github.lr

// Copyright (c) Mondoo, Inc.
// SPDX-License-Identifier: BUSL-1.1

option provider = "go.mondoo.com/cnquery/v9/providers/github"
option go_package = "go.mondoo.com/mql/v13/providers/github/resources"

private github {}

// Git commit
private git.commit @defaults("sha") {
  // Git commit SHA
  sha string
  // Git commit message
  message string
  // Git commit author
  author git.commitAuthor
  // Git commit committer
  committer git.commitAuthor
  // The GPG signature of the commit if there is one
  signatureVerification git.gpgSignature
}

// Git commit author
private git.commitAuthor @defaults("name email") {
  // Author shasum
  sha string
  // Author name
  name string
  // Author email
  email string
  // Date of commit
  date time
}

// Git GPG signature
private git.gpgSignature @defaults("sha") {
  // GPG signature shasum
  sha string
  // GPG signature reason
  reason string
  // Whether GPG signature is verified
  verified bool
  // GPG signature payload
  payload string
  // GPG signature
  signature string
}

// GitHub organization
github.organization @defaults("login name") {
  // Organization login
  login string
  // Organization ID
  id int
  // Organization global node ID
  nodeId string
  // Organization name
  name string
  // Organization company
  company string
  // Organization blog
  blog string
  // Organization location
  location string
  // Organization email
  email string
  // Organization Twitter handle
  twitterUsername string
  // Organization profile picture URL
  avatarUrl string
  // Organization's number of followers
  followers int
  // Number of organizations the organization is following
  following int
  // Organization description
  description string
  // Create time for the organization
  createdAt time
  // Update time for the organization
  updatedAt time
  // Number of private repositories
  totalPrivateRepos int
  // Number of public repositories
  totalPublicRepos int
  // Number of owned private repositories for the organization
  ownedPrivateRepos int
  // Number of private gists
  privateGists int
  // Disk usage for the organization
  diskUsage int
  // Number of collaborators for the organization
  collaborators int
  // Organization billing email
  billingEmail string
  // GitHub plan the organization is subscribed to
  plan dict
  // Whether two-factor authentication is required for all members. This value will be null if the API token does not have owner access on the organization.
  twoFactorRequirementEnabled bool
  // Whether the organization is verified by GitHub
  isVerified bool
  // The default repository permission
  defaultRepositoryPermission string
  // Whether members can create repositories
  membersCanCreateRepositories bool
  // Whether members can create public repositories
  membersCanCreatePublicRepositories bool
  // Whether members can create private repositories
  membersCanCreatePrivateRepositories bool
  // Whether members can create internal repositories
  membersCanCreateInternalRepositories bool
  // Whether members can create pages
  membersCanCreatePages bool
  // Whether members can create public pages
  membersCanCreatePublicPages bool
  // Whether members can create private pages
  membersCanCreatePrivatePages bool
  // Whether members can fork private repositories to their own GitHub account
  membersCanForkPrivateRepos bool
  // Whether Dependabot alerts are enabled for new repositories
  dependabotAlertsEnabledForNewRepos bool
  // Whether Dependabot security updates are enabled for new repositories
  dependabotSecurityUpdatesEnabledForNewRepos bool
  // Whether GitHub Advanced Security is enabled for new repositories
  advancedSecurityEnabledForNewRepos bool
  // Whether secret scanning is enabled for new repositories
  secretScanningEnabledForNewRepos bool
  // Whether secret scanning push protection is enabled for new repositories
  secretScanningPushProtectionEnabledForNewRepos bool
  // Whether secret scanning validity checks are enabled
  secretScanningValidityChecksEnabled bool
  // Whether members can delete repositories
  membersCanDeleteRepositories bool
  // Whether members can change repository visibility
  membersCanChangeRepoVisibility bool
  // Whether members can delete issues
  membersCanDeleteIssues bool
  // Whether readers can create discussions
  readersCanCreateDiscussions bool
  // List of users that are part of the owners group
  owners() []github.user
  // List of users that are part of the members group
  members() []github.user
  // List of users that are part of the teams group
  teams() []github.team
  // List of repositories
  repositories() []github.repository
  // List of GitHub installations
  installations() []github.installation
  // List of webhooks
  webhooks() []github.webhook
  // List of packages
  packages() []github.package
  // Whether the organization has projects
  hasOrganizationProjects bool
  // Whether projects in the organization have projects
  hasRepositoryProjects bool
  // Organization custom properties
  customProperties() []github.organization.customProperty
  // Organization audit log entries (requires GitHub Enterprise Cloud)
  auditLog() []github.auditLogEntry
  // Organization self-hosted runners
  runners() []github.runner
}

