feat: added check logic and metadata

prowler/providers/github/services/repository/repository_deletes_branch_on_merge/repository_deletes_branch_on_merge.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "github",
+  "CheckID": "repository_deletes_branch_on_merge",
+  "CheckTitle": "Check if a repository deletes the branch after merging",
+  "CheckType": [],
+  "ServiceName": "repository",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "Other",
+  "Description": "Ensure that the repository deletes the branch after merging.",
+  "Risk": "Inactive branches pose a security risk as they can accumulate outdated code, dependencies, and potential vulnerabilities over time. Malicious actors may exploit these branches, and they can clutter the repository, making it harder to manage and track the active code. Additionally, stale branches may unintentionally be accessed or used inappropriately, leading to potential security breaches.",
+  "RelatedUrl": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Regularly review and remove inactive branches from your repositories. This helps reduce the risk of malicious code injection, sensitive data leaks, and unnecessary clutter in the repository. By keeping branches active and up to date, you ensure that your codebase remains secure and manageable.",
+      "Url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-the-automatic-deletion-of-branches"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/github/services/repository/repository_deletes_branch_on_merge/repository_deletes_branch_on_merge.py

@@ -0,0 +1,41 @@
+from typing import List
+
+from prowler.lib.check.models import Check, Check_Report_Github
+from prowler.providers.github.services.repository.repository_client import (
+    repository_client,
+)
+
+
+class repository_deletes_branch_on_merge(Check):
+    """Check if a repository deletes branches on merge
+
+    This class verifies whether each repository deletes branches on merge.
+    """
+
+    def execute(self) -> List[Check_Report_Github]:
+        """Execute the Github Repository Deletes Branch On Merge check
+
+        Iterates over all repositories and checks if they delete branches on merge.
+
+        Returns:
+            List[Check_Report_Github]: A list of reports for each repository
+        """
+        findings = []
+        for repo in repository_client.repositories.values():
+            report = Check_Report_Github(self.metadata())
+            report.resource_id = repo.id
+            report.resource_name = repo.name
+            report.status = "FAIL"
+            report.status_extended = (
+                f"Repository {repo.name} does not delete branches on merge."
+            )
+
+            if repo.delete_branch_on_merge:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Repository {repo.name} does delete branches on merge."
+                )
+
+            findings.append(report)
+
+        return findings

prowler/providers/github/services/repository/repository_service.py

@@ -29,6 +29,12 @@ class Repository(GithubService):
                                 f"Could not find SECURITY.md for repo {repo.name}: {e}"
                             )
 
+                        delete_branch_on_merge = (
+                            repo.delete_branch_on_merge
+                            if repo.delete_branch_on_merge is not None
+                            else False
+                        )
+
                         branch_protection = None
                         try:
                             branch = repo.get_branch(default_branch)
@@ -68,6 +74,7 @@ class Repository(GithubService):
                             private=repo.private,
                             securitymd=securitymd_exists,
                             default_branch_protection=branch_protection,
+                            delete_branch_on_merge=delete_branch_on_merge,
                         )
 
         except Exception as error:
@@ -100,3 +107,4 @@ class Repo(BaseModel):
     default_branch: str
     default_branch_protection: Optional[Protection]
     securitymd: bool = False
+    delete_branch_on_merge: bool = False