Skip to content

Commit 39efa62

Browse files
author
Chris Vermeulen
authored
Merge pull request #3 from compliance-framework/demo-updates
Demo updates
2 parents 33459b6 + a55e32b commit 39efa62

10 files changed

Lines changed: 195 additions & 196 deletions

‎example-data/testorg-unremediated.json‎

Lines changed: 59 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -1,63 +1,61 @@
11
{
2-
"organization": {
3-
"login": "test-org",
4-
"id": 1234567,
5-
"node_id": "O_abcdefg",
6-
"url": "https://api.github.com/orgs/test-org",
7-
"repos_url": "https://api.github.com/orgs/test-org/repos",
8-
"events_url": "https://api.github.com/orgs/test-org/events",
9-
"hooks_url": "https://api.github.com/orgs/test-org/hooks",
10-
"issues_url": "https://api.github.com/orgs/test-org/issues",
11-
"members_url": "https://api.github.com/orgs/test-org/members{/member}",
12-
"public_members_url": "https://api.github.com/orgs/test-org/public_members{/member}",
13-
"avatar_url": "https://avatars.githubusercontent.com/u/1234567?v=4",
14-
"description": null,
15-
"is_verified": false,
16-
"has_organization_projects": true,
17-
"has_repository_projects": true,
18-
"public_repos": 0,
19-
"public_gists": 0,
20-
"followers": 0,
21-
"following": 0,
22-
"html_url": "https://github.com/test-org",
23-
"created_at": "2025-04-09T15:36:21Z",
24-
"updated_at": "2025-04-09T15:38:25Z",
25-
"archived_at": null,
26-
"type": "Organization",
27-
"total_private_repos": 0,
28-
"owned_private_repos": 0,
29-
"private_gists": 0,
30-
"disk_usage": 0,
31-
"collaborators": 0,
32-
"billing_email": "test@example.com",
33-
"default_repository_permission": "read",
34-
"members_can_create_repositories": true,
35-
"two_factor_requirement_enabled": false,
36-
"members_allowed_repository_creation_type": "all",
37-
"members_can_create_public_repositories": true,
38-
"members_can_create_private_repositories": true,
39-
"members_can_create_internal_repositories": false,
40-
"members_can_create_pages": true,
41-
"members_can_fork_private_repositories": false,
42-
"web_commit_signoff_required": false,
43-
"deploy_keys_enabled_for_repositories": false,
44-
"members_can_create_public_pages": true,
45-
"members_can_create_private_pages": true,
46-
"plan": {
47-
"name": "free",
48-
"space": 976562499,
49-
"private_repos": 10000,
50-
"filled_seats": 2,
51-
"seats": 1
52-
},
53-
"advanced_security_enabled_for_new_repositories": false,
54-
"dependabot_alerts_enabled_for_new_repositories": false,
55-
"dependabot_security_updates_enabled_for_new_repositories": false,
56-
"dependency_graph_enabled_for_new_repositories": false,
57-
"secret_scanning_enabled_for_new_repositories": false,
58-
"secret_scanning_push_protection_enabled_for_new_repositories": false,