// GitHub organization-level custom property
private github.organization.customProperty @defaults("name required") {
  // The name of the property
  name string
  // Short description of the property
  description string
  // Source type of the property (where it was created)
  sourceType string
  // Type of the value for the property
  valueType string
  // Whether the property is required
  required bool
  // Default value of the property
  defaultValue string
  // An ordered list of the allowed values of the property
  allowedValues []string
  // Who can edit the values of the property
  valuesEditableBy string
}

// GitHub user
private github.user @defaults("login name email company") {
  // User ID
  id int
  // User login
  login string
  // User name
  name string
  // User email
  email string
  // User bio
  bio string
  // User blog URL
  blog string
  // User location
  location string
  // User profile picture URL
  avatarUrl string
  // User followers
  followers int
  // User following
  following int
  // User Twitter handle
  twitterUsername string
  // User create time in UTC
  createdAt time
  // Last user update time in UTC
  updatedAt time
  // When the user was suspended
  suspendedAt time
  // User's company
  company string
  // Whether the user is hireable
  hireable bool
  // Whether the user is a GitHub site admin
  siteAdmin bool
  // User's repositories
  repositories() []github.repository
  // User gists
  gists() []github.gist
}

// GitHub team
private github.team @defaults("id name") {
  // Team ID
  id int
  // Team name
  name string
  // Team description
  description string
  // Team slug
  slug string
  // Team privacy configuration
  privacy string
  // Team default permission
  defaultPermission string
  // Team members
  members() []github.user
  // Team owned repositories
  repositories() []github.repository
  // Team organization
  organization github.organization
}

// GitHub collaborator
private github.collaborator @defaults("user.login user.name") {
  // Collaborator ID
  id int
  // Collaborator's user information
  user github.user
  // Collaborator's permissions
  permissions []string
}

// GitHub package
private github.package @defaults("name packageType visibility repository.fullName") {
  // Package ID
  id int
  // Package name
  name string
  // Package type
  packageType string
  // Package owner
  owner github.user
  // Package create time
  createdAt time
  // Package update time
  updatedAt time
  // Package version numbers
  versionCount int
  // Package visibility
  visibility string
  // Package repository information
  repository() github.repository
}

// GitHub packages
github.packages {
  []github.package
  // Public packages
  public() []github.package
  // Private packages
  private() []github.package
  // Internal packages
  internal() []github.package
}

