diff --git a/.github/workflows/export.yaml b/.github/workflows/export.yaml
index ce030efe5..bed2d3f6c 100644
--- a/.github/workflows/export.yaml
+++ b/.github/workflows/export.yaml
@@ -11,7 +11,7 @@ jobs:
strategy:
fail-fast: false
matrix:
- os: [ubuntu-20.04] # TODO: only build
+ os: [ubuntu-24.04] # TODO: only build
repo: ["valint", "action-bom", "action-verify", "action-slsa", "orbs", "azure-tasks", "helm-charts", "valint-pipe"]
runs-on: ${{ matrix.os }}
defaults:
@@ -52,4 +52,4 @@ jobs:
branch: docs_import_${{ steps.extract_branch.outputs.branch }}
path: sub/${{ matrix.repo }}
token: ${{ secrets.PR_PAT }}
- title: autogen - docs export
\ No newline at end of file
+ title: autogen - docs export
diff --git a/docs/configuration/_category_.json b/docs/configuration/_category_.json
new file mode 100644
index 000000000..61a128126
--- /dev/null
+++ b/docs/configuration/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Configuration",
+ "position": 999
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/_category_.json b/docs/configuration/initiatives/_category_.json
new file mode 100644
index 000000000..6cd81f819
--- /dev/null
+++ b/docs/configuration/initiatives/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Reference: Policies and Configuration Guide",
+ "position": 999
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md
new file mode 100644
index 000000000..3981263ec
--- /dev/null
+++ b/docs/configuration/initiatives/index.md
@@ -0,0 +1,311 @@
+# Documentation Index
+
+## Initiatives
+
+
+| Name | Description |
+|------|-------------|
+| [NIST Application Container Security Initiative](/docs/configuration/initiatives/sp-800-190.md) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. |
+| [NIST Supply Chain Integrity Initiative](/docs/configuration/initiatives/sp-800-53.md) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. |
+| [SLSA L1 Framework](/docs/configuration/initiatives/slsa.l1.md) | Evaluate SLSA Level 1 |
+| [SLSA L2 Framework](/docs/configuration/initiatives/slsa.l2.md) | Evaluate SLSA Level 2 |
+| [SSDF Client Initiative](/docs/configuration/initiatives/ssdf.md) | Evaluate PS rules from the SSDF initiative |
+| [Secure Software Pipeline Blueprint](/docs/configuration/initiatives/sspb.md) | Blueprint for secure pipelines - Gitlab |
+
+## Rules
+
+### SBOM
+**Evidence Type:** [SBOM](/docs/valint/sbom)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Apply Scribe Template Policy](/docs/configuration/initiatives/rules/api/scribe-api.md) | Verify XX using the Scribe API template rule. |
+| [Scribe Published Policy](/docs/configuration/initiatives/rules/api/scribe-api-published.md) | Verify image Scribe Publish flag is set for container image. |
+| [NTIA SBOM Compliance Check](/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. |
+| [Enforce SBOM Freshness](/docs/configuration/initiatives/rules/sbom/fresh-sbom.md) | Verify the SBOM is not older than the specified duration. |
+| [Require SBOM Existence](/docs/configuration/initiatives/rules/sbom/evidence-exists.md) | Verify the SBOM exists as evidence. |
+| [Require SBOM Signature](/docs/configuration/initiatives/rules/sbom/artifact-signed.md) | Verify the SBOM is signed. |
+| [Require SBOM Existence](/docs/configuration/initiatives/rules/sbom/require-sbom.md) | Verify the SBOM exists as evidence. |
+
+### Image SBOM
+**Evidence Type:** [Image SBOM](/docs/valint/sbom)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify File Integrity](/docs/configuration/initiatives/rules/multievidence/files_integrity.md) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. |
+| [Verify Image Labels](/docs/configuration/initiatives/rules/images/verify-labels.md) | Verify specified labels key-value pairs exist in the image. |
+| [Forbid Large Images](/docs/configuration/initiatives/rules/images/forbid-large-images.md) | Verify the image size is below the specified threshold. |
+| [Disallow Container Shell Entrypoint](/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md) | Verify the container image disallows shell entrypoint. |
+| [Fresh Base Image](/docs/configuration/initiatives/rules/images/fresh-base-image.md) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. |
+| [Banned Ports](/docs/configuration/initiatives/rules/images/banned-ports.md) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. |
+| [Disallow Specific Users in SBOM](/docs/configuration/initiatives/rules/images/banned-users.md) | Verify specific users are not allowed in an SBOM. |
+| [Restrict Build Scripts](/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md) | Verify no build scripts commands appear in block list. |
+| [Registry Connection HTTPS](/docs/configuration/initiatives/rules/images/enforce-https-registry.md) | Checks if the container's registry scheme is HTTPS |
+| [Require Image Labels](/docs/configuration/initiatives/rules/images/verify-labels-exist.md) | Verify the image has the specified labels. |
+| [Require Healthcheck](/docs/configuration/initiatives/rules/images/require-healthcheck.md) | Checks that the container image includes at least one healthcheck property. |
+| [Allowed Base Image](/docs/configuration/initiatives/rules/images/allowed-base-image.md) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. |
+| [Fresh Image](/docs/configuration/initiatives/rules/images/fresh-image.md) | Verify the image is not older than the specified threshold. |
+| [Allowed Main Image Source](/docs/configuration/initiatives/rules/images/allowed-image-source.md) | Ensures the main container image referenced in the SBOM is from an approved source. |
+| [Require Signed Container Image](/docs/configuration/initiatives/rules/images/image-signed.md) | Enforces that container images (target_type=container) are cryptographically signed. |
+| [Verify No Critical or High Vulnerabilities](/docs/configuration/initiatives/rules/api/scribe-api-cve.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). |
+| [Disallow Specific Users in SBOM](/docs/configuration/initiatives/rules/sbom/banned-users.md) | Verify specific users are not allowed in an SBOM. |
+| [Enforce SBOM Dependencies](/docs/configuration/initiatives/rules/sbom/required-packages.md) | Verify the artifact includes all required dependencies. |
+| [Enforce SBOM License Completeness](/docs/configuration/initiatives/rules/sbom/complete-licenses.md) | Verify all dependencies in the artifact have a license. |
+| [Restrict Disallowed SBOM Licenses](/docs/configuration/initiatives/rules/sbom/banned-licenses.md) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. |
+| [Enforce Allowed SBOM Components](/docs/configuration/initiatives/rules/sbom/allowed-components.md) | Verify the artifact contains only allowed components. |
+| [Require Specified SBOM Licenses](/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md) | Verify the artifact includes all specified licenses. |
+| [Restrict Disallowed Dependencies](/docs/configuration/initiatives/rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. |
+
+### Git SBOM
+**Evidence Type:** [Git SBOM](/docs/valint/sbom)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Restrict Coding Permissions](/docs/configuration/initiatives/rules/git/coding-permissions.md) | Verify only allowed users committed to the repository. |
+| [Required Git Evidence Exists](/docs/configuration/initiatives/rules/git/evidence-exists.md) | Verify required Git evidence exists. |
+| [Git Artifact Signed](/docs/configuration/initiatives/rules/git/artifact-signed.md) | Verify the Git artifact is signed. |
+| [Disallow Commits to Main Branch](/docs/configuration/initiatives/rules/git/no-commit-to-main.md) | Verify commits made directly to the main branch are disallowed. |
+| [Disallow Unsigned Commits](/docs/configuration/initiatives/rules/git/no-unsigned-commits.md) | Verify all commits are signed. |
+
+### SARIF Evidence
+**Evidence Type:** [SARIF Evidence](/docs/valint/sarif)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify Attack Vector Exists in SARIF](/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md) | Verify required evidence validates attack vectors in the SARIF report. |
+| [Verify IaC Misconfiguration Threshold in SARIF](/docs/configuration/initiatives/rules/sarif/report-iac-errors.md) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. |
+| [Verify Required Evidence in SARIF](/docs/configuration/initiatives/rules/sarif/evidence-exists.md) | Verify all required evidence exists as defined by the SARIF policy. |
+| [Verify Artifact Signature in SARIF](/docs/configuration/initiatives/rules/sarif/artifact-signed.md) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. |
+| [Verify Rule Compliance in SARIF](/docs/configuration/initiatives/rules/sarif/verify-sarif.md) | Verify the SARIF report complies with defined generic rules for compliance and security. vulnerability profiles. |
+| [Verify Tool Evidence in SARIF](/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md) | Verify required tools were used to generate the SARIF report. |
+| [Verify Semgrep Rule in SARIF](/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. |
+| [Verify Trivy SARIF Report Compliance](/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. |
+| [Verify IaC Misconfiguration Threshold in Trivy SARIF](/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. |
+| [Trivy Blocklist CVE Check](/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md) | Verify a CVE Blocklist against a SARIF report |
+| [Trivy Vulnerability Findings Check](/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. |
+| [Verify Attack Vector Threshold in Trivy SARIF](/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. |
+| [SARIF Update Needed](/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md) | Verify no security packages require updates. |
+| [K8s Jailbreak](/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold |
+
+### Generic Statement
+**Evidence Type:** [Generic Statement](/docs/valint/generic)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Required Trivy Evidence Exists](/docs/configuration/initiatives/rules/generic/trivy-exists.md) | Verify required Trivy evidence exists |
+| [Required Generic Evidence Exists](/docs/configuration/initiatives/rules/generic/evidence-exists.md) | Verify required evidence exists. |
+| [Generic Artifact Signed](/docs/configuration/initiatives/rules/generic/artifact-signed.md) | Verify required evidence is signed. |
+
+### Github Organization Discovery Evidence
+**Evidence Type:** [Github Organization Discovery Evidence](/docs/platforms/discover#github-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify members_can_create_repositories setting](/docs/configuration/initiatives/rules/github/org/create-repos.md) | Verify only allowed users can create repositories in the GitHub organization. |
+| [Verify `secret_scanning_push_protection` Setting](/docs/configuration/initiatives/rules/github/org/push-protection-sa.md) | Verify secret scanning push protection is configured in the GitHub repository. |
+| [Verify `secret_scanning_validity_checks_enabled` Setting](/docs/configuration/initiatives/rules/github/org/validity-checks.md) | Verify validity checks for secrets are configured for the GitHub repository. |
+| [Verify dependabot_security_updates_enabled_for_new_repositories setting](/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. |
+| [Verify `secret_scanning` Setting in `security_and_analysis`](/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md) | Verify secret scanning is configured in the GitHub repository. |
+| [Limit Admin Number in GitHub Organization](/docs/configuration/initiatives/rules/github/org/max-admins.md) | Verify the maximum number of GitHub organization admins is restricted. |
+| [Verify `advanced_security_enabled_for_new_repositories` setting](/docs/configuration/initiatives/rules/github/org/advanced-security.md) | Verify Advanced Security is enabled for new repositories in the GitHub organization. |
+| [Verify dependency_graph_enabled_for_new_repositories setting](/docs/configuration/initiatives/rules/github/org/dependency-graph.md) | Verify dependency graph is enabled for new repositories in the GitHub organization. |
+| [Verify GitHub Organization Requires Signoff on Web Commits](/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md) | Verify contributors sign commits through the GitHub web interface. |
+| [Verify Two-Factor Authentication (2FA) Requirement Enabled](/docs/configuration/initiatives/rules/github/org/2fa.md) | Verify Two-factor Authentication is required in the GitHub organization. |
+| [Verify GitHub Organization Secrets Are Not Too Old](/docs/configuration/initiatives/rules/github/org/old-secrets.md) | Verify secrets in the GitHub organization are not older than the specified threshold. |
+| [Allowed GitHub Organization Admins](/docs/configuration/initiatives/rules/github/org/allow-admins.md) | Verify only users in the Allowed List have admin privileges in the GitHub organization. |
+| [Verify secret_scanning_enabled_for_new_repositories setting](/docs/configuration/initiatives/rules/github/org/secret-scanning.md) | Verify secret scanning is configured for new repositories in the GitHub organization. |
+| [Allowed GitHub Organization Users](/docs/configuration/initiatives/rules/github/org/allow-users.md) | Verify only users in the Allowed List have user access to the GitHub organization. |
+| [Verify `secret_scanning_push_protection_custom_link_enabled` Setting](/docs/configuration/initiatives/rules/github/org/pp-custom-link.md) | Verify secret scanning push protection custom link is enabled in the GitHub organization. |
+| [Verify dependabot_security_updates setting in security_and_analysis](/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md) | Verify Dependabot security updates are configured in the GitHub organization. |
+| [Verify that members can create private repositories setting is configured](/docs/configuration/initiatives/rules/github/org/create-private-repos.md) | Verify only allowed users can create private repositories in the GitHub organization. |
+| [Verify Repo Visibility Setting](/docs/configuration/initiatives/rules/github/org/repo-visibility.md) | Verify only repositories in the Allowed List are public in the GitHub organization. |
+| [Verify `secret_scanning_validity_checks` Setting in `security_and_analysis`](/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md) | Verify validity checks for secrets are configured for the GitHub organization. |
+| [Verify `secret_scanning_push_protection_enabled_for_new_repositories` Setting](/docs/configuration/initiatives/rules/github/org/push-protection.md) | Verify secret scanning push protection is enabled for new repositories in the GitHub organization. |
+| [Verify dependabot_alerts_enabled_for_new_repositories setting](/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. |
+
+### Github Repository Discovery Evidence
+**Evidence Type:** [Github Repository Discovery Evidence](/docs/platforms/discover#github-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify secret scanning.](/docs/configuration/initiatives/rules/github/repository/validity-checks.md) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. |
+| [Verify Dependabot security updates setting](/docs/configuration/initiatives/rules/github/repository/dependabot.md) | Verify Dependabot security updates are configured in the GitHub repository. |
+| [Verify Repository Is Private](/docs/configuration/initiatives/rules/github/repository/repo-private.md) | Verify the GitHub repository is private. |
+| [Verify Repository Requires Commit Signoff](/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. |
+| [Verify Default Branch Protection](/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md) | Verify the default branch protection is configured in the GitHub repository. |
+| [Verify No Old Secrets Exist in Repository](/docs/configuration/initiatives/rules/github/repository/old-secrets.md) | Verify secrets in the GitHub repository are not older than the specified threshold. |
+| [Verify No Organization Secrets Exist in Repository](/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md) | Verify no organization secrets exist in the GitHub repository. |
+| [Verify Branch Verification Setting](/docs/configuration/initiatives/rules/github/repository/branch-verification.md) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. |
+| [Verify Branch Protection Setting](/docs/configuration/initiatives/rules/github/repository/branch-protection.md) | Verify branch protection is configured in the GitHub repository. |
+| [Verify All Commits Are Signed in Repository](/docs/configuration/initiatives/rules/github/repository/signed-commits.md) | Verify all commits are signed in a repository attestation. |
+| [Verify secret_scanning setting](/docs/configuration/initiatives/rules/github/repository/secret-scanning.md) | Verify `secret_scanning` is configured in the GitHub repository. |
+| [Verify No Cache Usage Exists in Repository](/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md) | Verify the GitHub repository has no cache usage. |
+| [Verify All Commits Are Signed in Repository](/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md) | Verify all commits in the GitHub repository are signed. |
+| [Verify Only Ephemeral Runners Exist in Repository](/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md) | Verify self-hosted runners are disallowed in the GitHub repository. |
+| [Allowed Public Repositories](/docs/configuration/initiatives/rules/github/repository/visibility.md) | Verify only GitHub repositories in the Allowed List are public. |
+| [Verify Push Protection Setting](/docs/configuration/initiatives/rules/github/repository/push-protection.md) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. |
+
+### Gitlab Organization Discovery Evidence
+**Evidence Type:** [Gitlab Organization Discovery Evidence](/docs/platforms/discover#gitlab-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Limit Admins in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. |
+| [Ensure Active Projects in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md) | Verify no GitLab organization projects are inactive. |
+| [Restrict Public Visibility in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md) | Verify only allowed projects in the GitLab organization have public visibility. |
+| [Allowed Admins in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md) | Verify only users in the Allowed List have admin privileges in the GitLab organization. |
+| [Forbid Long-Lived Tokens in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. |
+| [Forbid Unused Tokens in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md) | Verify there are no unused GitLab organization tokens. |
+| [Allowed Users in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/allow-users.md) | Verify only users in the Allowed List have access to the GitLab organization. |
+| [Restrict Token Scopes in GitLab](/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. |
+| [Block Users in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md) | Verify no users in the GitLab organization are on the block list. |
+| [Prevent Token Expiration in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md) | Verify no GitLab organization tokens are about to expire. |
+| [Forbid Token Scopes in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. |
+
+### Gitlab Project Discovery Evidence
+**Evidence Type:** [Gitlab Project Discovery Evidence](/docs/platforms/discover#gitlab-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Merge approval policy check for GitLab project](/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. |
+| [Set Push Rules for GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md) | Verify push rules are set for the GitLab project. |
+| [Disable Committers' Approval for Merge Requests in GitLab](/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. |
+| [Restrict Commit Authors in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md) | Verify only GitLab project users in the Allowed List have commit author permissions. |
+| [Require Minimal Approvers in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md) | Verify the required number of approvers for the GitLab project is met. |
+| [Enforce Medium Severity Limit](/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md) | Verify the maximum allowed medium severity alerts for the GitLab project. |
+| [Enforce Merge Access Level Policy for GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md) | Verify the GitLab project's merge access level complies with requirements. |
+| [Set Author Email Regex in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md) | Verify the `author_email_regex` for the GitLab project is set to the specified value. |
+| [Check CWE Compliance](/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md) | Verify that specified CWEs were not detected in the GitLab project. |
+| [Enforce Critical Severity Limit](/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md) | Verify the maximum allowed critical severity alerts for the GitLab project. |
+| [Verify Commit Message Format](/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md) | Verify that commit messages in the GitLab project adhere to the specified format template. |
+| [Enable Member Check for GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/member-check.md) | Verify `member_check` is enabled for the GitLab project. |
+| [Restrict Selective Code Owner Removals in GitLab](/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md) | Verify `selective_code_owner_removals` is set for the GitLab project. |
+| [Run Secrets Scanning in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md) | Verify secrets scanning is performed for the GitLab project. |
+| [Reset Approvals on Push in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md) | Verify `reset_approvals_on_push` is set for the GitLab project. |
+| [Reject Unsigned Commits in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. |
+| [Enable Commit Committer Check in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md) | Verify `commit_committer_check` is enabled for the GitLab project. |
+| [Protect CI Secrets in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md) | Verify secrets in the GitLab project are not shared. |
+| [Validate All Commits in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md) | Verify all commits in the GitLab project are validated. |
+| [Disallow Banned Approvers](/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md) | Verify approvers in the GitLab project are not on the banned list. |
+| [Allowed Committer Emails in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md) | Verify only users in the Allowed List use committer email addresses in the GitLab project. |
+| [Set Push Access Level in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md) | Verify the GitLab project's push access level policy complies with requirements. |
+| [Disallow Force Push in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. |
+| [Set Visibility Level in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md) | Verify the GitLab project's visibility matches the required level. |
+| [Restrict Approvers Per Merge Request](/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. |
+| [Allowed Commit Authors in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md) | Verify only users in the Allowed List author commits in the GitLab project. |
+| [Disable Author Approval for Merge Requests in GitLab](/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. |
+| [Enable Secrets Prevention in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md) | Verify `prevent_secrets` is enabled for the GitLab project. |
+| [Ensure All Commits Are Signed in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. |
+| [Check Description Substring](/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. |
+| [Verify Project Activity](/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md) | Verify the GitLab project is active for a specified duration. |
+| [Allowed Committer Names in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md) | Verify only users in the Allowed List commit by name in the GitLab project. |
+| [Check Message Substring](/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. |
+| [Run SAST Scanning in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md) | Verify SAST scanning is performed for the GitLab project. |
+| [Require Code Owner Approval in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md) | Verify code owner approval is required for specific branches in the GitLab project. |
+| [Ensure SAST Scanning Passes](/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md) | Verify SAST scanning is successful for the GitLab project. |
+| [Ensure Secrets Scanning Passes](/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md) | Verify secrets scanning is successful for the GitLab project. |
+| [Require Password for Approvals in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md) | Verify the binary field `require_password_to_approve` is set for the GitLab project. |
+
+### K8s Namespace Discovery Evidence
+**Evidence Type:** [K8s Namespace Discovery Evidence](/docs/platforms/discover#k8s-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Allowed Container Images](/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. |
+| [Verify Namespace Termination](/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. |
+| [Allowed Namespaces](/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md) | Verify only namespaces specified in the Allowed List are allowed within the cluster. |
+| [Verify Namespace Runtime Duration](/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. |
+| [Allowed Namespace Registries](/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. |
+| [Allowed Pods in Namespace](/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. |
+
+### K8s Pod Discovery Evidence
+**Evidence Type:** [K8s Pod Discovery Evidence](/docs/platforms/discover#k8s-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify Pod Runtime Duration](/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. |
+| [Verify Pod Termination](/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. |
+| [Allowed Pods](/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md) | Verify only pods explicitly listed in the Allowed List are allowed to run. |
+
+### Bitbucket Project Discovery Evidence
+**Evidence Type:** [Bitbucket Project Discovery Evidence](/docs/platforms/discover#bitbucket-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Prevent Long-Lived Tokens](/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md) | Verify Bitbucket API tokens expire before the maximum time to live. |
+| [Allowed Project Admins](/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. |
+| [Allowed Project Users](/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket project. |
+| [Prevent Credential Exposure](/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. |
+
+### Bitbucket Repository Discovery Evidence
+**Evidence Type:** [Bitbucket Repository Discovery Evidence](/docs/platforms/discover#bitbucket-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Allowed Repository Admins](/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. |
+| [Verify Default Branch Protection Setting Is Configured](/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md) | Verify the default branch protection is enabled in the Bitbucket repository. |
+| [Allowed Repository Users](/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. |
+
+### Bitbucket Workspace Discovery Evidence
+**Evidence Type:** [Bitbucket Workspace Discovery Evidence](/docs/platforms/discover#bitbucket-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Allowed Workspace Admins](/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. |
+| [Allowed Workspace Users](/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. |
+
+### Discovery Evidence
+**Evidence Type:** [Discovery Evidence](/docs/platforms/discover)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify GitLab Pipeline Labels](/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md) | Verify the pipeline includes all required label keys and values. |
+| [GitLab pipeline verify labels exist](/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md) | Verify the pipeline has all required label keys and values. |
+| [Verify Exposed Credentials](/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md) | Verify there are no exposed credentials. |
+
+### Dockerhub Project Discovery Evidence
+**Evidence Type:** [Dockerhub Project Discovery Evidence](/docs/platforms/discover#dockerhub-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify DockerHub Tokens are Active](/docs/configuration/initiatives/rules/dockerhub/token-expiration.md) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. |
+| [Verify no unused Dockerhub](/docs/configuration/initiatives/rules/dockerhub/token-not-used.md) | Verify that there are no unused Dockerhub. |
+
+### Jenkins Instance Discovery Evidence
+**Evidence Type:** [Jenkins Instance Discovery Evidence](/docs/platforms/discover#jenkins-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Disallow Unused Users](/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md) | Verify there are no users with zero activity. |
+| [Verify Inactive Users](/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md) | Verify there are no inactive users. |
+
+### SLSA Provenance
+**Evidence Type:** [SLSA Provenance](/docs/valint/help/valint_slsa)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [SLSA External Parameters Match in Provenance Document](/docs/configuration/initiatives/rules/slsa/verify-external-parameters.md) | Verify the specified external parameters value match in the provenance document. |
+| [Verify that provenance is authenticated](/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md) | Verify the artifact is signed. |
+| [SLSA Field Exists in Provenance Document](/docs/configuration/initiatives/rules/slsa/field-exists.md) | Verify the specified field exists in the provenance document. |
+| [Verify Provenance Document Exists](/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. |
+| [Disallow dependencies in SLSA Provenance Document](/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. |
+| [Verify build time](/docs/configuration/initiatives/rules/slsa/build-time.md) | Verify the artifact was created within the specified time window. |
+| [Verify that artifact was created by the specified builder](/docs/configuration/initiatives/rules/slsa/verify-builder.md) | Verify the artifact was created by the specified builder. |
+| [Verify that artifact has no disallowed builder dependencies](/docs/configuration/initiatives/rules/slsa/verify-byproducts.md) | Verify the artifact has no disallowed builder dependencies. |
+| [SLSA Field Value Matches in Provenance Document](/docs/configuration/initiatives/rules/slsa/verify-custom-fields.md) | Verify the specified field value matches in the provenance document. |
+
+### Statement
+**Evidence Type:** [Statement](/docs/valint/generic)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify Selected Commits Are Signed API](/docs/configuration/initiatives/rules/github/api/signed-commits-list.md) | Verify selected commits are signed in the GitHub organization. |
+| [Branch protection enabled in GitHub repository](/docs/configuration/initiatives/rules/github/api/branch-protection.md) | Verify GitHub branch protection rules |
+| [Disallow Unsigned Commits In Time Range](/docs/configuration/initiatives/rules/github/api/signed-commits-range.md) | Verify commits in the specified time range are signed. |
+| [Sign Selected Commits in GitLab](/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md) | Verify the selected commits are signed in the GitLab organization. |
+| [Set Push Rules in GitLab](/docs/configuration/initiatives/rules/gitlab/api/push-rules.md) | Verify GitLab push rules are configured via the API. |
+| [Sign Selected Commit Range in GitLab](/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md) | Verify the selected range of commits is signed via the GitLab API. |
+| [Verify No 3rd Party Findings via Scribe API](/docs/configuration/initiatives/rules/api/scribe-api-findings.md) | Verify via Scribe API that there are no findings reported by 3rd party tools in the target product. |
+| [Verify No Critical or High Vulnerabilities in Product](/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in any deliverable component of the product. |
+
+
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/_category_.json b/docs/configuration/initiatives/rules/_category_.json
new file mode 100644
index 000000000..46c5e5953
--- /dev/null
+++ b/docs/configuration/initiatives/rules/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Rule Configuration",
+ "position": 999
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/api/_category_.json b/docs/configuration/initiatives/rules/api/_category_.json
new file mode 100644
index 000000000..01fdec181
--- /dev/null
+++ b/docs/configuration/initiatives/rules/api/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Scribe API",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md
new file mode 100644
index 000000000..13a519171
--- /dev/null
+++ b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md
@@ -0,0 +1,38 @@
+---
+sidebar_label: Verify No Critical or High Vulnerabilities in Product
+title: Verify No Critical or High Vulnerabilities in Product
+---
+# Verify No Critical or High Vulnerabilities in Product
+**Type:** Rule
+**ID:** `scribe-cve-product`
+**Source:** [v2/rules/api/scribe-api-cve-product.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-cve-product.yaml)
+**Rego Source:** [scribe-api.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.rego)
+**Labels:** SCA, Blueprint, Scribe
+
+Verify via Scribe API that there are no critical or high severity vulnerabilities in any deliverable component of the product.
+
+:::tip
+Evidence **IS NOT** required for this rule.
+:::
+:::tip
+Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the `valint` utility.
+:::
+
+## Usage example
+
+```yaml
+uses: api/scribe-api-cve-product@v2
+```
+
+## Mitigation
+Ensure that all critical or high severity vulnerabilities are addressed before delivering the product.
+
+
+## Description
+This rule ensures that there are no critical or high severity vulnerabilities in any deliverable component of the product by verifying via the Scribe API.
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| cve | array | True | List of CVEs to check against the product components. |
+
diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve.md b/docs/configuration/initiatives/rules/api/scribe-api-cve.md
new file mode 100644
index 000000000..420ce34c5
--- /dev/null
+++ b/docs/configuration/initiatives/rules/api/scribe-api-cve.md
@@ -0,0 +1,57 @@
+---
+sidebar_label: Verify No Critical or High Vulnerabilities
+title: Verify No Critical or High Vulnerabilities
+---
+# Verify No Critical or High Vulnerabilities
+**Type:** Rule
+**ID:** `scribe-cve`
+**Source:** [v2/rules/api/scribe-api-cve.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-cve.yaml)
+**Rego Source:** [scribe-api-cve.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-cve.rego)
+**Labels:** SCA, Blueprint, Scribe
+
+Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.).
+
+:::tip
+Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the `valint` utility.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by product and target.
+:::
+
+## Usage example
+
+```yaml
+uses: api/scribe-api-cve@v2
+with:
+ superset:
+ cve:
+ max: 0
+ severity: 6
+```
+
+## Mitigation
+Ensure that all critical or high severity vulnerabilities are addressed before delivering the product.
+
+
+## Description
+This rule ensures that there are no critical or high severity vulnerabilities in any deliverable component of the product by verifying via the Scribe API.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| superset | object | False | The superset of CVEs to check for, including the following format [cve: [max: int, severity: int]] |
+
diff --git a/docs/configuration/initiatives/rules/api/scribe-api-findings.md b/docs/configuration/initiatives/rules/api/scribe-api-findings.md
new file mode 100644
index 000000000..f0232b8b3
--- /dev/null
+++ b/docs/configuration/initiatives/rules/api/scribe-api-findings.md
@@ -0,0 +1,60 @@
+---
+sidebar_label: Verify No 3rd Party Findings via Scribe API
+title: Verify No 3rd Party Findings via Scribe API
+---
+# Verify No 3rd Party Findings via Scribe API
+**Type:** Rule
+**ID:** `scribe-findings`
+**Source:** [v2/rules/api/scribe-api-findings.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-findings.yaml)
+**Rego Source:** [scribe-api-findings.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-findings.rego)
+**Labels:** SCA, Blueprint, Scribe
+
+Verify via Scribe API that there are no findings reported by 3rd party tools in the target product.
