From bcb8c7d3f8812edfb31274ab862cb5dbfbbcacab Mon Sep 17 00:00:00 2001 From: HugoPBrito Date: Mon, 16 Dec 2024 13:17:56 +0000 Subject: [PATCH] feat: added check logic and metadata --- .../__init__.py | 0 ...ires_conversation_resolution.metadata.json | 30 +++++++++++++ ...erging_requires_conversation_resolution.py | 44 +++++++++++++++++++ .../services/repository/repository_service.py | 2 + 4 files changed, 76 insertions(+) create mode 100644 prowler/providers/github/services/repository/repository_merging_requires_conversation_resolution/__init__.py create mode 100644 prowler/providers/github/services/repository/repository_merging_requires_conversation_resolution/repository_merging_requires_conversation_resolution.metadata.json create mode 100644 prowler/providers/github/services/repository/repository_merging_requires_conversation_resolution/repository_merging_requires_conversation_resolution.py diff --git a/prowler/providers/github/services/repository/repository_merging_requires_conversation_resolution/__init__.py b/prowler/providers/github/services/repository/repository_merging_requires_conversation_resolution/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/github/services/repository/repository_merging_requires_conversation_resolution/repository_merging_requires_conversation_resolution.metadata.json b/prowler/providers/github/services/repository/repository_merging_requires_conversation_resolution/repository_merging_requires_conversation_resolution.metadata.json new file mode 100644 index 0000000000..3b38856758 --- /dev/null +++ b/prowler/providers/github/services/repository/repository_merging_requires_conversation_resolution/repository_merging_requires_conversation_resolution.metadata.json @@ -0,0 +1,30 @@ +{ + "Provider": "github", + "CheckID": "repository_merging_requires_conversation_resolution", + "CheckTitle": "Check if repository requires conversation resolution before merging", + "CheckType": [], + "ServiceName": "repository", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "medium", + "ResourceType": "Other", + "Description": "Ensure that the repository requires conversation resolution before merging.", + "Risk": "Leaving comments unresolved before merging code can lead to overlooked issues, including potential bugs or security vulnerabilities, that might affect the quality and security of the codebase. Unaddressed concerns could result in a lower quality of code, increasing the risk of production failures or breaches.", + "RelatedUrl": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-conversation-resolution-before-merging", + "Remediation": { + "Code": { + "CLI": "", + "NativeIaC": "", + "Other": "", + "Terraform": "" + }, + "Recommendation": { + "Text": "Ensure that all comments in a code change proposal are resolved before merging. This guarantees that every reviewer’s concern is addressed, improving code quality and security by preventing issues from being ignored or overlooked.", + "Url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + } + }, + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "" +} diff --git a/prowler/providers/github/services/repository/repository_merging_requires_conversation_resolution/repository_merging_requires_conversation_resolution.py b/prowler/providers/github/services/repository/repository_merging_requires_conversation_resolution/repository_merging_requires_conversation_resolution.py new file mode 100644 index 0000000000..d2d4f11962 --- /dev/null +++ b/prowler/providers/github/services/repository/repository_merging_requires_conversation_resolution/repository_merging_requires_conversation_resolution.py @@ -0,0 +1,44 @@ +from typing import List + +from prowler.lib.check.models import Check, Check_Report_Github +from prowler.providers.github.services.repository.repository_client import ( + repository_client, +) + + +class repository_merging_requires_conversation_resolution(Check): + """Check if a repository requires + + This class verifies whether each repository + """ + + def execute(self) -> List[Check_Report_Github]: + """Execute the Github Repository Merging Requires + + Iterates over all repositories and checks if they + + Returns: + List[Check_Report_Github]: A list of reports for each repository + """ + findings = [] + for repo in repository_client.repositories.values(): + report = Check_Report_Github(self.metadata()) + report.resource_id = repo.id + report.resource_name = repo.name + report.status = "FAIL" + report.status_extended = ( + f"Repository {repo.name} does not require conversation resolution." + ) + + if ( + repo.default_branch_protection + and repo.default_branch_protection.conversation_resolution + ): + report.status = "PASS" + report.status_extended = ( + f"Repository {repo.name} does require conversation resolution." + ) + + findings.append(report) + + return findings diff --git a/prowler/providers/github/services/repository/repository_service.py b/prowler/providers/github/services/repository/repository_service.py index ef76e13e7f..d5273bf87d 100644 --- a/prowler/providers/github/services/repository/repository_service.py +++ b/prowler/providers/github/services/repository/repository_service.py @@ -52,6 +52,7 @@ class Repository(GithubService): allow_branch_deletion=protection.allow_deletions, enforce_status_checks=protection.required_status_checks.strict, enforce_admins=protection.enforce_admins, + conversation_resolution=protection.required_conversation_resolution, ) except Exception as e: @@ -86,6 +87,7 @@ class Protection(BaseModel): allow_branch_deletion: bool = True enforce_status_checks: bool = False enforce_admins: bool = False + conversation_resolution: bool = False class Repo(BaseModel):