ephemeris_forge_github/config/
security.rs

1use facet::Facet;
2
3/// Whether a security feature is on.
4#[derive(Clone, Copy, Debug, Eq, Facet, Ord, PartialEq, PartialOrd)]
5#[repr(u8)]
6pub enum Status {
7    /// The feature is on.
8    #[facet(rename = "enabled")]
9    Enabled,
10    /// The feature is off.
11    #[facet(rename = "disabled")]
12    Disabled,
13}
14
15/// The kind of reviewer that may bypass secret scanning push protection.
16#[derive(Clone, Copy, Debug, Eq, Facet, Ord, PartialEq, PartialOrd)]
17#[repr(u8)]
18pub enum ReviewerType {
19    /// An organization team.
20    #[facet(rename = "TEAM")]
21    Team,
22    /// A repository role.
23    #[facet(rename = "ROLE")]
24    Role,
25}
26
27/// Whether a reviewer is asked or skipped.
28#[derive(Clone, Copy, Debug, Eq, Facet, Ord, PartialEq, PartialOrd)]
29#[repr(u8)]
30pub enum ReviewerMode {
31    /// The reviewer always reviews bypass requests.
32    #[facet(rename = "ALWAYS")]
33    Always,
34    /// The reviewer is exempt from review.
35    #[facet(rename = "EXEMPT")]
36    Exempt,
37}
38
39/// A reviewer of push protection bypass requests.
40#[derive(Clone, Copy, Debug, Eq, Facet, Ord, PartialEq, PartialOrd)]
41#[facet(deny_unknown_fields)]
42pub struct Reviewer {
43    /// The team or role id.
44    pub reviewer_id: u64,
45    /// Whether the id names a team or a role.
46    pub reviewer_type: ReviewerType,
47    /// Whether the reviewer is asked or skipped.
48    pub mode: ReviewerMode,
49}
50
51/// Settings for delegated bypass of push protection.
52#[derive(Clone, Debug, Eq, Facet, PartialEq)]
53#[facet(deny_unknown_fields)]
54pub struct BypassOptions {
55    /// The complete reviewer set. Null leaves it alone.
56    pub reviewers: Option<Vec<Reviewer>>,
57}
58
59/// Whether code scanning default setup is on.
60#[derive(Clone, Copy, Debug, Eq, Facet, Ord, PartialEq, PartialOrd)]
61#[repr(u8)]
62pub enum SetupState {
63    /// Default setup runs.
64    #[facet(rename = "configured")]
65    Configured,
66    /// Default setup is off.
67    #[facet(rename = "not-configured")]
68    NotConfigured,
69}
70
71/// A language code scanning can analyze.
72#[derive(Clone, Copy, Debug, Eq, Facet, Ord, PartialEq, PartialOrd)]
73#[repr(u8)]
74pub enum Language {
75    /// GitHub Actions workflows.
76    #[facet(rename = "actions")]
77    Actions,
78    /// C and C++.
79    #[facet(rename = "c-cpp")]
80    CCpp,
81    /// C#.
82    #[facet(rename = "csharp")]
83    Csharp,
84    /// Go.
85    #[facet(rename = "go")]
86    Go,
87    /// Java and Kotlin.
88    #[facet(rename = "java-kotlin")]
89    JavaKotlin,
90    /// JavaScript and TypeScript.
91    #[facet(rename = "javascript-typescript")]
92    JavascriptTypescript,
93    /// Python.
94    #[facet(rename = "python")]
95    Python,
96    /// Ruby.
97    #[facet(rename = "ruby")]
98    Ruby,
99    /// Swift.
100    #[facet(rename = "swift")]
101    Swift,
102}
103
104/// Where code scanning runs.
105#[derive(Clone, Copy, Debug, Eq, Facet, Ord, PartialEq, PartialOrd)]
106#[repr(u8)]
107pub enum RunnerType {
108    /// A GitHub hosted runner.
109    #[facet(rename = "standard")]
110    Standard,
111    /// A runner picked by label.
112    #[facet(rename = "labeled")]
113    Labeled,
114}
115
116/// The set of queries code scanning runs.
117#[derive(Clone, Copy, Debug, Eq, Facet, Ord, PartialEq, PartialOrd)]
118#[repr(u8)]
119pub enum QuerySuite {
120    /// The default queries.
121    #[facet(rename = "default")]
122    Default,
123    /// The default queries plus extra ones.
124    #[facet(rename = "extended")]
125    Extended,
126}
127
128/// The sources code scanning treats as untrusted.
129#[derive(Clone, Copy, Debug, Eq, Facet, Ord, PartialEq, PartialOrd)]
130#[repr(u8)]
131pub enum ThreatModel {
132    /// Remote sources only.
133    #[facet(rename = "remote")]
134    Remote,
135    /// Remote and local sources.
136    #[facet(rename = "remote_and_local")]
137    RemoteAndLocal,
138}
139
140/// Desired code scanning default setup.
141#[derive(Clone, Debug, Eq, Facet, PartialEq)]
142#[facet(deny_unknown_fields)]
143pub struct CodeScanning {
144    /// Whether default setup runs. Null leaves it alone.
145    pub state: Option<SetupState>,
146    /// The languages to analyze. Null leaves it alone.
147    pub languages: Option<Vec<Language>>,
148    /// Where the analysis runs. Null leaves it alone.
149    pub runner_type: Option<RunnerType>,
150    /// The label of the runner when the runner type is labeled.
151    pub runner_label: Option<String>,
152    /// The set of queries to run. Null leaves it alone.
153    pub query_suite: Option<QuerySuite>,
154    /// The sources treated as untrusted. Null leaves it alone.
155    pub threat_model: Option<ThreatModel>,
156}
157
158/// Desired security settings of a repository.
159///
160/// A null field is not managed.
161#[derive(Clone, Debug, Eq, Facet, PartialEq)]
162#[facet(deny_unknown_fields)]
163pub struct Security {
164    /// GitHub Advanced Security.
165    pub advanced_security: Option<Status>,
166    /// GitHub Code Security.
167    pub code_security: Option<Status>,
168    /// Secret scanning.
169    pub secret_scanning: Option<Status>,
170    /// Secret scanning push protection.
171    pub secret_scanning_push_protection: Option<Status>,
172    /// AI detection of generic secrets.
173    pub secret_scanning_ai_detection: Option<Status>,
174    /// Scanning for non-provider patterns.
175    pub secret_scanning_non_provider_patterns: Option<Status>,
176    /// Delegated dismissal of secret scanning alerts.
177    pub secret_scanning_delegated_alert_dismissal: Option<Status>,
178    /// Delegated bypass of push protection.
179    pub secret_scanning_delegated_bypass: Option<Status>,
180    /// The reviewers for delegated bypass.
181    pub secret_scanning_delegated_bypass_options: BypassOptions,
182    /// Dependabot alerts.
183    pub vulnerability_alerts: Option<bool>,
184    /// Dependabot security updates.
185    pub automated_security_fixes: Option<bool>,
186    /// Private vulnerability reporting.
187    pub private_vulnerability_reporting: Option<bool>,
188    /// Code scanning default setup.
189    pub code_scanning_default_setup: Option<CodeScanning>,
190}
ephemeris_forge_github/config/security.rs

ephemeris_forge_github/config/
security.rs