+
+:::tip
+Evidence **IS NOT** required for this rule.
+:::
+:::tip
+Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the `valint` utility.
+:::
+
+## Usage example
+
+```yaml
+uses: api/scribe-api-findings@v2
+with:
+ superset:
+ findings:
+ severities:
+ - Critical
+ - High
+ tools:
+ - Trivy
+ - Snyk
+ titles:
+ - "CVE-2023-1234"
+ - "CVE-2023-5678"
+ - "CVE-2025"
+ cwes:
+ - "CWE-123"
+ - "CWE-456"
+ descriptions:
+ - "Vulnerability in component X"
+ - "Misconfiguration in component Y"
+ descriptions_to_ignore:
+ - "False positive in component Z"
+ - "Known issue in component A"
+```
+
+## Mitigation
+Ensure that all findings reported by 3rd party tools are addressed before delivering the product.
+
+
+## Description
+This rule ensures that there are no findings, such as vulnerabilities, misconfigurations, or other issues reported by 3rd party tools, in any component of the product by verifying via the Scribe API.
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| superset | object | False | Filters for the findings. See usage example. |
+
diff --git a/docs/configuration/initiatives/rules/api/scribe-api-published.md b/docs/configuration/initiatives/rules/api/scribe-api-published.md
new file mode 100644
index 000000000..58091e9d7
--- /dev/null
+++ b/docs/configuration/initiatives/rules/api/scribe-api-published.md
@@ -0,0 +1,47 @@
+---
+sidebar_label: Scribe Published Policy
+title: Scribe Published Policy
+---
+# Scribe Published Policy
+**Type:** Rule
+**ID:** `scribe-published-policy`
+**Source:** [v2/rules/api/scribe-api-published.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-published.yaml)
+**Rego Source:** [scribe-api-published.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-published.rego)
+**Labels:** Scribe
+
+Verify image Scribe Publish flag is set for container image.
+
+:::tip
+Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the `valint` utility.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: api/scribe-api-published@v2
+```
+
+## Mitigation
+Ensure that all critical or high severity vulnerabilities are addressed before delivering the product.
+
+
+## Description
+This rule ensures that the product is published only after all critical or high severity vulnerabilities are addressed.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+
+## Rule Parameters (`with`)
+| Parameter | Default |
+|-----------|---------|
+| superset | `{'published': None}` |
+
diff --git a/docs/configuration/initiatives/rules/api/scribe-api.md b/docs/configuration/initiatives/rules/api/scribe-api.md
new file mode 100644
index 000000000..fa486ba30
--- /dev/null
+++ b/docs/configuration/initiatives/rules/api/scribe-api.md
@@ -0,0 +1,44 @@
+---
+sidebar_label: Apply Scribe Template Policy
+title: Apply Scribe Template Policy
+---
+# Apply Scribe Template Policy
+**Type:** Rule
+**ID:** `scribe-template`
+**Source:** [v2/rules/api/scribe-api.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.yaml)
+**Rego Source:** [scribe-api.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.rego)
+**Labels:** Scribe
+
+Verify XX using the Scribe API template rule.
+
+:::tip
+Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the `valint` utility.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by product and target.
+:::
+
+## Usage example
+
+```yaml
+uses: api/scribe-api@v2
+```
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+
+## Rule Parameters (`with`)
+| Parameter | Default |
+|-----------|---------|
+| superset | `{'cve': {'max': 0, 'severity': 6}, 'licences': {'max': 500}, 'unmaintained': {'max': 2000}, 'images': {'max': 20}}` |
+
diff --git a/docs/configuration/initiatives/rules/bitbucket/_category_.json b/docs/configuration/initiatives/rules/bitbucket/_category_.json
new file mode 100644
index 000000000..e6515f2ae
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Bitbucket",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/bitbucket/project/_category_.json b/docs/configuration/initiatives/rules/bitbucket/project/_category_.json
new file mode 100644
index 000000000..a88c9e5b1
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/project/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Project",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md
new file mode 100644
index 000000000..de262da4c
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Allowed Project Admins
+title: Allowed Project Admins
+---
+# Allowed Project Admins
+**Type:** Rule
+**ID:** `bb-project-allowed-project-admins`
+**Source:** [v2/rules/bitbucket/project/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-admins.yaml)
+**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-admins.rego)
+
+Verify only users specified in the Allowed List have admin privileges in the Bitbucket project.
+
+:::note
+This rule requires Bitbucket Project Discovery Evidence. See [here](/docs/platforms/discover#bitbucket-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: bitbucket/project/allow-admins@v2
+with:
+ allowed_admins:
+ - "user1"
+ - "user2"
+ - "user3"
+```
+
+## Mitigation
+Ensure that only users in the Allowed List have admin privileges in the Bitbucket project to reduce the risk of unauthorized changes.
+
+
+## Description
+This rule ensures that only users in the Allowed List have admin privileges in the Bitbucket project.
+It performs the following steps:
+
+1. Checks the settings of the Bitbucket project.
+2. Verifies that only users in the Allowed List have admin privileges.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=bitbucket - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_admins | array | False | List of users allowed to have admin privileges in the Bitbucket project. |
+
diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md
new file mode 100644
index 000000000..013c0209c
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Allowed Project Users
+title: Allowed Project Users
+---
+# Allowed Project Users
+**Type:** Rule
+**ID:** `bb-project-allowed-project-users`
+**Source:** [v2/rules/bitbucket/project/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-users.yaml)
+**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-users.rego)
+
+Verify only users specified in the Allowed List have user access to the Bitbucket project.
+
+:::note
+This rule requires Bitbucket Project Discovery Evidence. See [here](/docs/platforms/discover#bitbucket-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: bitbucket/project/allow-users@v2
+with:
+ allowed_users:
+ - "user1"
+ - "user2"
+ - "user3"
+```
+
+## Mitigation
+Ensure that only users in the Allowed List have user access to the Bitbucket project to reduce the risk of unauthorized access.
+
+
+## Description
+This rule ensures that only users in the Allowed List have user access to the Bitbucket project.
+It performs the following steps:
+
+1. Checks the settings of the Bitbucket project.
+2. Verifies that only users in the Allowed List have user access.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=bitbucket - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_users | array | False | List of users allowed to have user access to the Bitbucket project. |
+
diff --git a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md
new file mode 100644
index 000000000..82a465060
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Prevent Credential Exposure
+title: Prevent Credential Exposure
+---
+# Prevent Credential Exposure
+**Type:** Rule
+**ID:** `bb-project-exposed-credentials`
+**Source:** [v2/rules/bitbucket/project/exposed-credentials.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/exposed-credentials.yaml)
+**Rego Source:** [exposed-credentials.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/exposed-credentials.rego)
+**Labels:** Bitbucket, Project
+
+Verify access to the Bitbucket project is blocked if exposed credentials are detected.
+
+:::note
+This rule requires Bitbucket Project Discovery Evidence. See [here](/docs/platforms/discover#bitbucket-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: bitbucket/project/exposed-credentials@v2
+```
+
+## Mitigation
+Ensure that access to the Bitbucket project is blocked if exposed credentials are detected to prevent unauthorized access.
+
+
+## Description
+This rule ensures that access to the Bitbucket project is blocked if exposed credentials are detected.
+It performs the following steps:
+
+1. Checks the settings of the Bitbucket project.
+2. Verifies that access is blocked if exposed credentials are detected.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=bitbucket - asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md
new file mode 100644
index 000000000..828f6e046
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md
@@ -0,0 +1,58 @@
+---
+sidebar_label: Prevent Long-Lived Tokens
+title: Prevent Long-Lived Tokens
+---
+# Prevent Long-Lived Tokens
+**Type:** Rule
+**ID:** `bb-project-long-live-tokens`
+**Source:** [v2/rules/bitbucket/project/long-live-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/long-live-tokens.yaml)
+**Rego Source:** [long-live-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/long-live-tokens.rego)
+**Labels:** Bitbucket, Project
+
+Verify Bitbucket API tokens expire before the maximum time to live.
+
+:::note
+This rule requires Bitbucket Project Discovery Evidence. See [here](/docs/platforms/discover#bitbucket-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: bitbucket/project/long-live-tokens@v2
+with:
+ max_days: 30
+```
+
+## Mitigation
+Ensure that Bitbucket API tokens expire before the maximum time to live to reduce the risk of unauthorized access.
+
+
+## Description
+This rule ensures that Bitbucket API tokens expire before the maximum time to live.
+It performs the following steps:
+
+1. Checks the settings of the Bitbucket project.
+2. Verifies that tokens expire before the maximum time to live.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=project - platform=bitbucket - platform_instance=bitbucket_dc |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| max_days | number | False | Maximum number of days a token can be valid. |
+
diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/_category_.json b/docs/configuration/initiatives/rules/bitbucket/repository/_category_.json
new file mode 100644
index 000000000..e93f68442
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/repository/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Repository",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md
new file mode 100644
index 000000000..bdcb29925
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Allowed Repository Admins
+title: Allowed Repository Admins
+---
+# Allowed Repository Admins
+**Type:** Rule
+**ID:** `bb-repo-allowed-repository-admins`
+**Source:** [v2/rules/bitbucket/repository/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-admins.yaml)
+**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-admins.rego)
+**Labels:** Bitbucket, Repository
+
+Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository.
+
+:::note
+This rule requires Bitbucket Repository Discovery Evidence. See [here](/docs/platforms/discover#bitbucket-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: bitbucket/repository/allow-admins@v2
+with:
+ allowed_admins:
+ - "user1"
+ - "user2"
+ - "user3"
+```
+
+## Mitigation
+Ensure that only users in the Allowed List have admin privileges in the Bitbucket repository to reduce the risk of unauthorized changes.
+
+
+## Description
+This rule ensures that only users in the Allowed List have admin privileges in the Bitbucket repository.
+It performs the following steps:
+
+1. Checks the settings of the Bitbucket repository.
+2. Verifies that only users in the Allowed List have admin privileges.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket repository resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=bitbucket - asset_type=repository |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_admins | array | False | List of users allowed to have admin privileges in the Bitbucket repository. |
+
diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md
new file mode 100644
index 000000000..7f9d70f65
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Allowed Repository Users
+title: Allowed Repository Users
+---
+# Allowed Repository Users
+**Type:** Rule
+**ID:** `bb-repo-allowed-repository-users`
+**Source:** [v2/rules/bitbucket/repository/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-users.yaml)
+**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-users.rego)
+**Labels:** Bitbucket, Repository
+
+Verify only users specified in the Allowed List have user access to the Bitbucket repository.
+
+:::note
+This rule requires Bitbucket Repository Discovery Evidence. See [here](/docs/platforms/discover#bitbucket-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: bitbucket/repository/allow-users@v2
+with:
+ allowed_users:
+ - "user1"
+ - "user2"
+ - "user3"
+```
+
+## Mitigation
+Ensure that only users in the Allowed List have user access to the Bitbucket repository to reduce the risk of unauthorized access.
+
+
+## Description
+This rule ensures that only users in the Allowed List have user access to the Bitbucket repository.
+It performs the following steps:
+
+1. Checks the settings of the Bitbucket repository.
+2. Verifies that only users in the Allowed List have user access.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket repository resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=bitbucket - asset_type=repository |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_users | array | False | List of users allowed to have user access to the Bitbucket repository. |
+
diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md
new file mode 100644
index 000000000..347cd4b4d
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md
@@ -0,0 +1,60 @@
+---
+sidebar_label: Verify Default Branch Protection Setting Is Configured
+title: Verify Default Branch Protection Setting Is Configured
+---
+# Verify Default Branch Protection Setting Is Configured
+**Type:** Rule
+**ID:** `bb-repo-branch-protection`
+**Source:** [v2/rules/bitbucket/repository/branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/branch-protection.yaml)
+**Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/branch-protection.rego)
+**Labels:** Bitbucket, Repository
+
+Verify the default branch protection is enabled in the Bitbucket repository.
+
+:::note
+This rule requires Bitbucket Repository Discovery Evidence. See [here](/docs/platforms/discover#bitbucket-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: bitbucket/repository/branch-protection@v2
+with:
+ branches:
+ - "main"
+```
+
+## Mitigation
+Ensures that the default branch is protected, reducing the risk of unauthorized changes.
+
+
+## Description
+This rule ensures that the default branch protection is enabled in the Bitbucket repository.
+It performs the following steps:
+
+1. Checks the repository settings for default branch protection configuration.
+2. Verifies that the configuration matches the expected settings.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket repository settings.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=bitbucket - asset_type=repository |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| branches | array | False | List of branches to verify default branch protection. |
+
diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/_category_.json b/docs/configuration/initiatives/rules/bitbucket/workspace/_category_.json
new file mode 100644
index 000000000..ed893c2ea
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/workspace/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Workspace",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md
new file mode 100644
index 000000000..793de740c
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Allowed Workspace Admins
+title: Allowed Workspace Admins
+---
+# Allowed Workspace Admins
+**Type:** Rule
+**ID:** `bb-workspace-allowed-workspace-admins`
+**Source:** [v2/rules/bitbucket/workspace/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-admins.yaml)
+**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-admins.rego)
+**Labels:** Bitbucket, Workspace
+
+Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace.
+
+:::note
+This rule requires Bitbucket Workspace Discovery Evidence. See [here](/docs/platforms/discover#bitbucket-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: bitbucket/workspace/allow-admins@v2
+with:
+ allowed_admins:
+ - "user1"
+ - "user2"
+ - "user3"
+```
+
+## Mitigation
+Ensure that only users in the Allowed List have admin privileges in the Bitbucket workspace to reduce the risk of unauthorized changes.
+
+
+## Description
+This rule ensures that only users in the Allowed List have admin privileges in the Bitbucket workspace.
+It performs the following steps:
+
+1. Checks the settings of the Bitbucket workspace.
+2. Verifies that only users in the Allowed List have admin privileges.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket workspace resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=bitbucket - asset_type=workspace |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_admins | array | False | List of users allowed to have admin privileges in the Bitbucket workspace. |
+
diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md
new file mode 100644
index 000000000..0a6d19ee1
--- /dev/null
+++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Allowed Workspace Users
+title: Allowed Workspace Users
+---
+# Allowed Workspace Users
+**Type:** Rule
+**ID:** `bb-workspace-allowed-workspace-users`
+**Source:** [v2/rules/bitbucket/workspace/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-users.yaml)
+**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-users.rego)
+**Labels:** Bitbucket, Workspace
+
+Verify only users specified in the Allowed List have user access to the Bitbucket workspace.
+
+:::note
+This rule requires Bitbucket Workspace Discovery Evidence. See [here](/docs/platforms/discover#bitbucket-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: bitbucket/workspace/allow-users@v2
+with:
+ allowed_users:
+ - "user1"
+ - "user2"
+ - "user3"
+```
+
+## Mitigation
+Ensure that only users in the Allowed List have user access to the Bitbucket workspace to reduce the risk of unauthorized access.
+
+
+## Description
+This rule ensures that only users in the Allowed List have user access to the Bitbucket workspace.
+It performs the following steps:
+
+1. Checks the settings of the Bitbucket workspace.
+2. Verifies that only users in the Allowed List have user access.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket workspace resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=bitbucket - asset_type=workspace |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_users | array | False | List of users allowed to have user access to the Bitbucket workspace. |
+
diff --git a/docs/configuration/initiatives/rules/dockerhub/_category_.json b/docs/configuration/initiatives/rules/dockerhub/_category_.json
new file mode 100644
index 000000000..7c6237a25
--- /dev/null
+++ b/docs/configuration/initiatives/rules/dockerhub/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Dockerhub",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md
new file mode 100644
index 000000000..31c705621
--- /dev/null
+++ b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md
@@ -0,0 +1,53 @@
+---
+sidebar_label: Verify DockerHub Tokens are Active
+title: Verify DockerHub Tokens are Active
+---
+# Verify DockerHub Tokens are Active
+**Type:** Rule
+**ID:** `dockerhub-token-expiration`
+**Source:** [v2/rules/dockerhub/token-expiration.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-expiration.yaml)
+**Rego Source:** [token-expiration.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-expiration.rego)
+**Labels:** Dockerhub
+
+Verify that all discovered Dockerhub tokens are set to Active in Dockerhub.
+
+:::note
+This rule requires Dockerhub Project Discovery Evidence. See [here](/docs/platforms/discover#dockerhub-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: dockerhub/token-expiration@v2
+```
+
+## Mitigation
+Ensure all Dockerhub tokens are set to Active status to prevent unauthorized access.
+
+
+## Description
+This rule verifies that all discovered Dockerhub tokens are set to Active in Dockerhub.
+It performs the following steps:
+
+1. Iterates over the Dockerhub tokens in the project.
+2. Checks each token's status against the Active status.
+ - If a token's status is not Active, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Dockerhub resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=project - platform=dockerhub |
+
diff --git a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md
new file mode 100644
index 000000000..14ba8e6e3
--- /dev/null
+++ b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md
@@ -0,0 +1,48 @@
+---
+sidebar_label: Verify no unused Dockerhub
+title: Verify no unused Dockerhub
+---
+# Verify no unused Dockerhub
+**Type:** Rule
+**ID:** `dockerhub-token-not-used`
+**Source:** [v2/rules/dockerhub/token-not-used.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-not-used.yaml)
+**Rego Source:** [token-not-used.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-not-used.rego)
+**Labels:** Dockerhub
+
+Verify that there are no unused Dockerhub.
+
+:::note
+This rule requires Dockerhub Project Discovery Evidence. See [here](/docs/platforms/discover#dockerhub-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: dockerhub/token-not-used@v2
+```
+
+## Description
+This rule verifies that there are no unused Dockerhub.
+It performs the following steps:
+
+1. Iterates over the Dockerhub tokens in the project.
+2. Checks each token's last_used is null , the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Dockerhub resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=project - platform=dockerhub |
+
diff --git a/docs/configuration/initiatives/rules/generic/_category_.json b/docs/configuration/initiatives/rules/generic/_category_.json
new file mode 100644
index 000000000..ab9d35851
--- /dev/null
+++ b/docs/configuration/initiatives/rules/generic/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Generic",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/generic/artifact-signed.md b/docs/configuration/initiatives/rules/generic/artifact-signed.md
new file mode 100644
index 000000000..7ef7ee9ae
--- /dev/null
+++ b/docs/configuration/initiatives/rules/generic/artifact-signed.md
@@ -0,0 +1,40 @@
+---
+sidebar_label: Generic Artifact Signed
+title: Generic Artifact Signed
+---
+# Generic Artifact Signed
+**Type:** Rule
+**ID:** `generic-artifact-signed`
+**Source:** [v2/rules/generic/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/artifact-signed.yaml)
+**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/artifact-signed.rego)
+**Labels:** 3rd-party
+
+Verify required evidence is signed.
+
+:::note
+This rule requires Signed Generic Statement. See [here](/docs/valint/generic) for more details.
+:::
+:::tip
+> Evidence **IS** required for this rule and will fail if missing.
+:::
+:::tip
+Signed Evidence for this rule **IS** required by default.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: generic/artifact-signed@v2
+```
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | True |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/generic/v0.1 |
+
diff --git a/docs/configuration/initiatives/rules/generic/evidence-exists.md b/docs/configuration/initiatives/rules/generic/evidence-exists.md
new file mode 100644
index 000000000..d99c50022
--- /dev/null
+++ b/docs/configuration/initiatives/rules/generic/evidence-exists.md
@@ -0,0 +1,39 @@
+---
+sidebar_label: Required Generic Evidence Exists
+title: Required Generic Evidence Exists
+---
+# Required Generic Evidence Exists
+**Type:** Rule
+**ID:** `generic-required-evidence`
+**Source:** [v2/rules/generic/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/evidence-exists.yaml)
+**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/evidence-exists.rego)
+**Labels:** 3rd-party
+
+Verify required evidence exists.
+
+:::note
+This rule requires Generic Statement. See [here](/docs/valint/generic) for more details.
+:::
+:::tip
+> Evidence **IS** required for this rule and will fail if missing.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: generic/evidence-exists@v2
+```
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/generic/v0.1 |
+
diff --git a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md
new file mode 100644
index 000000000..547b25e7d
--- /dev/null
+++ b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md
@@ -0,0 +1,37 @@
+---
+sidebar_label: K8s Jailbreak
+title: K8s Jailbreak
+---
+# K8s Jailbreak
+**Type:** Rule
+**ID:** `k8s-jailbreak`
+**Source:** [v2/rules/generic/k8s-jailbreak.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/k8s-jailbreak.yaml)
+**Rego Source:** [k8s-jailbreak.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/k8s-jailbreak.rego)
+**Labels:** K8s
+
+Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold
+
+:::note
+This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: generic/k8s-jailbreak@v2
+```
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+| target_type | data |
+
diff --git a/docs/configuration/initiatives/rules/generic/trivy-exists.md b/docs/configuration/initiatives/rules/generic/trivy-exists.md
new file mode 100644
index 000000000..b2e2d6c9c
--- /dev/null
+++ b/docs/configuration/initiatives/rules/generic/trivy-exists.md
@@ -0,0 +1,35 @@
+---
+sidebar_label: Required Trivy Evidence Exists
+title: Required Trivy Evidence Exists
+---
+# Required Trivy Evidence Exists
+**Type:** Rule
+**ID:** `required-trivy-evidence`
+**Source:** [v2/rules/generic/trivy-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/trivy-exists.yaml)
+**Labels:** 3rd-party
+
+Verify required Trivy evidence exists
+
+:::note
+This rule requires Generic Statement. See [here](/docs/valint/generic) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: generic/trivy-exists@v2
+```
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | https://aquasecurity.github.io/trivy/v0.42/docs/configuration/reporting/#json |
+
diff --git a/docs/configuration/initiatives/rules/git/_category_.json b/docs/configuration/initiatives/rules/git/_category_.json
new file mode 100644
index 000000000..2a7a53690
--- /dev/null
+++ b/docs/configuration/initiatives/rules/git/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Git",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/git/artifact-signed.md b/docs/configuration/initiatives/rules/git/artifact-signed.md
new file mode 100644
index 000000000..2fec2b81a
--- /dev/null
+++ b/docs/configuration/initiatives/rules/git/artifact-signed.md
@@ -0,0 +1,57 @@
+---
+sidebar_label: Git Artifact Signed
+title: Git Artifact Signed
+---
+# Git Artifact Signed
+**Type:** Rule
+**ID:** `git-artifact-signed`
+**Source:** [v2/rules/git/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/artifact-signed.yaml)
+**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/artifact-signed.rego)
+**Labels:** SBOM, Git
+
+Verify the Git artifact is signed.
+
+:::note
+This rule requires Signed Git SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+> Evidence **IS** required for this rule and will fail if missing.
+:::
+:::tip
+Signed Evidence for this rule **IS** required by default.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by product and target.
+:::
+
+## Usage example
+
+```yaml
+uses: git/artifact-signed@v2
+with:
+ identity:
+ emails:
+ - bob@company.com
+ - alice@company.com
+```
+
+## Mitigation
+Ensure that only Git artifacts with valid cryptographic signatures are deployed to prevent source code tampering.
+
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | True |
+| content_body_type | cyclonedx-json |
+| target_type | git |
+
+## Rule Parameters (`with`)
+| Parameter | Default |
+|-----------|---------|
+| identity | `{'common-names': [], 'emails': []}` |
+
diff --git a/docs/configuration/initiatives/rules/git/coding-permissions.md b/docs/configuration/initiatives/rules/git/coding-permissions.md
new file mode 100644
index 000000000..c55d1936d
--- /dev/null
+++ b/docs/configuration/initiatives/rules/git/coding-permissions.md
@@ -0,0 +1,63 @@
+---
+sidebar_label: Restrict Coding Permissions
+title: Restrict Coding Permissions
+---
+# Restrict Coding Permissions
+**Type:** Rule
+**ID:** `git-coding-permissions`
+**Source:** [v2/rules/git/coding-permissions.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/coding-permissions.yaml)
+**Rego Source:** [coding-permissions.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/coding-permissions.rego)
+**Labels:** SBOM, Git
+
+Verify only allowed users committed to the repository.
+
+:::note
+This rule requires Git SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by product and target.
+:::
+
+## Usage example
+
+```yaml
+uses: git/coding-permissions@v2
+```
+
+## Mitigation
+Prevent unauthorized users from committing to the repository by restricting commit permissions to allowed users only.
+
+
+## Description
+This rule verifies that only allowed users have committed to the repository.
+It performs the following steps:
+
+1. Iterates over the commits in the repository.
+2. Checks each commit's author against the list of allowed user IDs.
+ - If a commit's author is not in the allowed list, the rule flags it as a violation.
+3. Checks each committed file against the list of allowed files.
+ - If a committed file is not in the allowed list, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Git repository resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | git |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| ids | array | False | The list of user (commit.author) IDs allowed to commit to the repository. |
+| files | array | False | The list of files that are allowed to be committed to the repository. |
+
diff --git a/docs/configuration/initiatives/rules/git/evidence-exists.md b/docs/configuration/initiatives/rules/git/evidence-exists.md
new file mode 100644
index 000000000..237304dc8
--- /dev/null
+++ b/docs/configuration/initiatives/rules/git/evidence-exists.md
@@ -0,0 +1,47 @@
+---
+sidebar_label: Required Git Evidence Exists
+title: Required Git Evidence Exists
+---
+# Required Git Evidence Exists
+**Type:** Rule
+**ID:** `required-git-evidence`
+**Source:** [v2/rules/git/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/evidence-exists.yaml)
+**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/evidence-exists.rego)
+**Labels:** SBOM, Git
+
+Verify required Git evidence exists.
+
+:::note
+This rule requires Git SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+> Evidence **IS** required for this rule and will fail if missing.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by product and target.
+:::
+
+## Usage example
+
+```yaml
+uses: git/evidence-exists@v2
+```
+
+## Mitigation
+By confirming that all required evidence exists, this rule guarantees that a Source Code Bill of Materials (SBOM) is fully represented as evidence.
+
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | git |
+
diff --git a/docs/configuration/initiatives/rules/git/no-commit-to-main.md b/docs/configuration/initiatives/rules/git/no-commit-to-main.md
new file mode 100644
index 000000000..bfc24c3e1
--- /dev/null
+++ b/docs/configuration/initiatives/rules/git/no-commit-to-main.md
@@ -0,0 +1,55 @@
+---
+sidebar_label: Disallow Commits to Main Branch
+title: Disallow Commits to Main Branch
+---
+# Disallow Commits to Main Branch
+**Type:** Rule
+**ID:** `git-disallow-commits-to-main`
+**Source:** [v2/rules/git/no-commit-to-main.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-commit-to-main.yaml)
+**Rego Source:** [no-commit-to-main.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-commit-to-main.rego)
+**Labels:** SBOM, Git
+
+Verify commits made directly to the main branch are disallowed.
+
+:::note
+This rule requires Git SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by product and target.
+:::
+
+## Usage example
+
+```yaml
+uses: git/no-commit-to-main@v2
+```
+
+## Mitigation
+Enforcing no commits to the main branch ensures that changes are made through pull requests, allowing for code review and approval before merging.
+
+
+## Description
+This rule ensures that no commits are made directly to the main or master branches.
+It performs the following steps:
+
+1. Check SBOM target branch
+2. If the target branch is the main or master branch, the rule looks for commit objects.
+3. If commit objects are found, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Git repository resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | git |
+
diff --git a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md
new file mode 100644
index 000000000..4d015322b
--- /dev/null
+++ b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md
@@ -0,0 +1,56 @@
+---
+sidebar_label: Disallow Unsigned Commits
+title: Disallow Unsigned Commits
+---
+# Disallow Unsigned Commits
+**Type:** Rule
+**ID:** `git-disallow-unsigned-commits`
+**Source:** [v2/rules/git/no-unsigned-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-unsigned-commits.yaml)
+**Rego Source:** [no-unsigned-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-unsigned-commits.rego)
+**Labels:** Git
+
+Verify all commits are signed.
+
+:::note
+This rule requires Git SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by product and target.
+:::
+
+## Usage example
+
+```yaml
+uses: git/no-unsigned-commits@v2
+```
+
+## Mitigation
+Enforcing signed commits ensures reduced risk of unauthorized changes to the repository.
+
+
+## Description
+This rule ensures that all commits are signed.
+It performs the following steps:
+
+1. Iterates over the commits in the repository.
+2. For each Commit Rule inspects the 'PGPSignature' property of the commit, if it is not present, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- The Source SBOM evidence must be provided in the `cyclonedx-json` format.
+- The Source SBOM should include a `metadata.component.properties` array containing properties that identify base images.
+- The Source SBOM (Software Bill of Materials) must include the `PGPSignature` property for each commit Component.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | git |
+
diff --git a/docs/configuration/initiatives/rules/github/_category_.json b/docs/configuration/initiatives/rules/github/_category_.json
new file mode 100644
index 000000000..174a64f21
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "GitHub",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/github/api/_category_.json b/docs/configuration/initiatives/rules/github/api/_category_.json
new file mode 100644
index 000000000..e753985fa
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/api/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "GitHub API",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/github/api/branch-protection.md b/docs/configuration/initiatives/rules/github/api/branch-protection.md
new file mode 100644
index 000000000..00d7561e9
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/api/branch-protection.md
@@ -0,0 +1,86 @@
+---
+sidebar_label: Branch protection enabled in GitHub repository
+title: Branch protection enabled in GitHub repository
+---
+# Branch protection enabled in GitHub repository
+**Type:** Rule
+**ID:** `github-api-branch-protection`
+**Source:** [v2/rules/github/api/branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/branch-protection.yaml)
+**Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/branch-protection.rego)
+**Labels:** GitHub
+
+Verify GitHub branch protection rules
+
+:::tip
+Evidence **IS NOT** required for this rule.
