on_merge_enabled/repository_branch_delete_on_merge_enabled.py +++ b/prowler/providers/github/services/repository/repository_branch_delete_on_merge_enabled/repository_branch_delete_on_merge_enabled.py @@ -24,15 +24,11 @@ class repository_branch_delete_on_merge_enabled(Check): for repo in repository_client.repositories.values(): report = CheckReportGithub(metadata=self.metadata(), resource=repo) report.status = "FAIL" - report.status_extended = ( - f"Repository {repo.name} does not delete branches on merge." - ) + report.status_extended = f"Repository {repo.name} does not delete branches on merge in default branch ({repo.default_branch.name})." if repo.delete_branch_on_merge: report.status = "PASS" - report.status_extended = ( - f"Repository {repo.name} does delete branches on merge." - ) + report.status_extended = f"Repository {repo.name} does delete branches on merge in default branch ({repo.default_branch.name})." findings.append(report) diff --git a/prowler/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled.py b/prowler/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled.py index 1b7dfe2004..bf615a21b6 100644 --- a/prowler/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled.py +++ b/prowler/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled.py @@ -22,14 +22,14 @@ class repository_default_branch_deletion_disabled(Check): """ findings = [] for repo in repository_client.repositories.values(): - if repo.default_branch_deletion is not None: + if repo.default_branch.branch_deletion is not None: report = CheckReportGithub(metadata=self.metadata(), resource=repo) report.status = "FAIL" report.status_extended = ( f"Repository {repo.name} does allow default branch deletion." ) - if not repo.default_branch_deletion: + if not repo.default_branch.branch_deletion: report.status = "PASS" report.status_extended = ( f"Repository {repo.name} does deny default branch deletion." diff --git a/prowler/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push.py b/prowler/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push.py index b1364e2096..16eb7fa794 100644 --- a/prowler/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push.py +++ b/prowler/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push.py @@ -22,18 +22,14 @@ class repository_default_branch_disallows_force_push(Check): """ findings = [] for repo in repository_client.repositories.values(): - if repo.allow_force_pushes is not None: + if repo.default_branch.allow_force_pushes is not None: report = CheckReportGithub(metadata=self.metadata(), resource=repo) report.status = "FAIL" - report.status_extended = ( - f"Repository {repo.name} does allow force push." - ) + report.status_extended = f"Repository {repo.name} does allow force pushes on default branch ({repo.default_branch.name})." - if not repo.allow_force_pushes: + if not repo.default_branch.allow_force_pushes: report.status = "PASS" - report.status_extended = ( - f"Repository {repo.name} does deny force push." - ) + report.status_extended = f"Repository {repo.name} does deny force pushes on default branch ({repo.default_branch.name})." findings.append(report) diff --git a/prowler/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins.py b/prowler/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins.py index 39c8de0384..0a70cf0aea 100644 --- a/prowler/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins.py +++ b/prowler/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins.py @@ -22,12 +22,12 @@ class repository_default_branch_protection_applies_to_admins(Check): """ findings = [] for repo in repository_client.repositories.values(): - if repo.enforce_admins is not None: + if repo.default_branch.enforce_admins is not None: report = CheckReportGithub(metadata=self.metadata(), resource=repo) report.status = "FAIL" report.status_extended = f"Repository {repo.name} does not enforce administrators to be subject to the same branch protection rules as other users." - if repo.enforce_admins: + if repo.default_branch.enforce_admins: report.status = "PASS" report.status_extended = f"Repository {repo.name} does enforce administrators to be subject to the same branch protection rules as other users." diff --git a/prowler/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled.py b/prowler/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled.py index cf281c6a6a..1348018ee1 100644 --- a/prowler/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled.py +++ b/prowler/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled.py @@ -22,14 +22,14 @@ class repository_default_branch_protection_enabled(Check): """ findings = [] for repo in repository_client.repositories.values(): - if repo.default_branch_protection is not None: + if repo.default_branch.protected is not None: report = CheckReportGithub(metadata=self.metadata(), resource=repo) report.status = "FAIL" - report.status_extended = f"Repository {repo.name} does not enforce branch protection on default branch ({repo.default_branch})." + report.status_extended = f"Repository {repo.name} does not enforce branch protection on default branch ({repo.default_branch.name})." - if repo.default_branch_protection: + if repo.default_branch.protected: report.status = "PASS" - report.status_extended = f"Repository {repo.name} does enforce branch protection on default branch ({repo.default_branch})." + report.status_extended = f"Repository {repo.name} does enforce branch protection on default branch ({repo.default_branch.name})." findings.append(report) diff --git a/prowler/providers/github/services/repository/repository_default_branch_requires_codeowners_review/repository_default_branch_requires_codeowners_review.py b/prowler/providers/github/services/repository/repository_default_branch_requires_codeowners_review/repository_default_branch_requires_codeowners_review.py index 5e6f0c6464..4c5b75010a 100644 --- a/prowler/providers/github/services/repository/repository_default_branch_requires_codeowners_review/repository_default_branch_requires_codeowners_review.py +++ b/prowler/providers/github/services/repository/repository_default_branch_requires_codeowners_review/repository_default_branch_requires_codeowners_review.py @@ -22,9 +22,9 @@ class repository_default_branch_requires_codeowners_review(Check): """ findings = [] for repo in repository_client.repositories.values(): - if repo.require_code_owner_reviews is not None: + if repo.default_branch.require_code_owner_reviews is not None: report = CheckReportGithub(metadata=self.metadata(), resource=repo) - if repo.require_code_owner_reviews: + if repo.default_branch.require_code_owner_reviews: report.status = "PASS" report.status_extended = f"Repository {repo.name} requires code owner approval for changes to owned code." else: diff --git a/prowler/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution.py b/prowler/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution.py index 53cff78909..da33754cf5 100644 --- a/prowler/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution.py +++ b/prowler/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution.py @@ -22,18 +22,14 @@ class repository_default_branch_requires_conversation_resolution(Check): """ findings = [] for repo in repository_client.repositories.values(): - if repo.conversation_resolution is not None: + if repo.default_branch.conversation_resolution is not None: report = CheckReportGithub(metadata=self.metadata(), resource=repo) report.status = "FAIL" - report.status_extended = ( - f"Repository {repo.name} does not require conversation resolution." - ) + report.status_extended = f"Repository {repo.name} does not require conversation resolution on default branch ({repo.default_branch.name})." - if repo.conversation_resolution: + if repo.default_branch.conversation_resolution: report.status = "PASS" - report.status_extended = ( - f"Repository {repo.name} does require conversation resolution." - ) + report.status_extended = f"Repository {repo.name} does require conversation resolution on default branch ({repo.default_branch.name})." findings.append(report) diff --git a/prowler/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history.py b/prowler/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history.py index e57250a1e5..29a0e51b51 100644 --- a/prowler/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history.py +++ b/prowler/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history.py @@ -22,14 +22,14 @@ class repository_default_branch_requires_linear_history(Check): """ findings = [] for repo in repository_client.repositories.values(): - if repo.required_linear_history is not None: + if repo.default_branch.required_linear_history is not None: report = CheckReportGithub(metadata=self.metadata(), resource=repo) report.status = "FAIL" - report.status_extended = f"Repository {repo.name} does not require linear history on default branch ({repo.default_branch})." + report.status_extended = f"Repository {repo.name} does not require linear history on default branch ({repo.default_branch.name})." - if repo.required_linear_history: + if repo.default_branch.required_linear_history: report.status = "PASS" - report.status_extended = f"Repository {repo.name} does require linear history on default branch ({repo.default_branch})." + report.status_extended = f"Repository {repo.name} does require linear history on default branch ({repo.default_branch.name})." findings.append(report) diff --git a/prowler/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals.py b/prowler/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals.py index ad6c89e833..6312b98d02 100644 --- a/prowler/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals.py +++ b/prowler/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals.py @@ -22,12 +22,12 @@ class repository_default_branch_requires_multiple_approvals(Check): """ findings = [] for repo in repository_client.repositories.values(): - if repo.approval_count is not None: + if repo.default_branch.approval_count is not None: report = CheckReportGithub(metadata=self.metadata(), resource=repo) report.status = "FAIL" report.status_extended = f"Repository {repo.name} does not enforce at least 2 approvals for code changes." - if repo.approval_count >= 2: + if repo.default_branch.approval_count >= 2: report.status = "PASS" report.status_extended = f"Repository {repo.name} does enforce at least 2 approvals for code changes." diff --git a/prowler/providers/github/services/repository/repository_default_branch_requires_signed_commits/repository_default_branch_requires_signed_commits.py b/prowler/providers/github/services/repository/repository_default_branch_requires_signed_commits/repository_default_branch_requires_signed_commits.py index 3f929a2eac..4b6aa3ae4c 100644 --- a/prowler/providers/github/services/repository/repository_default_branch_requires_signed_commits/repository_default_branch_requires_signed_commits.py +++ b/prowler/providers/github/services/repository/repository_default_branch_requires_signed_commits/repository_default_branch_requires_signed_commits.py @@ -22,14 +22,14 @@ class repository_default_branch_requires_signed_commits(Check): """ findings = [] for repo in repository_client.repositories.values(): - if repo.require_signed_commits is not None: + if repo.default_branch.require_signed_commits is not None: report = CheckReportGithub(metadata=self.metadata(), resource=repo) report.status = "FAIL" - report.status_extended = f"Repository {repo.name} does not require signed commits on default branch ({repo.default_branch})." + report.status_extended = f"Repository {repo.name} does not require signed commits on default branch ({repo.default_branch.name})." - if repo.require_signed_commits: + if repo.default_branch.require_signed_commits: report.status = "PASS" - report.status_extended = f"Repository {repo.name} does require signed commits on default branch ({repo.default_branch})." + report.status_extended = f"Repository {repo.name} does require signed commits on default branch ({repo.default_branch.name})." findings.append(report) diff --git a/prowler/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required.py b/prowler/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required.py index 577b2bad05..e67b9def2c 100644 --- a/prowler/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required.py +++ b/prowler/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required.py @@ -22,16 +22,14 @@ class repository_default_branch_status_checks_required(Check): """ findings = [] for repo in repository_client.repositories.values(): - if repo.status_checks is not None: - report = CheckReportGithub( - self.metadata(), resource=repo, owner=repo.name - ) + if repo.default_branch.status_checks is not None: + report = CheckReportGithub(self.metadata(), resource=repo) report.status = "FAIL" report.status_extended = ( f"Repository {repo.name} does not enforce status checks." ) - if repo.status_checks: + if repo.default_branch.status_checks: report.status = "PASS" report.status_extended = ( f"Repository {repo.name} does enforce status checks." diff --git a/prowler/providers/github/services/repository/repository_inactive_not_archived/repository_inactive_not_archived.py b/prowler/providers/github/services/repository/repository_inactive_not_archived/repository_inactive_not_archived.py index fb28094598..c6426fa194 100644 --- a/prowler/providers/github/services/repository/repository_inactive_not_archived/repository_inactive_not_archived.py +++ b/prowler/providers/github/services/repository/repository_inactive_not_archived/repository_inactive_not_archived.py @@ -20,9 +20,7 @@ class repository_inactive_not_archived(Check): ) for repo in repository_client.repositories.values(): - report = CheckReportGithub( - metadata=self.metadata(), resource=repo, repository=repo.name - ) + report = CheckReportGithub(metadata=self.metadata(), resource=repo) if repo.archived: report.status = "PASS" diff --git a/prowler/providers/github/services/repository/repository_service.py b/prowler/providers/github/services/repository/repository_service.py index 3fca76bba4..6c0101503b 100644 --- a/prowler/providers/github/services/repository/repository_service.py +++ b/prowler/providers/github/services/repository/repository_service.py @@ -163,24 +163,27 @@ class Repository(GithubService): name=repo.name, owner=repo.owner.login, full_name=repo.full_name, - default_branch=repo.default_branch, + default_branch=Branch( + name=default_branch, + protected=branch_protection, + default_branch=True, + require_pull_request=require_pr, + approval_count=approval_cnt, + required_linear_history=required_linear_history, + allow_force_pushes=allow_force_pushes, + branch_deletion=branch_deletion, + status_checks=status_checks, + enforce_admins=enforce_admins, + conversation_resolution=conversation_resolution, + require_code_owner_reviews=require_code_owner_reviews, + require_signed_commits=require_signed_commits, + ), private=repo.private, archived=repo.archived, pushed_at=repo.pushed_at, securitymd=securitymd_exists, - require_pull_request=require_pr, - approval_count=approval_cnt, - required_linear_history=required_linear_history, - allow_force_pushes=allow_force_pushes, - default_branch_deletion=branch_deletion, - status_checks=status_checks, - enforce_admins=enforce_admins, - conversation_resolution=conversation_resolution, - default_branch_protection=branch_protection, codeowners_exists=codeowners_exists, - require_code_owner_reviews=require_code_owner_reviews, secret_scanning_enabled=secret_scanning_enabled, - require_signed_commits=require_signed_commits, dependabot_alerts_enabled=dependabot_alerts_enabled, delete_branch_on_merge=delete_branch_on_merge, ) @@ -192,6 +195,24 @@ class Repository(GithubService): return repos +class Branch(BaseModel): + """Model for Github Branch""" + + name: str + protected: bool + default_branch: bool + require_pull_request: Optional[bool] + approval_count: Optional[int] + required_linear_history: Optional[bool] + allow_force_pushes: Optional[bool] + branch_deletion: Optional[bool] + status_checks: Optional[bool] + enforce_admins: Optional[bool] + require_code_owner_reviews: Optional[bool] + require_signed_commits: Optional[bool] + conversation_resolution: Optional[bool] + + class Repo(BaseModel): """Model for Github Repository""" @@ -199,23 +220,12 @@ class Repo(BaseModel): name: str owner: str full_name: str - default_branch_protection: Optional[bool] - default_branch: str + default_branch: Branch private: bool archived: bool pushed_at: datetime securitymd: Optional[bool] - require_pull_request: Optional[bool] - required_linear_history: Optional[bool] - allow_force_pushes: Optional[bool] - default_branch_deletion: Optional[bool] - status_checks: Optional[bool] - enforce_admins: Optional[bool] - approval_count: Optional[int] codeowners_exists: Optional[bool] - require_code_owner_reviews: Optional[bool] secret_scanning_enabled: Optional[bool] - require_signed_commits: Optional[bool] dependabot_alerts_enabled: Optional[bool] delete_branch_on_merge: Optional[bool] - conversation_resolution: Optional[bool] diff --git a/tests/providers/github/services/repository/repository_branch_delete_on_merge_enabled/repository_branch_delete_on_merge_enabled_test.py b/tests/providers/github/services/repository/repository_branch_delete_on_merge_enabled/repository_branch_delete_on_merge_enabled_test.py index 160928ad2f..e10050e0cc 100644 --- a/tests/providers/github/services/repository/repository_branch_delete_on_merge_enabled/repository_branch_delete_on_merge_enabled_test.py +++ b/tests/providers/github/services/repository/repository_branch_delete_on_merge_enabled/repository_branch_delete_on_merge_enabled_test.py @@ -1,7 +1,7 @@ from datetime import datetime, timezone from unittest import mock -from prowler.providers.github.services.repository.repository_service import Repo +from prowler.providers.github.services.repository.repository_service import Branch, Repo from tests.providers.github.github_fixtures import set_mocked_github_provider @@ -30,19 +30,37 @@ class Test_repository_branch_delete_on_merge_enabled_test: def test_branch_deletion_disabled(self): repository_client = mock.MagicMock - repo_name = "repo1" + repo_name = "repo2" + default_branch = "main" repository_client.repositories = { - 1: Repo( - id=1, + 2: Repo( + id=2, name=repo_name, owner="account-name", - full_name="account-name/repo1", - default_branch="main", + full_name="account-name/repo2", + default_branch=Branch( + name=default_branch, + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), private=False, - securitymd=False, - delete_branch_on_merge=False, archived=False, pushed_at=datetime.now(timezone.utc), + securitymd=False, + codeowners_exists=False, + secret_scanning_enabled=False, + dependabot_alerts_enabled=False, + delete_branch_on_merge=False, ), } @@ -63,29 +81,47 @@ class Test_repository_branch_delete_on_merge_enabled_test: check = repository_branch_delete_on_merge_enabled() result = check.execute() assert len(result) == 1 - assert result[0].resource_id == 1 - assert result[0].resource_name == "repo1" + assert result[0].resource_id == 2 + assert result[0].resource_name == repo_name assert result[0].status == "FAIL" assert ( result[0].status_extended - == f"Repository {repo_name} does not delete branches on merge." + == f"Repository {repo_name} does not delete branches on merge in default branch ({default_branch})." ) def test_branch_deletion_enabled(self): repository_client = mock.MagicMock repo_name = "repo1" + default_branch = "main" repository_client.repositories = { 1: Repo( id=1, name=repo_name, owner="account-name", full_name="account-name/repo1", - default_branch="main", + default_branch=Branch( + name=default_branch, + protected=True, + default_branch=True, + require_pull_request=True, + approval_count=1, + required_linear_history=True, + allow_force_pushes=False, + branch_deletion=False, + status_checks=True, + enforce_admins=True, + require_code_owner_reviews=True, + require_signed_commits=True, + conversation_resolution=True, + ), private=False, - securitymd=True, - delete_branch_on_merge=True, archived=False, pushed_at=datetime.now(timezone.utc), + securitymd=True, + codeowners_exists=True, + secret_scanning_enabled=True, + dependabot_alerts_enabled=True, + delete_branch_on_merge=True, ), } @@ -107,9 +143,9 @@ class Test_repository_branch_delete_on_merge_enabled_test: result = check.execute() assert len(result) == 1 assert result[0].resource_id == 1 - assert result[0].resource_name == "repo1" + assert result[0].resource_name == repo_name assert result[0].status == "PASS" assert ( result[0].status_extended - == f"Repository {repo_name} does delete branches on merge." + == f"Repository {repo_name} does delete branches on merge in default branch ({default_branch})." ) diff --git a/tests/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled_test.py b/tests/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled_test.py index c2345297ff..b4d385fdf1 100644 --- a/tests/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled_test.py +++ b/tests/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled_test.py @@ -1,7 +1,7 @@ from datetime import datetime, timezone from unittest import mock -from prowler.providers.github.services.repository.repository_service import Repo +from prowler.providers.github.services.repository.repository_service import Branch, Repo from tests.providers.github.github_fixtures import set_mocked_github_provider @@ -31,7 +31,21 @@ class Test_repository_default_branch_deletion_disabled_test: def test_allow_branch_deletion_enabled(self): repository_client = mock.MagicMock repo_name = "repo1" - default_branch = "main" + default_branch = Branch( + name="main", + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ) now = datetime.now(timezone.utc) repository_client.repositories = { @@ -45,6 +59,11 @@ class Test_repository_default_branch_deletion_disabled_test: archived=False, pushed_at=now, default_branch_deletion=True, + securitymd=False, + codeowners_exists=False, + secret_scanning_enabled=False, + dependabot_alerts_enabled=False, + delete_branch_on_merge=False, ), } @@ -76,7 +95,21 @@ class Test_repository_default_branch_deletion_disabled_test: def test_allow_branch_deletion_disabled(self): repository_client = mock.MagicMock repo_name = "repo1" - default_branch = "main" + default_branch = Branch( + name="main", + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=False, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ) now = datetime.now(timezone.utc) repository_client.repositories = { @@ -90,6 +123,11 @@ class Test_repository_default_branch_deletion_disabled_test: archived=False, pushed_at=now, default_branch_deletion=False, + securitymd=False, + codeowners_exists=False, + secret_scanning_enabled=False, + dependabot_alerts_enabled=False, + delete_branch_on_merge=False, ), } diff --git a/tests/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push_test.py b/tests/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push_test.py index 489ad6c41b..b35393764e 100644 --- a/tests/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push_test.py +++ b/tests/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push_test.py @@ -1,7 +1,7 @@ from datetime import datetime, timezone from unittest import mock -from prowler.providers.github.services.repository.repository_service import Repo +from prowler.providers.github.services.repository.repository_service import Branch, Repo from tests.providers.github.github_fixtures import set_mocked_github_provider @@ -28,7 +28,7 @@ class Test_repository_default_branch_disallows_force_push_test: result = check.execute() assert len(result) == 0 - def test_allow_force_push_enabled(self): + def test_force_push_allowed(self): repository_client = mock.MagicMock repo_name = "repo1" default_branch = "main" @@ -38,12 +38,29 @@ class Test_repository_default_branch_disallows_force_push_test: name=repo_name, owner="account-name", full_name="account-name/repo1", - default_branch=default_branch, - allow_force_pushes=True, + default_branch=Branch( + name=default_branch, + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), private=False, - securitymd=False, archived=False, pushed_at=datetime.now(timezone.utc), + securitymd=False, + codeowners_exists=False, + secret_scanning_enabled=False, + dependabot_alerts_enabled=False, + delete_branch_on_merge=False, ), } @@ -69,10 +86,10 @@ class Test_repository_default_branch_disallows_force_push_test: assert result[0].status == "FAIL" assert ( result[0].status_extended - == f"Repository {repo_name} does allow force push." + == f"Repository {repo_name} does allow force pushes on default branch ({default_branch})." ) - def test_allow_force_push_disabled(self): + def test_force_push_disallowed(self): repository_client = mock.MagicMock repo_name = "repo1" default_branch = "main" @@ -82,12 +99,29 @@ class Test_repository_default_branch_disallows_force_push_test: name=repo_name, owner="account-name", full_name="account-name/repo1", + default_branch=Branch( + name=default_branch, + protected=True, + default_branch=True, + require_pull_request=True, + approval_count=1, + required_linear_history=True, + allow_force_pushes=False, + branch_deletion=False, + status_checks=True, + enforce_admins=True, + require_code_owner_reviews=True, + require_signed_commits=True, + conversation_resolution=True, + ), private=False, - default_branch=default_branch, - allow_force_pushes=False, - securitymd=True, archived=False, pushed_at=datetime.now(timezone.utc), + securitymd=True, + codeowners_exists=True, + secret_scanning_enabled=True, + dependabot_alerts_enabled=True, + delete_branch_on_merge=True, ), } @@ -113,5 +147,5 @@ class Test_repository_default_branch_disallows_force_push_test: assert result[0].status == "PASS" assert ( result[0].status_extended - == f"Repository {repo_name} does deny force push." + == f"Repository {repo_name} does deny force pushes on default branch ({default_branch})." ) diff --git a/tests/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins_test.py b/tests/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins_test.py index 29c3185614..296c3d78e5 100644 --- a/tests/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins_test.py +++ b/tests/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins_test.py @@ -1,7 +1,7 @@ from datetime import datetime, timezone from unittest import mock -from prowler.providers.github.services.repository.repository_service import Repo +from prowler.providers.github.services.repository.repository_service import Branch, Repo from tests.providers.github.github_fixtures import set_mocked_github_provider @@ -38,12 +38,29 @@ class Test_repository_default_branch_protection_applies_to_admins_test: name=repo_name, owner="account-name", full_name="account-name/repo1", - default_branch=default_branch, + default_branch=Branch( + name=default_branch, + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), private=False, - securitymd=False, - enforce_admins=False, archived=False, pushed_at=datetime.now(timezone.utc), + securitymd=False, + codeowners_exists=False, + secret_scanning_enabled=False, + dependabot_alerts_enabled=False, + delete_branch_on_merge=False, ), } @@ -82,12 +99,29 @@ class Test_repository_default_branch_protection_applies_to_admins_test: name=repo_name, owner="account-name", full_name="account-name/repo1", + default_branch=Branch( + name=default_branch, + protected=True, + default_branch=True, + require_pull_request=True, + approval_count=1, + required_linear_history=True, + allow_force_pushes=False, + branch_deletion=False, + status_checks=True, + enforce_admins=True, + require_code_owner_reviews=True, + require_signed_commits=True, + conversation_resolution=True, + ), private=False, - default_branch=default_branch, - enforce_admins=True, - securitymd=True, archived=False, pushed_at=datetime.now(timezone.utc), + securitymd=True, + codeowners_exists=True, + secret_scanning_enabled=True, + dependabot_alerts_enabled=True, + delete_branch_on_merge=True, ), } diff --git a/tests/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled_test.py b/tests/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled_test.py index 249c442739..67bce91575 100644 --- a/tests/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled_test.py +++ b/tests/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled_test.py @@ -1,7 +1,7 @@ from datetime import datetime, timezone from unittest import mock -from prowler.providers.github.services.repository.repository_service import Repo +from prowler.providers.github.services.repository.repository_service import Branch, Repo from tests.providers.github.github_fixtures import set_mocked_github_provider @@ -38,12 +38,29 @@ class Test_repository_default_branch_protection_enabled_test: name=repo_name, owner="account-name", full_name="account-name/repo1", - default_branch=default_branch, + default_branch=Branch( + name=default_branch, + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), private=False, - default_branch_protection=False, - securitymd=False, archived=False, pushed_at=datetime.now(timezone.utc), + securitymd=False, + codeowners_exists=False, + secret_scanning_enabled=False, + dependabot_alerts_enabled=False, + delete_branch_on_merge=False, ), } @@ -82,12 +99,29 @@ class Test_repository_default_branch_protection_enabled_test: name=repo_name, owner="account-name", full_name="account-name/repo1", + default_branch=Branch( + name=default_branch, + protected=True, + default_branch=True, + require_pull_request=True, + approval_count=1, + required_linear_history=True, + allow_force_pushes=False, + branch_deletion=False, + status_checks=True, + enforce_admins=True, + require_code_owner_reviews=True, + require_signed_commits=True, + conversation_resolution=True, + ), private=False, - default_branch=default_branch, - default_branch_protection=True, - securitymd=True, archived=False, pushed_at=datetime.now(timezone.utc), + securitymd=True, + codeowners_exists=True, + secret_scanning_enabled=True, + dependabot_alerts_enabled=True, + delete_branch_on_merge=True, ), } diff --git a/tests/providers/github/services/repository/repository_default_branch_requires_codeowners_review/repository_default_branch_requires_codeowners_review_test.py b/tests/providers/github/services/repository/repository_default_branch_requires_codeowners_review/repository_default_branch_requires_codeowners_review_test.py index d0c2b8c619..ab3d579b75 100644 --- a/tests/providers/github/services/repository/repository_default_branch_requires_codeowners_review/repository_default_branch_requires_codeowners_review_test.py +++ b/tests/providers/github/services/repository/repository_default_branch_requires_codeowners_review/repository_default_branch_requires_codeowners_review_test.py @@ -1,7 +1,7 @@ from datetime import datetime, timezone from unittest import mock -from prowler.providers.github.services.repository.repository_service import Repo +from prowler.providers.github.services.repository.repository_service import Branch, Repo from tests.providers.github.github_fixtures import set_mocked_github_provider @@ -37,14 +37,29 @@ class Test_repository_default_branch_requires_codeowners_review: name=repo_name, owner="account-name", full_name="account-name/repo1", - default_branch="main", + default_branch=Branch( + name="main", + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), private=False, - securitymd=True, - require_pull_request=False, - approval_count=0, - require_code_owner_reviews=False, archived=False, pushed_at=datetime.now(timezone.utc), + securitymd=True, + codeowners_exists=False, + secret_scanning_enabled=False, + dependabot_alerts_enabled=False, + delete_branch_on_merge=False, ), } @@ -82,14 +97,29 @@ class Test_repository_default_branch_requires_codeowners_review: name=repo_name, owner="account-name", full_name="account-name/repo2", - default_branch="main", + default_branch=Branch( + name="main", + protected=True, + default_branch=True, + require_pull_request=True, + approval_count=1, + required_linear_history=True, + allow_force_pushes=False, + branch_deletion=False, + status_checks=True, + enforce_admins=True, + require_code_owner_reviews=True, + require_signed_commits=True, + conversation_resolution=True, + ), private=False, - securitymd=True, - require_pull_request=False, - approval_count=0, - require_code_owner_reviews=True, archived=False, pushed_at=datetime.now(timezone.utc), + securitymd=True, + codeowners_exists=True, + secret_scanning_enabled=True, + dependabot_alerts_enabled=True, + delete_branch_on_merge=True, ), } diff --git a/tests/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution_test.py b/tests/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution_test.py index eb666df96d..8f5a82bbd8 100644 --- a/tests/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution_test.py +++ b/tests/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution_test.py @@ -1,7 +1,7 @@ from datetime import datetime, timezone from unittest import mock -from prowler.providers.github.services.repository.repository_service import Repo +from prowler.providers.github.services.repository.repository_service import Branch, Repo from tests.providers.github.github_fixtures import set_mocked_github_provider @@ -38,12 +38,29 @@ class Test_repository_default_branch_requires_conversation_resolution_test: name=repo_name, owner="account-name", full_name="account-name/repo1", - default_branch=default_branch, - conversation_resolution=False, + default_branch=Branch( + name=default_branch, + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), + private=False, archived=False, pushed_at=datetime.now(timezone.utc), - private=False, securitymd=False, + codeowners_exists=False, + secret_scanning_enabled=False, + dependabot_alerts_enabled=False, + delete_branch_on_merge=False, ), } @@ -69,7 +86,7 @@ class Test_repository_default_branch_requires_conversation_resolution_test: assert result[0].status == "FAIL" assert ( result[0].status_extended - == f"Repository {repo_name} does not require conversation resolution." + == f"Repository {repo_name} does not require conversation resolution on default branch ({default_branch})." ) def test_conversation_resolution_enabled(self): @@ -82,12 +99,29 @@ class Test_repository_default_branch_requires_conversation_resolution_test: name=repo_name, owner="account-name", full_name="account-name/repo1", + default_branch=Branch( + name=default_branch, + protected=True, + default_branch=True, + require_pull_request=True, + approval_count=1, + required_linear_history=True, + allow_force_pushes=False, + branch_deletion=False, + status_checks=True, + enforce_admins=True, + require_code_owner_reviews=True, + require_signed_commits=True, + conversation_resolution=True, + ), private=False, - default_branch=default_branch, - conversation_resolution=True, archived=False, pushed_at=datetime.now(timezone.utc), securitymd=True, + codeowners_exists=True, + secret_scanning_enabled=True, + dependabot_alerts_enabled=True, + delete_branch_on_merge=True, ), } @@ -113,5 +147,5 @@ class Test_repository_default_branch_requires_conversation_resolution_test: assert result[0].status == "PASS" assert ( result[0].status_extended - == f"Repository {repo_name} does require conversation resolution." + == f"Repository {repo_name} does require conversation resolution on default branch ({default_branch})." ) diff --git a/tests/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history_test.py b/tests/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history_test.py index 1e25aba932..b072396804 100644 --- a/tests/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history_test.py +++ b/tests/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history_test.py @@ -1,7 +1,7 @@ from datetime import datetime, timezone from unittest import mock -from prowler.providers.github.services.repository.repository_service import Repo +from prowler.providers.github.services.repository.repository_service import Branch, Repo from tests.providers.github.github_fixtures import set_mocked_github_provider @@ -38,12 +38,29 @@ class Test_repository_default_branch_requires_linear_history_test: name=repo_name, owner="account-name", full_name="account-name/repo1", - default_branch=default_branch, - required_linear_history=False, + default_branch=Branch( + name=default_branch, + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), private=False, - securitymd=False, archived=False, pushed_at=datetime.now(timezone.utc), + securitymd=False, + codeowners_exists=False, + secret_scanning_enabled=False, + dependabot_alerts_enabled=False, + delete_branch_on_merge=False, ), } @@ -82,12 +99,29 @@ class Test_repository_default_branch_requires_linear_history_test: name=repo_name, owner="account-name", full_name="account-name/repo1", + default_branch=Branch( + name=default_branch, + protected=True, + default_branch=True, + require_pull_request=True, + approval_count=1, + required_linear_history=True, + allow_force_pushes=False, + branch_deletion=False, + status_checks=True, + enforce_admins=True, + require_code_owner_reviews=True, + require_signed_commits=True, + conversation_resolution=True, + ), private=False, - default_branch=default_branch, - required_linear_history=True, - securitymd=True, archived=False, pushed_at=datetime.now(timezone.utc), + securitymd=True, + codeowners_exists=True, + secret_scanning_enabled=True, + dependabot_alerts_enabled=True, + delete_branch_on_merge=True, ), } diff --git a/tests/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals_test.py b/tests/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals_test.py index 30ee501362..ddb9e89df6 100644 --- a/tests/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals_test.py +++ b/tests/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals_test.py @@ -1,7 +1,7 @@ from datetime import datetime, timezone from unittest import mock -from prowler.providers.github.services.repository.repository_service import Repo +from prowler.providers.github.services.repository.repository_service import Branch, Repo from tests.providers.github.github_fixtures import set_mocked_github_provider @@ -37,14 +37,29 @@ class Test_repository_default_branch_requires_multiple_approvals: name=repo_name, owner="account-name", full_name="account-name/repo1", - default_branch_protection=False, - default_branch="main", + default_branch=Branch( + name="main", + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), private=False, - securitymd=False, - require_pull_request=False, - approval_count=0, archived=False, pushed_at=datetime.now(timezone.utc), + securitymd=False, + codeowners_exists=False, + secret_scanning_enabled=False, + dependabot_alerts_enabled=False, + delete_branch_on_merge=False, ), } @@ -82,14 +97,29 @@ class Test_repository_default_branch_requires_multiple_approvals: name=repo_name, owner="account-name", full_name="account-name/repo1", - default_branch_protection=False, - default_branch="master", + default_branch=Branch( + name="master", + protected=False, + default_branch=True, + require_pull_request=True, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), private=False, - securitymd=False, - require_pull_request=True, - approval_count=0, archived=False, pushed_at=datetime.now(timezone.utc), + securitymd=False, + codeowners_exists=False, + secret_scanning_enabled=False, + dependabot_alerts_enabled=False, + delete_branch_on_merge=False, ), } @@ -127,14 +157,29 @@ class Test_repository_default_branch_requires_multiple_approvals: name=repo_name, owner="account-name", full_name="account-name/repo1", - default_branch_protection=True, - default_branch="master", + default_branch=Branch( + name="master", + protected=True, + default_branch=True, + require_pull_request=True, + approval_count=2, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), private=False, - securitymd=True, - require_pull_request=True, - approval_count=2, archived=False, pushed_at=datetime.now(timezone.utc), + securitymd=True, + codeowners_exists=False, + secret_scanning_enabled=False, + dependabot_alerts_enabled=False, + delete_branch_on_merge=False, ), } diff --git a/tests/providers/github/services/repository/repository_default_branch_requires_signed_commits/repository_default_branch_requires_signed_commits_test.py b/tests/providers/github/services/repository/repository_default_branch_requires_signed_commits/repository_default_branch_requires_signed_commits_test.py index 7d499c0090..5785dd2a14 100644 --- a/tests/providers/github/services/repository/repository_default_branch_requires_signed_commits/repository_default_branch_requires_signed_commits_test.py +++ b/tests/providers/github/services/repository/repository_default_branch_requires_signed_commits/repository_default_branch_requires_signed_commits_test.py @@ -1,7 +1,7 @@ from datetime import datetime, timezone from unittest import mock -from prowler.providers.github.services.repository.repository_service import Repo +from prowler.providers.github.services.repository.repository_service import Branch, Repo from tests.providers.github.github_fixtures import set_mocked_github_provider @@ -38,12 +38,29 @@ class Test_repository_default_branch_requires_signed_commits: name=repo_name, owner="account-name", full_name="account-name/repo1", + default_branch=Branch( + name=default_branch, + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), private=False, - default_branch=default_branch, - require_signed_commits=False, - securitymd=True, archived=False, pushed_at=datetime.now(timezone.utc), + securitymd=False, + codeowners_exists=False, + secret_scanning_enabled=False, + dependabot_alerts_enabled=False, + delete_branch_on_merge=False, ), } @@ -65,7 +82,7 @@ class Test_repository_default_branch_requires_signed_commits: result = check.execute() assert len(result) == 1 assert result[0].resource_id == 1 - assert result[0].resource_name == repo_name + assert result[0].resource_name == "repo1" assert result[0].status == "FAIL" assert ( result[0].status_extended @@ -74,20 +91,37 @@ class Test_repository_default_branch_requires_signed_commits: def test_signed_commits_required(self): repository_client = mock.MagicMock - repo_name = "repo2" + repo_name = "repo1" default_branch = "main" repository_client.repositories = { - 2: Repo( - id=2, + 1: Repo( + id=1, name=repo_name, owner="account-name", - full_name="account-name/repo2", + full_name="account-name/repo1", + default_branch=Branch( + name=default_branch, + protected=True, + default_branch=True, + require_pull_request=True, + approval_count=1, + required_linear_history=True, + allow_force_pushes=False, + branch_deletion=False, + status_checks=True, + enforce_admins=True, + require_code_owner_reviews=True, + require_signed_commits=True, + conversation_resolution=True, + ), private=False, - default_branch=default_branch, - require_signed_commits=True, - securitymd=True, archived=False, pushed_at=datetime.now(timezone.utc), + securitymd=True, + codeowners_exists=True, + secret_scanning_enabled=True, + dependabot_alerts_enabled=True, + delete_branch_on_merge=True, ), } @@ -108,8 +142,8 @@ class Test_repository_default_branch_requires_signed_commits: check = repository_default_branch_requires_signed_commits() result = check.execute() assert len(result) == 1 - assert result[0].resource_id == 2 - assert result[0].resource_name == repo_name + assert result[0].resource_id == 1 + assert result[0].resource_name == "repo1" assert result[0].status == "PASS" assert ( result[0].status_extended diff --git a/tests/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required_test.py b/tests/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required_test.py index cb14a4a340..1ec8acc3e0 100644 --- a/tests/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required_test.py +++ b/tests/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required_test.py @@ -1,7 +1,7 @@ from datetime import datetime, timezone from unittest import mock -from prowler.providers.github.services.repository.repository_service import Repo +from prowler.providers.github.services.repository.repository_service import Branch, Repo from tests.providers.github.github_fixtures import set_mocked_github_provider @@ -38,12 +38,30 @@ class Test_repository_default_branch_status_checks_required_test: name=repo_name, owner="account-name", full_name="account-name/repo1", - default_branch=default_branch, + default_branch=Branch( + name=default_branch, + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), status_checks=False, archived=False, pushed_at=datetime.now(timezone.utc), private=False, securitymd=False, + codeowners_exists=False, + secret_scanning_enabled=False, + dependabot_alerts_enabled=False, + delete_branch_on_merge=False, ), } @@ -83,11 +101,29 @@ class Test_repository_default_branch_status_checks_required_test: