feat: add new check

tests/providers/github/services/repository/repository_code_changes_multi_approval_requirement/repository_code_changes_multi_approval_requirement_test.py

@@ -1,6 +1,9 @@
 from unittest import mock
 
-from prowler.providers.github.services.repository.repository_service import Repo
+from prowler.providers.github.services.repository.repository_service import (
+    Protection,
+    Repo,
+)
 from tests.providers.github.github_fixtures import set_mocked_github_provider
 
 
@@ -9,12 +12,15 @@ class Test_repository_code_changes_multi_approval_requirement:
         repository_client = mock.MagicMock
         repository_client.repositories = {}
 
-        with mock.patch(
-            "prowler.providers.common.provider.Provider.get_global_provider",
-            return_value=set_mocked_github_provider(),
-        ), mock.patch(
-            "prowler.providers.github.services.repository.repository_code_changes_multi_approval_requirement.repository_code_changes_multi_approval_requirement.repository_client",
-            new=repository_client,
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_code_changes_multi_approval_requirement.repository_code_changes_multi_approval_requirement.repository_client",
+                new=repository_client,
+            ),
         ):
             from prowler.providers.github.services.repository.repository_code_changes_multi_approval_requirement.repository_code_changes_multi_approval_requirement import (
                 repository_code_changes_multi_approval_requirement,
@@ -32,20 +38,24 @@ class Test_repository_code_changes_multi_approval_requirement:
                 id=1,
                 name=repo_name,
                 full_name="account-name/repo1",
-                default_branch="main",
                 private=False,
+                default_branch="main",
+                default_branch_protection=Protection(
+                    require_pull_request=False, approval_count=0
+                ),
                 securitymd=False,
-                require_pull_request=False,
-                approval_count=0,
             ),
         }
 
-        with mock.patch(
-            "prowler.providers.common.provider.Provider.get_global_provider",
-            return_value=set_mocked_github_provider(),
-        ), mock.patch(
-            "prowler.providers.github.services.repository.repository_code_changes_multi_approval_requirement.repository_code_changes_multi_approval_requirement.repository_client",
-            new=repository_client,
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_code_changes_multi_approval_requirement.repository_code_changes_multi_approval_requirement.repository_client",
+                new=repository_client,
+            ),
         ):
             from prowler.providers.github.services.repository.repository_code_changes_multi_approval_requirement.repository_code_changes_multi_approval_requirement import (
                 repository_code_changes_multi_approval_requirement,
@@ -70,20 +80,24 @@ class Test_repository_code_changes_multi_approval_requirement:
                 id=1,
                 name=repo_name,
                 full_name="account-name/repo1",
-                default_branch="master",
                 private=False,
+                default_branch="master",
+                default_branch_protection=Protection(
+                    require_pull_request=True, approval_count=0
+                ),
                 securitymd=False,
-                require_pull_request=True,
-                approval_count=0,
             ),
         }
 
-        with mock.patch(
-            "prowler.providers.common.provider.Provider.get_global_provider",
-            return_value=set_mocked_github_provider(),
-        ), mock.patch(
-            "prowler.providers.github.services.repository.repository_code_changes_multi_approval_requirement.repository_code_changes_multi_approval_requirement.repository_client",
-            new=repository_client,
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_code_changes_multi_approval_requirement.repository_code_changes_multi_approval_requirement.repository_client",
+                new=repository_client,
+            ),
         ):
             from prowler.providers.github.services.repository.repository_code_changes_multi_approval_requirement.repository_code_changes_multi_approval_requirement import (
                 repository_code_changes_multi_approval_requirement,
@@ -108,20 +122,24 @@ class Test_repository_code_changes_multi_approval_requirement:
                 id=1,
                 name=repo_name,
                 full_name="account-name/repo1",
-                default_branch="master",
                 private=False,
+                default_branch="master",
+                default_branch_protection=Protection(
+                    require_pull_request=True, approval_count=2
+                ),
                 securitymd=True,
-                require_pull_request=True,
-                approval_count=2,
             ),
         }
 
-        with mock.patch(
-            "prowler.providers.common.provider.Provider.get_global_provider",
-            return_value=set_mocked_github_provider(),
-        ), mock.patch(
-            "prowler.providers.github.services.repository.repository_code_changes_multi_approval_requirement.repository_code_changes_multi_approval_requirement.repository_client",
-            new=repository_client,
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_code_changes_multi_approval_requirement.repository_code_changes_multi_approval_requirement.repository_client",
+                new=repository_client,
+            ),
         ):
             from prowler.providers.github.services.repository.repository_code_changes_multi_approval_requirement.repository_code_changes_multi_approval_requirement import (
                 repository_code_changes_multi_approval_requirement,

tests/providers/github/services/repository/repository_enforces_default_branch_protection/repository_enforces_default_branch_protection_test.py