+:::
+
+## Usage example
+
+```yaml
+uses: github/api/branch-protection@v2
+with:
+ owner: "my-org"
+ repo: "my-repo"
+ branch: "main"
+ branch_protection_rules:
+ required_pull_request_reviews.dismiss_stale_reviews: true
+ required_pull_request_reviews.require_code_owner_reviews: true
+ required_pull_request_reviews.require_last_push_approval: true
+ required_pull_request_reviews.required_approving_review_count: 2
+ required_pull_request_reviews.bypass_pull_request_allowances.users: ["user1", "user2"]
+ required_pull_request_reviews.bypass_pull_request_allowances.teams: ["team1"]
+ required_pull_request_reviews.bypass_pull_request_allowances.apps: ["app1"]
+ required_pull_request_reviews.dismissal_restrictions.users: ["user3"]
+ required_pull_request_reviews.dismissal_restrictions.teams: ["team2"]
+ required_pull_request_reviews.dismissal_restrictions.apps: ["app2"]
+ required_status_checks.checks: ["check1", "check2"]
+ required_status_checks.strict: true
+ required_status_checks.contexts: ["context1", "context2"]
+ restrictions.users: ["user4"]
+ restrictions.teams: ["team3"]
+ restrictions.apps: ["app3"]
+ required_signatures: true
+ enforce_admins: true
+ required_linear_history: true
+ allow_force_pushes: false
+ allow_deletions: false
+ block_creations: true
+ required_conversation_resolution: true
+ lock_branch: true
+ allow_fork_syncing: true
+```
+
+## Description
+# This ones needs a large details
+This rule ensures that the branch protection rules are configured in the GitHub repository.
+It performs the following steps:
+
+1. Checks the repository settings for branch protection configuration.
+2. Verifies that the configuration matches the expected settings.
+2.1. Verifies that the required pull request reviews are configured.
+2.2. Verifies that the required status checks are configured.
+2.3. Verifies that the restrictions are configured.
+2.4. Verifies that the required signatures are configured.
+2.5. Verifies that the enforcement of admins is configured.
+2.6. Verifies that the required linear history is configured.
+2.7. Verifies that the allow force pushes is configured.
+2.8. Verifies that the allow deletions is configured.
+2.9. Verifies that the block creations is configured.
+2.10. Verifies that the required conversation resolution is configured.
+2.11. Verifies that the lock branch is configured.
+2.12. Verifies that the allow fork syncing is configured.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+- Github API token must be provided to access the GitHub API.
+
+## Rule Parameters (`with`)
+| Parameter | Default |
+|-----------|---------|
+| api_token | `{{ .Args.Token }}` |
+| owner | `{{ .Args.Owner }}` |
+| repo | `{{ .Args.Repo }}` |
+| branch | `{{ .Args.Branch }}` |
+| branch_protection_rules | `{'required_pull_request_reviews.dismiss_stale_reviews': True, 'required_pull_request_reviews.require_code_owner_reviews': False, 'required_pull_request_reviews.require_last_push_approval': False, 'required_pull_request_reviews.required_approving_review_count': 1, 'required_pull_request_reviews.bypass_pull_request_allowances.users': [], 'required_pull_request_reviews.bypass_pull_request_allowances.teams': [], 'required_pull_request_reviews.bypass_pull_request_allowances.apps': [], 'required_pull_request_reviews.dismissal_restrictions.users': [], 'required_pull_request_reviews.dismissal_restrictions.teams': [], 'required_pull_request_reviews.dismissal_restrictions.apps': [], 'required_status_checks.checks': [], 'required_status_checks.strict': False, 'required_status_checks.contexts': [], 'restrictions.users': [], 'restrictions.teams': [], 'restrictions.apps': [], 'required_signatures': False, 'enforce_admins': False, 'required_linear_history': False, 'allow_force_pushes': False, 'allow_deletions': True, 'block_creations': False, 'required_conversation_resolution': False, 'lock_branch': False, 'allow_fork_syncing': False}` |
+
diff --git a/docs/configuration/initiatives/rules/github/api/signed-commits-list.md b/docs/configuration/initiatives/rules/github/api/signed-commits-list.md
new file mode 100644
index 000000000..b4e835d21
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/api/signed-commits-list.md
@@ -0,0 +1,49 @@
+---
+sidebar_label: Verify Selected Commits Are Signed API
+title: Verify Selected Commits Are Signed API
+---
+# Verify Selected Commits Are Signed API
+**Type:** Rule
+**ID:** `github-api-signed-commits-list`
+**Source:** [v2/rules/github/api/signed-commits-list.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-list.yaml)
+**Rego Source:** [signed-commits-list.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-list.rego)
+**Labels:** GitHub, API
+
+Verify selected commits are signed in the GitHub organization.
+
+:::tip
+Evidence **IS NOT** required for this rule.
+:::
+
+## Usage example
+
+```yaml
+uses: github/api/signed-commits-list@v2
+with:
+ commit_id_list:
+ - "11111115644ea629569e6a3c98c8375111111"
+ - "22222225644ea629569e6a3c98c8375222222"
+ access_token: '{{ .Args.Token }}'
+ owner: my_owner
+```
+
+## Description
+This rule ensures that the selected commits are signed in the GitHub organization.
+It performs the following steps:
+
+1. Checks the selected commits in the Selected GitHub repository.
+2. Verifies that the selected commits are signed.
+2.1 Verifies that the selected commits are signed by the proper owner.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository resources.
+- Github API token must be provided to access the GitHub API.
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| commit_id_list | array | True | List of commit IDs to verify if they are signed. |
+| access_token | string | True | GitHub API access token. |
+| owner | string | True | GitHub repository owner. |
+| repo | string | True | GitHub repository name. |
+
diff --git a/docs/configuration/initiatives/rules/github/api/signed-commits-range.md b/docs/configuration/initiatives/rules/github/api/signed-commits-range.md
new file mode 100644
index 000000000..66010fe4d
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/api/signed-commits-range.md
@@ -0,0 +1,54 @@
+---
+sidebar_label: Disallow Unsigned Commits In Time Range
+title: Disallow Unsigned Commits In Time Range
+---
+# Disallow Unsigned Commits In Time Range
+**Type:** Rule
+**ID:** `signed-commits-range`
+**Source:** [v2/rules/github/api/signed-commits-range.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-range.yaml)
+**Rego Source:** [signed-commits-range.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-range.rego)
+**Labels:** GitHub
+
+Verify commits in the specified time range are signed.
+
+:::tip
+Evidence **IS NOT** required for this rule.
+:::
+
+## Usage example
+
+```yaml
+uses: github/api/signed-commits-range@v2
+with:
+ access_token: '{{
+ .Args.Token
+ }}'
+ owner: my_owner
+ repo: my_repo
+ since: "2021-01-01T00:00:00Z"
+ until: "2021-01-31T23:59:59Z"
+ sha: "11111115644ea629569e6a3c98c8375111111"
+```
+
+## Description
+This rule ensures that the commits in the specified time range are signed in the GitHub repository.
+It performs the following steps:
+
+1. Checks the commits in the specified time range in the GitHub repository.
+2. Verifies that the commits in the specified time range are signed.
+2.1 Verifies that the commits in the specified time range are signed by the proper owner.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository resources.
+- Github API token must be provided to access the GitHub API.
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| access_token | string | True | GitHub API access token. |
+| owner | string | True | GitHub repository owner. |
+| repo | string | True | GitHub repository name. |
+| since | string | False | ISO 8601 date-time string. The beginning of the time range. |
+| until | string | False | ISO 8601 date-time string. The end of the time range. |
+| sha | string | False | The SHA of the commit to verify. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/2fa.md b/docs/configuration/initiatives/rules/github/org/2fa.md
new file mode 100644
index 000000000..644e07024
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/2fa.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Verify Two-Factor Authentication (2FA) Requirement Enabled
+title: Verify Two-Factor Authentication (2FA) Requirement Enabled
+---
+# Verify Two-Factor Authentication (2FA) Requirement Enabled
+**Type:** Rule
+**ID:** `github-org-2fa`
+**Source:** [v2/rules/github/org/2fa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/2fa.yaml)
+**Rego Source:** [2fa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/2fa.rego)
+**Labels:** GitHub, Organization
+
+Verify Two-factor Authentication is required in the GitHub organization.
+
+:::note
+This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/org/2fa@v2
+```
+
+## Mitigation
+Enforces two-factor authentication (2FA) for organizational accounts, significantly reducing the risk of unauthorized access through compromised credentials.
+
+
+## Description
+This rule verifies that two-factor authentication (2FA) is enabled for the organization by examining the provided evidence.
+It checks the organization's details (retrieved from the SARIF or equivalent evidence) and compares the value of the
+`organization_details.two_factor_requirement_enabled` field against the expected value.
+
+The rule iterates over the organization data in the evidence, and if the `two_factor_requirement_enabled` field does not match
+the desired value, a violation is recorded. This ensures that all organizational accounts enforce 2FA, providing an additional
+layer of security against unauthorized access.
+
+### **Evidence Requirements**
+- Evidence must include organization data with a field named `organization_details.two_factor_requirement_enabled`.
+- The data should come from a trusted source (e.g., a GitHub organization scan).
+- The evidence must clearly indicate whether 2FA is enabled.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=organization |
+
+## Rule Parameters (`with`)
+| Parameter | Default |
+|-----------|---------|
+| desired_value | True |
+
diff --git a/docs/configuration/initiatives/rules/github/org/_category_.json b/docs/configuration/initiatives/rules/github/org/_category_.json
new file mode 100644
index 000000000..1ce17e465
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Org",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/github/org/advanced-security.md b/docs/configuration/initiatives/rules/github/org/advanced-security.md
new file mode 100644
index 000000000..e74375a12
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/advanced-security.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Verify `advanced_security_enabled_for_new_repositories` setting
+title: Verify `advanced_security_enabled_for_new_repositories` setting
+---
+# Verify `advanced_security_enabled_for_new_repositories` setting
+**Type:** Rule
+**ID:** `github-org-advanced-security`
+**Source:** [v2/rules/github/org/advanced-security.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/advanced-security.yaml)
+**Rego Source:** [advanced-security.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/advanced-security.rego)
+**Labels:** GitHub, Organization
+
+Verify Advanced Security is enabled for new repositories in the GitHub organization.
+
+:::note
+This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/org/advanced-security@v2
+with:
+ desired_value: true
+```
+
+## Mitigation
+Enforces advanced security for new repositories in the organization, significantly reducing the risk of introducing vulnerabilities or unapproved software.
+
+
+## Description
+This rule verifies that advanced security is enabled for new repositories in the GitHub organization by examining the provided Discovery evidence.
+It checks the organization's details and compares the value of the
+`organization_details.advanced_security_enabled_for_new_repositories` field against the expected value.
+
+The rule iterates over the organization data in the evidence, and if the `advanced_security_enabled_for_new_repositories` field does not match
+the desired value, a violation is recorded. This ensures that all new repositories enforce advanced security, significantly reducing the risk of
+introducing vulnerabilities or unapproved software.
+
+### **Evidence Requirements**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=organization |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| desired_value | boolean | False | Desired value for the `advanced_security_enabled_for_new_repositories` setting. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/allow-admins.md b/docs/configuration/initiatives/rules/github/org/allow-admins.md
new file mode 100644
index 000000000..8ef25f7f2
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/allow-admins.md
@@ -0,0 +1,63 @@
+---
+sidebar_label: Allowed GitHub Organization Admins
+title: Allowed GitHub Organization Admins
+---
+# Allowed GitHub Organization Admins
+**Type:** Rule
+**ID:** `github-org-allowed-admins`
+**Source:** [v2/rules/github/org/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-admins.yaml)
+**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-admins.rego)
+**Labels:** GitHub, Organization
+
+Verify only users in the Allowed List have admin privileges in the GitHub organization.
+
+:::note
+This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/org/allow-admins@v2
+with:
+ allowed_admins:
+ - user1
+ - user2
+ - user3
+```
+
+## Mitigation
+Ensures that only approved users have admin privileges in the GitHub organization, reducing the risk of unauthorized access through compromised credentials.
+
+
+## Description
+This rule verifies that only users in the Allowed List have admin privileges in the GitHub organization.
+It checks the organization's details and compares the value of the
+`organization_details.admins` field against the expected value.
+
+The rule iterates over the organization data in the evidence, and if the `admins` field does not match
+the desired value, a violation is recorded. This ensures that only users in the Allowed List have admin privileges in the GitHub organization.
+
+### **Evidence Requirements**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=organization |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_admins | array | False | List of allowed GitHub organization admins. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/allow-users.md b/docs/configuration/initiatives/rules/github/org/allow-users.md
new file mode 100644
index 000000000..ca8df3d50
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/allow-users.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Allowed GitHub Organization Users
+title: Allowed GitHub Organization Users
+---
+# Allowed GitHub Organization Users
+**Type:** Rule
+**ID:** `github-org-allowed-users`
+**Source:** [v2/rules/github/org/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-users.yaml)
+**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-users.rego)
+**Labels:** GitHub, Organization
+
+Verify only users in the Allowed List have user access to the GitHub organization.
+
+:::note
+This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/org/allow-users@v2
+with:
+ allowed_users:
+ - "user1"
+ - "user2"
+```
+
+## Mitigation
+Ensures that only approved users have access to the GitHub organization, reducing the risk of unauthorized access.
+
+
+## Description
+This rule ensures that only users specified in the allowed list have access to the GitHub organization.
+It performs the following steps:
+
+1. Iterates over the users in the GitHub organization.
+2. Checks each user against the allowed list specified in the `with.allowed_users` configuration.
+ - If a user is not in the allowed list, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=organization |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_users | array | False | List of allowed users. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/create-private-repos.md b/docs/configuration/initiatives/rules/github/org/create-private-repos.md
new file mode 100644
index 000000000..60db251bb
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/create-private-repos.md
@@ -0,0 +1,63 @@
+---
+sidebar_label: Verify that members can create private repositories setting is configured
+title: Verify that members can create private repositories setting is configured
+---
+# Verify that members can create private repositories setting is configured
+**Type:** Rule
+**ID:** `github-org-create-private-repos`
+**Source:** [v2/rules/github/org/create-private-repos.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-private-repos.yaml)
+**Rego Source:** [create-private-repos.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-private-repos.rego)
+**Labels:** GitHub, Organization
+
+Verify only allowed users can create private repositories in the GitHub organization.
+
+:::note
+This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/org/create-private-repos@v2
+with:
+ allowed_users:
+ - "user1"
+ - "user2"
+```
+
+## Mitigation
+Ensures that only approved users can create private repositories in the GitHub organization, reducing the risk of unauthorized repository creation.
+
+
+## Description
+This rule ensures that only users specified in the allowed list can create private repositories in the GitHub organization.
+Note: this setting is supported only in GitHub Enterprise.
+It performs the following steps:
+
+1. Iterates over the users in the GitHub organization.
+2. Checks users' permissions to create private repositories against the allowed list specified in the `with.allowed_users` configuration.
+ - If a user not on the allowed list has permission to create private repositories, the rule flags this as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=organization |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_users | array | False | List of allowed users. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/create-repos.md b/docs/configuration/initiatives/rules/github/org/create-repos.md
new file mode 100644
index 000000000..8f3e68c18
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/create-repos.md
@@ -0,0 +1,60 @@
+---
+sidebar_label: Verify members_can_create_repositories setting
+title: Verify members_can_create_repositories setting
+---
+# Verify members_can_create_repositories setting
+**Type:** Rule
+**ID:** `github-org-create-repos`
+**Source:** [v2/rules/github/org/create-repos.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-repos.yaml)
+**Rego Source:** [create-repos.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-repos.rego)
+**Labels:** GitHub, Organization
+
+Verify only allowed users can create repositories in the GitHub organization.
+
+:::note
+This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/org/create-repos@v2
+with:
+ desired_value: false
+```
+
+## Mitigation
+Ensures that only approved users can create repositories in the GitHub organization, reducing the risk of unauthorized repository creation.
+
+
+## Description
+This rule ensures that only users specified in the allowed list can create repositories in the GitHub organization.
+It performs the following steps:
+
+1. Iterates over the users in the GitHub organization.
+2. Checks users' permissions to create repositories against the allowed list specified in the `with.allowed_users` configuration.
+ - If a user not in the allowed list has permission to create repositories, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=organization |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| desired_value | boolean | False | The desired value for the `members_can_create_repositories` setting. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md
new file mode 100644
index 000000000..6805700cf
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md
@@ -0,0 +1,60 @@
+---
+sidebar_label: Verify dependabot_alerts_enabled_for_new_repositories setting
+title: Verify dependabot_alerts_enabled_for_new_repositories setting
+---
+# Verify dependabot_alerts_enabled_for_new_repositories setting
+**Type:** Rule
+**ID:** `github-org-dependabot-alerts`
+**Source:** [v2/rules/github/org/dependabot-alerts.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-alerts.yaml)
+**Rego Source:** [dependabot-alerts.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-alerts.rego)
+**Labels:** GitHub, Organization
+
+Verify Dependabot alerts for new repositories are enabled in the GitHub organization.
+
+:::note
+This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/org/dependabot-alerts@v2
+with:
+ desired_value: true
+```
+
+## Mitigation
+Ensures that Dependabot alerts are enabled for new repositories in the GitHub organization, helping to identify and address vulnerabilities in dependencies.
+
+
+## Description
+This rule verifies that Dependabot alerts for new repositories are enabled in the GitHub organization.
+It performs the following steps:
+
+1. Checks the organization's settings for the `dependabot_alerts_enabled_for_new_repositories` field.
+2. Compares the value of this field against the desired value specified in the `with.desired_value` configuration.
+ - If the field does not match the desired value, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization settings.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=organization |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| desired_value | boolean | False | Desired value for the dependabot_alerts_enabled_for_new_repositories setting. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md
new file mode 100644
index 000000000..ae9bac2b0
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify dependabot_security_updates setting in security_and_analysis
+title: Verify dependabot_security_updates setting in security_and_analysis
+---
+# Verify dependabot_security_updates setting in security_and_analysis
+**Type:** Rule
+**ID:** `github-org-dependabot-security-updates-sa`
+**Source:** [v2/rules/github/org/dependabot-security-updates-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates-sa.yaml)
+**Rego Source:** [dependabot-security-updates-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates-sa.rego)
+**Labels:** GitHub, Organization
+
+Verify Dependabot security updates are configured in the GitHub organization.
+
+:::note
+This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/org/dependabot-security-updates-sa@v2
+```
+
+## Mitigation
+Ensures that Dependabot security updates are enabled in the GitHub organization, reducing the risk of vulnerabilities in dependencies.
+
+
+## Description
+This rule ensures that Dependabot security updates are enabled in the GitHub organization.
+It performs the following steps:
+
+1. Checks the security and analysis settings of the GitHub organization.
+2. Verifies that the Dependabot security updates setting is enabled.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=organization |
+
diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md
new file mode 100644
index 000000000..45e410708
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Verify dependabot_security_updates_enabled_for_new_repositories setting
+title: Verify dependabot_security_updates_enabled_for_new_repositories setting
+---
+# Verify dependabot_security_updates_enabled_for_new_repositories setting
+**Type:** Rule
+**ID:** `github-org-dependabot-security-updates`
+**Source:** [v2/rules/github/org/dependabot-security-updates.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates.yaml)
+**Rego Source:** [dependabot-security-updates.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates.rego)
+**Labels:** GitHub, Organization
+
+Verify Dependabot security updates for new repositories are configured in the GitHub organization.
+
+:::note
+This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/org/dependabot-security-updates@v2
+with:
+ desired_value: true
+```
+
+## Mitigation
+Ensures that Dependabot security updates are enabled for new repositories in the GitHub organization, reducing the risk of vulnerabilities in dependencies.
+
+
+## Description
+This rule ensures that Dependabot security updates are enabled for new repositories in the GitHub organization.
+It performs the following steps:
+
+1. Checks the security and analysis settings of the GitHub organization.
+2. Verifies that the Dependabot security updates setting is enabled for new repositories.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=organization |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| desired_value | boolean | False | Indicates if Dependabot security updates for new repositories are enabled. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/dependency-graph.md b/docs/configuration/initiatives/rules/github/org/dependency-graph.md
new file mode 100644
index 000000000..9999445b2
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/dependency-graph.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Verify dependency_graph_enabled_for_new_repositories setting
+title: Verify dependency_graph_enabled_for_new_repositories setting
+---
+# Verify dependency_graph_enabled_for_new_repositories setting
+**Type:** Rule
+**ID:** `github-org-dependency-graph`
+**Source:** [v2/rules/github/org/dependency-graph.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependency-graph.yaml)
+**Rego Source:** [dependency-graph.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependency-graph.rego)
+**Labels:** GitHub, Organization
+
+Verify dependency graph is enabled for new repositories in the GitHub organization.
+
+:::note
+This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/org/dependency-graph@v2
+with:
+ desired_value: true
+```
+
+## Mitigation
+Ensures that the dependency graph is enabled in the GitHub organization, providing better visibility into dependencies and potential vulnerabilities.
+
+
+## Description
+This rule ensures that the dependency graph is enabled in the GitHub organization.
+It performs the following steps:
+
+1. Checks the settings of the GitHub organization.
+2. Verifies that the dependency graph setting is enabled.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=organization |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| desired_value | boolean | False | Indicates if the dependency graph is enabled. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/max-admins.md b/docs/configuration/initiatives/rules/github/org/max-admins.md
new file mode 100644
index 000000000..458ae9876
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/max-admins.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Limit Admin Number in GitHub Organization
+title: Limit Admin Number in GitHub Organization
+---
+# Limit Admin Number in GitHub Organization
+**Type:** Rule
+**ID:** `github-org-max-admins`
+**Source:** [v2/rules/github/org/max-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/max-admins.yaml)
+**Rego Source:** [max-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/max-admins.rego)
+**Labels:** GitHub, Organization
+
+Verify the maximum number of GitHub organization admins is restricted.
+
+:::note
+This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/org/max-admins@v2
+with:
+ max_admins: 5
+```
+
+## Mitigation
+Ensures that the number of admins in the GitHub organization is kept within a manageable limit, reducing the risk of unauthorized administrative actions.
+
+
+## Description
+This rule ensures that the number of admins in the GitHub organization does not exceed the specified maximum.
+It performs the following steps:
+
+1. Checks the list of admins in the GitHub organization.
+2. Verifies that the number of admins does not exceed the value specified in the `with.max_admins` configuration.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=organization |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| max_admins | integer | False | Maximum number of admins allowed. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/old-secrets.md b/docs/configuration/initiatives/rules/github/org/old-secrets.md
new file mode 100644
index 000000000..fee218e54
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/old-secrets.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Verify GitHub Organization Secrets Are Not Too Old
+title: Verify GitHub Organization Secrets Are Not Too Old
+---
+# Verify GitHub Organization Secrets Are Not Too Old
+**Type:** Rule
+**ID:** `github-org-old-secrets`
+**Source:** [v2/rules/github/org/old-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/old-secrets.yaml)
+**Rego Source:** [old-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/old-secrets.rego)
+**Labels:** GitHub, Organization
+
+Verify secrets in the GitHub organization are not older than the specified threshold.
+
+:::note
+This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/org/old-secrets@v2
+with:
+ max_secret_age: 12
+```
+
+## Mitigation
+Ensures that old secrets are removed from the GitHub organization, reducing the risk of exposure of outdated and potentially compromised secrets.
+
+
+## Description
+This rule ensures that secrets in the GitHub organization are not older than the specified threshold.
+It performs the following steps:
+
+1. Checks the list of secrets in the GitHub organization.
+2. Verifies that no secrets are older than the value specified in the `with.max_secret_age` configuration.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=organization |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| max_secret_age | integer | False | Maximum age of secrets in months. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md
new file mode 100644
index 000000000..a09354b45
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md
@@ -0,0 +1,43 @@
+---
+sidebar_label: Verify `secret_scanning_push_protection_custom_link_enabled` Setting
+title: Verify `secret_scanning_push_protection_custom_link_enabled` Setting
+---
+# Verify `secret_scanning_push_protection_custom_link_enabled` Setting
+**Type:** Rule
+**ID:** `github-org-pp-custom-link`
+**Source:** [v2/rules/github/org/pp-custom-link.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/pp-custom-link.yaml)
+**Rego Source:** [pp-custom-link.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/pp-custom-link.rego)
+**Labels:** GitHub, Organization
+
+Verify secret scanning push protection custom link is enabled in the GitHub organization.
+
+:::note
+This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/org/pp-custom-link@v2
+```
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=organization |
+
+## Rule Parameters (`with`)
+| Parameter | Default |
+|-----------|---------|
+| desired_value | True |
+
diff --git a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md
new file mode 100644
index 000000000..ff0d21fe2
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify `secret_scanning_push_protection` Setting
+title: Verify `secret_scanning_push_protection` Setting
+---
+# Verify `secret_scanning_push_protection` Setting
+**Type:** Rule
+**ID:** `github-org-push-protection-sa`
+**Source:** [v2/rules/github/org/push-protection-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection-sa.yaml)
+**Rego Source:** [push-protection-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection-sa.rego)
+**Labels:** GitHub, Organization
+
+Verify secret scanning push protection is configured in the GitHub repository.
+
+:::note
+This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/org/push-protection-sa@v2
+```
+
+## Mitigation
+Ensure that secret scanning push protection is enabled to provide better security for secret scanning in the GitHub organization.
+
+
+## Description
+This rule ensures that secret scanning push protection is enabled in the security and analysis settings of the GitHub organization.
+It performs the following steps:
+
+1. Checks the security and analysis settings of the GitHub organization.
+2. Verifies that the secret scanning push protection setting is enabled.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=organization |
+
diff --git a/docs/configuration/initiatives/rules/github/org/push-protection.md b/docs/configuration/initiatives/rules/github/org/push-protection.md
new file mode 100644
index 000000000..5aadbeab3
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/push-protection.md
@@ -0,0 +1,60 @@
+---
+sidebar_label: Verify `secret_scanning_push_protection_enabled_for_new_repositories`
+ Setting
+title: Verify `secret_scanning_push_protection_enabled_for_new_repositories` Setting
+---
+# Verify `secret_scanning_push_protection_enabled_for_new_repositories` Setting
+**Type:** Rule
+**ID:** `github-org-push-protection`
+**Source:** [v2/rules/github/org/push-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection.yaml)
+**Rego Source:** [push-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection.rego)
+**Labels:** GitHub, Organization
+
+Verify secret scanning push protection is enabled for new repositories in the GitHub organization.
+
+:::note
+This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/org/push-protection@v2
+with:
+ desired_value: true
+```
+
+## Mitigation
+Ensures that secret scanning push protection is enabled for new repositories in the GitHub organization, providing better security for secret scanning.
+
+
+## Description
+This rule ensures that secret scanning push protection is enabled for new repositories in the GitHub organization.
+It performs the following steps:
+
+1. Checks the security and analysis settings of the GitHub organization.
+2. Verifies that the secret scanning push protection setting is enabled for new repositories.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=organization |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| desired_value | boolean | False | Indicates if the secret scanning push protection is enabled for new repositories. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/repo-visibility.md b/docs/configuration/initiatives/rules/github/org/repo-visibility.md
new file mode 100644
index 000000000..98603f352
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/repo-visibility.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Verify Repo Visibility Setting
+title: Verify Repo Visibility Setting
+---
+# Verify Repo Visibility Setting
+**Type:** Rule
+**ID:** `github-org-repo-visibility`
+**Source:** [v2/rules/github/org/repo-visibility.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/repo-visibility.yaml)
+**Rego Source:** [repo-visibility.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/repo-visibility.rego)
+**Labels:** GitHub, Organization
+
+Verify only repositories in the Allowed List are public in the GitHub organization.
+
+:::note
+This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/org/repo-visibility@v2
+with:
+ allowed_repo_names:
+ - "my_org/.*"
+ - "my_org/my_repo/.*"
+```
+
+## Mitigation
+Ensure that the repository visibility setting is configured correctly to reduce the risk of unauthorized access to repositories.
+
+
+## Description
+This rule ensures that the repository visibility setting is configured correctly in the GitHub organization.
+It performs the following steps:
+
+1. Checks the visibility settings of repositories in the GitHub organization.
+2. Verifies that the visibility setting matches the value specified in the `with.desired_visibility` configuration.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=organization |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_repo_names | array | False | List of repository pattern allowed to be visible. |
+
diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md
new file mode 100644
index 000000000..16fabb0dd
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify `secret_scanning` Setting in `security_and_analysis`
+title: Verify `secret_scanning` Setting in `security_and_analysis`
+---
+# Verify `secret_scanning` Setting in `security_and_analysis`
+**Type:** Rule
+**ID:** `github-org-secret-scanning-sa`
+**Source:** [v2/rules/github/org/secret-scanning-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning-sa.yaml)
+**Rego Source:** [secret-scanning-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning-sa.rego)
+**Labels:** GitHub, Organization
+
+Verify secret scanning is configured in the GitHub repository.
+
+:::note
+This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/org/secret-scanning-sa@v2
+```
+
+## Mitigation
+Ensure that the Secret Scanning setting is enabled to detect and prevent the exposure of secrets in the organization’s repositories, enhancing security.
