ciso-assistant-community/.plumber.yaml at main · intuitem/ciso-assistant-community · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
# Plumber configuration (https://github.com/getplumber/plumber)
# Generated by: plumber analyze

version: "2.0"
github:
  controls:
    containerImageMustNotUseForbiddenTags:
      enabled: true
      tags:
      - latest
      - dev
      - development
      - staging
      - main
      - master
      containerImagesMustBePinnedByDigest: true
    branchMustBeProtected:
      enabled: true
      namePatterns:
      - main
      - master
      - release/*
      - production
      - dev
      defaultMustBeProtected: true
      allowForcePush: false
      codeOwnerApprovalRequired: true
    externalRefsMustNotCollide:
      enabled: true
    pipelineMustNotEnableDebugTrace:
      enabled: true
      forbiddenVariables:
      - ACTIONS_STEP_DEBUG
      - ACTIONS_RUNNER_DEBUG
    securityJobsMustNotBeWeakened:
      enabled: true
      securityJobPatterns:
      - '*codeql*'
      - '*dependency-review*'
      - '*trufflehog*'
      - '*gitleaks*'
      - '*osv-scanner*'
      - '*-sast'
      - '*-sast-*'
      - '*-scan'
      - '*scan*'
      - '*-security'
      - '*-security-*'
      - '*-audit'
      - '*-audit-*'
      allowFailureMustBeFalse:
        enabled: true
      rulesMustNotBeRedefined:
        enabled: true
      whenMustNotBeManual:
        enabled: true
    pipelineMustNotUseDockerInDocker:
      enabled: true
      detectInsecureDaemon: true
    actionsMustBePinnedByCommitSha:
      enabled: true
      trustedOwners:
      - actions
      - github
    githubActionMustComeFromAuthorizedSources:
      enabled: true
      trustGithubOfficialActions: true
      trustSameOrgActions: true
      # Explicit allowlist of trusted third-party actions. All entries are
      # SHA-pinned at their call sites (see actionsMustBePinnedByCommitSha).
      # Owner-level wildcards for well-known vendor orgs; exact repos for
      # individual-maintainer accounts.
      trustedGithubActions:
      - astral-sh/*              # setup-uv (uv/ruff maintainers)
      - pnpm/*                   # action-setup
      - docker/*                 # setup-buildx/login/metadata/build-push/setup-qemu
      - google/*                 # clusterfuzzlite
      - azure/*                  # setup-helm
      - losisin/helm-docs-github-action
      - losisin/helm-values-schema-json-action
      - getplumber/*             # Plumber action (see .github/workflows/plumber.yml)
    workflowMustNotInjectUserInputInScripts:
      enabled: true
    workflowMustNotUseDangerousTriggers:
      enabled: true
    pullRequestTargetMustNotCheckoutHead:
      enabled: true
    workflowsMustDeclarePermissions:
      enabled: true
    reusableWorkflowsMustNotInheritSecrets:
      enabled: true
    workflowMustNotGrantPermissionsWriteAll:
      enabled: true
    actionsMustNotBeArchived:
      enabled: true
    actionsMustNotCarryKnownCVEs:
      enabled: true
    pipelineMustNotExecuteUnverifiedScripts:
      enabled: true
    workflowMustNotExportEntireSecretsContext:
      enabled: true
    workflowMustNotWriteUntrustedContentToGitHubEnv:
      enabled: true
    actionRefsMustExistUpstream:
      enabled: true
    actionsMustNotExecuteMutableRemoteCode:
      enabled: true
    checkoutMustNotPersistCredentials:
      enabled: true