Query Environment Information for Workflow Jobs
- Dominant language
- Python
- Stars
- 747
- Forks
- 45
- PR merge metrics
- No merged PRs in 30d
Description
**Is your feature request related to a problem? Please describe.**
Many workflows that would be vulnerable to pwn requests or injection use a deployment environment with required approvals to protect a job from running. Usually this will manifest as a single job that runs in an environment in the beginning, and all other jobs will depend on that check succeeding.
It is possible to query a list of environments and their rules using the REST API without authentication. By adding this feature it will be possible to update cypher queries to reduce false positives.
**Describe the solution you'd like**
I'd like to see an `Environment` graph object attached to each job. The environment object should track the environment name and if the `protection_rules` array contains one or more entries of the `required_reviewers` class.
Here is an example of a repository that uses deployment environments: https://api.github.com/repos/netflix/mantis/environments
**Describe alternatives you've considered**
None, this is pretty clear cut because environment gating with required approvals will require manual verification to ensure a detection is not a false positive.
**Additional context**
Mentioned this in an earlier issue - https://github.com/CycodeLabs/raven/issues/111, so this covers adding the environment check.
I'm actually working on implementing this and will have a PR open soon!
Contributor guide
Assessment
This issue has not been assessed yet.