+
+
+## Description
+This rule checks if the `secret_scanning` setting is enabled to detect and prevent the exposure of secrets in the organization’s repositories.
+It performs the following steps:
+
+1. Checks the secret scanning settings of the GitHub organization.
+2. Verifies that the secret scanning setting is enabled.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=organization |
+
diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning.md b/docs/configuration/initiatives/rules/github/org/secret-scanning.md
new file mode 100644
index 000000000..aad5af60f
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/secret-scanning.md
@@ -0,0 +1,43 @@
+---
+sidebar_label: Verify secret_scanning_enabled_for_new_repositories setting
+title: Verify secret_scanning_enabled_for_new_repositories setting
+---
+# Verify secret_scanning_enabled_for_new_repositories setting
+**Type:** Rule
+**ID:** `github-org-secret-scanning`
+**Source:** [v2/rules/github/org/secret-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning.yaml)
+**Rego Source:** [secret-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning.rego)
+**Labels:** GitHub, Organization
+
+Verify secret scanning is configured for new repositories in the GitHub organization.
+
+:::note
+This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/org/secret-scanning@v2
+```
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=organization |
+
+## Rule Parameters (`with`)
+| Parameter | Default |
+|-----------|---------|
+| desired_value | True |
+
diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md
new file mode 100644
index 000000000..ba7944eb9
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify `secret_scanning_validity_checks` Setting in `security_and_analysis`
+title: Verify `secret_scanning_validity_checks` Setting in `security_and_analysis`
+---
+# Verify `secret_scanning_validity_checks` Setting in `security_and_analysis`
+**Type:** Rule
+**ID:** `github-org-validity-checks-sa`
+**Source:** [v2/rules/github/org/validity-checks-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks-sa.yaml)
+**Rego Source:** [validity-checks-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks-sa.rego)
+**Labels:** GitHub, Organization
+
+Verify validity checks for secrets are configured for the GitHub organization.
+
+:::note
+This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/org/validity-checks-sa@v2
+```
+
+## Mitigation
+Ensure that the Validity checks under GitHub organization setting is enabled to maintain the integrity of the organization’s repositories, preventing potential issues and vulnerabilities.
+
+
+## Description
+This rule checks if the `validity_checks` under GitHub organization setting is enabled to ensure the integrity of the organization’s repositories.
+It performs the following steps:
+
+1. Checks the validity checks settings of the GitHub organization.
+2. Verifies that the validity checks setting is enabled.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=organization |
+
diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks.md b/docs/configuration/initiatives/rules/github/org/validity-checks.md
new file mode 100644
index 000000000..e0e954854
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/validity-checks.md
@@ -0,0 +1,43 @@
+---
+sidebar_label: Verify `secret_scanning_validity_checks_enabled` Setting
+title: Verify `secret_scanning_validity_checks_enabled` Setting
+---
+# Verify `secret_scanning_validity_checks_enabled` Setting
+**Type:** Rule
+**ID:** `github-org-validity-checks`
+**Source:** [v2/rules/github/org/validity-checks.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks.yaml)
+**Rego Source:** [validity-checks.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks.rego)
+**Labels:** GitHub, Organization
+
+Verify validity checks for secrets are configured for the GitHub repository.
+
+:::note
+This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/org/validity-checks@v2
+```
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=organization |
+
+## Rule Parameters (`with`)
+| Parameter | Default |
+|-----------|---------|
+| desired_value | True |
+
diff --git a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md
new file mode 100644
index 000000000..50f953fd3
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify GitHub Organization Requires Signoff on Web Commits
+title: Verify GitHub Organization Requires Signoff on Web Commits
+---
+# Verify GitHub Organization Requires Signoff on Web Commits
+**Type:** Rule
+**ID:** `github-org-web-commit-signoff`
+**Source:** [v2/rules/github/org/web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/web-commit-signoff.yaml)
+**Rego Source:** [web-commit-signoff.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/web-commit-signoff.rego)
+**Labels:** GitHub, Organization
+
+Verify contributors sign commits through the GitHub web interface.
+
+:::note
+This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/org/web-commit-signoff@v2
+```
+
+## Mitigation
+Ensure that the Web Commit Signoff setting under the GitHub organization is enabled to require signoff on all web-based commits, enhancing security and accountability.
+
+
+## Description
+This rule checks if the `web_commit_signoff` setting is enabled to ensure all web-based commits are signed off.
+It performs the following steps:
+
+1. Checks the web commit signoff settings of the GitHub organization.
+2. Verifies that the web commit signoff setting is enabled.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=organization |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/_category_.json b/docs/configuration/initiatives/rules/github/repository/_category_.json
new file mode 100644
index 000000000..e93f68442
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Repository",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/github/repository/branch-protection.md b/docs/configuration/initiatives/rules/github/repository/branch-protection.md
new file mode 100644
index 000000000..89069fd1d
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/branch-protection.md
@@ -0,0 +1,63 @@
+---
+sidebar_label: Verify Branch Protection Setting
+title: Verify Branch Protection Setting
+---
+# Verify Branch Protection Setting
+**Type:** Rule
+**ID:** `github-repo-branch-protection`
+**Source:** [v2/rules/github/repository/branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-protection.yaml)
+**Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-protection.rego)
+**Labels:** GitHub, Repository
+
+Verify branch protection is configured in the GitHub repository.
+
+:::note
+This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/repository/branch-protection@v2
+with:
+ desired_protected: true
+ branches:
+ - 'main'
+ - 'master'
+```
+
+## Mitigation
+Ensure branch protection settings are correctly configured to reduce the risk of unauthorized changes.
+
+
+## Description
+This rule ensures that branch protection is configured in the GitHub repository.
+It performs the following steps:
+
+1. Checks the repository settings for branch protection.
+2. Verifies that the protection settings match the expected values.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=repository |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| desired_protected | boolean | False | Desired branch protection setting. |
+| branches | array | False | List of branches to be protected. |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/branch-verification.md b/docs/configuration/initiatives/rules/github/repository/branch-verification.md
new file mode 100644
index 000000000..48232d5e9
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/branch-verification.md
@@ -0,0 +1,57 @@
+---
+sidebar_label: Verify Branch Verification Setting
+title: Verify Branch Verification Setting
+---
+# Verify Branch Verification Setting
+**Type:** Rule
+**ID:** `github-repo-branch-verification`
+**Source:** [v2/rules/github/repository/branch-verification.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-verification.yaml)
+**Rego Source:** [branch-verification.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-verification.rego)
+**Labels:** GitHub, Repository
+
+Verify branch verification in the GitHub repository matches the value defined in the configuration file.
+
+:::note
+This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/repository/branch-verification@v2
+```
+
+## Mitigation
+Ensures that branch verification settings are correctly configured, reducing the risk of unauthorized changes.
+
+
+## Description
+This rule ensures that branch verification in the GitHub repository matches the value defined in the configuration file.
+It performs the following steps:
+
+1. Checks the repository settings for branch verification.
+2. Verifies that the verification setting matches the expected value.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=repository |
+
+## Rule Parameters (`with`)
+| Parameter | Default |
+|-----------|---------|
+| desired_verified | True |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md
new file mode 100644
index 000000000..dec363eed
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify All Commits Are Signed in Repository
+title: Verify All Commits Are Signed in Repository
+---
+# Verify All Commits Are Signed in Repository
+**Type:** Rule
+**ID:** `github-repo-signed-commits`
+**Source:** [v2/rules/github/repository/check-signed-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/check-signed-commits.yaml)
+**Rego Source:** [check-signed-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/check-signed-commits.rego)
+**Labels:** GitHub, Repository
+
+Verify all commits in the GitHub repository are signed.
+
+:::note
+This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/repository/check-signed-commits@v2
+```
+
+## Mitigation
+Ensures that all commits are signed, reducing the risk of unauthorized changes.
+
+
+## Description
+This rule ensures that all commits in the GitHub repository are signed.
+It performs the following steps:
+
+1. Iterates over the commits in the repository.
+2. Checks each commit for a valid signature.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository commits.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=repository |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md
new file mode 100644
index 000000000..1d266e99a
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify Default Branch Protection
+title: Verify Default Branch Protection
+---
+# Verify Default Branch Protection
+**Type:** Rule
+**ID:** `github-repo-default-branch-protection`
+**Source:** [v2/rules/github/repository/default-branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/default-branch-protection.yaml)
+**Rego Source:** [default-branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/default-branch-protection.rego)
+**Labels:** GitHub, Repository
+
+Verify the default branch protection is configured in the GitHub repository.
+
+:::note
+This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/repository/default-branch-protection@v2
+```
+
+## Mitigation
+Ensures that the default branch is protected, reducing the risk of unauthorized changes.
+
+
+## Description
+This rule ensures that the default branch protection is configured in the GitHub repository.
+It performs the following steps:
+
+1. Checks the repository settings for default branch protection configuration.
+2. Verifies that the configuration matches the expected settings.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=repository |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/dependabot.md b/docs/configuration/initiatives/rules/github/repository/dependabot.md
new file mode 100644
index 000000000..08b9ba9ba
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/dependabot.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify Dependabot security updates setting
+title: Verify Dependabot security updates setting
+---
+# Verify Dependabot security updates setting
+**Type:** Rule
+**ID:** `github-repo-dependabot`
+**Source:** [v2/rules/github/repository/dependabot.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/dependabot.yaml)
+**Rego Source:** [dependabot.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/dependabot.rego)
+**Labels:** GitHub, Repository
+
+Verify Dependabot security updates are configured in the GitHub repository.
+
+:::note
+This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/repository/dependabot@v2
+```
+
+## Mitigation
+Ensures that Dependabot security updates are enabled, reducing the risk of vulnerabilities in dependencies.
+
+
+## Description
+This rule ensures that Dependabot security updates are configured in the GitHub repository.
+It performs the following steps:
+
+1. Checks the repository settings for Dependabot security updates configuration.
+2. Verifies that the configuration matches the expected settings.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=repository |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md
new file mode 100644
index 000000000..3893a88d4
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify Only Ephemeral Runners Exist in Repository
+title: Verify Only Ephemeral Runners Exist in Repository
+---
+# Verify Only Ephemeral Runners Exist in Repository
+**Type:** Rule
+**ID:** `github-repo-ephemeral-runners-only`
+**Source:** [v2/rules/github/repository/ephemeral-runners-only.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/ephemeral-runners-only.yaml)
+**Rego Source:** [ephemeral-runners-only.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/ephemeral-runners-only.rego)
+**Labels:** GitHub, Repository
+
+Verify self-hosted runners are disallowed in the GitHub repository.
+
+:::note
+This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/repository/ephemeral-runners-only@v2
+```
+
+## Mitigation
+Ensures that only ephemeral runners are used, reducing the risk of persistent runner vulnerabilities.
+
+
+## Description
+This rule ensures that only ephemeral runners are used in the GitHub repository.
+It performs the following steps:
+
+1. Checks the repository settings for runner configuration.
+2. Verifies that only ephemeral runners are used.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=repository |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md
new file mode 100644
index 000000000..8f2e89285
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify No Cache Usage Exists in Repository
+title: Verify No Cache Usage Exists in Repository
+---
+# Verify No Cache Usage Exists in Repository
+**Type:** Rule
+**ID:** `github-repo-no-cache-usage`
+**Source:** [v2/rules/github/repository/no-cache-usage.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-cache-usage.yaml)
+**Rego Source:** [no-cache-usage.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-cache-usage.rego)
+**Labels:** GitHub, Repository
+
+Verify the GitHub repository has no cache usage.
+
+:::note
+This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/repository/no-cache-usage@v2
+```
+
+## Mitigation
+Ensures that no cache is used, reducing the risk of outdated or insecure dependencies.
+
+
+## Description
+This rule ensures that no cache is used in the GitHub repository.
+It performs the following steps:
+
+1. Checks the repository settings for cache usage.
+2. Verifies that no cache is used.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=repository |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md
new file mode 100644
index 000000000..be2c1a241
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify No Organization Secrets Exist in Repository
+title: Verify No Organization Secrets Exist in Repository
+---
+# Verify No Organization Secrets Exist in Repository
+**Type:** Rule
+**ID:** `github-repo-no-org-secrets`
+**Source:** [v2/rules/github/repository/no-org-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-org-secrets.yaml)
+**Rego Source:** [no-org-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-org-secrets.rego)
+**Labels:** GitHub, Repository
+
+Verify no organization secrets exist in the GitHub repository.
+
+:::note
+This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/repository/no-org-secrets@v2
+```
+
+## Mitigation
+Ensures that no organization secrets are used, reducing the risk of unauthorized access.
+
+
+## Description
+This rule ensures that no organization secrets are used in the GitHub repository.
+It performs the following steps:
+
+1. Checks the repository settings for organization secrets.
+2. Verifies that no organization secrets are used.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=repository |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/old-secrets.md b/docs/configuration/initiatives/rules/github/repository/old-secrets.md
new file mode 100644
index 000000000..fd5293186
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/old-secrets.md
@@ -0,0 +1,57 @@
+---
+sidebar_label: Verify No Old Secrets Exist in Repository
+title: Verify No Old Secrets Exist in Repository
+---
+# Verify No Old Secrets Exist in Repository
+**Type:** Rule
+**ID:** `github-repo-old-secrets`
+**Source:** [v2/rules/github/repository/old-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/old-secrets.yaml)
+**Rego Source:** [old-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/old-secrets.rego)
+**Labels:** GitHub, Repository
+
+Verify secrets in the GitHub repository are not older than the specified threshold.
+
+:::note
+This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/repository/old-secrets@v2
+```
+
+## Mitigation
+Ensures that secrets are rotated regularly, reducing the risk of compromised secrets.
+
+
+## Description
+This rule ensures that secrets in the GitHub repository are not older than the specified threshold.
+It performs the following steps:
+
+1. Checks the repository settings for secrets.
+2. Verifies that the age of each secret does not exceed the specified threshold.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=repository |
+
+## Rule Parameters (`with`)
+| Parameter | Default |
+|-----------|---------|
+| max_secret_age | 12 |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/push-protection.md b/docs/configuration/initiatives/rules/github/repository/push-protection.md
new file mode 100644
index 000000000..7bedd3d91
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/push-protection.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify Push Protection Setting
+title: Verify Push Protection Setting
+---
+# Verify Push Protection Setting
+**Type:** Rule
+**ID:** `github-repo-push-protection`
+**Source:** [v2/rules/github/repository/push-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/push-protection.yaml)
+**Rego Source:** [push-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/push-protection.rego)
+**Labels:** GitHub, Repository
+
+Verify `secret_scanning_push_protection` is configured in the GitHub repository.
+
+:::note
+This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/repository/push-protection@v2
+```
+
+## Mitigation
+Ensures that push protection is enabled, reducing the risk of unauthorized changes.
+
+
+## Description
+This rule ensures that push protection is enabled in the GitHub repository.
+It performs the following steps:
+
+1. Checks the repository settings for push protection.
+2. Verifies that push protection is enabled.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=repository |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/repo-private.md b/docs/configuration/initiatives/rules/github/repository/repo-private.md
new file mode 100644
index 000000000..3f093b80b
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/repo-private.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify Repository Is Private
+title: Verify Repository Is Private
+---
+# Verify Repository Is Private
+**Type:** Rule
+**ID:** `github-repo-private`
+**Source:** [v2/rules/github/repository/repo-private.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/repo-private.yaml)
+**Rego Source:** [repo-private.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/repo-private.rego)
+**Labels:** GitHub, Repository
+
+Verify the GitHub repository is private.
+
+:::note
+This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/repository/repo-private@v2
+```
+
+## Mitigation
+Ensures that the repository is private, reducing the risk of unauthorized access.
+
+
+## Description
+This rule ensures that the GitHub repository is private.
+It performs the following steps:
+
+1. Checks the repository settings for privacy.
+2. Verifies that the repository is private.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=repository |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md
new file mode 100644
index 000000000..c36877398
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify secret_scanning setting
+title: Verify secret_scanning setting
+---
+# Verify secret_scanning setting
+**Type:** Rule
+**ID:** `github-repo-secret-scanning`
+**Source:** [v2/rules/github/repository/secret-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/secret-scanning.yaml)
+**Rego Source:** [secret-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/secret-scanning.rego)
+**Labels:** GitHub, Repository
+
+Verify `secret_scanning` is configured in the GitHub repository.
+
+:::note
+This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/repository/secret-scanning@v2
+```
+
+## Mitigation
+Ensures that Secret Scanning is configured, reducing the risk of leaking sensitive information.
+
+
+## Description
+This rule ensures that the `secret_scanning` is configured in the GitHub repository.
+It performs the following steps:
+
+1. Checks the repository settings for `secret_scanning` configuration.
+2. Verifies that the configuration matches the expected settings.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=repository |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/signed-commits.md b/docs/configuration/initiatives/rules/github/repository/signed-commits.md
new file mode 100644
index 000000000..7d5d1e7a1
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/signed-commits.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify All Commits Are Signed in Repository
+title: Verify All Commits Are Signed in Repository
+---
+# Verify All Commits Are Signed in Repository
+**Type:** Rule
+**ID:** `github-repo-signed-commits`
+**Source:** [v2/rules/github/repository/signed-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/signed-commits.yaml)
+**Rego Source:** [signed-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/signed-commits.rego)
+**Labels:** GitHub, Repository
+
+Verify all commits are signed in a repository attestation.
+
+:::note
+This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/repository/signed-commits@v2
+```
+
+## Mitigation
+Ensures that all commits are signed, reducing the risk of unauthorized changes.
+
+
+## Description
+This rule ensures that all commits in the GitHub repository are signed.
+It performs the following steps:
+
+1. Iterates over the commits in the repository.
+2. Checks each commit for a valid signature.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository commits.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=repository |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/validity-checks.md b/docs/configuration/initiatives/rules/github/repository/validity-checks.md
new file mode 100644
index 000000000..4b385d1f0
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/validity-checks.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify secret scanning.
+title: Verify secret scanning.
+---
+# Verify secret scanning.
+**Type:** Rule
+**ID:** `github-repo-validity-checks`
+**Source:** [v2/rules/github/repository/validity-checks.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/validity-checks.yaml)
+**Rego Source:** [validity-checks.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/validity-checks.rego)
+**Labels:** GitHub, Repository
+
+Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories.
+
+:::note
+This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/repository/validity-checks@v2
+```
+
+## Mitigation
+Ensure that the validity checks are set in the GitHub organization and all the repositories.
+
+
+## Description
+This rule ensures that both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories.
+It performs the following steps:
+
+1. Checks the organization settings for `secret_scanning_validity_checks` and `security_and_analysis`.
+2. Verifies that the settings are configured as expected.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=repository |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/visibility.md b/docs/configuration/initiatives/rules/github/repository/visibility.md
new file mode 100644
index 000000000..897e4c6fb
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/visibility.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Allowed Public Repositories
+title: Allowed Public Repositories
+---
+# Allowed Public Repositories
+**Type:** Rule
+**ID:** `github-repo-visibility`
+**Source:** [v2/rules/github/repository/visibility.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/visibility.yaml)
+**Rego Source:** [visibility.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/visibility.rego)
+**Labels:** GitHub, Repository
+
+Verify only GitHub repositories in the Allowed List are public.
+
+:::note
+This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/repository/visibility@v2
+with:
+ allowed_repo_names:
+ - my-org/.*
+ - my-org/my-repo.*
+```
+
+## Mitigation
+Ensures that only allowed repositories are public, reducing the risk of unauthorized access.
+
+
+## Description
+This rule ensures that only GitHub repositories in the Allowed List are public.
+It performs the following steps:
+
+1. Checks the repository settings for visibility.
+2. Verifies that the repository is public only if it is in the Allowed List.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=repository |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_repo_names | string | False | List of allowed repository patterns. |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md
new file mode 100644
index 000000000..224fb90da
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify Repository Requires Commit Signoff
+title: Verify Repository Requires Commit Signoff
+---
+# Verify Repository Requires Commit Signoff
+**Type:** Rule
+**ID:** `github-repo-web-commit-signoff`
+**Source:** [v2/rules/github/repository/web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/web-commit-signoff.yaml)
+**Rego Source:** [web-commit-signoff.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/web-commit-signoff.rego)
+**Labels:** GitHub, Repository
+
+Verify contributors sign off on commits to the GitHub repository through the GitHub web interface.
+
+:::note
+This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/repository/web-commit-signoff@v2
+```
+
+## Mitigation
+Ensure that the repository requires signoff on all commits made through the GitHub web interface, enhancing security and accountability.
+
+
+## Description
+This rule checks if the repository requires signoff on all commits made through the GitHub web interface.
+It performs the following steps:
+
+1. Checks the repository settings for commit signoff.
+2. Verifies that the repository requires signoff on all commits made through the GitHub web interface.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github - asset_type=repository |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/_category_.json b/docs/configuration/initiatives/rules/gitlab/_category_.json
new file mode 100644
index 000000000..d41c80a07
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Gitlab",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/gitlab/api/_category_.json b/docs/configuration/initiatives/rules/gitlab/api/_category_.json
new file mode 100644
index 000000000..1cd6c97e0
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/api/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Gitlab API",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/gitlab/api/push-rules.md b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md
new file mode 100644
index 000000000..61a775b66
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md
@@ -0,0 +1,64 @@
+---
+sidebar_label: Set Push Rules in GitLab
+title: Set Push Rules in GitLab
+---
+# Set Push Rules in GitLab
+**Type:** Rule
+**ID:** `gitlab-api-push-rules`
+**Source:** [v2/rules/gitlab/api/push-rules.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/push-rules.yaml)
+**Rego Source:** [push-rules.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/push-rules.rego)
+**Labels:** Gitlab, API
+
+Verify GitLab push rules are configured via the API.
+
+:::tip
+Evidence **IS NOT** required for this rule.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/api/push-rules@v2
+with:
+ api_token: '{{ .Args.Token }}'
+ project: my_project
+ push_rule:
+ commit_message_regex: .*hotfix:.*
+ commit_message_negative_regex: .*fixme.*
+ branch_name_regex: .*main.*
+ deny_delete_tag: true
+ member_check: true
+ prevent_secrets: true
+ author_email_regex: .*@example.com
+ file_name_regex: "abc"
+ max_file_size: 100
+ commit_committer_name_check: "enabled"
+ reject_unsigned_commits: "enabled"
+```
+
+## Description
+This rule ensures that GitLab push rules are configured via the API.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the push rules are configured via the API.
+2.1 Verifies that the push rules are configured with the proper settings.
+2.2 Verifies that the push rules are configured with the proper regular expressions.
+2.3 Verifies that the push rules are configured with the proper file size.
+2.4 Verifies that the push rules are configured with the proper member check.
+2.5 Verifies that the push rules are configured with the proper secrets prevention.
+2.6 Verifies that the push rules are configured with the proper tag deletion prevention.
+2.7 Verifies that the push rules are configured with the proper author email regular expression.
+2.8 Verifies that the push rules are configured with the proper file name regular expression.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+- GitLab API token must be provided to access the GitLab API.
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| api_token | string | True | GitLab API access token. |
+| project | string | True | GitLab project name. |
+| push_rule | object | True | GitLab push rules. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md
new file mode 100644
index 000000000..0abbada93
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md
@@ -0,0 +1,37 @@
+---
+sidebar_label: Sign Selected Commits in GitLab
+title: Sign Selected Commits in GitLab
+---
+# Sign Selected Commits in GitLab
+**Type:** Rule
+**ID:** `gitlab-api-signed-commits-list`
+**Source:** [v2/rules/gitlab/api/signed-commits-list.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-list.yaml)
+**Rego Source:** [signed-commits-list.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-list.rego)
+**Labels:** Gitlab, API
+
+Verify the selected commits are signed in the GitLab organization.
+
+:::tip
+Evidence **IS NOT** required for this rule.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/api/signed-commits-list@v2
+with:
+ commit_id_list:
+ - 'commit1'
+ - 'commit2'
+ - 'commit3'
+ private_token: {{ .Args.Token }}
+ project_id: {{ .Args.ProjectID }}
+```
+
+## Rule Parameters (`with`)
+| Parameter | Default |
+|-----------|---------|
+| commit_id_list | [] |
+| private_token | |
+| project_id | |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md
new file mode 100644
index 000000000..9f526d4e8
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Sign Selected Commit Range in GitLab
+title: Sign Selected Commit Range in GitLab
+---
+# Sign Selected Commit Range in GitLab
+**Type:** Rule
+**ID:** `gitlab-api-signed-commits-range`
+**Source:** [v2/rules/gitlab/api/signed-commits-range.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-range.yaml)
+**Rego Source:** [signed-commits-range.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-range.rego)
+**Labels:** Gitlab, API
+
+Verify the selected range of commits is signed via the GitLab API.
+
+:::tip
+Evidence **IS NOT** required for this rule.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/api/signed-commits-range@v2
+with:
+ since: "2021-01-01T00:00:00Z"
+ until: "2021-01-31T23:59:59Z"
+ project_id: my_project_id
+ private_token: '{{ .Args.Token }}'
+```
+
+## Mitigation
+Ensure that the commits in the specified time range are signed in the GitLab repository.
+
+
+## Description
+This rule ensures that the commits in the specified time range are signed in the GitLab repository.
+It performs the following steps:
+
+1. Checks the commits in the specified time range in the GitLab repository.
+2. Verifies that the commits in the specified time range are signed.
+2.1 Verifies that the commits in the specified time range are signed by the proper owner.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab repository resources.
+- GitLab API token must be provided to access the GitLab API.
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| since | string | False | ISO 8601 date-time string. The beginning of the time range. |
+| until | string | False | ISO 8601 date-time string. The end of the time range. |
+| project_id | string | True | GitLab project ID. |
+| private_token | string | True | GitLab API access token. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/org/_category_.json b/docs/configuration/initiatives/rules/gitlab/org/_category_.json
new file mode 100644
index 000000000..1ce17e465
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/org/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Org",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md
new file mode 100644
index 000000000..73c7c93f6
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Allowed Admins in GitLab Organization
+title: Allowed Admins in GitLab Organization
+---
+# Allowed Admins in GitLab Organization
+**Type:** Rule
+**ID:** `gitlab-org-allowed-admins`
+**Source:** [v2/rules/gitlab/org/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-admins.yaml)
+**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-admins.rego)
+**Labels:** Gitlab, Organization
+
+Verify only users in the Allowed List have admin privileges in the GitLab organization.
+
+:::note
+This rule requires Gitlab Organization Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/org/allow-admins@v2
+with:
+ allowed_admins:
+ - "user1"
+ - "user2"
+ - "user3"
+```
+
+## Mitigation
+Ensure that only users in the Allowed List have admin privileges in the GitLab organization to reduce the risk of unauthorized changes.
+
+
+## Description
+This rule ensures that only users in the Allowed List have admin privileges in the GitLab organization.
+It performs the following steps:
+
+1. Checks the settings of the GitLab organization.
+2. Verifies that only users in the Allowed List have admin privileges.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=organization |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_admins | array | False | List of users allowed to have admin privileges in the GitLab organization. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md
new file mode 100644
index 000000000..3e2bdf5c5
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Restrict Token Scopes in GitLab
+title: Restrict Token Scopes in GitLab
+---
+# Restrict Token Scopes in GitLab
+**Type:** Rule
+**ID:** `gitlab-org-allowed-token-scope`
+**Source:** [v2/rules/gitlab/org/allow-token-scopes.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-token-scopes.yaml)
+**Rego Source:** [allow-token-scopes.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-token-scopes.rego)
+**Labels:** Gitlab, Organization
+
+Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission.
+
+:::note
+This rule requires Gitlab Organization Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/org/allow-token-scopes@v2
+with:
+ allowed_token_scopes:
+ - api
+ - read_api
+ - read_repository
+ - read_registry
+```
+
+## Description
+This rule ensures that all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission.
+It performs the following steps:
+
+1. Checks the settings of the GitLab organization.
+2. Verifies that all tokens are restricted to allowed scopes.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=organization |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_token_scopes | array | False | List of allowed token scopes in the GitLab organization. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md
new file mode 100644
index 000000000..cdc185c53
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Allowed Users in GitLab Organization
+title: Allowed Users in GitLab Organization
+---
+# Allowed Users in GitLab Organization
+**Type:** Rule
+**ID:** `gitlab-org-allowed-users`
+**Source:** [v2/rules/gitlab/org/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-users.yaml)
+**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-users.rego)
+**Labels:** Gitlab, Organization
+
+Verify only users in the Allowed List have access to the GitLab organization.
+
+:::note
+This rule requires Gitlab Organization Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/org/allow-users@v2
+with:
+ allowed_users:
+ - "user1"
+ - "user2"
+ - "user3"
+```
+
+## Mitigation
+Ensure that only users in the Allowed List have access to the GitLab organization to reduce the risk of unauthorized access.
+
+
+## Description
+This rule ensures that only users in the Allowed List have access to the GitLab organization.
+It performs the following steps:
+
+1. Checks the settings of the GitLab organization.
+2. Verifies that only users in the Allowed List have access.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=organization |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_users | array | False | List of users allowed to have access to the GitLab organization. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md
new file mode 100644
index 000000000..0486fbdf8
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Block Users in GitLab Organization
+title: Block Users in GitLab Organization
+---
+# Block Users in GitLab Organization
+**Type:** Rule
+**ID:** `gitlab-org-blocked-users`
+**Source:** [v2/rules/gitlab/org/blocked-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/blocked-users.yaml)
+**Rego Source:** [blocked-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/blocked-users.rego)
+**Labels:** Gitlab, Organization
+
+Verify no users in the GitLab organization are on the block list.
