From 5ecf2e9b33d43c02d8dd18ff4b2125d78021cf4e Mon Sep 17 00:00:00 2001 From: HugoPBrito Date: Mon, 16 Dec 2024 11:31:29 +0000 Subject: [PATCH] feat: added check logic and metadata --- .../__init__.py | 0 ...itory_enforces_status_checks.metadata.json | 30 +++++++++++++ .../repository_enforces_status_checks.py | 44 +++++++++++++++++++ .../services/repository/repository_service.py | 5 +++ 4 files changed, 79 insertions(+) create mode 100644 prowler/providers/github/services/repository/repository_enforces_status_checks/__init__.py create mode 100644 prowler/providers/github/services/repository/repository_enforces_status_checks/repository_enforces_status_checks.metadata.json create mode 100644 prowler/providers/github/services/repository/repository_enforces_status_checks/repository_enforces_status_checks.py diff --git a/prowler/providers/github/services/repository/repository_enforces_status_checks/__init__.py b/prowler/providers/github/services/repository/repository_enforces_status_checks/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/github/services/repository/repository_enforces_status_checks/repository_enforces_status_checks.metadata.json b/prowler/providers/github/services/repository/repository_enforces_status_checks/repository_enforces_status_checks.metadata.json new file mode 100644 index 0000000000..67309f650e --- /dev/null +++ b/prowler/providers/github/services/repository/repository_enforces_status_checks/repository_enforces_status_checks.metadata.json @@ -0,0 +1,30 @@ +{ + "Provider": "github", + "CheckID": "repository_enforces_status_checks", + "CheckTitle": "Check if repository enforces status checks to pass", + "CheckType": [], + "ServiceName": "repository", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", + "ResourceType": "Other", + "Description": "Ensure that the repository enforces status checks to pass before merging code into the main branch.", + "Risk": "Merging code without requiring all checks to pass increases the risk of introducing bugs, vulnerabilities, or unstable changes into the codebase. This can compromise the quality, security, and functionality of the application.", + "RelatedUrl": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging", + "Remediation": { + "Code": { + "CLI": "", + "NativeIaC": "", + "Other": "", + "Terraform": "" + }, + "Recommendation": { + "Text": "Require all predefined status checks to pass successfully before allowing code changes to be merged. This ensures that all quality, stability, and security conditions are met, reducing the likelihood of errors or vulnerabilities being introduced into the project.", + "Url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + } + }, + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "" +} diff --git a/prowler/providers/github/services/repository/repository_enforces_status_checks/repository_enforces_status_checks.py b/prowler/providers/github/services/repository/repository_enforces_status_checks/repository_enforces_status_checks.py new file mode 100644 index 0000000000..08143ea3d2 --- /dev/null +++ b/prowler/providers/github/services/repository/repository_enforces_status_checks/repository_enforces_status_checks.py @@ -0,0 +1,44 @@ +from typing import List + +from prowler.lib.check.models import Check, Check_Report_Github +from prowler.providers.github.services.repository.repository_client import ( + repository_client, +) + + +class repository_enforces_status_checks(Check): + """Check if a repository enforces status checks. + + This class verifies whether each repository enforces status checks. + """ + + def execute(self) -> List[Check_Report_Github]: + """Execute the Github Repository + + Iterates over all repositories and checks if they enforce status checks. + + Returns: + List[Check_Report_Github]: A list of reports for each repository. + """ + findings = [] + for repo in repository_client.repositories.values(): + report = Check_Report_Github(self.metadata()) + report.resource_id = repo.id + report.resource_name = repo.name + report.status = "FAIL" + report.status_extended = ( + f"Repository {repo.name} does not enforce status checks." + ) + + if ( + repo.default_branch_protection + and repo.default_branch_protection.enforce_status_checks + ): + report.status = "PASS" + report.status_extended = ( + f"Repository {repo.name} does enforce status checks." + ) + + findings.append(report) + + return findings diff --git a/prowler/providers/github/services/repository/repository_service.py b/prowler/providers/github/services/repository/repository_service.py index 73b7d7e534..6226cda769 100644 --- a/prowler/providers/github/services/repository/repository_service.py +++ b/prowler/providers/github/services/repository/repository_service.py @@ -49,6 +49,9 @@ class Repository(GithubService): ) allow_force_pushes = protection.allow_force_pushes branch_deletion = protection.allow_deletions + status_checks = ( + protection.required_status_checks.strict + ) branch_protection = Protection( require_pull_request=require_pr, @@ -56,6 +59,7 @@ class Repository(GithubService): linear_history=required_linear_history, allow_force_push=allow_force_pushes, allow_branch_deletion=branch_deletion, + enforce_status_checks=status_checks, ) except Exception as e: @@ -88,6 +92,7 @@ class Protection(BaseModel): linear_history: bool = False allow_force_push: bool = True allow_branch_deletion: bool = True + enforce_status_checks: bool = False class Repo(BaseModel):