feat(repository): add new check repository_branch_delete_on_merge_enabled (#6209)

Co-authored-by: MrCloudSec <hello@mistercloudsec.com>

prowler/CHANGELOG.md

@@ -16,6 +16,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - Add `repository_default_branch_deletion_disabled` check for GitHub provider. [(#6200)](https://github.com/prowler-cloud/prowler/pull/6200)
 - Add `repository_default_branch_status_checks_required` check for GitHub provider. [(#6204)](https://github.com/prowler-cloud/prowler/pull/6204)
 - Add `repository_default_branch_protection_applies_to_admins` check for GitHub provider. [(#6205)](https://github.com/prowler-cloud/prowler/pull/6205)
+- Add `repository_branch_delete_on_merge_enabled` check for GitHub provider. [(#6209)](https://github.com/prowler-cloud/prowler/pull/6209)
 - Add `repository_default_branch_requires_conversation_resolution` check for GitHub provider. [(#6208)](https://github.com/prowler-cloud/prowler/pull/6208)
 - Add `organization_members_mfa_required` check for GitHub provider. [(#6304)](https://github.com/prowler-cloud/prowler/pull/6304)
 - Add GitHub provider documentation and CIS v1.0.0 compliance. [(#6116)](https://github.com/prowler-cloud/prowler/pull/6116)

prowler/providers/github/github_provider.py

@@ -247,7 +247,7 @@ class GithubProvider(Provider):
                 if not session_token:
                     # OAUTH
                     logger.info(
-                        "Looking for GITHUB_OAUTH_TOKEN environment variable as user has not provided any token...."
+                        "Looking for GITHUB_OAUTH_APP_TOKEN environment variable as user has not provided any token...."
                     )
                     session_token = environ.get("GITHUB_OAUTH_APP_TOKEN", "")
                     if session_token:

prowler/providers/github/services/repository/repository_branch_delete_on_merge_enabled/repository_branch_delete_on_merge_enabled.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "github",
+  "CheckID": "repository_branch_delete_on_merge_enabled",
+  "CheckTitle": "Check if a repository deletes the branch after merging",
+  "CheckType": [],
+  "ServiceName": "repository",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "GitHubRepository",
+  "Description": "Ensure that the repository deletes the branch after merging.",
+  "Risk": "Inactive branches pose a security risk as they can accumulate outdated code, dependencies, and potential vulnerabilities over time. Malicious actors may exploit these branches, and they can clutter the repository, making it harder to manage and track the active code. Additionally, stale branches may unintentionally be accessed or used inappropriately, leading to potential security breaches.",
+  "RelatedUrl": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Regularly review and remove inactive branches from your repositories. This helps reduce the risk of malicious code injection, sensitive data leaks, and unnecessary clutter in the repository. By keeping branches active and up to date, you ensure that your codebase remains secure and manageable.",
+      "Url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-the-automatic-deletion-of-branches"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/github/services/repository/repository_branch_delete_on_merge_enabled/repository_branch_delete_on_merge_enabled.py

@@ -0,0 +1,41 @@
+from typing import List
+
+from prowler.lib.check.models import Check, CheckReportGithub
+from prowler.providers.github.services.repository.repository_client import (
+    repository_client,
+)
+
+
+class repository_branch_delete_on_merge_enabled(Check):
+    """Check if a repository deletes branches on merge
+
+    This class verifies whether each repository deletes branches on merge.
+    """
+
+    def execute(self) -> List[CheckReportGithub]:
+        """Execute the Github Repository Deletes Branch On Merge check
+
+        Iterates over all repositories and checks if they delete branches on merge.
+
+        Returns:
+            List[CheckReportGithub]: A list of reports for each repository
+        """
+        findings = []
+        for repo in repository_client.repositories.values():
+            report = CheckReportGithub(
+                metadata=self.metadata(), resource=repo, repository=repo.name
+            )
+            report.status = "FAIL"
+            report.status_extended = (
+                f"Repository {repo.name} does not delete branches on merge."
+            )
+
+            if repo.delete_branch_on_merge:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Repository {repo.name} does delete branches on merge."
+                )
+
+            findings.append(report)
+
+        return findings