+
+:::note
+This rule requires Gitlab Organization Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/org/blocked-users@v2
+with:
+ blocked_users:
+ - "user1"
+ - "user2"
+ - "user3"
+```
+
+## Mitigation
+Ensure that no users are on the block list in the GitLab organization to reduce the risk of unauthorized access.
+
+
+## Description
+This rule ensures that no users in the GitLab organization are on the block list.
+It performs the following steps:
+
+1. Checks the settings of the GitLab organization.
+2. Verifies that no users are on the block list.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=organization |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| blocked_users | array | False | List of users blocked in the GitLab organization. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md
new file mode 100644
index 000000000..824fc4a93
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Prevent Token Expiration in GitLab Organization
+title: Prevent Token Expiration in GitLab Organization
+---
+# Prevent Token Expiration in GitLab Organization
+**Type:** Rule
+**ID:** `gitlab-org-token-about-to-expire`
+**Source:** [v2/rules/gitlab/org/expiring-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/expiring-tokens.yaml)
+**Rego Source:** [expiring-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/expiring-tokens.rego)
+**Labels:** Gitlab, Organization
+
+Verify no GitLab organization tokens are about to expire.
+
+:::note
+This rule requires Gitlab Organization Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/org/expiring-tokens@v2
+with:
+ exiring_in_days: 30
+```
+
+## Mitigation
+Ensure that no GitLab organization tokens are about to expire to prevent service disruption.
+
+
+## Description
+This rule ensures that no GitLab organization tokens are about to expire.
+It performs the following steps:
+
+1. Checks the settings of the GitLab organization.
+2. Verifies that no tokens are about to expire.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=organization |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| exiring_in_days | number | False | Number of days before a token expires. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md
new file mode 100644
index 000000000..4c5950612
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Forbid Token Scopes in GitLab Organization
+title: Forbid Token Scopes in GitLab Organization
+---
+# Forbid Token Scopes in GitLab Organization
+**Type:** Rule
+**ID:** `gitlab-org-disallowed-token-scope`
+**Source:** [v2/rules/gitlab/org/forbid-token-scopes.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/forbid-token-scopes.yaml)
+**Rego Source:** [forbid-token-scopes.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/forbid-token-scopes.rego)
+**Labels:** Blueprint, Gitlab, Organization
+
+Verify no GitLab organization tokens have disallowed scopes.
+
+:::note
+This rule requires Gitlab Organization Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/org/forbid-token-scopes@v2
+with:
+ project_scopes:
+ - write_api
+ - write_repository
+```
+
+## Mitigation
+Ensure that no GitLab organization tokens have disallowed scopes to prevent excessive permission.
+
+
+## Description
+This rule ensures that no GitLab organization tokens have disallowed scopes.
+It performs the following steps:
+
+1. Checks the settings of the GitLab organization.
+2. Verifies that no tokens have disallowed scopes.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=organization |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| project_scopes | array | False | List of disallowed token scopes in the GitLab organization. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md
new file mode 100644
index 000000000..74e4dbbf7
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Ensure Active Projects in GitLab Organization
+title: Ensure Active Projects in GitLab Organization
+---
+# Ensure Active Projects in GitLab Organization
+**Type:** Rule
+**ID:** `gitlab-org-inactive-projects`
+**Source:** [v2/rules/gitlab/org/inactive-projects.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/inactive-projects.yaml)
+**Rego Source:** [inactive-projects.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/inactive-projects.rego)
+**Labels:** Gitlab, Organization
+
+Verify no GitLab organization projects are inactive.
+
+:::note
+This rule requires Gitlab Organization Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/org/inactive-projects@v2
+with:
+ inactive_for_days: 90
+```
+
+## Mitigation
+Ensure that no GitLab organization projects are inactive to prevent service disruption.
+
+
+## Description
+This rule ensures that no GitLab organization projects are inactive.
+It performs the following steps:
+
+1. Checks the settings of the GitLab organization.
+2. Verifies that no projects are inactive.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=organization |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| inactive_for_days | number | False | Number of days before a project is considered inactive. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md
new file mode 100644
index 000000000..922de7791
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Forbid Long-Lived Tokens in GitLab Organization
+title: Forbid Long-Lived Tokens in GitLab Organization
+---
+# Forbid Long-Lived Tokens in GitLab Organization
+**Type:** Rule
+**ID:** `gitlab-org-token-excessive-lifespan`
+**Source:** [v2/rules/gitlab/org/longlive-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/longlive-tokens.yaml)
+**Rego Source:** [longlive-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/longlive-tokens.rego)
+**Labels:** Blueprint, Gitlab, Organization
+
+Verify no GitLab organization tokens have an excessively long lifespan.
+
+:::note
+This rule requires Gitlab Organization Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/org/longlive-tokens@v2
+with:
+ exiring_in_days: 365
+```
+
+## Mitigation
+Ensure that no GitLab organization tokens have an excessively long lifespan to prevent service disruption.
+
+
+## Description
+This rule ensures that no GitLab organization tokens have an excessively long lifespan.
+It performs the following steps:
+
+1. Checks the settings of the GitLab organization.
+2. Verifies that no tokens have an excessively long lifespan.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=organization |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| exiring_in_days | number | False | Number of days before a token expires. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md
new file mode 100644
index 000000000..7ab171500
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Limit Admins in GitLab Organization
+title: Limit Admins in GitLab Organization
+---
+# Limit Admins in GitLab Organization
+**Type:** Rule
+**ID:** `gitlab-org-max-admins`
+**Source:** [v2/rules/gitlab/org/max-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/max-admins.yaml)
+**Rego Source:** [max-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/max-admins.rego)
+**Labels:** Blueprint, GitLab, Organization
+
+Verify the maximum number of admins for the GitLab project is restricted.
+
+:::note
+This rule requires Gitlab Organization Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/org/max-admins@v2
+with:
+ max_admins: 0
+```
+
+## Mitigation
+Ensure that the maximum number of admins for the GitLab project is restricted to reduce the risk of unauthorized changes.
+
+
+## Description
+This rule ensures that the maximum number of admins for the GitLab project is restricted.
+It performs the following steps:
+
+1. Checks the settings of the GitLab organization.
+2. Verifies that the maximum number of admins is restricted.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=organization |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| max_admins | number | False | Maximum number of admins allowed in the GitLab organization. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md
new file mode 100644
index 000000000..303c97227
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md
@@ -0,0 +1,57 @@
+---
+sidebar_label: Restrict Public Visibility in GitLab Organization
+title: Restrict Public Visibility in GitLab Organization
+---
+# Restrict Public Visibility in GitLab Organization
+**Type:** Rule
+**ID:** `gitlab-org-allowed-visible-projects`
+**Source:** [v2/rules/gitlab/org/projects-visibility.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/projects-visibility.yaml)
+**Rego Source:** [projects-visibility.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/projects-visibility.rego)
+**Labels:** Gitlab, Organization
+
+Verify only allowed projects in the GitLab organization have public visibility.
+
+:::note
+This rule requires Gitlab Organization Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/org/projects-visibility@v2
+with:
+ allowed_public:
+ - "Learn GitLab"
+ - "Scribe Gitlab Test"
+```
+
+## Description
+This rule ensures that only allowed projects in the GitLab organization have public visibility.
+It performs the following steps:
+
+1. Checks the settings of the GitLab organization.
+2. Verifies that only allowed projects have public visibility.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=organization |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_public | array | False | List of projects allowed to have public visibility in the GitLab organization. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md
new file mode 100644
index 000000000..619affeb1
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Forbid Unused Tokens in GitLab Organization
+title: Forbid Unused Tokens in GitLab Organization
+---
+# Forbid Unused Tokens in GitLab Organization
+**Type:** Rule
+**ID:** `gitlab-org-unused-tokens`
+**Source:** [v2/rules/gitlab/org/unused-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/unused-tokens.yaml)
+**Rego Source:** [unused-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/unused-tokens.rego)
+**Labels:** Gitlab, Organization
+
+Verify there are no unused GitLab organization tokens.
+
+:::note
+This rule requires Gitlab Organization Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/org/unused-tokens@v2
+with:
+ unused_for_days: 90
+```
+
+## Mitigation
+Ensure that no GitLab organization tokens are unused to prevent service disruption.
+
+
+## Description
+This rule ensures that no GitLab organization tokens are unused.
+It performs the following steps:
+
+1. Checks the settings of the GitLab organization.
+2. Verifies that no tokens are unused.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=organization |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| unused_for_days | number | False | Number of days before a token is considered unused. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/_category_.json b/docs/configuration/initiatives/rules/gitlab/pipeline/_category_.json
new file mode 100644
index 000000000..a57065cbf
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/pipeline/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Pipeline",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md
new file mode 100644
index 000000000..9c019a28e
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md
@@ -0,0 +1,60 @@
+---
+sidebar_label: GitLab pipeline verify labels exist
+title: GitLab pipeline verify labels exist
+---
+# GitLab pipeline verify labels exist
+**Type:** Rule
+**ID:** `gitlab-pipeline-verify-labels-exist`
+**Source:** [v2/rules/gitlab/pipeline/verify-labels-exist.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels-exist.yaml)
+**Rego Source:** [verify-labels-exist.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels-exist.rego)
+**Labels:** Gitlab, Pipeline
+
+Verify the pipeline has all required label keys and values.
+
+:::note
+This rule requires Discovery Evidence. See [here](/docs/platforms/discover) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/pipeline/verify-labels-exist@v2
+with:
+ labels:
+ - "app.kubernetes.io/instance"
+```
+
+## Mitigation
+Ensure that all required labels exist in the pipeline to reduce the risk of misconfiguration.
+
+
+## Description
+This rule ensures that the pipeline has all required label keys and values.
+It performs the following steps:
+
+1. Checks the settings of the GitLab pipeline.
+2. Verifies that all required labels exist in the pipeline.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab pipeline resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=pipeline |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| labels | array | True | List of labels to verify exist in the pipeline. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md
new file mode 100644
index 000000000..cc46d1ca1
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Verify GitLab Pipeline Labels
+title: Verify GitLab Pipeline Labels
+---
+# Verify GitLab Pipeline Labels
+**Type:** Rule
+**ID:** `gitlab-pipeline-verify-labels`
+**Source:** [v2/rules/gitlab/pipeline/verify-labels.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels.yaml)
+**Rego Source:** [verify-labels.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels.rego)
+**Labels:** Gitlab, Pipeline
+
+Verify the pipeline includes all required label keys and values.
+
+:::note
+This rule requires Discovery Evidence. See [here](/docs/platforms/discover) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/pipeline/verify-labels@v2
+with:
+ labels:
+ app.kubernetes.io/instance: "defaul1t"
+```
+
+## Mitigation
+Ensure that all required labels exist in the pipeline to reduce the risk of misconfiguration.
+
+
+## Description
+This rule ensures that the pipeline includes all required label keys and values.
+It performs the following steps:
+
+1. Checks the settings of the GitLab pipeline.
+2. Verifies that all required labels exist in the pipeline.
+2.1 Verify that all the label values match the expected values.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab pipeline resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=pipeline |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| labels | object | True | List of labels to verify exist in the pipeline. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/_category_.json b/docs/configuration/initiatives/rules/gitlab/project/_category_.json
new file mode 100644
index 000000000..a88c9e5b1
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Project",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md
new file mode 100644
index 000000000..8d523c739
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Verify Project Activity
+title: Verify Project Activity
+---
+# Verify Project Activity
+**Type:** Rule
+**ID:** `gitlab-project-abandoned-project`
+**Source:** [v2/rules/gitlab/project/abandoned-project.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/abandoned-project.yaml)
+**Rego Source:** [abandoned-project.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/abandoned-project.rego)
+**Labels:** Gitlab, Project
+
+Verify the GitLab project is active for a specified duration.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/abandoned-project@v2
+with:
+ inactive_for_days: 30
+```
+
+## Mitigation
+Ensure that the GitLab project is active for the specified duration to prevent project abandonment.
+
+
+## Description
+This rule ensures that the GitLab project is active for a specified duration.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the project has been active for the specified duration.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| inactive_for_days | number | False | Number of days the project has been inactive. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md
new file mode 100644
index 000000000..43e902f13
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Merge approval policy check for GitLab project
+title: Merge approval policy check for GitLab project
+---
+# Merge approval policy check for GitLab project
+**Type:** Rule
+**ID:** `gitlab-project-merge-approval`
+**Source:** [v2/rules/gitlab/project/approvals-policy-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvals-policy-check.yaml)
+**Rego Source:** [approvals-policy-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvals-policy-check.rego)
+**Labels:** Blueprint, Gitlab, Project
+
+Verify the project's merge approval policy complies with requirements.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/approvals-policy-check@v2
+with:
+ name: "All Members"
+ approvals_required_min: 2
+```
+
+## Mitigation
+Ensure that the project's merge approval policy complies with requirements to prevent unauthorized merges.
+
+
+## Description
+This rule ensures that the project's merge approval policy complies with requirements.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the project's merge approval policy matchinig the 'name' field.
+2.1. Verifies that the project's merge approval policy requires a minimum number of approvals as specified in the 'approvals_required_min' field.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| name | string | True | Name of the group or user that must approve the merge request. |
+| approvals_required_min | number | True | Minimum number of approvals required for merge requests. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md
new file mode 100644
index 000000000..1e54c8d91
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Restrict Approvers Per Merge Request
+title: Restrict Approvers Per Merge Request
+---
+# Restrict Approvers Per Merge Request
+**Type:** Rule
+**ID:** `gitlab-project-approvers-per-merge-request`
+**Source:** [v2/rules/gitlab/project/approvers-per-merge-request.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvers-per-merge-request.yaml)
+**Rego Source:** [approvers-per-merge-request.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvers-per-merge-request.rego)
+**Labels:** Gitlab, Project
+
+Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/approvers-per-merge-request@v2
+with:
+ disable_overriding_approvers_per_merge_request: false
+```
+
+## Mitigation
+Ensure that the binary field Disable Overriding Approvers Per Merge Request reduces the risk of unauthorized access by setting it to the specified value.
+
+
+## Description
+This rule ensures that the binary field Disable Overriding Approvers Per Merge Request is set for the GitLab project.
+
+It performs the following steps:
+1. Checks the settings of the GitLab project.
+2. Verifies that the binary field Disable Overriding Approvers Per Merge Request is set.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| disable_overriding_approvers_per_merge_request | boolean | False | Whether to disable overriding approvers per merge request. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md
new file mode 100644
index 000000000..cfb8cda12
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Set Author Email Regex in GitLab Project
+title: Set Author Email Regex in GitLab Project
+---
+# Set Author Email Regex in GitLab Project
+**Type:** Rule
+**ID:** `gitlab-project-author-email-regex`
+**Source:** [v2/rules/gitlab/project/author-email-regex.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/author-email-regex.yaml)
+**Rego Source:** [author-email-regex.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/author-email-regex.rego)
+**Labels:** Gitlab, Project
+
+Verify the `author_email_regex` for the GitLab project is set to the specified value.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/author-email-regex@v2
+with:
+ author_email_regex: ".*@mycompany.com"
+```
+
+## Mitigation
+Ensure that the Author Email reduces the risk of unauthorized access by setting the `author_email_regex` field to the specified value.
+
+
+## Description
+This rule ensures that the `author_email_regex` for the GitLab project is set to the specified value.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the Author Email matches the 'author_email_regex' field.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| author_email_regex | string | False | The regular expression for the author email. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md
new file mode 100644
index 000000000..a125c366a
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Check CWE Compliance
+title: Check CWE Compliance
+---
+# Check CWE Compliance
+**Type:** Rule
+**ID:** `gitlab-project-check-cwe`
+**Source:** [v2/rules/gitlab/project/check-cwe.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-cwe.yaml)
+**Rego Source:** [check-cwe.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-cwe.rego)
+**Labels:** Gitlab, Project
+
+Verify that specified CWEs were not detected in the GitLab project.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/check-cwe@v2
+with:
+ cwe_value: "89"
+```
+
+## Mitigation
+Ensure that the specified CWEs were not detected in the GitLab project to prevent vulnerabilities.
+
+
+## Description
+This rule ensures that the specified CWEs were not detected in the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the specified CWEs were not detected in the GitLab project.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| cwe_value | string | True | The CWE value to check for. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md
new file mode 100644
index 000000000..a80374c33
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Ensure All Commits Are Signed in GitLab Project
+title: Ensure All Commits Are Signed in GitLab Project
+---
+# Ensure All Commits Are Signed in GitLab Project
+**Type:** Rule
+**ID:** `gitlab-project-signed-commits`
+**Source:** [v2/rules/gitlab/project/check-signed-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-signed-commits.yaml)
+**Rego Source:** [check-signed-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-signed-commits.rego)
+**Labels:** Gitlab, Project
+
+Verify all commits in the GitLab project are signed.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/check-signed-commits@v2
+```
+
+## Mitigation
+Ensure that all commits in the GitLab project are signed to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that all commits in the GitLab project are signed.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that all commits are signed.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md
new file mode 100644
index 000000000..bf4a52c38
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Require Code Owner Approval in GitLab Project
+title: Require Code Owner Approval in GitLab Project
+---
+# Require Code Owner Approval in GitLab Project
+**Type:** Rule
+**ID:** `gitlab-project-code-owner-approval`
+**Source:** [v2/rules/gitlab/project/co-approval-required.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/co-approval-required.yaml)
+**Rego Source:** [co-approval-required.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/co-approval-required.rego)
+**Labels:** Gitlab, Project
+
+Verify code owner approval is required for specific branches in the GitLab project.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/co-approval-required@v2
+with:
+ branch: "main"
+```
+
+## Mitigation
+Require code owner approval for specific branches in the GitLab project to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that code owner approval is required for specific branches in the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that code owner approval is required for the specified branch.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| branch | string | True | The branch to require code owner approval. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md
new file mode 100644
index 000000000..d77361ab8
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Restrict Commit Authors in GitLab Project
+title: Restrict Commit Authors in GitLab Project
+---
+# Restrict Commit Authors in GitLab Project
+**Type:** Rule
+**ID:** `gitlab-project-allowed-commit-authors`
+**Source:** [v2/rules/gitlab/project/commit-author-email-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-email-check.yaml)
+**Rego Source:** [commit-author-email-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-email-check.rego)
+**Labels:** Gitlab, Project
+
+Verify only GitLab project users in the Allowed List have commit author permissions.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/commit-author-email-check@v2
+with:
+ allowed_authors:
+ - mail@example.com
+ - mail2@example.com
+```
+
+## Mitigation
+Ensure that only users in the Allowed List have commit author permissions in the GitLab project to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that only users in the Allowed List have commit author permissions in the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that only users in the Allowed List have commit author permissions.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_authors | array | False | List of users allowed to have commit author permissions in the GitLab project. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md
new file mode 100644
index 000000000..55e087650
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md
@@ -0,0 +1,60 @@
+---
+sidebar_label: Allowed Commit Authors in GitLab Project
+title: Allowed Commit Authors in GitLab Project
+---
+# Allowed Commit Authors in GitLab Project
+**Type:** Rule
+**ID:** `gitlab-project-allowed-commit-author-names`
+**Source:** [v2/rules/gitlab/project/commit-author-name-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-name-check.yaml)
+**Rego Source:** [commit-author-name-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-name-check.rego)
+**Labels:** Gitlab, Project
+
+Verify only users in the Allowed List author commits in the GitLab project.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/commit-author-name-check@v2
+with:
+ allowed_authors:
+ - examplename
+```
+
+## Mitigation
+Ensure that only users in the Allowed List author commits in the GitLab project to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that only users in the Allowed List author commits in the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that only users in the Allowed List author commits.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_authors | array | False | List of users allowed to author commits in the GitLab project. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md
new file mode 100644
index 000000000..a2fddaafd
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Enable Commit Committer Check in GitLab Project
+title: Enable Commit Committer Check in GitLab Project
+---
+# Enable Commit Committer Check in GitLab Project
+**Type:** Rule
+**ID:** `gitlab-project-verify-commit_committer_check`
+**Source:** [v2/rules/gitlab/project/commit-committer-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-committer-check.yaml)
+**Rego Source:** [commit-committer-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-committer-check.rego)
+**Labels:** Gitlab, Project
+
+Verify `commit_committer_check` is enabled for the GitLab project.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/commit-committer-check@v2
+```
+
+## Mitigation
+Enable `commit_committer_check` in the GitLab project to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that `commit_committer_check` is enabled for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that `commit_committer_check` is enabled.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md
new file mode 100644
index 000000000..56cf33494
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Verify Commit Message Format
+title: Verify Commit Message Format
+---
+# Verify Commit Message Format
+**Type:** Rule
+**ID:** `gitlab-project-verify-commit_message_check`
+**Source:** [v2/rules/gitlab/project/commit-message-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-message-check.yaml)
+**Rego Source:** [commit-message-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-message-check.rego)
+**Labels:** Gitlab, Project
+
+Verify that commit messages in the GitLab project adhere to the specified format template.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/commit-message-check@v2
+with:
+ commit_message_regex: ".*JIRA-\\d+.*"
+```
+
+## Mitigation
+Ensure that commit messages adhere to the specified format template to maintain consistency and readability.
+
+
+## Description
+This rule ensures that commit messages in the GitLab project adhere to the specified format template.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that commit messages adhere to the specified format template.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| commit_message_regex | string | True | The regular expression to match the commit message format. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md
new file mode 100644
index 000000000..2786a114a
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Validate All Commits in GitLab Project
+title: Validate All Commits in GitLab Project
+---
+# Validate All Commits in GitLab Project
+**Type:** Rule
+**ID:** `gitlab-project-all-commits-validated`
+**Source:** [v2/rules/gitlab/project/commits-validated.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commits-validated.yaml)
+**Rego Source:** [commits-validated.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commits-validated.rego)
+**Labels:** Gitlab, Project
+
+Verify all commits in the GitLab project are validated.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/commits-validated@v2
+```
+
+## Mitigation
+Ensure that all commits in the GitLab project are validated to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that all commits in the GitLab project are validated.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that all commits are validated.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md
new file mode 100644
index 000000000..5f48fd56c
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md
@@ -0,0 +1,60 @@
+---
+sidebar_label: Allowed Committer Emails in GitLab Project
+title: Allowed Committer Emails in GitLab Project
+---
+# Allowed Committer Emails in GitLab Project
+**Type:** Rule
+**ID:** `gitlab-project-allowed-committer-emails`
+**Source:** [v2/rules/gitlab/project/committer-email-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-email-check.yaml)
+**Rego Source:** [committer-email-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-email-check.rego)
+**Labels:** Gitlab, Project
+
+Verify only users in the Allowed List use committer email addresses in the GitLab project.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/committer-email-check@v2
+with:
+ allowed_committers:
+ - mail@example.com
+```
+
+## Mitigation
+Ensure that only users in the Allowed List use committer email addresses in the GitLab project to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that only users in the Allowed List use committer email addresses in the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that only users in the Allowed List use committer email addresses.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_committers | array | False | List of email addresses allowed to use committer email addresses in the GitLab project. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md
new file mode 100644
index 000000000..8a9d8858e
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md
@@ -0,0 +1,60 @@
+---
+sidebar_label: Allowed Committer Names in GitLab Project
+title: Allowed Committer Names in GitLab Project
+---
+# Allowed Committer Names in GitLab Project
+**Type:** Rule
+**ID:** `gitlab-project-allowed-committer-names`
+**Source:** [v2/rules/gitlab/project/committer-name-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-name-check.yaml)
+**Rego Source:** [committer-name-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-name-check.rego)
+**Labels:** Gitlab, Project
+
+Verify only users in the Allowed List commit by name in the GitLab project.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/committer-name-check@v2
+with:
+ allowed_committers:
+ - somename
+```
+
+## Mitigation
+Ensure that only users in the Allowed List commit by name in the GitLab project to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that only users in the Allowed List commit by name in the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that only users in the Allowed List commit by name.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_committers | array | False | List of users allowed to commit by name in the GitLab project. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md
new file mode 100644
index 000000000..b1fe783df
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Enforce Critical Severity Limit
+title: Enforce Critical Severity Limit
+---
+# Enforce Critical Severity Limit
+**Type:** Rule
+**ID:** `gitlab-project-critical-severity-limit`
+**Source:** [v2/rules/gitlab/project/critical-severity-limit.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/critical-severity-limit.yaml)
+**Rego Source:** [critical-severity-limit.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/critical-severity-limit.rego)
+**Labels:** Gitlab, Project
+
+Verify the maximum allowed critical severity alerts for the GitLab project.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/critical-severity-limit@v2
+with:
+ max_allowed_vulnerability_count: 0
+```
+
+## Mitigation
+Ensure that the maximum allowed critical severity alerts for the GitLab project is enforced to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that the maximum allowed critical severity alerts for the GitLab project is enforced.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the maximum allowed critical severity alerts is enforced.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| max_allowed_vulnerability_count | number | False | Maximum allowed critical severity alerts for the GitLab project. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md
new file mode 100644
index 000000000..c099ebfcb
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Check Description Substring
+title: Check Description Substring
+---
+# Check Description Substring
+**Type:** Rule
+**ID:** `gitlab-project-description-substring-check`
+**Source:** [v2/rules/gitlab/project/description-substring-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/description-substring-check.yaml)
+**Rego Source:** [description-substring-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/description-substring-check.rego)
+**Labels:** Gitlab, Project
+
+Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/description-substring-check@v2
+with:
+ pattern: "(?i)insdput"
+```
+
+## Mitigation
+Ensure that the specified substring is not found in the description attribute of vulnerabilities to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that a specific substring is not found in the description attribute of vulnerabilities for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the specified substring is not found in the description attribute of vulnerabilities.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| pattern | string | False | The substring to search for in the description attribute of vulnerabilities. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md
new file mode 100644
index 000000000..1dc623619
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Disallow Banned Approvers
+title: Disallow Banned Approvers
+---
+# Disallow Banned Approvers
+**Type:** Rule
+**ID:** `gitlab-project-disallowed-banned-approvers`
+**Source:** [v2/rules/gitlab/project/disallowed-banned-approvers.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/disallowed-banned-approvers.yaml)
+**Rego Source:** [disallowed-banned-approvers.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/disallowed-banned-approvers.rego)
+**Labels:** Gitlab, Project
+
+Verify approvers in the GitLab project are not on the banned list.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/disallowed-banned-approvers@v2
+with:
+ banned_list:
+ - user1
+ - user2
+```
+
+## Mitigation
+Ensure that approvers in the GitLab project are not on the banned list to prevent unauthorized approvals.
+
+
+## Description
+This rule ensures that approvers in the GitLab project are not on the banned list.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that approvers are not on the banned list.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| banned_list | array | False | List of users banned from approving in the GitLab project. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md
new file mode 100644
index 000000000..a7563bf66
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Disallow Force Push in GitLab Project
+title: Disallow Force Push in GitLab Project
+---
+# Disallow Force Push in GitLab Project
+**Type:** Rule
+**ID:** `gitlab-project-disallow-force-push`
+**Source:** [v2/rules/gitlab/project/force-push-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/force-push-protection.yaml)
+**Rego Source:** [force-push-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/force-push-protection.rego)
+**Labels:** Gitlab, Project
+
+Verify force pushes in the GitLab project are disallowed to maintain repository integrity.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/force-push-protection@v2
+with:
+ branch: "main"
+```
+
+## Mitigation
+Ensure that force pushes in the GitLab project are disallowed to maintain repository integrity.
+
+
+## Description
+This rule ensures that force pushes in the GitLab project are disallowed to maintain repository integrity.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that force pushes are disallowed.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| branch | string | False | The branch to disallow force pushes. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md
new file mode 100644
index 000000000..97b566385
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Enforce Medium Severity Limit
+title: Enforce Medium Severity Limit
+---
+# Enforce Medium Severity Limit
+**Type:** Rule
+**ID:** `gitlab-project-medium-severity-limit`
+**Source:** [v2/rules/gitlab/project/medium-severity-limit.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/medium-severity-limit.yaml)
+**Rego Source:** [medium-severity-limit.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/medium-severity-limit.rego)
+**Labels:** Gitlab, Project
+
+Verify the maximum allowed medium severity alerts for the GitLab project.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/medium-severity-limit@v2
+with:
+ max_allowed_specific_severity: 0
+```
+
+## Mitigation
+Ensure that the maximum allowed medium severity alerts for the GitLab project is enforced to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that the maximum allowed medium severity alerts for the GitLab project is enforced.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the maximum allowed medium severity alerts is enforced.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| max_allowed_specific_severity | number | False | Maximum allowed medium severity alerts for the GitLab project. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/member-check.md b/docs/configuration/initiatives/rules/gitlab/project/member-check.md
new file mode 100644
index 000000000..d5e607ecc
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/member-check.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Enable Member Check for GitLab Project
+title: Enable Member Check for GitLab Project
+---
+# Enable Member Check for GitLab Project
+**Type:** Rule
+**ID:** `gitlab-project-verify-member_check`
+**Source:** [v2/rules/gitlab/project/member-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/member-check.yaml)
+**Rego Source:** [member-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/member-check.rego)
+**Labels:** Gitlab, Project
+
+Verify `member_check` is enabled for the GitLab project.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/member-check@v2
+```
+
+## Mitigation
+Ensure that Member Check is enabled for the GitLab project to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that `member_check` is enabled for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that `member_check` is enabled.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md
new file mode 100644
index 000000000..699e195a9
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md
@@ -0,0 +1,63 @@
+---
+sidebar_label: Enforce Merge Access Level Policy for GitLab Project
+title: Enforce Merge Access Level Policy for GitLab Project
+---
+# Enforce Merge Access Level Policy for GitLab Project
+**Type:** Rule
+**ID:** `gitlab-project-merge-access-level`
+**Source:** [v2/rules/gitlab/project/merge-access-level.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-access-level.yaml)
+**Rego Source:** [merge-access-level.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-access-level.rego)
+**Labels:** Gitlab, Project
+
+Verify the GitLab project's merge access level complies with requirements.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/merge-access-level@v2
+with:
+ branch: "main"
+ access_level: 30
+ access_level_description: "Maintainers"
+```
+
+## Mitigation
+Ensure that the GitLab project's merge access level complies with requirements to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that the GitLab project's merge access level complies with requirements.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. For scoped branchs, verifies that the merge access level complies with the specified requirements.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| branch | string | False | The branch to enforce merge access level policy. |
+| access_level | number | False | The access level to enforce for merge access level policy. |
+| access_level_description | string | False | The access level description to enforce for merge access level policy. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md
new file mode 100644
index 000000000..03f4f6a7d
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Disable Author Approval for Merge Requests in GitLab
+title: Disable Author Approval for Merge Requests in GitLab
+---
+# Disable Author Approval for Merge Requests in GitLab
+**Type:** Rule
+**ID:** `gitlab-project-merge-requests-author-approval`
+**Source:** [v2/rules/gitlab/project/merge-requests-author-approval.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-author-approval.yaml)
+**Rego Source:** [merge-requests-author-approval.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-author-approval.rego)
+**Labels:** Gitlab, Project
+
+Verify the binary field `merge_requests_author_approval` is set for the GitLab project.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/merge-requests-author-approval@v2
+with:
+ merge_requests_author_approval: true
+```
+
+## Mitigation
+Ensure that the binary field `merge_requests_author_approval` is set for the GitLab project to prevent unauthorized approvals.