// GitHub repository
github.repository @defaults("fullName") {
  init(name string) // can only be used when logged in to github as a user
  // Repository ID
  id int
  // Repository name
  name string
  // Repository full name
  fullName string
  // Repository description
  description string
  // Repository clone URL
  cloneUrl string
  // Repository SSH URL
  sshUrl string
  // Repository homepage
  homepage string
  // Repository topics
  topics []string
  // Repository language
  language string
  // Number of users watching the repository
  watchersCount int
  // Number of repository forks
  forksCount int
  // Number of repository stargazers
  stargazersCount int
  // Number of open issues in repository
  openIssuesCount int
  // Repository create time
  createdAt time
  // Repository update time
  updatedAt time
  // Repository pushed time
  pushedAt time
  // Whether the repository is archived
  archived bool
  // Whether the repository is disabled
  disabled bool
  // Whether the repository is private
  private bool
  // Whether the repository is a fork
  isFork bool
  // Repository visibility
  visibility string
  // Whether the repository allows auto merging
  allowAutoMerge bool
  // Whether the repository allows forking
  allowForking bool
  // Whether the repository allows merge commit
  allowMergeCommit bool
  // Whether the repository allows rebase merge
  allowRebaseMerge bool
  // Whether the repository allows squash merge
  allowSquashMerge bool
  // Whether the repository has open issues
  hasIssues bool
  // Whether the repository has projects
  hasProjects bool
  // Whether the repository has a wiki
  hasWiki bool
  // Whether the repository has pages
  hasPages bool
  // Whether the repository has downloads
  hasDownloads bool
  // Whether the repository has discussions
  hasDiscussions bool
  // Whether the repository is an organization repository template
  isTemplate bool
  // Repository custom properties
  customProperties dict
  // List of open merge requests for the repository
  openMergeRequests() []github.mergeRequest
  // List of closed merge requests for the repository
  closedMergeRequests() []github.mergeRequest
  // List of all merge requests for the repository
  allMergeRequests() []github.mergeRequest
  // List of branches for the repository
  branches() []github.branch
  // Default branch name for the repository
  defaultBranchName string
  // Default branch
  defaultBranch() github.branch
  // List of commits for the repository
  commits() []github.commit
  // List of contributors for the repository
  contributors() []github.user
  // List of all collaborators for the repository
  collaborators() []github.collaborator
  // List of admin collaborators for the repository
  adminCollaborators() []github.collaborator
  // List of files in the repository
  files() []github.file
  // List of releases for the repository
  releases() []github.release
  // Repository owner
  owner github.user
  // List of webhooks for the repository
  webhooks() []github.webhook
  // List of workflows for the repository
  workflows() []github.workflow
  // List of repository forks
  forks() []github.repository
  // List of repository stargazers
  stargazers() []github.user
  // List of repository open issues
  openIssues() []github.issue
  // List of repository closed issues
  closedIssues() []github.issue
  // List of repository milestones
  milestones() []github.milestone
  // Repository license
  license() github.license
  // Repository code of conduct
  codeOfConductFile() github.file
  // Repository support file
  supportFile() github.file
  // Repository security file
  securityFile() github.file
  // Dependabot alerts for the repository
  dependabotAlerts() []github.dependabotAlert
  // Secret scanning alerts for the repository
  secretScanningAlerts() []github.secretScanningAlert
  // Code scanning alerts for the repository
  codeScanningAlerts() []github.codeScanningAlert
  // Self-hosted runners for the repository
  runners() []github.runner
  // Deployment environments for the repository
  environments() []github.environment
  // Deployments for the repository
  deployments() []github.deployment
  // Software Bill of Materials (SPDX format) for the repository
  spdxSbom() github.repository.sbom
}

// SPDX SBOM for a GitHub repository
private github.repository.sbom @defaults("name spdxVersion") {
  // SPDX identifier for the document
  spdxId string
  // Version of the SPDX specification (e.g., "SPDX-2.3")
  spdxVersion string
  // Name of the SPDX document (e.g., "owner/repo")
  name string
  // License under which the SPDX document is released
  dataLicense string
  // Namespace URI for the document
  documentNamespace string
  // Optional comment about the document
  comment string
  // Time when the SBOM was generated
  createdAt time
  // List of creators of the SBOM
  creators []string
  // List of packages described in the SBOM
  packages []github.repository.sbom.package
  // Dependency relationships between packages
  relationships []github.repository.sbom.relationship
}

// A package entry in a GitHub repository SBOM
private github.repository.sbom.package @defaults("name versionInfo") {
  // Unique SPDX identifier for this package
  spdxId string
  // Package name
  name string
  // Package version or version range
  versionInfo string
  // Download location
  downloadLocation string
  // Whether file contents were analyzed
  filesAnalyzed bool
  // Concluded license
  licenseConcluded string
  // License declared by the package author
  licenseDeclared string
  // External references (e.g., purl)
  externalRefs []github.repository.sbom.externalRef
}

// An external reference for a package in a GitHub repository SBOM
private github.repository.sbom.package.externalRef {
  // The category of reference to an external resource this reference refers to. E.g. `PACKAGE-MANAGER`.
  referenceCategory string
  // A locator for the particular external resource this reference refers to. E.g. `pkg:gem/rails@6.0.1`.
  referenceLocator string
  // The category of reference to an external resource this reference refers to. E.g. `purl`.
  referenceType string
}

// A relationship entry between two SPDX elements
private github.repository.sbom.relationship {
  // Type of relationship (e.g., "DEPENDS_ON")
  relationshipType string
  // SPDX identifier of the source element
  spdxElementId string
  // SPDX identifier of the target element
  relatedSpdxElement string
}

