diff --git a/.gds/bundle.lock.yaml b/.gds/bundle.lock.yaml deleted file mode 100644 index 1e44640..0000000 --- a/.gds/bundle.lock.yaml +++ /dev/null @@ -1,16 +0,0 @@ -# GENERATED FILE - DO NOT EDIT DIRECTLY -schema_version: 1 - -bundle: - version: "0.9.4-dev" - release_sequence: 0 - channel: "development" - source_tree_digest: "sha256:ba597010d9403127df8c67102186ef40c546a08101d1a93201d17f8108deb520" - digest: "sha256:12020fd6433653d350bca1bc3ee3f8b6a59c0bcbdef96ed2ed8d24480cff212b" - -projection: - input_digest: "sha256:048baa26a4f956354ef7f505aaf8720b03f233a06fed36cd84c5e2c9c60abc7b" - output_digest: "sha256:1bc616a57202f145974e0002e21a77d8d0ddafea4ed7bf261bd0f6da836f7f56" - files: - - path: ".gds/compiled-policy.json" - digest: "sha256:eee55b283957a67c6ac3c369f7218a6b9ce07071de802a45117a016e576af9cf" diff --git a/.gds/compiled-policy.json b/.gds/compiled-policy.json deleted file mode 100644 index 5f01b2e..0000000 --- a/.gds/compiled-policy.json +++ /dev/null @@ -1,412 +0,0 @@ -{ - "schema_version": 1, - "compiled_policy": { - "repository_id": "repo_01M0QEF303AAMRB0G64Q5S8W78", - "bundle_version": "0.9.4-dev", - "digest": "sha256:bbcefb49524571df06f352e99aaf80780babe504917fd67575e32933bbf1397d" - }, - "sources": [ - { - "id": "repository-default", - "tier": "base", - "priority": 100, - "distribution": "public", - "path": "policies/base/repository-default.yaml", - "digest": "sha256:0ea560cc2653184e07c6f744455f745a34f764a5c0dcda55f2dc76fa5296f2f0" - }, - { - "id": "opennetwork-default", - "tier": "owner", - "priority": 110, - "distribution": "public", - "path": "policies/owners/opennetwork-default.yaml", - "digest": "sha256:096b9781b05c37fd5b440a171a6e5599cda3ef77983db72bf9c68d3d40b34ab4" - } - ], - "effective": { - "agent": { - "generated_projection_edit": "forbidden", - "profiles": [ - "core", - "drakkars" - ] - }, - "context": { - "private_parent_persistence": "forbidden" - }, - "git": { - "branch_cleanup": "merged-only", - "default_branch": "main", - "integration": "pull-request" - }, - "github": { - "actions": { - "allowed_actions": { - "management": "observed" - }, - "enabled": { - "management": "managed", - "value": true - }, - "selected_actions": { - "management": "observed" - }, - "sha_pinning_required": { - "management": "observed" - } - }, - "merge": { - "allow_auto_merge": { - "management": "observed" - }, - "allow_merge_commit": { - "management": "managed", - "value": true - }, - "allow_rebase_merge": { - "management": "observed" - }, - "allow_squash_merge": { - "management": "managed", - "value": false - }, - "allow_update_branch": { - "management": "managed", - "value": true - }, - "delete_branch_on_merge": { - "management": "managed", - "value": true - }, - "merge_commit_message": { - "management": "observed" - }, - "merge_commit_title": { - "management": "observed" - }, - "squash_merge_commit_message": { - "management": "observed" - }, - "squash_merge_commit_title": { - "management": "observed" - } - }, - "releases": { - "immutable": { - "management": "observed" - } - }, - "rulesets": { - "management": "observed" - }, - "security": { - "management": "observed" - }, - "workflow": { - "can_approve_pull_request_reviews": { - "management": "managed", - "value": false - }, - "default_workflow_permissions": { - "management": "managed", - "value": "read" - } - } - }, - "package_management": { - "mutable_version_resolution": "forbidden", - "npm_family_on_managed_path": "allowed", - "remote_stream_to_shell": "forbidden" - }, - "rollout": { - "mode": "pull-request" - }, - "security": { - "external_write_requires_approval": true, - "public_projection_scan": "required", - "secrets_in_repository": "forbidden" - } - }, - "provenance": { - "/effective/agent/generated_projection_edit": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/agent/profiles/0": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "append" - }, - "/effective/agent/profiles/1": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "append" - }, - "/effective/context/private_parent_persistence": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/git/branch_cleanup": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/git/default_branch": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/git/integration": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/actions/allowed_actions/management": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/actions/enabled/management": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/actions/enabled/value": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/actions/selected_actions/management": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/actions/sha_pinning_required/management": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/merge/allow_auto_merge/management": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/merge/allow_merge_commit/management": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/merge/allow_merge_commit/value": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/merge/allow_rebase_merge/management": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/merge/allow_squash_merge/management": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/merge/allow_squash_merge/value": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