+
+
+## Description
+This rule ensures that the binary field Merge Requests Author Approval is set for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the binary field Merge Requests Author Approval is set.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| merge_requests_author_approval | boolean | False | The binary field to enforce for merge requests author approval. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md
new file mode 100644
index 000000000..73012b220
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Disable Committers' Approval for Merge Requests in GitLab
+title: Disable Committers' Approval for Merge Requests in GitLab
+---
+# Disable Committers' Approval for Merge Requests in GitLab
+**Type:** Rule
+**ID:** `gitlab-project-merge-requests-disable-committers-approval`
+**Source:** [v2/rules/gitlab/project/merge-requests-disable-committers-approval.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-disable-committers-approval.yaml)
+**Rego Source:** [merge-requests-disable-committers-approval.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-disable-committers-approval.rego)
+**Labels:** Gitlab, Project
+
+Verify `merge_requests_disable_committers_approval` is set for the GitLab project.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/merge-requests-disable-committers-approval@v2
+with:
+ merge_requests_disable_committers_approval: false
+```
+
+## Mitigation
+Ensure that the binary Merge Requests Disable Committers Approval field is set for the GitLab project to prevent unauthorized approvals.
+
+
+## Description
+This rule ensures that the binary field Merge Requests Disable Committers Approval is set for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the binary field `merge_requests_disable_committers_approval` is set.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| merge_requests_disable_committers_approval | boolean | False | The binary field to enforce for merge requests committers' approval. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md
new file mode 100644
index 000000000..9bb75f6dd
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Check Message Substring
+title: Check Message Substring
+---
+# Check Message Substring
+**Type:** Rule
+**ID:** `gitlab-project-message-substring-check`
+**Source:** [v2/rules/gitlab/project/message-substring-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/message-substring-check.yaml)
+**Rego Source:** [message-substring-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/message-substring-check.rego)
+**Labels:** Gitlab, Project
+
+Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/message-substring-check@v2
+with:
+ pattern: "(?i)dghd"
+```
+
+## Mitigation
+Ensure that the specified substring is not found in the message attribute of vulnerabilities for the GitLab project to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that a specific substring is not found in the message attribute of vulnerabilities for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the specified substring is not found in the message attribute of vulnerabilities.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| pattern | string | True | The pattern to search for in the message attribute of vulnerabilities. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md
new file mode 100644
index 000000000..8aa4d7b58
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Enable Secrets Prevention in GitLab Project
+title: Enable Secrets Prevention in GitLab Project
+---
+# Enable Secrets Prevention in GitLab Project
+**Type:** Rule
+**ID:** `gitlab-project-verify-prevent_secrets`
+**Source:** [v2/rules/gitlab/project/prevent-secrets-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/prevent-secrets-check.yaml)
+**Rego Source:** [prevent-secrets-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/prevent-secrets-check.rego)
+**Labels:** Gitlab, Project
+
+Verify `prevent_secrets` is enabled for the GitLab project.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/prevent-secrets-check@v2
+```
+
+## Mitigation
+Ensure that Secrets Prevention is enabled for the GitLab project to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that `prevent_secrets` is enabled for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that `prevent_secrets` is enabled.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md
new file mode 100644
index 000000000..d34548bc4
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Protect CI Secrets in GitLab Project
+title: Protect CI Secrets in GitLab Project
+---
+# Protect CI Secrets in GitLab Project
+**Type:** Rule
+**ID:** `gitlab-project-protect-ci-secrets`
+**Source:** [v2/rules/gitlab/project/protect-ci-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/protect-ci-secrets.yaml)
+**Rego Source:** [protect-ci-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/protect-ci-secrets.rego)
+**Labels:** Gitlab, Project
+
+Verify secrets in the GitLab project are not shared.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/protect-ci-secrets@v2
+with:
+ pattern: "(?i)(token|secret)"
+```
+
+## Mitigation
+Ensure that secrets in the GitLab project are not shared to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that secrets in the GitLab project are not shared.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that secrets are not shared.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| pattern | string | False | The pattern to match secrets. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md
new file mode 100644
index 000000000..8c0ef7478
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md
@@ -0,0 +1,63 @@
+---
+sidebar_label: Set Push Access Level in GitLab Project
+title: Set Push Access Level in GitLab Project
+---
+# Set Push Access Level in GitLab Project
+**Type:** Rule
+**ID:** `gitlab-project-push-access-level`
+**Source:** [v2/rules/gitlab/project/push-access-level.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-access-level.yaml)
+**Rego Source:** [push-access-level.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-access-level.rego)
+**Labels:** Gitlab, Project
+
+Verify the GitLab project's push access level policy complies with requirements.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/push-access-level@v2
+with:
+ branch: "main"
+ access_level: 30
+ access_level_description: "Maintainers"
+```
+
+## Mitigation
+Ensure that the GitLab project's push access level complies with requirements to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that the GitLab project's push access level complies with requirements.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. For scoped branchs, verifies that the push access level complies with the specified requirements.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| branch | string | False | The branch to enforce push access level policy. |
+| access_level | number | False | The access level to enforce for push access level policy. |
+| access_level_description | string | False | The access level description to enforce for push access level policy. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md
new file mode 100644
index 000000000..77d37f3fc
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Set Push Rules for GitLab Project
+title: Set Push Rules for GitLab Project
+---
+# Set Push Rules for GitLab Project
+**Type:** Rule
+**ID:** `gitlab-project-verify-push_rules`
+**Source:** [v2/rules/gitlab/project/push-rules-set.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-rules-set.yaml)
+**Rego Source:** [push-rules-set.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-rules-set.rego)
+**Labels:** Gitlab, Project
+
+Verify push rules are set for the GitLab project.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/push-rules-set@v2
+```
+
+## Mitigation
+Ensure that push rules are set for the GitLab project to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that push rules are set for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that push rules are set.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md
new file mode 100644
index 000000000..d966af231
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Reject Unsigned Commits in GitLab Project
+title: Reject Unsigned Commits in GitLab Project
+---
+# Reject Unsigned Commits in GitLab Project
+**Type:** Rule
+**ID:** `gitlab-project-disallow-unsigned-commits`
+**Source:** [v2/rules/gitlab/project/reject-unsigned-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reject-unsigned-commits.yaml)
+**Rego Source:** [reject-unsigned-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reject-unsigned-commits.rego)
+**Labels:** Blueprint, Gitlab, Project
+
+Verify `reject_unsigned_commits` is enabled for the GitLab project.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/reject-unsigned-commits@v2
+```
+
+## Mitigation
+Ensure that Reject Unsigned Commits is enabled for the GitLab project to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that `reject_unsigned_commits` is enabled for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that `reject_unsigned_commits` is enabled.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md
new file mode 100644
index 000000000..74629475a
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Require Password for Approvals in GitLab Project
+title: Require Password for Approvals in GitLab Project
+---
+# Require Password for Approvals in GitLab Project
+**Type:** Rule
+**ID:** `gitlab-project-require-password-to-approve`
+**Source:** [v2/rules/gitlab/project/require-password-to-approve.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/require-password-to-approve.yaml)
+**Rego Source:** [require-password-to-approve.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/require-password-to-approve.rego)
+**Labels:** Gitlab, Project
+
+Verify the binary field `require_password_to_approve` is set for the GitLab project.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/require-password-to-approve@v2
+with:
+ require_password_to_approve: true
+```
+
+## Mitigation
+Ensure that the binary field `require_password_to_approve` is set for the GitLab project to prevent unauthorized approvals.
+
+
+## Description
+This rule ensures that the binary field `require_password_to_approve` is set for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the binary field `require_password_to_approve` is set.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| require_password_to_approve | boolean | False | The binary field to enforce for requiring password to approve. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md
new file mode 100644
index 000000000..a1d23a6e1
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Require Minimal Approvers in GitLab Project
+title: Require Minimal Approvers in GitLab Project
+---
+# Require Minimal Approvers in GitLab Project
+**Type:** Rule
+**ID:** `gitlab-project-required-minimal-approvers`
+**Source:** [v2/rules/gitlab/project/required-minimal-approvers.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/required-minimal-approvers.yaml)
+**Rego Source:** [required-minimal-approvers.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/required-minimal-approvers.rego)
+**Labels:** Gitlab, Project
+
+Verify the required number of approvers for the GitLab project is met.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/required-minimal-approvers@v2
+```
+
+## Mitigation
+Ensure that the required number of approvers for the GitLab project is met to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that the required number of approvers for the GitLab project is met.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the required number of approvers is met.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md
new file mode 100644
index 000000000..f598ceaac
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Reset Approvals on Push in GitLab Project
+title: Reset Approvals on Push in GitLab Project
+---
+# Reset Approvals on Push in GitLab Project
+**Type:** Rule
+**ID:** `gitlab-project-reset-pprovals-on-push`
+**Source:** [v2/rules/gitlab/project/reset-pprovals-on-push.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reset-pprovals-on-push.yaml)
+**Rego Source:** [reset-pprovals-on-push.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reset-pprovals-on-push.rego)
+**Labels:** Gitlab, Project
+
+Verify `reset_approvals_on_push` is set for the GitLab project.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/reset-pprovals-on-push@v2
+with:
+ reset_approvals_on_push: true
+```
+
+## Mitigation
+Ensure that the binary field `reset_approvals_on_push` is set for the GitLab project to prevent unauthorized approvals.
+
+
+## Description
+This rule ensures that the binary field `reset_approvals_on_push` is set for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the binary field `reset_approvals_on_push` is set.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| reset_approvals_on_push | boolean | False | The binary field to enforce for resetting approvals on push. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md
new file mode 100644
index 000000000..ee0b45035
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Ensure SAST Scanning Passes
+title: Ensure SAST Scanning Passes
+---
+# Ensure SAST Scanning Passes
+**Type:** Rule
+**ID:** `gitlab-project-sast-scan-pass`
+**Source:** [v2/rules/gitlab/project/sast-scan-pass.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scan-pass.yaml)
+**Rego Source:** [sast-scan-pass.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scan-pass.rego)
+**Labels:** Gitlab, Project
+
+Verify SAST scanning is successful for the GitLab project.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/sast-scan-pass@v2
+```
+
+## Mitigation
+Ensure that SAST scanning is successful for the GitLab project to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that SAST scanning is successful for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that SAST scanning is successful.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md
new file mode 100644
index 000000000..f2dd6cb95
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Run SAST Scanning in GitLab Project
+title: Run SAST Scanning in GitLab Project
+---
+# Run SAST Scanning in GitLab Project
+**Type:** Rule
+**ID:** `gitlab-project-sast-scanning`
+**Source:** [v2/rules/gitlab/project/sast-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scanning.yaml)
+**Rego Source:** [sast-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scanning.rego)
+**Labels:** Gitlab, Project
+
+Verify SAST scanning is performed for the GitLab project.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/sast-scanning@v2
+```
+
+## Mitigation
+Ensure that SAST scanning is performed for the GitLab project to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that SAST scanning is performed for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that SAST scanning is performed.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md
new file mode 100644
index 000000000..f1259f531
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Ensure Secrets Scanning Passes
+title: Ensure Secrets Scanning Passes
+---
+# Ensure Secrets Scanning Passes
+**Type:** Rule
+**ID:** `gitlab-project-secrets-scan-pass`
+**Source:** [v2/rules/gitlab/project/secrets-scan-pass.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scan-pass.yaml)
+**Rego Source:** [secrets-scan-pass.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scan-pass.rego)
+**Labels:** Gitlab, Project
+
+Verify secrets scanning is successful for the GitLab project.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/secrets-scan-pass@v2
+```
+
+## Mitigation
+Ensure that secrets scanning is successful for the GitLab project to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that secrets scanning is successful for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that secrets scanning is successful.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md
new file mode 100644
index 000000000..d928ba814
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Run Secrets Scanning in GitLab Project
+title: Run Secrets Scanning in GitLab Project
+---
+# Run Secrets Scanning in GitLab Project
+**Type:** Rule
+**ID:** `gitlab-project-secrets-scanning`
+**Source:** [v2/rules/gitlab/project/secrets-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scanning.yaml)
+**Rego Source:** [secrets-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scanning.rego)
+**Labels:** Gitlab, Project
+
+Verify secrets scanning is performed for the GitLab project.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/secrets-scanning@v2
+```
+
+## Mitigation
+Ensure that secrets scanning is performed for the GitLab project to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that secrets scanning is performed for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that secrets scanning is performed.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md
new file mode 100644
index 000000000..b6394dc4e
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Restrict Selective Code Owner Removals in GitLab
+title: Restrict Selective Code Owner Removals in GitLab
+---
+# Restrict Selective Code Owner Removals in GitLab
+**Type:** Rule
+**ID:** `gitlab-project-selective-code-owner-removals`
+**Source:** [v2/rules/gitlab/project/selective-code-owner-removals.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/selective-code-owner-removals.yaml)
+**Rego Source:** [selective-code-owner-removals.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/selective-code-owner-removals.rego)
+**Labels:** Gitlab, Project
+
+Verify `selective_code_owner_removals` is set for the GitLab project.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/selective-code-owner-removals@v2
+with:
+ selective_code_owner_removals: true
+```
+
+## Mitigation
+Ensure that `selective_code_owner_removals` is set for the GitLab project to prevent unauthorized changes.
+
+
+## Description
+This rule ensures that `selective_code_owner_removals` is set for the GitLab project.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that `selective_code_owner_removals` is set.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| selective_code_owner_removals | boolean | True | Indicates whether `selective_code_owner_removals` is set for the GitLab project. |
+
diff --git a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md
new file mode 100644
index 000000000..713c49fe2
--- /dev/null
+++ b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Set Visibility Level in GitLab Project
+title: Set Visibility Level in GitLab Project
+---
+# Set Visibility Level in GitLab Project
+**Type:** Rule
+**ID:** `gitlab-project-project-visibility-level`
+**Source:** [v2/rules/gitlab/project/visibility-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/visibility-check.yaml)
+**Rego Source:** [visibility-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/visibility-check.rego)
+**Labels:** Gitlab, Project
+
+Verify the GitLab project's visibility matches the required level.
+
+:::note
+This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: gitlab/project/visibility-check@v2
+with:
+ visibility: private
+```
+
+## Mitigation
+Ensure that the GitLab project's visibility matches the required level to prevent unauthorized access.
+
+
+## Description
+This rule ensures that the GitLab project's visibility matches the required level.
+It performs the following steps:
+
+1. Checks the settings of the GitLab project.
+2. Verifies that the visibility level matches the required level.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=gitlab - asset_type=project |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| visibility | string | True | The visibility level to enforce for the GitLab project. |
+
diff --git a/docs/configuration/initiatives/rules/images/_category_.json b/docs/configuration/initiatives/rules/images/_category_.json
new file mode 100644
index 000000000..fb18a4fc4
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Images",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/images/allowed-base-image.md b/docs/configuration/initiatives/rules/images/allowed-base-image.md
new file mode 100644
index 000000000..f8706fe13
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/allowed-base-image.md
@@ -0,0 +1,66 @@
+---
+sidebar_label: Allowed Base Image
+title: Allowed Base Image
+---
+# Allowed Base Image
+**Type:** Rule
+**ID:** `images-allowed-base-image`
+**Source:** [v2/rules/images/allowed-base-image.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-base-image.yaml)
+**Rego Source:** [allowed-base-image.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-base-image.rego)
+**Labels:** SBOM, Images
+
+Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`.
+
+:::note
+This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by target and product.
+:::
+
+## Usage example
+
+```yaml
+uses: images/allowed-base-image@v2
+with:
+ approved_sources:
+ - "docker.io/library/*"
+ - "docker.io/my_org/*"
+```
+
+## Mitigation
+Ensures that only trusted base images are used in container builds, reducing the risk of deploying compromised or outdated images. This check mitigates vulnerabilities by enforcing that each base image matches an approved source pattern.
+
+
+## Description
+This rule examines the SBOM evidence for a container image, focusing on components in the "container" group that represent base images.
+A base image is identified by the presence of a property whose name ends with "isbaseimage" (case-insensitive) and whose value is "true".
+For each detected base image, the rule verifies that its name matches one of the approved source patterns defined in the configuration
+(via `with.approved_sources`). If a base image does not match any of the approved patterns, it is flagged as invalid. If no base image data
+is found, a violation is recorded indicating that the necessary base image information is missing.
+
+**Evidence Requirements:**
+
+- The SBOM evidence must be provided in the `cyclonedx-json` format.
+- The SBOM should include a `metadata.component.properties` array containing properties that identify base images.
+- The approved source patterns must be specified in the `with.approved_sources` parameter.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+| filter-by | ['target', 'product'] |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| approved_sources | array | False | A list of approved base image pattern. |
+
diff --git a/docs/configuration/initiatives/rules/images/allowed-image-source.md b/docs/configuration/initiatives/rules/images/allowed-image-source.md
new file mode 100644
index 000000000..6f5aeb92d
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/allowed-image-source.md
@@ -0,0 +1,66 @@
+---
+sidebar_label: Allowed Main Image Source
+title: Allowed Main Image Source
+---
+# Allowed Main Image Source
+**Type:** Rule
+**ID:** `images-allowed-image-source`
+**Source:** [v2/rules/images/allowed-image-source.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-image-source.yaml)
+**Rego Source:** [allowed-image-source.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-image-source.rego)
+**Labels:** SBOM, Images
+
+Ensures the main container image referenced in the SBOM is from an approved source.
+
+:::note
+This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by target and product.
+:::
+
+## Usage example
+
+```yaml
+uses: images/allowed-image-source@v2
+with:
+ approved_sources:
+ - "docker.io/library/*"
+ - "docker.io/my_org/*"
+```
+
+## Mitigation
+Enforces that the main image comes from a trusted source, reducing the risk of deploying images that are compromised or outdated. This check helps maintain container security by ensuring that only images matching approved source patterns are used.
+
+
+## Description
+This rule extracts the main image’s name and version from the SBOM evidence and verifies that it originates from an approved source.
+It does so by comparing the image name against a list of approved source patterns provided via the configuration (`with.approved_sources`).
+The matching is performed using a case-insensitive, anchored regex.
+
+- If one or more approved source patterns are provided and the image name matches at least one pattern, the image is considered compliant.
+- If the image name does not match any approved source, or if no approved source patterns are provided, a violation is recorded.
+
+**Evidence Requirements:**
+- Evidence must be provided in the CycloneDX JSON format.
+- The SBOM must include a `metadata.component` section containing the main image’s `name` and `version` fields.
+- The approved source patterns must be specified in `with.approved_sources`.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+| filter-by | ['target', 'product'] |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| approved_sources | array | False | A list of approved Image source patterns. |
+
diff --git a/docs/configuration/initiatives/rules/images/banned-ports.md b/docs/configuration/initiatives/rules/images/banned-ports.md
new file mode 100644
index 000000000..b6215c2c6
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/banned-ports.md
@@ -0,0 +1,69 @@
+---
+sidebar_label: Banned Ports
+title: Banned Ports
+---
+# Banned Ports
+**Type:** Rule
+**ID:** `images-banned-ports`
+**Source:** [v2/rules/images/banned-ports.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-ports.yaml)
+**Rego Source:** [banned-ports.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-ports.rego)
+**Labels:** SBOM, Images
+
+Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided.
+
+:::note
+This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by target and product.
+:::
+
+## Usage example
+
+```yaml
+uses: images/banned-ports@v2
+with:
+ banned_ports:
+ - port: "3000"
+ protocol: "tcp"
+ - port: "8080"
+ protocol: "tcp"
+```
+
+## Mitigation
+Prevents deployment of container images that expose disallowed ports, reducing the risk of unauthorized network access and potential exploitation. This check ensures that only images with approved port configurations are deployed.
+
+
+## Description
+This rule evaluates the CycloneDX SBOM evidence for a container image to verify that no disallowed ports are exposed.
+It performs the following steps:
+
+1. Retrieves all properties from the SBOM's `metadata.component.properties` whose names start with "imageExposedPorts_".
+2. Expects each property value to be formatted as "port/protocol" (e.g., "3000/tcp") and splits the value into its components.
+3. Compares each exposed port against the list of banned ports provided in the configuration (`with.banned_ports`).
+ - If a banned port (and, if specified, protocol) is detected, the rule flags it as a violation.
+4. If no banned ports list is provided, the rule also fails.
+
+**Evidence Requirements:**
+
+- Evidence must be provided in the CycloneDX JSON format.
+- The SBOM must include a `metadata.component.properties` array with entries for exposed ports.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| content_body_type | cyclonedx-json |
+| target_type | container |
+| filter-by | ['target', 'product'] |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| banned_ports | array | False | A list of banned ports and protocols. Each entry should be a dictionary with 'port' and 'protocol' keys. |
+
diff --git a/docs/configuration/initiatives/rules/images/banned-users.md b/docs/configuration/initiatives/rules/images/banned-users.md
new file mode 100644
index 000000000..52d2e90b9
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/banned-users.md
@@ -0,0 +1,65 @@
+---
+sidebar_label: Disallow Specific Users in SBOM
+title: Disallow Specific Users in SBOM
+---
+# Disallow Specific Users in SBOM
+**Type:** Rule
+**ID:** `sbom-disallowed-users`
+**Source:** [v2/rules/images/banned-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-users.yaml)
+**Rego Source:** [banned-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-users.rego)
+**Labels:** SBOM, Image
+
+Verify specific users are not allowed in an SBOM.
+
+:::note
+This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by target and product.
+:::
+
+## Usage example
+
+```yaml
+uses: images/banned-users@v2
+with:
+ users:
+ - root
+```
+
+## Mitigation
+Prevents the execution of container images with default or disallowed user accounts reducing the risk of privilege escalation and ensuring that only secure, non-privileged user configurations are used.
+
+
+## Description
+This rule inspects the CycloneDX SBOM evidence for a container image to ensure that the image is not configured
+to run with a banned default user. It does so by examining the `metadata.component.properties` array for a property
+with the name "user". The value of this property is then compared against a list of disallowed users specified in
+the configuration (via `with.users`). If the image is found to be running as a banned user (for example, "root"),
+a violation is recorded.
+
+**Evidence Requirements:**
+
+- Evidence must be provided in the CycloneDX JSON format.
+- The SBOM must include a `metadata.component.properties` array with an entry where the property name is "user".
+- The disallowed user list (e.g., ["root"]) must be provided in the `with.users` parameter.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+| filter-by | ['target', 'product'] |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| users | array | False | A list of disallowed users. Each entry should be a string representing a username. |
+
diff --git a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md
new file mode 100644
index 000000000..c9b26b396
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md
@@ -0,0 +1,58 @@
+---
+sidebar_label: Restrict Build Scripts
+title: Restrict Build Scripts
+---
+# Restrict Build Scripts
+**Type:** Rule
+**ID:** `images-disallowed-build-script`
+**Source:** [v2/rules/images/blocklist-build-scripts.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/blocklist-build-scripts.yaml)
+**Rego Source:** [blocklist-build-scripts.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/blocklist-build-scripts.rego)
+**Labels:** SBOM, Images
+
+Verify no build scripts commands appear in block list.
+
+:::note
+This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by target and product.
+:::
+
+## Usage example
+
+```yaml
+uses: images/blocklist-build-scripts@v2
+with:
+ blocklist:
+ - "wget"
+ - "curl"
+```
+
+## Mitigation
+Prevents the execution of unauthorized or insecure build scripts during the image build process, reducing the risk of malicious command injection and ensuring a more secure supply chain.
+
+
+## Description
+This rule inspects the SBOM (in CycloneDX JSON format) for each Layer component and specifically looks for a property named "CreatedBy".
+It then checks whether the value of this property contains any substrings specified in the 'blocklist' parameter.
+If a match is found, the rule generates a violation indicating that a disallowed build script command was used during the build process.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+| filter-by | ['target', 'product'] |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| blocklist | array | False | A list of disallowed build script commands. Each entry should be a string representing a command or substring. |
+
diff --git a/docs/configuration/initiatives/rules/images/enforce-https-registry.md b/docs/configuration/initiatives/rules/images/enforce-https-registry.md
new file mode 100644
index 000000000..6694658b6
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/enforce-https-registry.md
@@ -0,0 +1,51 @@
+---
+sidebar_label: Registry Connection HTTPS
+title: Registry Connection HTTPS
+---
+# Registry Connection HTTPS
+**Type:** Rule
+**ID:** `images-registry-https-check`
+**Source:** [v2/rules/images/enforce-https-registry.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/enforce-https-registry.yaml)
+**Rego Source:** [enforce-https-registry.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/enforce-https-registry.rego)
+**Labels:** Registry, Images
+
+Checks if the container's registry scheme is HTTPS
+
+:::note
+This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by product and target.
+:::
+
+## Usage example
+
+```yaml
+uses: images/enforce-https-registry@v2
+```
+
+## Description
+This rule examines the CycloneDX SBOM evidence for a container image to verify that the registry connection
+is secure. It does so by scanning the `metadata.component.properties` array for a property named
+'registry_scheme'. If the value of this property is exactly 'https', the rule passes; otherwise, it fails,
+indicating that the image may have been pulled from an insecure registry.
+
+**Evidence Requirements:**
+
+- Evidence must be provided in the CycloneDX JSON format.
+- The SBOM should include a `metadata.component.properties` array with an entry for 'registry_scheme'.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+| filter-by | ['product', 'target'] |
+
diff --git a/docs/configuration/initiatives/rules/images/forbid-large-images.md b/docs/configuration/initiatives/rules/images/forbid-large-images.md
new file mode 100644
index 000000000..8a4558cae
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/forbid-large-images.md
@@ -0,0 +1,65 @@
+---
+sidebar_label: Forbid Large Images
+title: Forbid Large Images
+---
+# Forbid Large Images
+**Type:** Rule
+**ID:** `images-project-large-image`
+**Source:** [v2/rules/images/forbid-large-images.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/forbid-large-images.yaml)
+**Rego Source:** [forbid-large-images.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/forbid-large-images.rego)
+**Labels:** SBOM, Images
+
+Verify the image size is below the specified threshold.
+
+:::note
+This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by target and product.
+:::
+
+## Usage example
+
+```yaml
+uses: images/forbid-large-images@v2
+with:
+ max_size: 77819980
+```
+
+## Mitigation
+Prevents the deployment of overly large container images, which helps control resource usage, reduces the attack surface by limiting unnecessary code and dependencies, and minimizes potential vulnerabilities.
+
+
+## Description
+This rule inspects the CycloneDX SBOM evidence for container images. It searches through the SBOM's components
+to locate a component belonging to the "layer" group where a property named "size" is defined. The rule specifically
+looks for the size property when the associated "index" property is "0" (which typically represents the overall image size).
+The extracted size is then converted to a numeric value and compared against the maximum size specified in the rule's configuration (`max_size`).
+
+- If the image size is less than or equal to the specified `max_size`, the rule passes and the image is considered acceptable.
+- If the image size exceeds the threshold, a violation is recorded with a message indicating the actual image size and the maximum allowed size.
+
+### **Evidence Requirements**
+
+- Evidence must be provided in the `cyclonedx-json` format.
+- The SBOM must include a component in the "layer" group with a "size" property, and an "index" property set to "0".
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+| filter-by | ['target', 'product'] |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| max_size | integer | True | The maximum allowed image size in bytes. |
+
diff --git a/docs/configuration/initiatives/rules/images/fresh-base-image.md b/docs/configuration/initiatives/rules/images/fresh-base-image.md
new file mode 100644
index 000000000..886b15b83
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/fresh-base-image.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Fresh Base Image
+title: Fresh Base Image
+---
+# Fresh Base Image
+**Type:** Rule
+**ID:** `images-fresh-base-image`
+**Source:** [v2/rules/images/fresh-base-image.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-base-image.yaml)
+**Rego Source:** [fresh-base-image.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-base-image.rego)
+**Labels:** SBOM, Images
+
+Verifies that each base image is not older than the specified threshold (max_days) from its creation date.
