GitHub

- uses: getplumber/plumber@COMMIT_SHA   # vX.Y.Z
  with:
    threshold: "80"
    config-file: configs/strict.plumber.yaml
    controls: actionsMustBePinnedByCommitSha,branchMustBeProtected
    score: "true"
    soft-fail: "true"
    upload-sarif: "true"
    upload-artifacts: "true"

- uses: getplumber/plumber@COMMIT_SHA   # vX.Y.Z
  id: plumber
- run: echo "Compliance is ${{ steps.plumber.outputs.compliance }}%"

- uses: getplumber/plumber@COMMIT_SHA   # vX.Y.Z
  with:
    github-url: ghes.example.com
    verify-attestation: "false"

- uses: getplumber/plumber@COMMIT_SHA   # vX.Y.Z
  with:
    project: my-org/other-repo
    github-token: ${{ secrets.PLUMBER_PAT }}

- uses: getplumber/plumber@COMMIT_SHA   # vX.Y.Z
  with:
    controls: actionsMustBePinnedByCommitSha,workflowsMustDeclarePermissions

- uses: getplumber/plumber@COMMIT_SHA   # vX.Y.Z
  with:
    soft-fail: ${{ github.event_name == 'pull_request' && 'true' || 'false' }}

"partialControls": [
  {
    "control": "branchMustBeProtected",
    "reason": "Token lacks Administration:Read scope; force-push and code-owner-approval rules (ISSUE-505) not evaluated.",
    "affectedBranches": 1,
    "remediation": "Re-run with a token carrying Administration:Read (fine-grained PAT) or `repo` scope (classic PAT)."
  }
]

version: "2.0"

github:
  controls:
    # Third-party action references must be pinned by 40-character commit SHA.
    # trustedOwners is the exemption list; first-party `actions/*` and
    # `github/*` are exempt by default.
    actionsMustBePinnedByCommitSha:
      enabled: true
      trustedOwners:
        - actions
        - github

    # uses: owner/repo@ref pointing at an archived GitHub repository.
    actionsMustNotBeArchived:
      enabled: true

    # Cross-references every pinned action against the GitHub Advisory
    # Database under the `actions` ecosystem.
    actionsMustNotCarryKnownCVEs:
      enabled: true

    # Restrict step and reusable-workflow `uses:` to authorized sources.
    # Trust = official owners (actions/*, github/*), your own org
    # (trustSameOrgActions), the allowlist below (exact owner/repo or
    # owner/* wildcard), or a minimum-stars floor.
    githubActionMustComeFromAuthorizedSources:
      enabled: true
      trustGithubOfficialActions: true
      trustSameOrgActions: true
      minimumStars: 0
      trustedGithubActions:
        - jdx/mise-action
        # - mycompany/*
    # uses: owner/repo@ref where the same name exists upstream as BOTH a
    # tag and a branch (ref-confusion). Pin by commit SHA to disambiguate.
    externalRefsMustNotCollide:
      enabled: true

    # Same forbidden-tag list as GitLab plus a digest-pinning sub-option.
    containerImageMustNotUseForbiddenTags:
      enabled: true
      tags:
        - latest
        - dev
        - development
        - staging
        - main
        - master
      containerImagesMustBePinnedByDigest: true

    # Truthy ACTIONS_STEP_DEBUG / ACTIONS_RUNNER_DEBUG in any merged env
    # block, expression binding, or runtime $GITHUB_ENV write.
    pipelineMustNotEnableDebugTrace:
      enabled: true
      forbiddenVariables:
        - ACTIONS_STEP_DEBUG
        - ACTIONS_RUNNER_DEBUG

    # Docker-in-Docker services + insecure daemon configuration
    # (DOCKER_TLS_CERTDIR="" or DOCKER_HOST tcp://...:2375).
    pipelineMustNotUseDockerInDocker:
      enabled: true
      detectInsecureDaemon: true

    # `jobs.<name>.secrets: inherit` hands every secret visible to the
    # caller (repo, organisation, environment) to the reusable workflow.
    # Declare each secret explicitly instead.
    reusableWorkflowsMustNotInheritSecrets:
      enabled: true

    # On GitHub a job's name is `<workflow-file-basename>/<job-id>`
    # (e.g. `codeql-analysis/analyze`). Patterns are globs over that name.
    securityJobsMustNotBeWeakened:
      enabled: true
      securityJobPatterns:
        - "*codeql*"
        - "*dependency-review*"
        - "*trufflehog*"
        - "*gitleaks*"
        - "*osv-scanner*"
        - "*-sast"
        - "*-sast-*"
        - "*-scan"
        - "*scan*"
        - "*-security"
        - "*-security-*"
        - "*-audit"
        - "*-audit-*"
      allowFailureMustBeFalse:
        enabled: true
      rulesMustNotBeRedefined:
        enabled: true
      whenMustNotBeManual:
        enabled: true

    # curl | bash, wget | sh, download-then-execute, base64 pipe-to-shell.
    pipelineMustNotExecuteUnverifiedScripts:
      enabled: true
      trustedUrls: []
        # - https://internal-artifacts.example.com/*

    # `${{ github.event.* }}`, `${{ github.head_ref }}` or `${{ github.actor }}`
    # interpolated directly into a `run:` shell. Bind through env: first.
    workflowMustNotInjectUserInputInScripts:
      enabled: true

    # `${{ github.event.* }}` / `${{ github.head_ref }}` written into
    # $GITHUB_ENV or $GITHUB_PATH is sticky and hijacks every later step.
    # env: binding stops ISSUE-207 but not this — base64-encode the value
    # itself (or use toJSON) so a newline can't open a second variable.
    workflowMustNotWriteUntrustedContentToGitHubEnv:
      enabled: true

    # `pull_request_target` and `workflow_run` run with the base repo's
    # secrets while being influenceable by an unprivileged caller.
    workflowMustNotUseDangerousTriggers:
      enabled: true

    # Workflows without an explicit `permissions:` block fall back to the
    # repo-wide GITHUB_TOKEN default. Declare `permissions: { contents: read }`
    # at the workflow level for least privilege.
    workflowsMustDeclarePermissions:
      enabled: true

    # `permissions: write-all` at workflow or job scope.
    workflowMustNotGrantPermissionsWriteAll:
      enabled: true

    # Opt-in. Assert every workflow includes the action(s) your org requires.
    workflowMustIncludeRequiredActions:
      enabled: false
      # requiredGroups:
      #   - ["actions/attest-build-provenance"]
      #   - ["your-org/license-scan", "your-org/sbom"]

    # Reads both classic Branch Protection and Repository / Organization
    # Rulesets, unions them, stricter wins.
    branchMustBeProtected:
      enabled: true
      defaultMustBeProtected: true
      namePatterns:
        - main
        - master
        - release/*
        - production
        - dev
      allowForcePush: false
      codeOwnerApprovalRequired: true