GitHub posture rules

63 rules. The same engine runs in the vulnetix gha posture commands and in the Software Factory on GitHub App events, so a finding means the same thing in both places. The commands, their flags and the GitHub token each one needs are on GitHub posture commands.

Context	Meaning
needs	The rule only runs when those GitHub facts were read through the API. Without them it is reported as not evaluated, never as passed.
uses	The rule runs on the files alone, and reads those facts when present to lower or raise the severity of each finding.

Workflows (vulnetix gha workflows)

Rule	Severity	Context
VNX-GH-001: Untrusted input expanded into an executed script	Critical	uses repo
VNX-GH-002: Untrusted input written to GITHUB_ENV or GITHUB_PATH	High
VNX-GH-003: Privileged workflow runs code from an untrusted pull request	Critical	uses repo, environments
VNX-GH-004: Checkout credentials persisted into an uploaded workspace	High
VNX-GH-005: Privileged workflow consumes artifacts from an untrusted run	High
VNX-GH-006: Release workflow restores a cache writable by untrusted runs	High
VNX-GH-007: Workflow token permissions not declared	Medium	uses repo
VNX-GH-008: Excessive token permissions	Medium
VNX-GH-009: OIDC token minted outside a protected environment	Medium	uses environments
VNX-GH-010: All secrets passed to a reusable workflow	Medium	uses repo
VNX-GH-011: Secrets context exposed in bulk	High
VNX-GH-012: Hard-coded container registry credentials	High
VNX-GH-013: Deprecated workflow commands re-enabled	High
VNX-GH-014: Authorisation by spoofable actor name	High
VNX-GH-015: Condition always evaluates to true	High
VNX-GH-016: Self-hosted runner reachable from pull requests	High	uses repo, runner groups
VNX-GH-017: Secret printed to the job log	Medium
VNX-GH-018: Comment-triggered workflow without an author check	High	uses repo
VNX-GH-019: Obfuscated action reference or expression	Low
VNX-GH-020: Pull request head ref used as a branch or tag name without quoting	Medium
VNX-GH-021: Secrets sent to an external host	Critical
VNX-GH-022: Privileged job restores a cache keyed on contributor input	High

Actions and images (vulnetix gha actions)

Rule	Severity	Context
VNX-GH-101: Action or reusable workflow not pinned to a commit SHA	Medium	uses action refs, actions policy, repo
VNX-GH-102: SHA pin does not match its version comment	High	needs action refs
VNX-GH-103: Pinned commit is not in the action’s repository	Critical	needs action refs
VNX-GH-104: Action repository archived, missing or hijackable	High	needs action refs
VNX-GH-105: Action version has a published vulnerability	High	needs action refs
VNX-GH-106: Container image not pinned to a digest	Low
VNX-GH-107: Action major version runs on a retired runtime	Low
VNX-GH-108: Action not permitted by the allowed-actions policy	Medium	needs actions policy
VNX-GH-109: Action owner resembles a popular publisher	High
VNX-GH-111: Remote script piped into an interpreter	Medium

Repository settings (vulnetix gha settings)

Rule	Severity	Context
VNX-GH-201: Default branch is not protected	High	needs repo, branches
VNX-GH-202: Default branch merges without review	High	needs repo, branches
VNX-GH-203: Approvals survive new commits	Medium	needs repo, branches
VNX-GH-204: Workflow changes bypass code owners	Medium	needs repo, branches, codeowners
VNX-GH-205: Force pushes or deletion allowed on the default branch	High	needs repo, branches
VNX-GH-206: Branch protection can be bypassed	Medium	needs repo, branches
VNX-GH-207: No required status checks	Low	needs repo, branches
VNX-GH-208: Workflow token defaults to write	Medium	needs repo, actions policy
VNX-GH-209: GitHub Actions can approve pull requests	Medium	needs repo, actions policy
VNX-GH-210: Fork pull request workflows run without approval	Medium	needs repo, actions policy
VNX-GH-211: Any action may run	Low	needs repo, actions policy
VNX-GH-212: Secret scanning or push protection disabled	Medium	needs repo, security and analysis
VNX-GH-213: Dependabot alerts or security updates disabled	Low	needs repo, security and analysis
VNX-GH-214: Environment secrets deployable without approval	High	needs repo, environments
VNX-GH-215: Deploy key with write access, or unused	Medium	needs deploy keys
VNX-GH-216: Webhook deliveries can be forged or intercepted	Medium	needs webhooks
VNX-GH-217: Outside collaborator with admin access	Medium	needs collaborators
VNX-GH-218: Signed commits not required	Low	needs repo, branches
VNX-GH-219: Repository secret used by an untrusted-trigger workflow	High	needs repo
VNX-GH-220: Public repository has no private vulnerability reporting	Low	needs repo, security and analysis
VNX-GH-221: Security policy files missing	Low	needs repo, repo files
VNX-GH-222: Actions secret not rotated in a year	Low	needs secrets

Organisation settings (vulnetix gha org)

Rule	Severity	Context
VNX-GH-301: Organisation does not require two-factor authentication	High	needs org
VNX-GH-302: Broad default repository permission for members	Medium	needs org
VNX-GH-303: Members can create public repositories	Low	needs org
VNX-GH-304: Organisation allows any action	Medium	needs org
VNX-GH-305: Organisation workflow token defaults to write	Medium	needs org
VNX-GH-306: Organisation secret visible to every repository	Medium	needs org
VNX-GH-307: Self-hosted runners available to public repositories	High	needs runner groups
VNX-GH-308: Organisation lets Actions approve pull requests	Medium	needs org
VNX-GH-309: Organisation webhook deliveries can be forged or intercepted	Medium	needs org