+
+:::note
+This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by target and product.
+:::
+
+## Usage example
+
+```yaml
+uses: images/fresh-base-image@v2
+with:
+ max_days: 183
+```
+
+## Mitigation
+Ensures that container images are built on up-to-date base images, reducing the risk of deploying images with outdated layers that may contain unpatched vulnerabilities or deprecated components. This check prevents the use of stale base images, thereby enhancing overall container security.
+
+
+## Description
+This rule processes the CycloneDX SBOM evidence for a container image to verify that its base image remains fresh.
+It identifies base image components by locating properties whose names end with "isbaseimage" (case-insensitive) and have a value of "true".
+The rule then extracts the "created" timestamp from these components and calculates the image’s age against the allowed threshold specified in `with.max_days`.
+If any base image is older than the allowed age, or if no base image data is found, the rule records a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided in CycloneDX JSON format.
+- The SBOM should include a `metadata.component.properties` array with properties for base image identification and creation timestamp.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+| filter-by | ['target', 'product'] |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| max_days | integer | True | The maximum allowed age of the base image in days. |
+
diff --git a/docs/configuration/initiatives/rules/images/fresh-image.md b/docs/configuration/initiatives/rules/images/fresh-image.md
new file mode 100644
index 000000000..baf77e017
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/fresh-image.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Fresh Image
+title: Fresh Image
+---
+# Fresh Image
+**Type:** Rule
+**ID:** `fresh-image`
+**Source:** [v2/rules/images/fresh-image.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-image.yaml)
+**Rego Source:** [fresh-image.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-image.rego)
+**Labels:** SBOM, Images
+
+Verify the image is not older than the specified threshold.
+
+:::note
+This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by target and product.
+:::
+
+## Usage example
+
+```yaml
+uses: images/fresh-image@v2
+with:
+ max_days: 183
+```
+
+## Mitigation
+Prevents the deployment of outdated container images—which may include unpatched vulnerabilities or outdated dependencies— by enforcing a maximum age limit based on the image's build time.
+
+
+## Description
+This rule extracts the Image creation timestamp from the SBOM evidence. It searches for a property named "created"
+within the image's metadata (specifically under `metadata.component.properties`). The creation timestamp is parsed using RFC 3339.
+
+The rule compares the current time with the sum of the creation time and the maximum allowed age (by days). If the current time exceeds this sum,
+the rule flags the image as too old and generates a violation with details on the calculated maximum allowed time.
+
+### **Evidence Requirements**
+- Evidence must be provided in the `cyclonedx-json` format.
+- The SBOM must contain a component under `metadata.component.properties` with a property named "created" in valid RFC 3339 format.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+| filter-by | ['target', 'product'] |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| max_days | integer | True | The maximum allowed age of the image in days. |
+
diff --git a/docs/configuration/initiatives/rules/images/image-signed.md b/docs/configuration/initiatives/rules/images/image-signed.md
new file mode 100644
index 000000000..7ff88fc2f
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/image-signed.md
@@ -0,0 +1,69 @@
+---
+sidebar_label: Require Signed Container Image
+title: Require Signed Container Image
+---
+# Require Signed Container Image
+**Type:** Rule
+**ID:** `images-require-signed-image`
+**Source:** [v2/rules/images/image-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/image-signed.yaml)
+**Rego Source:** [image-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/image-signed.rego)
+**Labels:** Images, Blueprint
+
+Enforces that container images (target_type=container) are cryptographically signed.
+
+:::note
+This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by product and target.
+:::
+
+## Usage example
+
+```yaml
+uses: images/image-signed@v2
+with:
+ identity:
+ emails:
+ - bob@company.com
+ - alice@company.com
+ skip_image_regex:
+ - .*alpine.*
+```
+
+## Mitigation
+Ensures that only container images with valid cryptographic signatures are deployed, mitigating the risk of tampering. By requiring evidence in the CycloneDX attest-cyclonedx-json format, this rule confirms that images have been signed by trusted entities.
+
+
+## Description
+This rule evaluates the evidence for a container image to determine if it is properly signed. It checks the
+environment field in the evidence to verify that the `content_type` is set to "attest-cyclonedx-json". If the
+image name matches any pattern specified in `with.skip_image_regex`, the signature check is skipped, allowing flexibility
+for images that do not require a signature. Otherwise, if the evidence does not indicate a valid signature, the rule fails.
+
+**Evidence Requirements:**
+
+- Evidence must be provided in CycloneDX JSON format with a `content_body_type` of "cyclonedx-json".
+- The evidence environment must include a `content_type` field that indicates the report is signed (i.e., "attest-cyclonedx-json").
+- The `with.skip_image_regex` parameter allows specifying patterns (e.g., "alpine") to bypass the signature requirement for certain images.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| target_type | container |
+| signed | False |
+| filter-by | ['product', 'target'] |
+| content_body_type | cyclonedx-json |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| identity | object | False | Identity information for the signers |
+| skip_image_regex | array | False | Patterns to bypass the signature requirement for certain images |
+
diff --git a/docs/configuration/initiatives/rules/images/require-healthcheck.md b/docs/configuration/initiatives/rules/images/require-healthcheck.md
new file mode 100644
index 000000000..02d073bfb
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/require-healthcheck.md
@@ -0,0 +1,54 @@
+---
+sidebar_label: Require Healthcheck
+title: Require Healthcheck
+---
+# Require Healthcheck
+**Type:** Rule
+**ID:** `images-require-healthcheck`
+**Source:** [v2/rules/images/require-healthcheck.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/require-healthcheck.yaml)
+**Rego Source:** [require-healthcheck.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/require-healthcheck.rego)
+**Labels:** SBOM, Images
+
+Checks that the container image includes at least one healthcheck property.
+
+:::note
+This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by target and product.
+:::
+
+## Usage example
+
+```yaml
+uses: images/require-healthcheck@v2
+```
+
+## Mitigation
+Ensures that container images define a HEALTHCHECK instruction so that the runtime environment can monitor and manage container health. This minimizes the risk of undetected failures at runtime.
+
+
+## Description
+This rule examines the CycloneDX SBOM evidence for a container image to verify that a healthcheck is defined.
+It does so by scanning the `metadata.component.properties` array for any property whose name, when lowercased,
+starts with "imagehealthcheck_". If at least one such property is found, the image is considered compliant;
+otherwise, a violation is recorded indicating a missing healthcheck.
+
+**Evidence Requirements:**
+- Evidence must be provided in the CycloneDX JSON format.
+- The SBOM should include a `metadata.component.properties` array with entries that define healthcheck instructions.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+| filter-by | ['target', 'product'] |
+
diff --git a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md
new file mode 100644
index 000000000..809e5a2d8
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md
@@ -0,0 +1,50 @@
+---
+sidebar_label: Disallow Container Shell Entrypoint
+title: Disallow Container Shell Entrypoint
+---
+# Disallow Container Shell Entrypoint
+**Type:** Rule
+**ID:** `images-disallow-shell-access`
+**Source:** [v2/rules/images/restrict-shell-entrypoint.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/restrict-shell-entrypoint.yaml)
+**Rego Source:** [restrict-shell-entrypoint.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/restrict-shell-entrypoint.rego)
+**Labels:** SBOM, Images
+
+Verify the container image disallows shell entrypoint.
+
+:::note
+This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by target and product.
+:::
+
+## Usage example
+
+```yaml
+uses: images/restrict-shell-entrypoint@v2
+```
+
+## Mitigation
+Prevent unauthorized shell access by ensuring container images do not use a shell-based entrypoint. This reduces the risk of privilege escalation, unauthorized command execution, and potential security vulnerabilities from unrestricted shell access within containers.
+### **Evidence Requirements** - Evidence must be provided in the `cyclonedx-json` format. - The SBOM must contain a component under `metadata.component.properties` with a property named "entrypoint".
+
+
+## Description
+This rule ensures that container images do not allow shell access by verifying their configured entrypoint.
+Attackers often exploit shell access in containerized environments to execute arbitrary commands, escalate privileges, or perform unauthorized actions.
+This rule extracts the 'entrypoint' property from the CycloneDX SBOM metadata and checks whether it contains a shell invocation (e.g., 'sh', 'bash').
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+| filter-by | ['target', 'product'] |
+
diff --git a/docs/configuration/initiatives/rules/images/verify-labels-exist.md b/docs/configuration/initiatives/rules/images/verify-labels-exist.md
new file mode 100644
index 000000000..34759b8ab
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/verify-labels-exist.md
@@ -0,0 +1,70 @@
+---
+sidebar_label: Require Image Labels
+title: Require Image Labels
+---
+# Require Image Labels
+**Type:** Rule
+**ID:** `required-image-labels`
+**Source:** [v2/rules/images/verify-labels-exist.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels-exist.yaml)
+**Rego Source:** [verify-labels-exist.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels-exist.rego)
+**Labels:** SBOM, Images
+
+Verify the image has the specified labels.
+
+:::note
+This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by target and product.
+:::
+
+## Usage example
+
+```yaml
+uses: images/verify-labels-exist@v2
+with:
+ labels:
+ - "org.opencontainers.image.created"
+ - "org.opencontainers.image.revision"
+ - "org.opencontainers.image.title"
+ - "org.opencontainers.image.vendor"
+ - "org.opencontainers.image.version"
+```
+
+## Mitigation
+Ensures that container images include all required metadata labels, which are essential for traceability, auditing, and enforcing compliance with security and operational standards.
+
+
+## Description
+This rule checks the CycloneDX SBOM evidence for the container image to verify that each required label
+(as defined in the `with.labels` parameter) exists with the correct value.
+
+1. The rule iterates over the list of required labels provided in the `with.labels` configuration.
+2. For each required label, it examines the `metadata.component.properties` array in the SBOM.
+3. It looks for a property where the name starts with "label_" and ends with the required label key, and
+ where the property value matches the expected value.
+4. If such a property is not found, a violation is recorded with the missing label and expected value details.
+
+### **Evidence Requirements**
+- Evidence must be provided in the `cyclonedx-json` format.
+- The SBOM should include a `metadata.component.properties` array that contains label information.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+| filter-by | ['target', 'product'] |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| labels | array | False | A list of required labels. |
+
diff --git a/docs/configuration/initiatives/rules/images/verify-labels.md b/docs/configuration/initiatives/rules/images/verify-labels.md
new file mode 100644
index 000000000..c492c1062
--- /dev/null
+++ b/docs/configuration/initiatives/rules/images/verify-labels.md
@@ -0,0 +1,66 @@
+---
+sidebar_label: Verify Image Labels
+title: Verify Image Labels
+---
+# Verify Image Labels
+**Type:** Rule
+**ID:** `image-labels`
+**Source:** [v2/rules/images/verify-labels.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels.yaml)
+**Rego Source:** [verify-labels.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels.rego)
+**Labels:** SBOM, Images
+
+Verify specified labels key-value pairs exist in the image.
+
+:::note
+This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by target and product.
+:::
+
+## Usage example
+
+```yaml
+uses: images/verify-labels@v2
+with:
+ labels:
+ - "org.opencontainers.image.vendor=my_vendor"
+```
+
+## Mitigation
+Ensures that all required metadata labels are present with the expected values, which is crucial for traceability, auditing, and compliance with container security standards.
+
+
+## Description
+This rule checks the CycloneDX SBOM evidence for the container image to verify that each
+required label (as defined in the `with.labels` parameter) exists with the correct value.
+
+1. The rule iterates over the list of required labels provided in the `with.labels` configuration.
+2. For each required label, it examines the `metadata.component.properties` array in the SBOM.
+3. It looks for a property where the name starts with "label_" and ends with the required label key, and
+ where the property value matches the expected value.
+4. If such a property is not found, a violation is recorded with the missing label and expected value details.
+
+### **Evidence Requirements**
+- Evidence must be provided in the `cyclonedx-json` format.
+- The SBOM should include a `metadata.component.properties` array that contains label information.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+| filter-by | ['target', 'product'] |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| labels | array | False | A list of required labels. |
+
diff --git a/docs/configuration/initiatives/rules/jenkins/_category_.json b/docs/configuration/initiatives/rules/jenkins/_category_.json
new file mode 100644
index 000000000..a1e606da6
--- /dev/null
+++ b/docs/configuration/initiatives/rules/jenkins/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Jenkins",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/jenkins/folder/_category_.json b/docs/configuration/initiatives/rules/jenkins/folder/_category_.json
new file mode 100644
index 000000000..5a7c99815
--- /dev/null
+++ b/docs/configuration/initiatives/rules/jenkins/folder/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Folder",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md
new file mode 100644
index 000000000..851ca8a62
--- /dev/null
+++ b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify Exposed Credentials
+title: Verify Exposed Credentials
+---
+# Verify Exposed Credentials
+**Type:** Rule
+**ID:** `jenkins-exposed-credentials`
+**Source:** [v2/rules/jenkins/folder/exposed-credentials.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/folder/exposed-credentials.yaml)
+**Rego Source:** [exposed-credentials.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/folder/exposed-credentials.rego)
+**Labels:** Jenkins, Folder
+
+Verify there are no exposed credentials.
+
+:::note
+This rule requires Discovery Evidence. See [here](/docs/platforms/discover) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: jenkins/folder/exposed-credentials@v2
+```
+
+## Mitigation
+Ensure that there are no exposed credentials in the Jenkins folder to reduce the risk of unauthorized access.
+
+
+## Description
+This rule ensures that there are no exposed credentials in the Jenkins folder.
+It performs the following steps:
+
+1. Checks the Jenkins folder for exposed credentials.
+2. Verifies that there are no exposed credentials.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Jenkins folder resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=folder |
+
diff --git a/docs/configuration/initiatives/rules/jenkins/instance/_category_.json b/docs/configuration/initiatives/rules/jenkins/instance/_category_.json
new file mode 100644
index 000000000..194968062
--- /dev/null
+++ b/docs/configuration/initiatives/rules/jenkins/instance/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Instance",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md
new file mode 100644
index 000000000..e4a94c697
--- /dev/null
+++ b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md
@@ -0,0 +1,58 @@
+---
+sidebar_label: Verify Inactive Users
+title: Verify Inactive Users
+---
+# Verify Inactive Users
+**Type:** Rule
+**ID:** `jenkins-inactive-users`
+**Source:** [v2/rules/jenkins/instance/inactive-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/inactive-users.yaml)
+**Rego Source:** [inactive-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/inactive-users.rego)
+**Labels:** Jenkins, Instance
+
+Verify there are no inactive users.
+
+:::note
+This rule requires Jenkins Instance Discovery Evidence. See [here](/docs/platforms/discover#jenkins-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: jenkins/instance/inactive-users@v2
+with:
+ inactive_for_days: 90
+```
+
+## Mitigation
+Ensure that no Jenkins instance users are inactive to prevent service disruption.
+
+
+## Description
+This rule ensures that no Jenkins instance users are inactive.
+It performs the following steps:
+
+1. Checks the settings of the Jenkins instance.
+2. Verifies that no users are inactive.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Jenkins instance resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=instance - platform=jenkins |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| inactive_for_days | number | False | Number of days before a user is considered inactive. |
+
diff --git a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md
new file mode 100644
index 000000000..e389c4c5b
--- /dev/null
+++ b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md
@@ -0,0 +1,51 @@
+---
+sidebar_label: Disallow Unused Users
+title: Disallow Unused Users
+---
+# Disallow Unused Users
+**Type:** Rule
+**ID:** `jenkins-unused-users`
+**Source:** [v2/rules/jenkins/instance/unused-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/unused-users.yaml)
+**Rego Source:** [unused-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/unused-users.rego)
+**Labels:** Jenkins, Instance
+
+Verify there are no users with zero activity.
+
+:::note
+This rule requires Jenkins Instance Discovery Evidence. See [here](/docs/platforms/discover#jenkins-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: jenkins/instance/unused-users@v2
+```
+
+## Mitigation
+Ensure that there are no users with zero activity in the Jenkins instance to prevent service disruption.
+
+
+## Description
+This rule ensures that there are no users with zero activity in the Jenkins instance.
+It performs the following steps:
+
+1. Checks the settings of the Jenkins instance.
+2. Verifies that there are no users with zero activity.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Jenkins instance resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=instance - platform=jenkins |
+
diff --git a/docs/configuration/initiatives/rules/k8s/_category_.json b/docs/configuration/initiatives/rules/k8s/_category_.json
new file mode 100644
index 000000000..8b1cd3ce2
--- /dev/null
+++ b/docs/configuration/initiatives/rules/k8s/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "K8S",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/k8s/namespace/_category_.json b/docs/configuration/initiatives/rules/k8s/namespace/_category_.json
new file mode 100644
index 000000000..3ea66151d
--- /dev/null
+++ b/docs/configuration/initiatives/rules/k8s/namespace/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Namespace",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md
new file mode 100644
index 000000000..6d4175020
--- /dev/null
+++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Allowed Container Images
+title: Allowed Container Images
+---
+# Allowed Container Images
+**Type:** Rule
+**ID:** `k8s-namespace-blocked-images`
+**Source:** [v2/rules/k8s/namespace/allowed-images.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/allowed-images.yaml)
+**Rego Source:** [blocked-images.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/blocked-images.rego)
+**Labels:** K8s, Namespace
+
+Verify only container images specified in the Allowed List run within the Kubernetes namespace.
+
+:::note
+This rule requires K8s Namespace Discovery Evidence. See [here](/docs/platforms/discover#k8s-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: k8s/namespace/allowed-images@v2
+with:
+ images_to_include:
+ - docker.io/my_org/my_image1
+ - docker.io/my_org/my_image2
+```
+
+## Mitigation
+Ensures that only approved container images are running within the Kubernetes namespace, reducing the risk of introducing vulnerabilities or unapproved software.
+
+
+## Description
+This rule ensures that only container images specified in the allowed list are running within the Kubernetes namespace.
+It performs the following steps:
+
+1. Iterates over the container images running in the namespace.
+2. Checks each image against the allowed list specified in the `with.images_to_include` configuration.
+ - If an image is not in the allowed list, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=namespace - platform=k8s |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| images_to_include | array | False | List of allowed container images. |
+
diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md
new file mode 100644
index 000000000..86df02e4e
--- /dev/null
+++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Allowed Namespace Registries
+title: Allowed Namespace Registries
+---
+# Allowed Namespace Registries
+**Type:** Rule
+**ID:** `k8s-namespace-allowed-registries`
+**Source:** [v2/rules/k8s/namespace/allowed-registries.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/allowed-registries.yaml)
+**Rego Source:** [allowed-registries.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/allowed-registries.rego)
+**Labels:** K8s, Namespace
+
+Verify container images in Kubernetes namespaces originate from registries in the Allowed List.
+
+:::note
+This rule requires K8s Namespace Discovery Evidence. See [here](/docs/platforms/discover#k8s-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: k8s/namespace/allowed-registries@v2
+with:
+ allowed_registries:
+ - docker.io/*
+ - gcr.io/*
+```
+
+## Mitigation
+Ensures that only approved container registries are used within the Kubernetes namespace, reducing the risk of introducing vulnerabilities or unapproved software.
+
+
+## Description
+This rule ensures that only container images from specified registries are allowed within the Kubernetes namespace.
+It performs the following steps:
+
+1. Iterates over the container images running in the namespace.
+2. Checks each image's registry against the allowed registries specified in the `with.allowed_registries` configuration.
+ - If an image's registry is not in the allowed list, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=namespace - platform=k8s |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_registries | array | False | A list of allowed container registries Regex patterns. |
+
diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md
new file mode 100644
index 000000000..9f3ab6a6e
--- /dev/null
+++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md
@@ -0,0 +1,60 @@
+---
+sidebar_label: Verify Namespace Runtime Duration
+title: Verify Namespace Runtime Duration
+---
+# Verify Namespace Runtime Duration
+**Type:** Rule
+**ID:** `k8s-namespace-verify-namespace-duration`
+**Source:** [v2/rules/k8s/namespace/verify-namespace-duration.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-duration.yaml)
+**Rego Source:** [verify-namespace-duration.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-duration.rego)
+**Labels:** K8s, Namespace
+
+Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits.
+
+:::note
+This rule requires K8s Namespace Discovery Evidence. See [here](/docs/platforms/discover#k8s-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: k8s/namespace/verify-namespace-duration@v2
+with:
+ threshold_date: "1970-01-01T00:00:00Z"
+```
+
+## Mitigation
+Ensures that namespaces do not exceed their intended lifecycle, maintaining cluster hygiene and resource efficiency.
+
+
+## Description
+This rule verifies that the duration of namespaces in Kubernetes does not exceed the specified limit.
+It performs the following steps:
+
+1. Iterates over the namespaces in the cluster.
+2. Checks each namespace's duration against the limit specified in the `with.threshold_date` configuration.
+ - If a namespace's duration exceeds the limit, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=namespace - platform=k8s |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| threshold_date | string | False | The threshold date for namespace duration (supports regex). |
+
diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md
new file mode 100644
index 000000000..2f09ed274
--- /dev/null
+++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Verify Namespace Termination
+title: Verify Namespace Termination
+---
+# Verify Namespace Termination
+**Type:** Rule
+**ID:** `k8s-namespace-verify-namespace-termination`
+**Source:** [v2/rules/k8s/namespace/verify-namespace-termination.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-termination.yaml)
+**Rego Source:** [verify-namespace-termination.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-termination.rego)
+**Labels:** K8s, Namespace
+
+Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene.
+
+:::note
+This rule requires K8s Namespace Discovery Evidence. See [here](/docs/platforms/discover#k8s-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: k8s/namespace/verify-namespace-termination@v2
+with:
+ namespaces:
+ - ".*"
+```
+
+## Mitigation
+Ensures that namespaces are terminated in a timely manner, preventing lingering resources and maintaining cluster hygiene.
+
+
+## Description
+This rule verifies that namespaces in Kubernetes are terminated properly within the specified time frame.
+It performs the following steps:
+
+1. Iterates over the namespaces marked for termination in the cluster.
+2. Checks each namespace's termination time against the limit specified in the `with.max_termination_time` configuration.
+ - If a namespace's termination time exceeds the limit, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=namespace - platform=k8s |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| namespaces | array | False | A list of namespaces to verify (supports regex). |
+
diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md
new file mode 100644
index 000000000..9fa04fe21
--- /dev/null
+++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md
@@ -0,0 +1,61 @@
+---
+sidebar_label: Allowed Namespaces
+title: Allowed Namespaces
+---
+# Allowed Namespaces
+**Type:** Rule
+**ID:** `k8s-namespace-white-listed-namespaces`
+**Source:** [v2/rules/k8s/namespace/white-listed-namespaces.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-namespaces.yaml)
+**Rego Source:** [white-listed-namespaces.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-namespaces.rego)
+**Labels:** K8s, Namespace
+
+Verify only namespaces specified in the Allowed List are allowed within the cluster.
+
+:::note
+This rule requires K8s Namespace Discovery Evidence. See [here](/docs/platforms/discover#k8s-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: k8s/namespace/white-listed-namespaces@v2
+with:
+ namespaces:
+ - default
+```
+
+## Mitigation
+Ensures that only approved namespaces are allowed within the Kubernetes cluster, reducing the risk of unauthorized or misconfigured namespaces.
+
+
+## Description
+This rule ensures that only namespaces specified in the whitelist are allowed within the Kubernetes cluster.
+It performs the following steps:
+
+1. Iterates over the namespaces in the cluster.
+2. Checks each namespace against the whitelist specified in the `with.namespaces` configuration.
+ - If a namespace is not in the whitelist, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=namespace - platform=k8s |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| namespaces | array | False | A list of allowed namespaces. |
+
diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md
new file mode 100644
index 000000000..16ca50ecf
--- /dev/null
+++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md
@@ -0,0 +1,65 @@
+---
+sidebar_label: Allowed Pods in Namespace
+title: Allowed Pods in Namespace
+---
+# Allowed Pods in Namespace
+**Type:** Rule
+**ID:** `k8s-namespace-white-listed-pod`
+**Source:** [v2/rules/k8s/namespace/white-listed-pod.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-pod.yaml)
+**Rego Source:** [white-listed-pod.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-pod.rego)
+**Labels:** K8s, Namespace
+
+Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace.
+
+:::note
+This rule requires K8s Namespace Discovery Evidence. See [here](/docs/platforms/discover#k8s-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: k8s/namespace/white-listed-pod@v2
+with:
+ white_listed_pod:
+ - my-pod-1.*
+ - my-pod-2.*
+ verify_namespaces:
+ - ",*"
+```
+
+## Mitigation
+Ensures that only approved pods are running within the Kubernetes namespace, reducing the risk of unauthorized or misconfigured pods.
+
+
+## Description
+This rule ensures that only pods specified in the whitelist are allowed within the Kubernetes namespace.
+It performs the following steps:
+
+1. Iterates over the pods in the namespace.
+2. Checks each pod against the whitelist specified in the `with.white_listed_pod` configuration.
+ - If a pod is not in the whitelist, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=namespace - platform=k8s |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| white_listed_pod | array | True | A list of allowed pods (supports regex). |
+| verify_namespaces | array | False | A list of namespaces to verify. |
+
diff --git a/docs/configuration/initiatives/rules/k8s/pods/_category_.json b/docs/configuration/initiatives/rules/k8s/pods/_category_.json
new file mode 100644
index 000000000..d22e47cb4
--- /dev/null
+++ b/docs/configuration/initiatives/rules/k8s/pods/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Pods",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md
new file mode 100644
index 000000000..3bd9120a7
--- /dev/null
+++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md
@@ -0,0 +1,60 @@
+---
+sidebar_label: Verify Pod Runtime Duration
+title: Verify Pod Runtime Duration
+---
+# Verify Pod Runtime Duration
+**Type:** Rule
+**ID:** `k8s-pods-verify-pod-duration`
+**Source:** [v2/rules/k8s/pods/verify-pod-duration.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-duration.yaml)
+**Rego Source:** [verify-pod-duration.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-duration.rego)
+**Labels:** K8s, Pod
+
+Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits.
+
+:::note
+This rule requires K8s Pod Discovery Evidence. See [here](/docs/platforms/discover#k8s-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: k8s/pods/verify-pod-duration@v2
+with:
+ max_days: 30
+```
+
+## Mitigation
+Ensures that pods do not exceed their intended lifecycle, maintaining cluster hygiene and resource efficiency.
+
+
+## Description
+This rule verifies that the duration of pods in Kubernetes does not exceed the specified limit.
+It performs the following steps:
+
+1. Iterates over the pods in the cluster.
+2. Checks each pod's duration against the limit specified in the `with.max_days` configuration.
+ - If a pod's duration exceeds the limit, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=pod - platform=k8s |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| max_days | integer | False | The maximum allowed duration for pods in days. |
+
diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md
new file mode 100644
index 000000000..0419bfd0d
--- /dev/null
+++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify Pod Termination
+title: Verify Pod Termination
+---
+# Verify Pod Termination
+**Type:** Rule
+**ID:** `k8s-pods-verify-pod-termination`
+**Source:** [v2/rules/k8s/pods/verify-pod-termination.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-termination.yaml)
+**Rego Source:** [verify-pod-termination.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-termination.rego)
+**Labels:** K8s, Pod
+
+Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene.
+
+:::note
+This rule requires K8s Pod Discovery Evidence. See [here](/docs/platforms/discover#k8s-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: k8s/pods/verify-pod-termination@v2
+```
+
+## Mitigation
+Ensures that pods are terminated in a timely manner, preventing lingering resources and maintaining cluster hygiene.
+
+
+## Description
+This rule verifies that pods in Kubernetes are terminated properly within the specified time frame.
+It performs the following steps:
+
+1. Iterates over the pods marked for termination in the cluster.
+2. Checks each pod's termination status is present, if such a status is present, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=pod - platform=k8s |
+
diff --git a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md
new file mode 100644
index 000000000..2c2f7e044
--- /dev/null
+++ b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md
@@ -0,0 +1,65 @@
+---
+sidebar_label: Allowed Pods
+title: Allowed Pods
+---
+# Allowed Pods
+**Type:** Rule
+**ID:** `k8s-pods-white-listed-pod`
+**Source:** [v2/rules/k8s/pods/white-listed-pod.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/white-listed-pod.yaml)
+**Rego Source:** [white-listed-pod.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/white-listed-pod.rego)
+**Labels:** K8s, Pod
+
+Verify only pods explicitly listed in the Allowed List are allowed to run.
+
+:::note
+This rule requires K8s Pod Discovery Evidence. See [here](/docs/platforms/discover#k8s-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: k8s/pods/white-listed-pod@v2
+with:
+ white_listed_pod:
+ - my-pod-1.*
+ - my-pod-2.*
+ verify_namespaces:
+ - ".*"
+```
+
+## Mitigation
+Ensures that only approved pods are running within the Kubernetes cluster, reducing the risk of unauthorized or misconfigured pods.
+
+
+## Description
+This rule ensures that only pods specified in the whitelist are allowed to run within the Kubernetes cluster.
+It performs the following steps:
+
+1. Iterates over the pods in the cluster.
+2. Checks each pod against the whitelist specified in the `with.white_listed_pod` configuration.
