kernel-zero/kernel-zero.workflow.policy.json at main · AP3X-Dev/kernel-zero · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
  "apiVersion": "kernel-zero.dev/v1",
  "kind": "WorkflowPolicy",
  "metadata": {
    "name": "kernel-zero-workflow-policy",
    "revision": 1,
    "description": "Deterministic GitHub Actions workflow hygiene rules for the KERNEL ZERO repository."
  },
  "scope": {
    "include": [".github/workflows/*.yml", ".github/workflows/*.yaml"]
  },
  "rules": [
    {
      "id": "pinned-actions",
      "title": "Actions are pinned",
      "level": "error",
      "check": {
        "kind": "pinned-actions",
        "mode": "tag"
      },
      "remediation": "Reference every action by an immutable ref; switch this rule to sha mode once every action is pinned to a commit."
    },
    {
      "id": "least-privilege-permissions",
      "title": "Least-privilege permissions",
      "level": "error",
      "check": {
        "kind": "restricted-permissions",
        "allowWrite": []
      },
      "remediation": "Declare top-level permissions and grant write only to scopes this policy lists."
    }
  ]
}