prowler/providers/github/services/repository/repository_service.py

@@ -18,6 +18,11 @@ class Repository(GithubService):
             for client in self.clients:
                 for repo in client.get_user().get_repos():
                     default_branch = repo.default_branch
+                    delete_branch_on_merge = (
+                        repo.delete_branch_on_merge
+                        if repo.delete_branch_on_merge is not None
+                        else False
+                    )
                     securitymd_exists = False
                     try:
                         securitymd_exists = repo.get_contents("SECURITY.md") is not None
@@ -102,6 +107,7 @@ class Repository(GithubService):
                         enforce_admins=enforce_admins,
                         conversation_resolution=conversation_resolution,
                         default_branch_protection=branch_protection,
+                        delete_branch_on_merge=delete_branch_on_merge,
                     )
 
         except Exception as error:
@@ -128,4 +134,5 @@ class Repo(BaseModel):
     status_checks: Optional[bool]
     enforce_admins: Optional[bool]
     approval_count: Optional[int]
+    delete_branch_on_merge: Optional[bool]
     conversation_resolution: Optional[bool]

tests/providers/github/services/repository/repository_branch_delete_on_merge_enabled/repository_branch_delete_on_merge_enabled_test.py

@@ -0,0 +1,108 @@
+from unittest import mock
+
+from prowler.providers.github.services.repository.repository_service import Repo
+from tests.providers.github.github_fixtures import set_mocked_github_provider
+
+
+class Test_repository_branch_delete_on_merge_enabled_test:
+    def test_no_repositories(self):
+        repository_client = mock.MagicMock
+        repository_client.repositories = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_branch_delete_on_merge_enabled.repository_branch_delete_on_merge_enabled.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_branch_delete_on_merge_enabled.repository_branch_delete_on_merge_enabled import (
+                repository_branch_delete_on_merge_enabled,
+            )
+
+            check = repository_branch_delete_on_merge_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_branch_deletion_disabled(self):
+        repository_client = mock.MagicMock
+        repo_name = "repo1"
+        repository_client.repositories = {
+            1: Repo(
+                id=1,
+                name=repo_name,
+                full_name="account-name/repo1",
+                default_branch="main",
+                private=False,
+                securitymd=False,
+                delete_branch_on_merge=False,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_branch_delete_on_merge_enabled.repository_branch_delete_on_merge_enabled.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_branch_delete_on_merge_enabled.repository_branch_delete_on_merge_enabled import (
+                repository_branch_delete_on_merge_enabled,
+            )
+
+            check = repository_branch_delete_on_merge_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "repo1"
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Repository {repo_name} does not delete branches on merge."
+            )
+
+    def test_branch_deletion_enabled(self):
+        repository_client = mock.MagicMock
+        repo_name = "repo1"
+        repository_client.repositories = {
+            1: Repo(
+                id=1,
+                name=repo_name,
+                full_name="account-name/repo1",
+                default_branch="main",
+                private=False,
+                securitymd=True,
+                delete_branch_on_merge=True,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_branch_delete_on_merge_enabled.repository_branch_delete_on_merge_enabled.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_branch_delete_on_merge_enabled.repository_branch_delete_on_merge_enabled import (
+                repository_branch_delete_on_merge_enabled,
+            )
+
+            check = repository_branch_delete_on_merge_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "repo1"
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Repository {repo_name} does delete branches on merge."
+            )

tests/providers/github/services/repository/repository_service_test.py

@@ -24,6 +24,7 @@ def mock_list_repositories(_):
             status_checks=True,
             approval_count=2,
             enforce_admins=True,
+            delete_branch_on_merge=True,
             conversation_resolution=True,
         ),
     }
@@ -56,5 +57,6 @@ class Test_Repository_Service:
         assert repository_service.repositories[1].default_branch_deletion
         assert repository_service.repositories[1].status_checks
         assert repository_service.repositories[1].enforce_admins
+        assert repository_service.repositories[1].delete_branch_on_merge
         assert repository_service.repositories[1].conversation_resolution
         assert repository_service.repositories[1].approval_count == 2