// GitHub license
private github.license @defaults("spdxId") {
  // License key
  key string
  // License name
  name string
  // License URL
  url string
  // License spdx ID
  spdxId string
}

// GitHub repository file
private github.file @defaults("name type") {
  // File path
  path string
  // File name
  name string
  // File type
  type string
  // File shasum
  sha string
  // Whether the file is a binary
  isBinary bool
  // List of files in the directory
  files() []github.file
  // File owner
  ownerName string
  // File repository name
  repoName string
  // File content
  content() string
  // File download URL
  downloadUrl string
  // Whether the file exists in the repository
  exists bool
}

// GitHub release
private github.release @defaults("name tagName") {
  // Release URL
  url string
  // Release name
  name string
  // Release tag name
  tagName string
  // Whether the release is a pre-release
  preRelease bool
  // Release creation time
  createdAt time
  // Release publish time
  publishedAt time
  // Release author
  author github.user
}

// GitHub webhook
private github.webhook @defaults("id name") {
  // Webhook ID
  id int
  // Webhook name
  name string
  // Webhook URL
  url string
  // List of events for the webhook
  events []string
  // Webhook configuration including content type, secret, and SSL verification settings
  config dict
  // Whether the webhook is active
  active bool
}

// GitHub workflow
private github.workflow @defaults("id name") {
  // Workflow ID
  id int
  // Workflow name
  name string
  // Workflow path
  path string
  // Workflow state
  state string
  // Workflow create time
  createdAt time
  // Workflow update time
  updatedAt time
  // Workflow file
  file() github.file
  // Workflow configuration
  configuration() dict
}

// GitHub repository branch
private github.branch @defaults("name") {
  // Repository branch name
  name string
  // Whether branch protection is enabled
  isProtected bool
  // Repository branch HEAD commit
  headCommit() github.commit
  // Repository branch HEAD commit SHA sum
  headCommitSha string
  // Repository branch protection rules
  protectionRules() github.branchprotection
  // Repository branch repository name
  repoName string
  // Repository branch owner
  owner github.user
  // Whether the branch is the default branch
  isDefault bool
}

// GitHub repository branch protection
private github.branchprotection @defaults("id") {
  // Repository branch protection ID
  id string
  // Require status checks to pass before merging
  requiredStatusChecks dict
  // Require a pull request before merging
  requiredPullRequestReviews dict
  // Require conversation resolution before merging
  requiredConversationResolution dict
  // Whether signed commits are required
  requiredSignatures bool
  // Require linear history
  requireLinearHistory dict
  // Include administrators
  enforceAdmins dict
  // Restrict who can push to matching branches
  restrictions dict
  // Allow force pushes
  allowForcePushes dict
  // Allow deletions
  allowDeletions dict
}

// GitHub repository commit
private github.commit @defaults("sha") {
  // Commit owner
  owner string
  // Commit repository
  repository string
  // Commit SHA
  sha string
  // Commit URL
  url string
  // Commit author
  author github.user
  // Commit committer
  committer github.user
  // Commit resource object
  commit git.commit
  // Commit stats
  stats dict
  // Authored date
  authoredDate time
  // Committed date
  committedDate time
}

// GitHub repository pull request
private github.mergeRequest @defaults("id state") {
  // Pull request ID
  id int
  // Pull request number
  number int
  // Pull request state
  state string
  // Pull request creation time (in UTC)
  createdAt time
  // Pull request labels
  labels []dict
  // Pull request title
  title string
  // Pull request owner
  owner github.user
  // Pull request assignees
  assignees []github.user
  // Pull request commits
  commits() []github.commit
  // Pull request reviews
  reviews() []github.review
  // Pull request repository name
  repoName string
  // Pull request milestone
  milestone github.milestone
  // Time when the pull request was merged
  mergedAt time
}

// GitHub repository review
private github.review @defaults("url state") {
  // Review URL
  url string
  // Review state
  state string
  // Author association
  authorAssociation string
  // Review user information
  user github.user
}

// GitHub application installation
private github.installation @defaults("id appId") {
  // Application installation ID
  id int
  // Application configured ID
  appId int
  // Application configured slug
  appSlug string
  // Application installation create time
  createdAt time
  // Application installation update time
  updatedAt time
}