59-
"secret_scanning_push_protection_custom_link_enabled": false,
60-
"secret_scanning_push_protection_custom_link": null,
61-
"secret_scanning_validity_checks_enabled": false
62-
}
2+
"login": "test-org",
3+
"id": 1234567,
4+
"node_id": "O_abcdefg",
5+
"url": "https://api.github.com/orgs/test-org",
6+
"repos_url": "https://api.github.com/orgs/test-org/repos",
7+
"events_url": "https://api.github.com/orgs/test-org/events",
8+
"hooks_url": "https://api.github.com/orgs/test-org/hooks",
9+
"issues_url": "https://api.github.com/orgs/test-org/issues",
10+
"members_url": "https://api.github.com/orgs/test-org/members{/member}",
11+
"public_members_url": "https://api.github.com/orgs/test-org/public_members{/member}",
12+
"avatar_url": "https://avatars.githubusercontent.com/u/1234567?v=4",
13+
"description": null,
14+
"is_verified": false,
15+
"has_organization_projects": true,
16+
"has_repository_projects": true,
17+
"public_repos": 0,
18+
"public_gists": 0,
19+
"followers": 0,
20+
"following": 0,
21+
"html_url": "https://github.com/test-org",
22+
"created_at": "2025-04-09T15:36:21Z",
23+
"updated_at": "2025-04-09T15:38:25Z",
24+
"archived_at": null,
25+
"type": "Organization",
26+
"total_private_repos": 0,
27+
"owned_private_repos": 0,
28+
"private_gists": 0,
29+
"disk_usage": 0,
30+
"collaborators": 0,
31+
"billing_email": "test@example.com",
32+
"default_repository_permission": "read",
33+
"members_can_create_repositories": true,
34+
"two_factor_requirement_enabled": false,
35+
"members_allowed_repository_creation_type": "all",
36+
"members_can_create_public_repositories": true,
37+
"members_can_create_private_repositories": true,
38+
"members_can_create_internal_repositories": false,
39+
"members_can_create_pages": true,
40+
"members_can_fork_private_repositories": false,
41+
"web_commit_signoff_required": false,
42+
"deploy_keys_enabled_for_repositories": false,
43+
"members_can_create_public_pages": true,
44+
"members_can_create_private_pages": true,
45+
"plan": {
46+
"name": "free",
47+
"space": 976562499,
48+
"private_repos": 10000,
49+
"filled_seats": 2,
50+
"seats": 1
51+
},
52+
"advanced_security_enabled_for_new_repositories": false,
53+
"dependabot_alerts_enabled_for_new_repositories": false,
54+
"dependabot_security_updates_enabled_for_new_repositories": false,
55+
"dependency_graph_enabled_for_new_repositories": false,
56+
"secret_scanning_enabled_for_new_repositories": false,
57+
"secret_scanning_push_protection_enabled_for_new_repositories": false,
58+
"secret_scanning_push_protection_custom_link_enabled": false,
59+
"secret_scanning_push_protection_custom_link": null,
60+
"secret_scanning_validity_checks_enabled": false
6361
}