owner="account-name", full_name="account-name/repo1", private=False, - default_branch=default_branch, + default_branch=Branch( + name=default_branch, + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=True, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), status_checks=True, archived=False, pushed_at=datetime.now(timezone.utc), securitymd=True, + codeowners_exists=False, + secret_scanning_enabled=False, + dependabot_alerts_enabled=False, + delete_branch_on_merge=False, ), } diff --git a/tests/providers/github/services/repository/repository_dependency_scanning_enabled/repository_dependency_scanning_enabled_test.py b/tests/providers/github/services/repository/repository_dependency_scanning_enabled/repository_dependency_scanning_enabled_test.py index 63b2594600..990886ad00 100644 --- a/tests/providers/github/services/repository/repository_dependency_scanning_enabled/repository_dependency_scanning_enabled_test.py +++ b/tests/providers/github/services/repository/repository_dependency_scanning_enabled/repository_dependency_scanning_enabled_test.py @@ -1,7 +1,7 @@ from datetime import datetime, timezone from unittest import mock -from prowler.providers.github.services.repository.repository_service import Repo +from prowler.providers.github.services.repository.repository_service import Branch, Repo from tests.providers.github.github_fixtures import set_mocked_github_provider @@ -37,15 +37,29 @@ class Test_repository_dependency_scanning_enabled: name=repo_name, owner="account-name", full_name="account-name/repo1", - default_branch="main", + default_branch=Branch( + name="main", + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), private=False, archived=False, pushed_at=datetime.now(timezone.utc), securitymd=True, - require_pull_request=False, - approval_count=0, + codeowners_exists=False, secret_scanning_enabled=True, dependabot_alerts_enabled=False, + delete_branch_on_merge=False, ), } @@ -83,15 +97,29 @@ class Test_repository_dependency_scanning_enabled: name=repo_name, owner="account-name", full_name="account-name/repo2", - default_branch="main", + default_branch=Branch( + name="main", + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), private=False, archived=False, pushed_at=datetime.now(timezone.utc), securitymd=True, - require_pull_request=False, - approval_count=0, + codeowners_exists=False, secret_scanning_enabled=True, dependabot_alerts_enabled=True, + delete_branch_on_merge=False, ), } diff --git a/tests/providers/github/services/repository/repository_has_codeowners_file/repository_has_codeowners_file_test.py b/tests/providers/github/services/repository/repository_has_codeowners_file/repository_has_codeowners_file_test.py index 9a28163702..a181ec8404 100644 --- a/tests/providers/github/services/repository/repository_has_codeowners_file/repository_has_codeowners_file_test.py +++ b/tests/providers/github/services/repository/repository_has_codeowners_file/repository_has_codeowners_file_test.py @@ -1,7 +1,7 @@ from datetime import datetime, timezone from unittest import mock -from prowler.providers.github.services.repository.repository_service import Repo +from prowler.providers.github.services.repository.repository_service import Branch, Repo from tests.providers.github.github_fixtures import set_mocked_github_provider @@ -37,14 +37,28 @@ class Test_repository_has_codeowners_file: name=repo_name, owner="account-name", full_name="account-name/repo1", - default_branch="main", + default_branch=Branch( + name="main", + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), private=False, securitymd=True, - require_pull_request=False, - approval_count=0, codeowners_exists=False, + secret_scanning_enabled=False, archived=False, pushed_at=datetime.now(timezone.utc), + delete_branch_on_merge=False, ), } @@ -82,14 +96,28 @@ class Test_repository_has_codeowners_file: name=repo_name, owner="account-name", full_name="account-name/repo2", - default_branch="main", + default_branch=Branch( + name="main", + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), private=False, securitymd=True, - require_pull_request=False, - approval_count=0, codeowners_exists=True, + secret_scanning_enabled=False, archived=False, pushed_at=datetime.now(timezone.utc), + delete_branch_on_merge=False, ), } diff --git a/tests/providers/github/services/repository/repository_inactive_not_archived/repository_inactive_not_archived_test.py b/tests/providers/github/services/repository/repository_inactive_not_archived/repository_inactive_not_archived_test.py index 58291070df..69ff88a93a 100644 --- a/tests/providers/github/services/repository/repository_inactive_not_archived/repository_inactive_not_archived_test.py +++ b/tests/providers/github/services/repository/repository_inactive_not_archived/repository_inactive_not_archived_test.py @@ -1,7 +1,7 @@ from datetime import datetime, timedelta, timezone from unittest import mock -from prowler.providers.github.services.repository.repository_service import Repo +from prowler.providers.github.services.repository.repository_service import Branch, Repo from tests.providers.github.github_fixtures import set_mocked_github_provider @@ -40,11 +40,31 @@ class Test_repository_inactive_not_archived: 1: Repo( id=1, name=repo_name, + owner="account-name", full_name="account-name/test-repo", private=False, - default_branch=default_branch, + default_branch=Branch( + name=default_branch, + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), archived=False, pushed_at=recent_activity, + securitymd=False, + codeowners_exists=False, + secret_scanning_enabled=False, + dependabot_alerts_enabled=False, + delete_branch_on_merge=False, ), } repository_client.audit_config = {} @@ -85,11 +105,31 @@ class Test_repository_inactive_not_archived: 1: Repo( id=1, name=repo_name, + owner="account-name", full_name="account-name/test-repo", private=False, - default_branch=default_branch, + default_branch=Branch( + name=default_branch, + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), archived=False, pushed_at=old_activity, + securitymd=False, + codeowners_exists=False, + secret_scanning_enabled=False, + dependabot_alerts_enabled=False, + delete_branch_on_merge=False, ), } repository_client.audit_config = {} @@ -128,11 +168,31 @@ class Test_repository_inactive_not_archived: 1: Repo( id=1, name=repo_name, + owner="account-name", full_name="account-name/test-repo", - default_branch=default_branch, private=False, + default_branch=Branch( + name=default_branch, + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), archived=True, pushed_at=old_activity, + securitymd=False, + codeowners_exists=False, + secret_scanning_enabled=False, + dependabot_alerts_enabled=False, + delete_branch_on_merge=False, ), } repository_client.audit_config = {} @@ -173,11 +233,31 @@ class Test_repository_inactive_not_archived: 1: Repo( id=1, name=repo_name, + owner="account-name", full_name="account-name/test-repo", private=False, - default_branch=default_branch, + default_branch=Branch( + name=default_branch, + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), archived=False, pushed_at=old_activity, + securitymd=False, + codeowners_exists=False, + secret_scanning_enabled=False, + dependabot_alerts_enabled=False, + delete_branch_on_merge=False, ), } repository_client.audit_config = {"inactive_not_archived_days_threshold": 40} diff --git a/tests/providers/github/services/repository/repository_public_has_securitymd_file/repository_public_has_securitymd_file_test.py b/tests/providers/github/services/repository/repository_public_has_securitymd_file/repository_public_has_securitymd_file_test.py index e3d6849506..45cf49edd7 100644 --- a/tests/providers/github/services/repository/repository_public_has_securitymd_file/repository_public_has_securitymd_file_test.py +++ b/tests/providers/github/services/repository/repository_public_has_securitymd_file/repository_public_has_securitymd_file_test.py @@ -1,7 +1,7 @@ from datetime import datetime, timezone from unittest import mock -from prowler.providers.github.services.repository.repository_service import Repo +from prowler.providers.github.services.repository.repository_service import Branch, Repo from tests.providers.github.github_fixtures import set_mocked_github_provider @@ -37,13 +37,28 @@ class Test_repository_public_has_securitymd_file_test: name=repo_name, owner="account-name", full_name="account-name/repo1", - default_branch="main", + default_branch=Branch( + name="main", + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), private=False, securitymd=False, - require_pull_request=False, - approval_count=0, + codeowners_exists=False, + secret_scanning_enabled=False, archived=False, pushed_at=datetime.now(timezone.utc), + delete_branch_on_merge=False, ), } @@ -81,13 +96,28 @@ class Test_repository_public_has_securitymd_file_test: name=repo_name, owner="account-name", full_name="account-name/repo1", - default_branch="main", + default_branch=Branch( + name="main", + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), private=False, securitymd=True, - require_pull_request=False, - approval_count=0, + codeowners_exists=False, + secret_scanning_enabled=False, archived=False, pushed_at=datetime.now(timezone.utc), + delete_branch_on_merge=False, ), } diff --git a/tests/providers/github/services/repository/repository_secret_scanning_enabled/repository_secret_scanning_enabled_test.py b/tests/providers/github/services/repository/repository_secret_scanning_enabled/repository_secret_scanning_enabled_test.py index 0bff5cd6bc..ccdcc4dd25 100644 --- a/tests/providers/github/services/repository/repository_secret_scanning_enabled/repository_secret_scanning_enabled_test.py +++ b/tests/providers/github/services/repository/repository_secret_scanning_enabled/repository_secret_scanning_enabled_test.py @@ -1,7 +1,7 @@ from datetime import datetime, timezone from unittest import mock -from prowler.providers.github.services.repository.repository_service import Repo +from prowler.providers.github.services.repository.repository_service import Branch, Repo from tests.providers.github.github_fixtures import set_mocked_github_provider @@ -37,14 +37,28 @@ class Test_repository_secret_scanning_enabled: name=repo_name, owner="account-name", full_name="account-name/repo1", - default_branch="main", + default_branch=Branch( + name="main", + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), private=False, securitymd=True, - require_pull_request=False, - approval_count=0, + codeowners_exists=False, secret_scanning_enabled=False, archived=False, pushed_at=datetime.now(timezone.utc), + delete_branch_on_merge=False, ), } @@ -82,14 +96,28 @@ class Test_repository_secret_scanning_enabled: name=repo_name, owner="account-name", full_name="account-name/repo2", - default_branch="main", + default_branch=Branch( + name="main", + protected=False, + default_branch=True, + require_pull_request=False, + approval_count=0, + required_linear_history=False, + allow_force_pushes=True, + branch_deletion=True, + status_checks=False, + enforce_admins=False, + require_code_owner_reviews=False, + require_signed_commits=False, + conversation_resolution=False, + ), private=False, securitymd=True, - require_pull_request=False, - approval_count=0, + codeowners_exists=False, secret_scanning_enabled=True, archived=False, pushed_at=datetime.now(timezone.utc), + delete_branch_on_merge=False, ), } diff --git a/tests/providers/github/services/repository/repository_service_test.py b/tests/providers/github/services/repository/repository_service_test.py index 9c9e7371c9..487ac41e7c 100644 --- a/tests/providers/github/services/repository/repository_service_test.py +++ b/tests/providers/github/services/repository/repository_service_test.py @@ -2,6 +2,7 @@ from datetime import datetime, timezone from unittest.mock import MagicMock, patch from prowler.providers.github.services.repository.repository_service import ( + Branch, Repo, Repository, ) @@ -15,25 +16,28 @@ def mock_list_repositories(_): name="repo1", owner="account-name", full_name="account-name/repo1", - default_branch_protection=True, - default_branch="main", + default_branch=Branch( + name="main", + protected=True, + default_branch=True, + require_pull_request=True, + approval_count=2, + required_linear_history=True, + allow_force_pushes=True, + branch_deletion=True, + status_checks=True, + enforce_admins=True, + require_code_owner_reviews=True, + require_signed_commits=True, + conversation_resolution=True, + ), private=False, securitymd=True, - require_pull_request=True, - required_linear_history=True, - allow_force_pushes=True, - default_branch_deletion=True, - status_checks=True, - approval_count=2, codeowners_exists=True, - require_code_owner_reviews=True, secret_scanning_enabled=True, - require_signed_commits=True, archived=False, pushed_at=datetime.now(timezone.utc), - enforce_admins=True, delete_branch_on_merge=True, - conversation_resolution=True, ), } @@ -57,21 +61,27 @@ class Test_Repository_Service: assert repository_service.repositories[1].name == "repo1" assert repository_service.repositories[1].full_name == "account-name/repo1" assert repository_service.repositories[1].private is False - assert repository_service.repositories[1].default_branch == "main" + assert repository_service.repositories[1].default_branch.name == "main" assert repository_service.repositories[1].securitymd - assert repository_service.repositories[1].required_linear_history - assert repository_service.repositories[1].require_pull_request - assert repository_service.repositories[1].allow_force_pushes - assert repository_service.repositories[1].default_branch_deletion - assert repository_service.repositories[1].status_checks - assert repository_service.repositories[1].enforce_admins + assert repository_service.repositories[1].default_branch.required_linear_history + assert repository_service.repositories[1].default_branch.require_pull_request + assert repository_service.repositories[1].default_branch.allow_force_pushes + assert repository_service.repositories[1].default_branch.branch_deletion + assert repository_service.repositories[1].default_branch.status_checks + assert repository_service.repositories[1].default_branch.enforce_admins assert repository_service.repositories[1].delete_branch_on_merge - assert repository_service.repositories[1].conversation_resolution - assert repository_service.repositories[1].approval_count == 2 + assert repository_service.repositories[1].default_branch.conversation_resolution + assert repository_service.repositories[1].default_branch.approval_count == 2 assert repository_service.repositories[1].codeowners_exists is True - assert repository_service.repositories[1].require_code_owner_reviews is True + assert ( + repository_service.repositories[1].default_branch.require_code_owner_reviews + is True + ) assert repository_service.repositories[1].secret_scanning_enabled is True - assert repository_service.repositories[1].require_signed_commits is True + assert ( + repository_service.repositories[1].default_branch.require_signed_commits + is True + ) assert repository_service.repositories[1].archived is False assert repository_service.repositories[1].pushed_at is not None