GitHub

"partialControls": [
  {
    "control": "branchMustBeProtected",
    "reason": "Token lacks Administration:Read scope; force-push and code-owner-approval rules (ISSUE-505) not evaluated.",
    "affectedBranches": 1,
    "remediation": "Re-run with a token carrying Administration:Read (fine-grained PAT) or `repo` scope (classic PAT)."
  }
]

version: "2.0"

github:
  controls:
    # Third-party action references must be pinned by 40-character commit SHA.
    # trustedOwners is the exemption list; first-party `actions/*` and
    # `github/*` are exempt by default.
    actionsMustBePinnedByCommitSha:
      enabled: true
      trustedOwners:
        - actions
        - github

    # uses: owner/repo@ref pointing at an archived GitHub repository.
    actionsMustNotBeArchived:
      enabled: true

    # Cross-references every pinned action against the GitHub Advisory
    # Database under the `actions` ecosystem.
    actionsMustNotCarryKnownCVEs:
      enabled: true

    # Same forbidden-tag list as GitLab plus a digest-pinning sub-option.
    containerImageMustNotUseForbiddenTags:
      enabled: true
      tags:
        - latest
        - dev
        - development
        - staging
        - main
        - master
      containerImagesMustBePinnedByDigest: true

    # Truthy ACTIONS_STEP_DEBUG / ACTIONS_RUNNER_DEBUG in any merged env
    # block, expression binding, or runtime $GITHUB_ENV write.
    pipelineMustNotEnableDebugTrace:
      enabled: true
      forbiddenVariables:
        - ACTIONS_STEP_DEBUG
        - ACTIONS_RUNNER_DEBUG

    # Docker-in-Docker services + insecure daemon configuration
    # (DOCKER_TLS_CERTDIR="" or DOCKER_HOST tcp://...:2375).
    pipelineMustNotUseDockerInDocker:
      enabled: true
      detectInsecureDaemon: true

    # `jobs.<name>.secrets: inherit` hands every secret visible to the
    # caller (repo, organisation, environment) to the reusable workflow.
    # Declare each secret explicitly instead.
    reusableWorkflowsMustNotInheritSecrets:
      enabled: true

    # See the Security Job Weakening Detection section above for the full
    # naming-format reference and slash-form pattern examples.
    securityJobsMustNotBeWeakened:
      enabled: true
      securityJobPatterns:
        - "*codeql*"
        - "*dependency-review*"
        - "*trufflehog*"
        - "*gitleaks*"
        - "*osv-scanner*"
        - "*-sast"
        - "*-sast-*"
        - "*-scan"
        - "*scan*"
        - "*-security"
        - "*-security-*"
        - "*-audit"
        - "*-audit-*"
      allowFailureMustBeFalse:
        enabled: true
      rulesMustNotBeRedefined:
        enabled: true
      whenMustNotBeManual:
        enabled: true

    # `${{ github.event.* }}`, `${{ github.head_ref }}` or `${{ github.actor }}`
    # interpolated directly into a `run:` shell. Bind through env: first.
    workflowMustNotInjectUserInputInScripts:
      enabled: true

    # `pull_request_target` and `workflow_run` run with the base repo's
    # secrets while being influenceable by an unprivileged caller.
    workflowMustNotUseDangerousTriggers:
      enabled: true

    # Workflows without an explicit `permissions:` block fall back to the
    # repo-wide GITHUB_TOKEN default. Declare `permissions: { contents: read }`
    # at the workflow level for least privilege.
    workflowsMustDeclarePermissions:
      enabled: true

    # `permissions: write-all` at workflow or job scope.
    workflowMustNotGrantPermissionsWriteAll:
      enabled: true

    # Opt-in. Assert every workflow includes the action(s) your org requires.
    workflowMustIncludeRequiredActions:
      enabled: false
      # requiredGroups:
      #   - ["actions/attest-build-provenance"]
      #   - ["your-org/license-scan", "your-org/sbom"]

    # Reads both classic Branch Protection and Repository / Organization
    # Rulesets, unions them, stricter wins.
    branchMustBeProtected:
      enabled: true
      defaultMustBeProtected: true
      namePatterns:
        - main
        - master
        - release/*
        - production
        - dev
      allowForcePush: false
      codeOwnerApprovalRequired: true