‎example-data/testorg.json‎

Lines changed: 59 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -1,63 +1,61 @@
11
{
2-
"organization": {
3-
"login": "test-org",
4-
"id": 1234567,
5-
"node_id": "O_abcdefg",
6-
"url": "https://api.github.com/orgs/test-org",
7-
"repos_url": "https://api.github.com/orgs/test-org/repos",
8-
"events_url": "https://api.github.com/orgs/test-org/events",
9-
"hooks_url": "https://api.github.com/orgs/test-org/hooks",
10-
"issues_url": "https://api.github.com/orgs/test-org/issues",
11-
"members_url": "https://api.github.com/orgs/test-org/members{/member}",
12-
"public_members_url": "https://api.github.com/orgs/test-org/public_members{/member}",
13-
"avatar_url": "https://avatars.githubusercontent.com/u/1234567?v=4",
14-
"description": null,
15-
"is_verified": false,
16-
"has_organization_projects": true,
17-
"has_repository_projects": true,
18-
"public_repos": 0,
19-
"public_gists": 0,
20-
"followers": 0,
21-
"following": 0,
22-
"html_url": "https://github.com/test-org",
23-
"created_at": "2025-04-09T15:36:21Z",
24-
"updated_at": "2025-04-09T15:38:25Z",
25-
"archived_at": null,
26-
"type": "Organization",
27-
"total_private_repos": 0,
28-
"owned_private_repos": 0,
29-
"private_gists": 0,
30-
"disk_usage": 0,
31-
"collaborators": 0,
32-
"billing_email": "test@example.com",
33-
"default_repository_permission": "read",
34-
"members_can_create_repositories": true,
35-
"two_factor_requirement_enabled": true,
36-
"members_allowed_repository_creation_type": "all",
37-
"members_can_create_public_repositories": false,
38-
"members_can_create_private_repositories": true,
39-
"members_can_create_internal_repositories": true,
40-
"members_can_create_pages": false,
41-
"members_can_fork_private_repositories": false,
42-
"web_commit_signoff_required": true,
43-
"deploy_keys_enabled_for_repositories": true,
44-
"members_can_create_public_pages": false,
45-
"members_can_create_private_pages": true,
46-
"plan": {
47-
"name": "free",
48-
"space": 976562499,
49-
"private_repos": 10000,
50-
"filled_seats": 2,
51-
"seats": 1
52-
},
53-
"advanced_security_enabled_for_new_repositories": true,
54-
"dependabot_alerts_enabled_for_new_repositories": true,
55-
"dependabot_security_updates_enabled_for_new_repositories": true,
56-
"dependency_graph_enabled_for_new_repositories": true,
57-
"secret_scanning_enabled_for_new_repositories": true,
58-
"secret_scanning_push_protection_enabled_for_new_repositories": true,
59-
"secret_scanning_push_protection_custom_link_enabled": true,
60-
"secret_scanning_push_protection_custom_link": null,
61-
"secret_scanning_validity_checks_enabled": true
62-
}
2+
"login": "test-org",
3+
"id": 1234567,
4+
"node_id": "O_abcdefg",
5+
"url": "https://api.github.com/orgs/test-org",
6+
"repos_url": "https://api.github.com/orgs/test-org/repos",
7+
"events_url": "https://api.github.com/orgs/test-org/events",
8+
"hooks_url": "https://api.github.com/orgs/test-org/hooks",
9+
"issues_url": "https://api.github.com/orgs/test-org/issues",
10+
"members_url": "https://api.github.com/orgs/test-org/members{/member}",
11+
"public_members_url": "https://api.github.com/orgs/test-org/public_members{/member}",
12+
"avatar_url": "https://avatars.githubusercontent.com/u/1234567?v=4",
13+
"description": null,
14+
"is_verified": false,
15+
"has_organization_projects": true,
16+
"has_repository_projects": true,
17+
"public_repos": 0,
18+
"public_gists": 0,
19+
"followers": 0,
20+
"following": 0,
21+
"html_url": "https://github.com/test-org",
22+
"created_at": "2025-04-09T15:36:21Z",
23+
"updated_at": "2025-04-09T15:38:25Z",
24+
"archived_at": null,
25+
"type": "Organization",
26+
"total_private_repos": 0,
27+
"owned_private_repos": 0,
28+
"private_gists": 0,
29+
"disk_usage": 0,
30+
"collaborators": 0,
31+
"billing_email": "test@example.com",
32+
"default_repository_permission": "read",
33+
"members_can_create_repositories": true,
34+
"two_factor_requirement_enabled": true,
35+
"members_allowed_repository_creation_type": "all",
36+
"members_can_create_public_repositories": false,
37+
"members_can_create_private_repositories": true,
38+
"members_can_create_internal_repositories": true,
39+
"members_can_create_pages": false,
40+
"members_can_fork_private_repositories": false,
41+
"web_commit_signoff_required": true,
42+
"deploy_keys_enabled_for_repositories": true,
43+
"members_can_create_public_pages": false,
44+
"members_can_create_private_pages": true,
45+
"plan": {
46+
"name": "free",
47+
"space": 976562499,
48+
"private_repos": 10000,
49+
"filled_seats": 2,
50+
"seats": 1
51+
},
52+
"advanced_security_enabled_for_new_repositories": true,
53+
"dependabot_alerts_enabled_for_new_repositories": true,
54+
"dependabot_security_updates_enabled_for_new_repositories": true,
55+
"dependency_graph_enabled_for_new_repositories": true,
56+
"secret_scanning_enabled_for_new_repositories": true,
57+
"secret_scanning_push_protection_enabled_for_new_repositories": true,
58+
"secret_scanning_push_protection_custom_link_enabled": true,
59+
"secret_scanning_push_protection_custom_link": null,
60+
"secret_scanning_validity_checks_enabled": true
6361
}