@@ -0,0 +1,114 @@
+from unittest import mock
+
+from prowler.providers.github.services.repository.repository_service import (
+    Protection,
+    Repo,
+)
+from tests.providers.github.github_fixtures import set_mocked_github_provider
+
+
+class Test_repository_enforces_default_branch_protection_test:
+    def test_no_repositories(self):
+        repository_client = mock.MagicMock
+        repository_client.repositories = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_enforces_default_branch_protection.repository_enforces_default_branch_protection.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_enforces_default_branch_protection.repository_enforces_default_branch_protection import (
+                repository_enforces_default_branch_protection,
+            )
+
+            check = repository_enforces_default_branch_protection()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_without_default_branch_protection(self):
+        repository_client = mock.MagicMock
+        repo_name = "repo1"
+        default_branch = "main"
+        repository_client.repositories = {
+            1: Repo(
+                id=1,
+                name=repo_name,
+                full_name="account-name/repo1",
+                default_branch=default_branch,
+                private=False,
+                securitymd=False,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_enforces_default_branch_protection.repository_enforces_default_branch_protection.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_enforces_default_branch_protection.repository_enforces_default_branch_protection import (
+                repository_enforces_default_branch_protection,
+            )
+
+            check = repository_enforces_default_branch_protection()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "repo1"
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Repository {repo_name} does not enforce branch protection on default branch ({default_branch})."
+            )
+
+    def test_default_branch_protection(self):
+        repository_client = mock.MagicMock
+        repo_name = "repo1"
+        default_branch = "main"
+        repository_client.repositories = {
+            1: Repo(
+                id=1,
+                name=repo_name,
+                full_name="account-name/repo1",
+                private=False,
+                default_branch=default_branch,
+                default_branch_protection=Protection(
+                    require_pull_request=True, approval_count=2
+                ),
+                securitymd=True,
+            ),
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_github_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.github.services.repository.repository_enforces_default_branch_protection.repository_enforces_default_branch_protection.repository_client",
+                new=repository_client,
+            ),
+        ):
+            from prowler.providers.github.services.repository.repository_enforces_default_branch_protection.repository_enforces_default_branch_protection import (
+                repository_enforces_default_branch_protection,
+            )
+
+            check = repository_enforces_default_branch_protection()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].resource_id == 1
+            assert result[0].resource_name == "repo1"
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Repository {repo_name} does enforce branch protection on default branch ({default_branch})."
+            )

tests/providers/github/services/repository/repository_public_has_securitymd_file/repository_public_has_securitymd_file_test.py

@@ -35,8 +35,6 @@ class Test_repository_public_has_securitymd_file_test:
                 default_branch="main",
                 private=False,
                 securitymd=False,
-                require_pull_request=False,
-                approval_count=0,
             ),
         }
 
@@ -73,8 +71,6 @@ class Test_repository_public_has_securitymd_file_test:
                 default_branch="main",
                 private=False,
                 securitymd=True,
-                require_pull_request=False,
-                approval_count=0,
             ),
         }
 

tests/providers/github/services/repository/repository_service_test.py

@@ -1,6 +1,7 @@
 from unittest.mock import patch
 
 from prowler.providers.github.services.repository.repository_service import (
+    Protection,
     Repo,
     Repository,
 )
@@ -13,11 +14,12 @@ def mock_list_repositories(_):
             id=1,
             name="repo1",
             full_name="account-name/repo1",
-            default_branch="main",
             private=False,
+            default_branch="main",
+            default_branch_protection=Protection(
+                require_pull_request=True, approval_count=2
+            ),
             securitymd=True,
-            require_pull_request=True,
-            approval_count=2,
         ),
     }
 
@@ -41,6 +43,14 @@ class Test_Repository_Service:
         assert repository_service.repositories[1].name == "repo1"
         assert repository_service.repositories[1].full_name == "account-name/repo1"
         assert repository_service.repositories[1].private is False
+        assert repository_service.repositories[1].default_branch == "main"
+        # Default branch protection
+        assert repository_service.repositories[
+            1
+        ].default_branch_protection.require_pull_request
+        assert (
+            repository_service.repositories[1].default_branch_protection.approval_count
+            == 2
+        )
+        # Repo
         assert repository_service.repositories[1].securitymd
-        assert repository_service.repositories[1].require_pull_request
-        assert repository_service.repositories[1].approval_count == 2