diff --git a/prowler/providers/github/services/repository/repository_deletes_branch_on_merge/__init__.py b/prowler/providers/github/services/repository/repository_deletes_branch_on_merge/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/github/services/repository/repository_deletes_branch_on_merge/repository_deletes_branch_on_merge.metadata.json b/prowler/providers/github/services/repository/repository_deletes_branch_on_merge/repository_deletes_branch_on_merge.metadata.json new file mode 100644 index 0000000000..044799ee72 --- /dev/null +++ b/prowler/providers/github/services/repository/repository_deletes_branch_on_merge/repository_deletes_branch_on_merge.metadata.json @@ -0,0 +1,30 @@ +{ + "Provider": "github", + "CheckID": "repository_deletes_branch_on_merge", + "CheckTitle": "Check if a repository deletes the branch after merging", + "CheckType": [], + "ServiceName": "repository", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "medium", + "ResourceType": "Other", + "Description": "Ensure that the repository deletes the branch after merging.", + "Risk": "Inactive branches pose a security risk as they can accumulate outdated code, dependencies, and potential vulnerabilities over time. Malicious actors may exploit these branches, and they can clutter the repository, making it harder to manage and track the active code. Additionally, stale branches may unintentionally be accessed or used inappropriately, leading to potential security breaches.", + "RelatedUrl": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches", + "Remediation": { + "Code": { + "CLI": "", + "NativeIaC": "", + "Other": "", + "Terraform": "" + }, + "Recommendation": { + "Text": "Regularly review and remove inactive branches from your repositories. This helps reduce the risk of malicious code injection, sensitive data leaks, and unnecessary clutter in the repository. By keeping branches active and up to date, you ensure that your codebase remains secure and manageable.", + "Url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-the-automatic-deletion-of-branches" + } + }, + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "" +} diff --git a/prowler/providers/github/services/repository/repository_deletes_branch_on_merge/repository_deletes_branch_on_merge.py b/prowler/providers/github/services/repository/repository_deletes_branch_on_merge/repository_deletes_branch_on_merge.py new file mode 100644 index 0000000000..b971c7f594 --- /dev/null +++ b/prowler/providers/github/services/repository/repository_deletes_branch_on_merge/repository_deletes_branch_on_merge.py @@ -0,0 +1,41 @@ +from typing import List + +from prowler.lib.check.models import Check, Check_Report_Github +from prowler.providers.github.services.repository.repository_client import ( + repository_client, +) + + +class repository_deletes_branch_on_merge(Check): + """Check if a repository deletes branches on merge + + This class verifies whether each repository deletes branches on merge. + """ + + def execute(self) -> List[Check_Report_Github]: + """Execute the Github Repository Deletes Branch On Merge check + + Iterates over all repositories and checks if they delete branches on merge. + + Returns: + List[Check_Report_Github]: A list of reports for each repository + """ + findings = [] + for repo in repository_client.repositories.values(): + report = Check_Report_Github(self.metadata()) + report.resource_id = repo.id + report.resource_name = repo.name + report.status = "FAIL" + report.status_extended = ( + f"Repository {repo.name} does not delete branches on merge." + ) + + if repo.delete_branch_on_merge: + report.status = "PASS" + report.status_extended = ( + f"Repository {repo.name} does delete branches on merge." + ) + + findings.append(report) + + return findings diff --git a/prowler/providers/github/services/repository/repository_service.py b/prowler/providers/github/services/repository/repository_service.py index d5273bf87d..6786c64c84 100644 --- a/prowler/providers/github/services/repository/repository_service.py +++ b/prowler/providers/github/services/repository/repository_service.py @@ -29,6 +29,12 @@ class Repository(GithubService): f"Could not find SECURITY.md for repo {repo.name}: {e}" ) + delete_branch_on_merge = ( + repo.delete_branch_on_merge + if repo.delete_branch_on_merge is not None + else False + ) + branch_protection = None try: branch = repo.get_branch(default_branch) @@ -68,6 +74,7 @@ class Repository(GithubService): private=repo.private, securitymd=securitymd_exists, default_branch_protection=branch_protection, + delete_branch_on_merge=delete_branch_on_merge, ) except Exception as error: @@ -100,3 +107,4 @@ class Repo(BaseModel): default_branch: str default_branch_protection: Optional[Protection] securitymd: bool = False + delete_branch_on_merge: bool = False