// GitHub gist
private github.gist @defaults("description") {
  // Gist ID
  id string
  // Gist description
  description string
  // Gist create time
  createdAt time
  // Gist update time
  updatedAt time
  // Gist owner
  owner github.user
  // Whether the gist is public
  public bool
  // Gist files
  files []github.gistfile
}

// GitHub gist file
private github.gistfile @defaults("filename") {
  // Gist ID
  gistId string
  // Gist file name
  filename string
  // Gist file type
  type string
  // Gist file language
  language string
  // Gist file raw URL
  rawUrl string
  // Gist file size
  size int
  // Gist file content
  content() string
}

// GitHub milestone
private github.milestone @defaults("title state") {
  // Milestone ID
  id int
  // Milestone number
  number int
  // Milestone title
  title string
  // Milestone description
  description string
  // Milestone state (open or closed)
  state string
  // Milestone URL
  url string
  // Milestone web URL
  htmlUrl string
  // Milestone creator
  creator github.user
  // Number of open issues in this milestone
  openIssues int
  // Number of closed issues in this milestone
  closedIssues int
  // Milestone creation time
  createdAt time
  // Milestone update time
  updatedAt time
  // Milestone closed time
  closedAt time
  // Milestone due date
  dueOn time
}

// GitHub issue
private github.issue @defaults("title") {
  // Issue ID
  id int
  // Issue number
  number int
  // Issue title
  title string
  // Issue state
  state string
  // Issue body
  body string
  // Issue URL
  url string
  // Issue create time
  createdAt time
  // Issue update time
  updatedAt time
  // Issue closed time
  closedAt time
  // Users to whom the issue is assigned
  assignees []github.user
  // User who closed the issue
  closedBy github.user
  // Whether the issue is a draft
  draft bool
  // Whether the issue is locked
  locked bool
  // Issue milestone
  milestone github.milestone
}

// GitHub Dependabot alert
private github.dependabotAlert @defaults("number state") {
  // Alert number
  number int
  // Alert state (auto_dismissed, dismissed, fixed, open)
  state string
  // Vulnerable dependency information
  dependency dict
  // Security advisory details
  securityAdvisory dict
  // Specific vulnerability details
  securityVulnerability dict
  // API URL
  url string
  // Web URL
  htmlUrl string
  // Alert creation time
  createdAt time
  // Last update time
  updatedAt time
  // When the alert was dismissed
  dismissedAt time
  // When the vulnerability was fixed
  fixedAt time
  // When the alert was auto-dismissed
  autoDismissedAt time
  // User who dismissed the alert
  dismissedBy github.user
  // Reason for dismissal
  dismissedReason string
  // Comment on dismissal
  dismissedComment string
}

// GitHub secret scanning alert
private github.secretScanningAlert @defaults("number state") {
  // Alert number
  number int
  // Alert state (open, resolved)
  state string
  // Resolution status (false_positive, wont_fix, revoked, used_in_tests, pattern_deleted)
  resolution string
  // Type of secret detected
  secretType string
  // Human-readable name of the secret type
  secretTypeDisplayName string
  // The secret value (partially redacted)
  secret string
  // Validity of the secret (active, inactive, unknown)
  validity string
  // Whether the secret was publicly leaked
  publiclyLeaked bool
  // Whether the secret was found in multiple repositories
  multiRepo bool
  // API URL
  url string
  // Web URL
  htmlUrl string
  // Alert creation time
  createdAt time
  // Last update time
  updatedAt time
  // When the alert was resolved
  resolvedAt time
  // User who resolved the alert
  resolvedBy github.user
  // Whether push protection was bypassed
  pushProtectionBypassed bool
  // User who bypassed push protection
  pushProtectionBypassedBy github.user
  // When push protection was bypassed
  pushProtectionBypassedAt time
  // Comment on resolution
  resolutionComment string
}