/merge/allow_update_branch/management": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/merge/allow_update_branch/value": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/merge/delete_branch_on_merge/management": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/merge/delete_branch_on_merge/value": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/merge/merge_commit_message/management": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/merge/merge_commit_title/management": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/merge/squash_merge_commit_message/management": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/merge/squash_merge_commit_title/management": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/releases/immutable/management": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/rulesets/management": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/security/management": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/workflow/can_approve_pull_request_reviews/management": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/workflow/can_approve_pull_request_reviews/value": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/workflow/default_workflow_permissions/management": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/github/workflow/default_workflow_permissions/value": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/package_management/mutable_version_resolution": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/package_management/npm_family_on_managed_path": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/package_management/remote_stream_to_shell": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/rollout/mode": { - "source": "opennetwork-default", - "tier": "owner", - "priority": 110, - "file": "policies/owners/opennetwork-default.yaml", - "operation": "set" - }, - "/effective/security/external_write_requires_approval": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/security/public_projection_scan": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - }, - "/effective/security/secrets_in_repository": { - "source": "repository-default", - "tier": "base", - "priority": 100, - "file": "policies/base/repository-default.yaml", - "operation": "set" - } - } -} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 04500cf..06d8c35 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -30,7 +30,7 @@ jobs: name: rust permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-ci.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-ci.yml@26749820fad5bde1f1726636af5b04d329ed2fe5 # 0.1.20 with: toolchain: '1.98.0' # The three-OS matrix is the evidence ADR-0113 asks for, and standard @@ -46,7 +46,7 @@ jobs: name: supply-chain permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-supply-chain.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-supply-chain.yml@26749820fad5bde1f1726636af5b04d329ed2fe5 # 0.1.20 with: enable_deny: true enable_audit: true @@ -56,7 +56,7 @@ jobs: name: actionlint permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml@26749820fad5bde1f1726636af5b04d329ed2fe5 # 0.1.20 pr-hygiene: name: pr-hygiene @@ -68,7 +68,7 @@ jobs: # that would use them is off. issues: write # the stale bot closes threads pull-requests: write # the labeler applies labels - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml@26749820fad5bde1f1726636af5b04d329ed2fe5 # 0.1.20 boundary: diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 0829342..c79b7c5 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -26,7 +26,7 @@ jobs: actions: read # CodeQL reads the workflow definitions it analyses contents: read security-events: write # CodeQL publishes its findings to code scanning - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@26749820fad5bde1f1726636af5b04d329ed2fe5 # 0.1.20 with: languages: '["rust", "actions"]' queries: security-and-quality @@ -37,7 +37,7 @@ jobs: permissions: contents: read pull-requests: write # writes the review it produces - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml@26749820fad5bde1f1726636af5b04d329ed2fe5 # 0.1.20 with: fail_on_severity: moderate @@ -52,13 +52,13 @@ jobs: contents: read id-token: write # mints the OIDC token Scorecard's publication is signed with security-events: write # Scorecard publishes its findings to code scanning - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-scorecard.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-scorecard.yml@26749820fad5bde1f1726636af5b04d329ed2fe5 # 0.1.20 osv: name: osv permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/osv-scan.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/osv-scan.yml@26749820fad5bde1f1726636af5b04d329ed2fe5 # 0.1.20 zizmor: name: zizmor @@ -66,10 +66,10 @@ jobs: actions: read # the SARIF upload reads this run to attach its results contents: read security-events: write # zizmor publishes its findings to code scanning - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/zizmor-sarif.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/zizmor-sarif.yml@26749820fad5bde1f1726636af5b04d329ed2fe5 # 0.1.20 secret-scan: name: secret-scan permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml@26749820fad5bde1f1726636af5b04d329ed2fe5 # 0.1.20