‎policies/gh_org_mfa_enabled.rego‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,7 @@
11
package compliance_framework.mfa_enabled
2-
# METADATA
3-
# title: Github Settings - Organizations - Two Factor Authentication Required
4-
# description: Ensure that 2FA is enabled for all users within the organization, making it harder for TAs to gain access to the organization's repos and settings
5-
# custom:
6-
# controls:
7-
# - <control-id>
8-
# schedule: "* * * * *"
9-
102

113
violation[{}] if {
12-
input.organization.two_factor_requirement_enabled == false
4+
input.two_factor_requirement_enabled == false
135
}
146

157
title := "Two Factor Authentication is required at an organization level"
@@ -44,4 +36,12 @@ controls := [
4436
"class": "SP800-53-enhancement",
4537
"control-id": "ia-2.2", # Multi-factor Authentication for Non-privileged Accounts
4638
},
39+
{
40+
"class": "OWASP_DSOMM_3",
41+
"control-id": "IM-3.10",
42+
},
43+
{
44+
"class": "OWASP_DSOMM_3",
45+
"control-id": "IM-3.11",
46+
},
4747
]

‎policies/gh_org_mfa_enabled_test.rego‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,16 +2,12 @@ package compliance_framework.mfa_enabled
22

33
test_mfa_enabled if {
44
count(violation) == 0 with input as {
5-
"organization": {
6-
"two_factor_requirement_enabled": true
7-
}
5+
"two_factor_requirement_enabled": true
86
}
97
}
108

119
test_mfa_violate_if_disabled if {
1210
count(violation) > 0 with input as {
13-
"organization": {
14-
"two_factor_requirement_enabled": false
15-
}
11+
"two_factor_requirement_enabled": false
1612
}
1713
}

‎policies/gh_org_public_repos.rego‎

Lines changed: 3 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,11 @@
1-
21
package compliance_framework.public_repos
3-
# METADATA
4-
# title: Github Settings - Organizations - Public Repos and Gists
5-
# description: "The organization should not have any public repos or gists if it is a sensitive organization"
6-
# custom:
7-
# controls:
8-
# - <control-id>
9-
# schedule: "* * * * *"
10-
11-
122

133
checks["repos"] if {
14-
input.organization.public_repos > 0
4+
input.public_repos > 0
155
}
166

177
checks["gists"] if {
18-
input.organization.public_gists > 0
8+
input.public_gists > 0
199
}
2010

2111
violation[{}] if {
@@ -29,4 +19,4 @@ description := "The Organization should not have any public repositories or gist
2919
# No direct controls in the frameworks at the moment
3020
# But will be useful when we are mapping ISO 27001, data privacy or custom
3121
# IPR frameworks generated either as a standard or a custom catalog
32-
controls := []
22+
controls := []

‎policies/gh_org_public_repos_test.rego‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,18 +2,14 @@ package compliance_framework.public_repos
22

33
test_public_repos_is_zero if {
44
count(violation) == 0 with input as {
5-
"organization": {
6-
"pubic_repos": 0,
7-
"public_gists": 0
8-
}
5+
"pubic_repos": 0,
6+
"public_gists": 0
97
}
108
}
119

1210
test_public_repos_violate_when_higher if {
1311
count(violation) > 0 with input as {
14-
"organization": {
15-
"public_repos": 10,
16-
"public_gists": 0
17-
}
12+
"public_repos": 10,
13+
"public_gists": 0
1814
}
1915
}

0 commit comments

Comments
 (0)