Add remediation for default_workflow_permissions

Fixes: #77
mindersec · Apr 22, 2024 · 8be5eda · 8be5eda
1 parent 8663709
commit 8be5eda
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/rule-types/github/default_workflow_permissions.yaml b/rule-types/github/default_workflow_permissions.yaml
@@ -54,6 +54,13 @@ def:
           def: ".can_approve_pull_request_reviews"
         profile:
           def: ".can_approve_pull_request_reviews"
+  remediate:
+    type: rest
+    rest:
+      method: PUT
+      endpoint: "/repos/{{.Entity.Owner}}/{{.Entity.Name}}/actions/permissions/workflow"
+      body: |
+        {"default_workflow_permissions": "{{ .Profile.default_workflow_permissions }}", "can_approve_pull_request_reviews": {{ .Profile.can_approve_pull_request_reviews }} }
   # Defines the configuration for alerting on the rule
   alert:
     type: security_advisory