// GitHub code scanning alert
private github.codeScanningAlert @defaults("number state") {
  // Alert number
  number int
  // Alert state (open, closed, dismissed, fixed)
  state string
  // The security rule that triggered the alert
  rule dict
  // The tool that generated the alert
  tool dict
  // API URL
  url string
  // Web URL
  htmlUrl string
  // Alert creation time
  createdAt time
  // Last update time
  updatedAt time
  // When the alert was fixed
  fixedAt time
  // When the alert was closed
  closedAt time
  // User who closed the alert
  closedBy github.user
  // When the alert was dismissed
  dismissedAt time
  // User who dismissed the alert
  dismissedBy github.user
  // Reason for dismissal
  dismissedReason string
  // Comment on dismissal
  dismissedComment string
  // Most recent instance of this alert
  mostRecentInstance dict
}

// GitHub organization audit log entry
private github.auditLogEntry @defaults("action actor timestamp") {
  // Unique document ID
  documentId string
  // The action that was performed (e.g., user.login, repo.create)
  action string
  // The actor who performed the action
  actor string
  // Actor ID
  actorId int
  // Actor location country code
  actorLocation string
  // Business name (if applicable)
  business string
  // Business ID (if applicable)
  businessId int
  // Organization name
  org string
  // Organization ID
  orgId int
  // The user affected by the action
  user string
  // User ID
  userId int
  // Event creation time
  createdAt time
  // Timestamp when the event occurred
  timestamp time
  // External identity SAML NameID
  externalIdentityNameId string
  // External identity username
  externalIdentityUsername string
  // Hashed token (if applicable)
  hashedToken string
  // Token ID (if applicable)
  tokenId int
  // Token scopes (if applicable)
  tokenScopes string
  // Additional event data
  data dict
  // Additional fields not explicitly defined
  additionalFields dict
}

// GitHub Actions self-hosted runner
private github.runner @defaults("id name os status") {
  // Runner ID
  id int
  // Runner name
  name string
  // Operating system (linux, macos, windows)
  os string
  // Runner status (online, offline)
  status string
  // Whether the runner is currently executing a job
  busy bool
  // Labels assigned to the runner
  labels []github.runnerLabel
}

// GitHub Actions runner label
private github.runnerLabel @defaults("name type") {
  // Label ID
  id int
  // Label name
  name string
  // Label type (read-only or custom)
  type string
}

// GitHub deployment environment
private github.environment @defaults("name id") {
  // Environment ID
  id int
  // Environment name
  name string
  // Environment URL
  url string
  // Environment web URL
  htmlUrl string
  // Wait timer in minutes before deployments can proceed
  waitTimer int
  // Whether admins can bypass protection rules
  canAdminsBypass bool
  // Environment creation time
  createdAt time
  // Environment update time
  updatedAt time
  // Whether only protected branches can deploy
  protectedBranches bool
  // Whether custom branch policies are enabled
  customBranchPolicies bool
  // Protection rules for this environment
  protectionRules []github.environmentProtectionRule
}

// GitHub environment protection rule
private github.environmentProtectionRule @defaults("type") {
  // Rule ID
  id int
  // Rule type (required_reviewers, wait_timer, branch_policy)
  type string
  // Wait timer in minutes (for wait_timer type)
  waitTimer int
  // Whether to prevent self-review
  preventSelfReview bool
  // Required reviewers (users or teams)
  reviewers []dict
}

// GitHub deployment
private github.deployment @defaults("id environment sha") {
  // Deployment ID
  id int
  // Deployment repository name
  repoName string
  // Deployment repository owner
  owner github.user
  // Git SHA being deployed
  sha string
  // Git ref (branch, tag, or SHA)
  ref string
  // Deployment task (e.g., "deploy")
  task string
  // Target environment name
  environment string
  // Deployment description
  description string
  // User who created the deployment
  creator github.user
  // Deployment creation time
  createdAt time
  // Deployment update time
  updatedAt time
  // Deployment payload (custom data)
  payload dict
  // Statuses URL
  statusesUrl string
  // Latest deployment status
  latestStatus() github.deploymentStatus
}

// GitHub deployment status
private github.deploymentStatus @defaults("id state") {
  // Status ID
  id int
  // Deployment state (pending, success, failure, error, inactive, in_progress, queued)
  state string
  // Status description
  description string
  // Target environment name
  environment string
  // User who created the status
  creator github.user
  // Status creation time
  createdAt time
  // Status update time
  updatedAt time
  // Target URL for the deployment
  targetUrl string
  // Log URL
  logUrl string
  // Environment URL
  environmentUrl string
}