+ - If a pod is not in the whitelist, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - asset_type=pod - platform=k8s |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| white_listed_pod | array | True | A list of allowed pods (supports regex). |
+| verify_namespaces | array | True | A list of namespaces to verify (supports regex). |
+
diff --git a/docs/configuration/initiatives/rules/multievidence/_category_.json b/docs/configuration/initiatives/rules/multievidence/_category_.json
new file mode 100644
index 000000000..9696ec52e
--- /dev/null
+++ b/docs/configuration/initiatives/rules/multievidence/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Multievidence",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/multievidence/files_integrity.md b/docs/configuration/initiatives/rules/multievidence/files_integrity.md
new file mode 100644
index 000000000..6ad76cd05
--- /dev/null
+++ b/docs/configuration/initiatives/rules/multievidence/files_integrity.md
@@ -0,0 +1,43 @@
+---
+sidebar_label: Verify File Integrity
+title: Verify File Integrity
+---
+# Verify File Integrity
+**Type:** Rule
+**ID:** `file-integrity`
+**Source:** [v2/rules/multievidence/files_integrity.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/multievidence/files_integrity.yaml)
+**Rego Source:** [files_integrity.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/multievidence/files_integrity.rego)
+**Labels:** SBOM
+
+Verify the checksum of each file in one SBOM matches the checksum in a second SBOM.
+
+:::note
+This rule requires Signed Image SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS** required by default.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: multievidence/files_integrity@v2
+```
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | True |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+| labels | - new_evidence |
+
+## Rule Parameters (`with`)
+| Parameter | Default |
+|-----------|---------|
+| ref_sbom | `{{ .Env.REF_SBOM_DATA }}` |
+| path_prefix | pkg:file/ |
+
diff --git a/docs/configuration/initiatives/rules/sarif/_category_.json b/docs/configuration/initiatives/rules/sarif/_category_.json
new file mode 100644
index 000000000..1d0527158
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "SARIF",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/sarif/artifact-signed.md b/docs/configuration/initiatives/rules/sarif/artifact-signed.md
new file mode 100644
index 000000000..bc19b5ab4
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/artifact-signed.md
@@ -0,0 +1,60 @@
+---
+sidebar_label: Verify Artifact Signature in SARIF
+title: Verify Artifact Signature in SARIF
+---
+# Verify Artifact Signature in SARIF
+**Type:** Rule
+**ID:** `sarif-artifact-signed`
+**Source:** [v2/rules/sarif/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/artifact-signed.yaml)
+**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/artifact-signed.rego)
+**Labels:** SARIF
+
+Verify the artifact referenced in the SARIF report is signed to confirm its integrity.
+
+:::note
+This rule requires Signed SARIF Evidence. See [here](/docs/valint/sarif) for more details.
+:::
+:::tip
+> Evidence **IS** required for this rule and will fail if missing.
+:::
+:::tip
+Signed Evidence for this rule **IS** required by default.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: sarif/artifact-signed@v2
+```
+
+## Mitigation
+Ensures that the referenced artifact has a valid digital signature, confirming its integrity and authenticity. This prevents tampering and verifies that the artifact originates from a trusted source.
+
+
+## Description
+This rule verifies that the artifact referenced in the SARIF report has been cryptographically signed.
+It uses the provided evidence (which must adhere to the SARIF 2.1.0 schema) to confirm that a valid signature exists.
+The rule checks that the evidence indicates the artifact is signed, ensuring that it has not been modified since its creation.
+Additionally, the rule validates that the signature corresponds to one of the expected identities as defined in the configuration.
+
+### **Evidence Requirements**
+- Evidence must be provided in a generic format conforming to SARIF 2.1.0.
+- The SARIF report must indicate that the artifact is signed (i.e., the 'signed' flag is true).
+- The signer's identity should match one of the specified common names or emails in the configuration.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | True |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+
+## Rule Parameters (`with`)
+| Parameter | Default |
+|-----------|---------|
+| identity | `{'common-names': [], 'emails': []}` |
+
diff --git a/docs/configuration/initiatives/rules/sarif/evidence-exists.md b/docs/configuration/initiatives/rules/sarif/evidence-exists.md
new file mode 100644
index 000000000..42cd057ee
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/evidence-exists.md
@@ -0,0 +1,44 @@
+---
+sidebar_label: Verify Required Evidence in SARIF
+title: Verify Required Evidence in SARIF
+---
+# Verify Required Evidence in SARIF
+**Type:** Rule
+**ID:** `required-sarif-evidence`
+**Source:** [v2/rules/sarif/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/evidence-exists.yaml)
+**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/evidence-exists.rego)
+**Labels:** SARIF
+
+Verify all required evidence exists as defined by the SARIF policy.
+
+:::note
+This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details.
+:::
+:::tip
+> Evidence **IS** required for this rule and will fail if missing.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: sarif/evidence-exists@v2
+```
+
+## Mitigation
+By confirming that all required evidence exists, this rule guarantees that the outputs from various security scans (such as vulnerability assessments, configuration checks, and static analysis) are fully represented as evidence.
+
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+
diff --git a/docs/configuration/initiatives/rules/sarif/patcheck/_category_.json b/docs/configuration/initiatives/rules/sarif/patcheck/_category_.json
new file mode 100644
index 000000000..4a0cbea05
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/patcheck/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Patcheck",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md
new file mode 100644
index 000000000..73272dd36
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md
@@ -0,0 +1,37 @@
+---
+sidebar_label: SARIF Update Needed
+title: SARIF Update Needed
+---
+# SARIF Update Needed
+**Type:** Rule
+**ID:** `sarif-update-needed`
+**Source:** [v2/rules/sarif/patcheck/updates-needed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/patcheck/updates-needed.yaml)
+**Rego Source:** [updates-needed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/patcheck/updates-needed.rego)
+**Labels:** SARIF
+
+Verify no security packages require updates.
+
+:::note
+This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: sarif/patcheck/updates-needed@v2
+```
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+
diff --git a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md
new file mode 100644
index 000000000..60a3b8c25
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Verify IaC Misconfiguration Threshold in SARIF
+title: Verify IaC Misconfiguration Threshold in SARIF
+---
+# Verify IaC Misconfiguration Threshold in SARIF
+**Type:** Rule
+**ID:** `sarif-iac-findings`
+**Source:** [v2/rules/sarif/report-iac-errors.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/report-iac-errors.yaml)
+**Rego Source:** [report-iac-errors.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/report-iac-errors.rego)
+**Labels:** SARIF
+
+Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold.
+
+:::note
+This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: sarif/report-iac-errors@v2
+with:
+ violations_threshold: 0
+```
+
+## Mitigation
+Ensures that IaC misconfiguration errors remain within acceptable limits, reducing the risk of deploying images with insecure configuration settings.
+
+
+## Description
+This rule evaluates the SARIF report generated by the Vulnerability Scanner to detect vulnerabilities that match
+a specified blocklist of CVE identifiers. It processes the report by iterating over its vulnerability results, retrieving
+the corresponding rule definitions, and checking if the rule IDs contain any of the CVEs listed in the configuration.
+If the total number of matching vulnerabilities exceeds the allowed threshold, the rule records a violation that includes
+details such as the CVE identifier, its severity, and the location (artifact URI) where it was detected.
+
+### **Evidence Requirements**
+
+Evidence must be provided in a SARIF 2.1.0 compliant format, generated by the Vulnerability Scanner.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| violations_threshold | integer | False | The maximum number of allowed IaC misconfiguration errors. |
+
diff --git a/docs/configuration/initiatives/rules/sarif/trivy/_category_.json b/docs/configuration/initiatives/rules/sarif/trivy/_category_.json
new file mode 100644
index 000000000..54def2fba
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/trivy/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "Trivy",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md
new file mode 100644
index 000000000..6a48c671c
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md
@@ -0,0 +1,67 @@
+---
+sidebar_label: Trivy Blocklist CVE Check
+title: Trivy Blocklist CVE Check
+---
+# Trivy Blocklist CVE Check
+**Type:** Rule
+**ID:** `trivy-blocklist-cve`
+**Source:** [v2/rules/sarif/trivy/blocklist-cve.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/blocklist-cve.yaml)
+**Rego Source:** [../blocklist-report.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../blocklist-report.rego)
+**Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example
+**Labels:** SARIF, Trivy
+
+Verify a CVE Blocklist against a SARIF report
+
+:::note
+This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::info
+Rule is scoped by product.
+:::
+
+## Usage example
+
+```yaml
+uses: sarif/trivy/blocklist-cve@v2
+```
+
+## Mitigation
+Ensures that any vulnerabilities matching a predefined CVE blocklist are flagged, preventing images with known high-risk vulnerabilities from progressing through the pipeline.
+
+
+## Description
+This rule processes the SARIF report produced by the Trivy Vulnerability Scanner to verify that no vulnerabilities
+matching a predefined blocklist of CVE identifiers are present beyond the allowed threshold. The evaluation proceeds as follows:
+
+The rule iterates over the vulnerability results in the SARIF report (located under
+`input.evidence.predicate.content.runs[0].results`), and for each result, retrieves the corresponding rule definition from
+`input.evidence.predicate.content.runs[0].tool.driver.rules` based on the result's ruleIndex. It then checks if the result's
+ruleId contains any of the CVE identifiers provided in the `with.rule_ids` configuration parameter. If the total number of such
+findings exceeds the allowed threshold (specified by `with.violations_threshold`), a violation is recorded with details including
+the rule ID, severity (extracted from the rule’s properties), and the location where the vulnerability was detected.
+
+### **Evidence Requirements**
+
+- Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema.
+- The SARIF report should be generated by the "Trivy Vulnerability Scanner".
+- Evidence filtering based on the product must be applied as defined in the configuration.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+| tool | Trivy Vulnerability Scanner |
+| filter-by | ['product'] |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| rule_ids | array | False | List of CVE identifiers to check for in the Trivy SARIF report. |
+| violations_threshold | integer | False | The maximum number of allowed violations. |
+
diff --git a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md
new file mode 100644
index 000000000..82c29d586
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Verify IaC Misconfiguration Threshold in Trivy SARIF
+title: Verify IaC Misconfiguration Threshold in Trivy SARIF
+---
+# Verify IaC Misconfiguration Threshold in Trivy SARIF
+**Type:** Rule
+**ID:** `trivy-iac-findings`
+**Source:** [v2/rules/sarif/trivy/report-trivy-iac-errors.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/report-trivy-iac-errors.yaml)
+**Rego Source:** [../report-iac-errors.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../report-iac-errors.rego)
+**Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example
+**Labels:** SARIF, Trivy
+
+Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold.
+
+:::note
+This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::info
+Rule is scoped by product.
+:::
+
+## Usage example
+
+```yaml
+uses: sarif/trivy/report-trivy-iac-errors@v2
+with:
+ violations_threshold: 0
+```
+
+## Mitigation
+Ensures that IaC misconfiguration errors remain within acceptable limits, reducing the risk of deploying images with insecure configuration settings.
+
+
+## Description
+This rule evaluates the SARIF report generated by the Trivy Vulnerability Scanner to detect vulnerabilities that match
+a specified blocklist of CVE identifiers. It processes the report by iterating over its vulnerability results, retrieving
+the corresponding rule definitions, and checking if the rule IDs contain any of the CVEs listed in the configuration.
+If the total number of matching vulnerabilities exceeds the allowed threshold, the rule records a violation that includes
+details such as the CVE identifier, its severity, and the location (artifact URI) where it was detected.
+
+### **Evidence Requirements**
+
+Evidence must be provided in a SARIF 2.1.0 compliant format, generated by the Trivy Vulnerability Scanner.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+| tool | Trivy Vulnerability Scanner |
+| filter-by | ['product'] |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| violations_threshold | integer | False | The maximum number of allowed IaC misconfiguration errors. |
+
diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md
new file mode 100644
index 000000000..070aa80fc
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md
@@ -0,0 +1,71 @@
+---
+sidebar_label: Trivy Vulnerability Findings Check
+title: Trivy Vulnerability Findings Check
+---
+# Trivy Vulnerability Findings Check
+**Type:** Rule
+**ID:** `trivy-verify-vulnerability-findings`
+**Source:** [v2/rules/sarif/trivy/verify-cve-severity.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-cve-severity.yaml)
+**Rego Source:** [verify-cve-severity.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-cve-severity.rego)
+**Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example
+**Labels:** SARIF, Trivy
+
+Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed
+the defined severity threshold.
+
+
+:::note
+This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details.
+:::
+:::tip
+> Evidence **IS** required for this rule and will fail if missing.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::info
+Rule is scoped by product.
+:::
+
+## Usage example
+
+```yaml
+uses: sarif/trivy/verify-cve-severity@v2
+with:
+ severity_threshold: 0
+```
+
+## Mitigation
+Ensures that the SARIF report generated by Trivy meets the predefined security criteria, helping to detect critical vulnerabilities and configuration issues early.
+
+
+## Description
+This rule processes the SARIF report produced by the Trivy Vulnerability Scanner to verify that it
+complies with a set of predefined rules. The evaluation is based on several configurable parameters:
+
+The rule iterates over the vulnerability results in the SARIF report (provided under
+`input.evidence.predicate.content.runs[0].results`), and for each result, it retrieves the corresponding
+rule definition from `input.evidence.predicate.content.runs[0].tool.driver.rules` based on the result's
+ruleIndex. It then evaluates whether the severity (extracted from the rule’s properties) exceeds the specified
+threshold. If the number of such violations exceeds the allowed maximum, a violation is recorded.
+
+### **Evidence Requirements**
+
+- Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema.
+- The SARIF report should be generated by the "Trivy Vulnerability Scanner".
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+| tool | Trivy Vulnerability Scanner |
+| filter-by | ['product'] |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| severity_threshold | integer | True | The maximum severity level allowed for vulnerabilities. |
+
diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md
new file mode 100644
index 000000000..1b02523f8
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md
@@ -0,0 +1,49 @@
+---
+sidebar_label: Verify Attack Vector Threshold in Trivy SARIF
+title: Verify Attack Vector Threshold in Trivy SARIF
+---
+# Verify Attack Vector Threshold in Trivy SARIF
+**Type:** Rule
+**ID:** `trivy-attack-vectors`
+**Source:** [v2/rules/sarif/trivy/verify-trivy-attack-vector.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-trivy-attack-vector.yaml)
+**Rego Source:** [../verify-attack-vector.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../verify-attack-vector.rego)
+**Labels:** SARIF, Trivy
+
+Verify no attack vector in the Trivy SARIF report exceeds the specified threshold.
+
+:::note
+This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::info
+Rule is scoped by product.
+:::
+
+## Usage example
+
+```yaml
+uses: sarif/trivy/verify-trivy-attack-vector@v2
+with:
+ attack_vectors:
+ - "stack buffer overflow"
+ violations_threshold: 0
+```
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+| tool | Trivy Vulnerability Scanner |
+| filter-by | ['product'] |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| attack_vectors | array | False | List of attack vectors to check for in the Trivy SARIF report. |
+| violations_threshold | integer | False | The maximum number of allowed attack vector violations in the Trivy SARIF report. |
+
diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md
new file mode 100644
index 000000000..5104fbfec
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md
@@ -0,0 +1,69 @@
+---
+sidebar_label: Verify Trivy SARIF Report Compliance
+title: Verify Trivy SARIF Report Compliance
+---
+# Verify Trivy SARIF Report Compliance
+**Type:** Rule
+**ID:** `trivy-report`
+**Source:** [v2/rules/sarif/trivy/verify-trivy-report.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-trivy-report.yaml)
+**Rego Source:** [../verify-sarif.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../verify-sarif.rego)
+**Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example
+**Labels:** SARIF, Trivy
+
+Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues.
+
+:::note
+This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::info
+Rule is scoped by product.
+:::
+
+## Usage example
+
+```yaml
+uses: sarif/trivy/verify-trivy-report@v2
+```
+
+## Mitigation
+Ensures that the SARIF report generated by Trivy meets the predefined security criteria, helping to detect critical vulnerabilities and configuration issues early.
+
+
+## Description
+This rule processes the SARIF report produced by the Trivy Vulnerability Scanner to verify that it
+complies with a set of predefined rules. The evaluation is based on several configurable parameters:
+
+The rule iterates over the vulnerability results in the SARIF report (provided under
+`input.evidence.predicate.content.runs[0].results`), and for each result, it retrieves the corresponding
+rule definition from `input.evidence.predicate.content.runs[0].tool.driver.rules` based on the result's
+ruleIndex. It then evaluates whether the severity (extracted from the rule’s properties) exceeds the specified
+threshold. If the number of such violations exceeds the allowed maximum, a violation is recorded.
+
+### **Evidence Requirements**
+
+- Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema.
+- The SARIF report should be generated by the "Trivy Vulnerability Scanner".
+- The evidence must include proper filtering based on the product as defined in the configuration.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+| tool | Trivy Vulnerability Scanner |
+| filter-by | ['product'] |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| rule_level | array | False | List of rule levels to check for in the Trivy SARIF report. |
+| precision | array | False | List of precision levels to check for in the Trivy SARIF report. |
+| rule_ids | array | False | List of rule IDs to check for in the Trivy SARIF report. |
+| ignore | array | False | List of rule IDs to ignore in the Trivy SARIF report. |
+| max_allowed | integer | False | The maximum number of allowed violations. |
+
diff --git a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md
new file mode 100644
index 000000000..20f5479df
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md
@@ -0,0 +1,70 @@
+---
+sidebar_label: Verify Attack Vector Exists in SARIF
+title: Verify Attack Vector Exists in SARIF
+---
+# Verify Attack Vector Exists in SARIF
+**Type:** Rule
+**ID:** `sarif-attack-vectors`
+**Source:** [v2/rules/sarif/verify-attack-vector.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-attack-vector.yaml)
+**Rego Source:** [verify-attack-vector.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-attack-vector.rego)
+**Labels:** SARIF
+
+Verify required evidence validates attack vectors in the SARIF report.
+
+:::note
+This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: sarif/verify-attack-vector@v2
+with:
+ attack_vectors:
+ - "stack buffer overflow"
+ violations_threshold: 0
+```
+
+## Mitigation
+Helps prevent the deployment of images vulnerable to specific attack vectors by ensuring that any findings related to disallowed attack vectors are detected and flagged. This rule minimizes potential exploitation paths by enforcing that only acceptable vulnerability profiles are present.
+
+
+## Description
+This rule evaluates the SARIF report produced by the Vulnerability Scanner to verify that vulnerabilities
+associated with specific attack vectors are properly identified. The rule works as follows:
+
+1. It iterates over the vulnerability results in the SARIF report (from `input.evidence.predicate.content.runs[0].results`).
+2. For each result, it retrieves the corresponding rule definition from
+ `input.evidence.predicate.content.runs[0].tool.driver.rules` based on the result's ruleIndex.
+3. The rule checks if the rule’s full description contains the phrase "The attack vector is" and whether it
+ includes any of the attack vectors specified in the configuration (`with.attack_vectors`).
+4. If such a vulnerability is found and the total number of matching findings exceeds the configured threshold
+ (`with.violations_threshold`), a violation is recorded. The violation includes the rule identifier and the
+ associated description.
+
+### **Evidence Requirements**
+
+- Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema.
+- The SARIF report should be generated by a tool like the Vulnerability Scanner.
+- The report must include detailed rule definitions and descriptions that mention attack vectors.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| attack_vectors | array | False | List of attack vectors to check for in the SARIF report. |
+| violations_threshold | integer | False | The maximum number of allowed attack vector violations. |
+
diff --git a/docs/configuration/initiatives/rules/sarif/verify-sarif.md b/docs/configuration/initiatives/rules/sarif/verify-sarif.md
new file mode 100644
index 000000000..1dacfc9d2
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/verify-sarif.md
@@ -0,0 +1,68 @@
+---
+sidebar_label: Verify Rule Compliance in SARIF
+title: Verify Rule Compliance in SARIF
+---
+# Verify Rule Compliance in SARIF
+**Type:** Rule
+**ID:** `sarif-policy`
+**Source:** [v2/rules/sarif/verify-sarif.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-sarif.yaml)
+**Rego Source:** [verify-sarif.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-sarif.rego)
+**Labels:** SARIF
+
+Verify the SARIF report complies with defined generic rules for compliance and security. vulnerability profiles.
+
+:::note
+This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: sarif/verify-sarif@v2
+```
+
+## Mitigation
+Ensures that the SARIF report adheres to the predefined generic compliance rules by validating the vulnerability types, severity levels, and total number of findings. This verification helps maintain a consistent security posture and prevents the use of images with unacceptable
+
+
+## Description
+This rule evaluates the SARIF report provided as evidence to verify that it meets a set of predefined generic rules.
+It does so by using helper functions from the `data.sarif` module to:
+
+1. Check that the vulnerability results in the report (found under `input.evidence.predicate.content.runs[0].results`)
+ conform to the expected type and severity level as defined by configuration parameters (such as `rule_level`, `precision`,
+ `rule_ids`, and `ignore`).
+2. Ensure that the total number of reported violations does not exceed the maximum allowed (`with.max_allowed`).
+
+If the number of violations exceeds the threshold, a violation is recorded with details including the rule identifier,
+severity, and the corresponding location in the artifact.
+
+### **Evidence Requirements**
+
+- Evidence must be provided in a generic format that adheres to the SARIF 2.1.0 schema.
+- The SARIF report should include a structured list of vulnerability results, along with rule definitions and descriptions.
+- The evaluation uses the configuration parameters provided in the `with` section to guide the verification process.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| rule_level | array | False | List of rule levels to check for in the SARIF report. |
+| precision | array | False | List of precision levels to check for in the SARIF report. |
+| rule_ids | array | False | List of rule IDs to check for in the SARIF report. |
+| ignore | array | False | List of rule IDs to ignore in the SARIF report. |
+| max_allowed | integer | False | The maximum number of allowed violations. |
+
diff --git a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md
new file mode 100644
index 000000000..51bba1c7a
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md
@@ -0,0 +1,66 @@
+---
+sidebar_label: Verify Semgrep Rule in SARIF
+title: Verify Semgrep Rule in SARIF
+---
+# Verify Semgrep Rule in SARIF
+**Type:** Rule
+**ID:** `sarif-semgrep-report`
+**Source:** [v2/rules/sarif/verify-semgrep-report.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-semgrep-report.yaml)
+**Rego Source:** [verify-semgrep-report.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-semgrep-report.rego)
+**Labels:** SARIF, Semgrep
+
+Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues.
+
+:::note
+This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: sarif/verify-semgrep-report@v2
+```
+
+## Mitigation
+Ensures that any violations detected in the SARIF report produced by Semgrep are promptly identified and flagged, helping to prevent the use of assets that do not meet the required security standards.
+
+
+## Description
+This rule evaluates the SARIF report generated by Semgrep to verify that it complies with a set of predefined compliance rules.
+It iterates over the vulnerability results in the SARIF report (located under
+`input.evidence.predicate.content.runs[0].results`) and retrieves the corresponding rule definitions
+from `input.evidence.predicate.content.runs[0].tool.driver.rules` based on each result's ruleIndex.
+
+The rule checks whether the result’s ruleId contains any of the identifiers specified in the configuration (`with.rule_ids`).
+If the total number of matching findings exceeds the allowed threshold (specified by `with.violations_threshold`), a violation is recorded.
+Each violation includes details such as the rule identifier, the extracted severity, and the location of the finding.
+
+### **Evidence Requirements**
+
+- Evidence must be provided in a generic format conforming to the SARIF 2.1.0 schema.
+- The SARIF report should be generated by Semgrep.
+- The report must include detailed rule definitions and descriptions that support matching against the specified blocklist.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| rule_level | array | False | List of rule levels to check for in the SARIF report. |
+| precision | array | False | List of precision levels to check for in the SARIF report. |
+| rule_ids | array | False | List of rule IDs to check for in the SARIF report. |
+| ignore | array | False | List of rule IDs to ignore in the SARIF report. |
+| max_allowed | integer | False | The maximum number of allowed violations. |
+
diff --git a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md
new file mode 100644
index 000000000..c9f4b8e30
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md
@@ -0,0 +1,55 @@
+---
+sidebar_label: Verify Tool Evidence in SARIF
+title: Verify Tool Evidence in SARIF
+---
+# Verify Tool Evidence in SARIF
+**Type:** Rule
+**ID:** `sarif-tool-evidence`
+**Source:** [v2/rules/sarif/verify-tool-evidence.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-tool-evidence.yaml)
+**Rego Source:** [verify-tool-evidence.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-tool-evidence.rego)
+**Labels:** SARIF
+
+Verify required tools were used to generate the SARIF report.
+
+:::note
+This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details.
+:::
+:::tip
+> Evidence **IS** required for this rule and will fail if missing.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: sarif/verify-tool-evidence@v2
+```
+
+## Mitigation
+Confirms the SARIF report originates from the correct scanning tool, ensuring the evidence is trustworthy.
+
+
+## Description
+This rule checks the `tool` field in the SARIF evidence to verify that it matches the expected scanner
+(e.g., "Semgrep Vulnerability Scanner" or "Trivy Vulnerability Scanner"). Set evidence match criteria:
+the `tool` field must equal the expected scanner name to ensure the report is generated by the correct tool.
+A mismatch indicates that the report may not be reliable.
+
+### **Evidence Requirements**
+- Evidence must adhere to the SARIF 2.1.0 schema.
+- The report must include a valid `tool` field.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| tool | semgrep |
+| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 |
+
diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md
new file mode 100644
index 000000000..6e824ea72
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md
@@ -0,0 +1,84 @@
+---
+sidebar_label: NTIA SBOM Compliance Check
+title: NTIA SBOM Compliance Check
+---
+# NTIA SBOM Compliance Check
+**Type:** Rule
+**ID:** `NTIA-compliance`
+**Source:** [v2/rules/sbom/NTIA-compliance.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/NTIA-compliance.yaml)
+**Rego Source:** [NTIA-compliance.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/NTIA-compliance.rego)
+**Labels:** SBOM, Compliance, Image, Git
+
+Validates that SBOM metadata meets basic NTIA requirements for authors and supplier.
+
+:::note
+This rule requires SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::note
+Ensure that the SBOM includes metadata for authors and suppliers to meet NTIA requirements.
+
+For example,
+```yaml
+valint bom my_company/my_image:latest \
+ --author-name "bob" \
+ --author-email bob@my_company.com \
+ --author-phone "123-456-7890" \
+ --supplier-email bob@my_company.com \
+ --supplier-name "alice" \
+ --supplier-url "https://my_company.com" \
+ --supplier-phone "123-456-7890"
+```
+
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by product and target.
+:::
+
+## Usage example
+
+```yaml
+uses: sbom/NTIA-compliance@v2
+with:
+ required_author:
+ name: "bom"
+ email: "bob@company.com"
+ required_supplier:
+ name: "alice"
+```
+
+## Mitigation
+Ensures that the SBOM metadata meets NTIA requirements, reducing the risk of incomplete or inaccurate information about authors and suppliers.
+
+
+## Description
+This rule validates that the SBOM metadata meets basic NTIA requirements for authors and suppliers.
+It performs the following steps:
+
+1. Checks that authors exist, are non-empty, and each author has both a name and email.
+2. Checks that the supplier exists with a non-empty name, URL, and contact. At least one contact must have a non-empty email.
+3. Optionally enforces a required author (case-insensitive match for name/email).
+4. Optionally enforces a required supplier (case-insensitive match for supplier name).
+
+**Evidence Requirements:**
+- Evidence must be provided in the CycloneDX JSON format.
+- The SBOM must include metadata for authors and suppliers.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| required_author | object | False | The required author (case-insensitive match for name/email). |
+| required_supplier | object | False | The required supplier (case-insensitive match for supplier name). |
+
diff --git a/docs/configuration/initiatives/rules/sbom/_category_.json b/docs/configuration/initiatives/rules/sbom/_category_.json
new file mode 100644
index 000000000..cdfd70c71
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "SBOM",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/sbom/allowed-components.md b/docs/configuration/initiatives/rules/sbom/allowed-components.md
new file mode 100644
index 000000000..0fcf18aa1
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/allowed-components.md
@@ -0,0 +1,70 @@
+---
+sidebar_label: Enforce Allowed SBOM Components
+title: Enforce Allowed SBOM Components
+---
+# Enforce Allowed SBOM Components
+**Type:** Rule
+**ID:** `sbom-allowed-components`
+**Source:** [v2/rules/sbom/allowed-components.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/allowed-components.yaml)
+**Rego Source:** [allowed-components.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/allowed-components.rego)
+**Labels:** SBOM, Image
+
+Verify the artifact contains only allowed components.
+
+:::note
+This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::note
+Components type reference: https://cyclonedx.org/docs/1.6/json/#components_items_type
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by product and target.
+:::
+
+## Usage example
+
+```yaml
+uses: sbom/allowed-components@v2
+with:
+ types:
+ - library
+ - operating-system
+```
+
+## Mitigation
+Ensures that only approved components are included in the SBOM, reducing the risk of introducing vulnerabilities or unapproved dependencies into the software supply chain.
+
+
+## Description
+This rule inspects the CycloneDX SBOM evidence for the artifact to verify that it contains only allowed components.
+It performs the following steps:
+
+1. Iterates over the components listed in the SBOM.
+2. Checks each component's type against the allowed types specified in the `with.types` configuration.
+3. Compares each component's name against the allowlist provided in the `with.allowlist` configuration.
+ - If a component's type or name is not allowed, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided in the CycloneDX JSON format.
+- The SBOM must include a list of components with their types and names.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| types | array | True | A list of allowed component types. |
+| allowlist | array | True | A list of allowed components. |
+
diff --git a/docs/configuration/initiatives/rules/sbom/artifact-signed.md b/docs/configuration/initiatives/rules/sbom/artifact-signed.md
new file mode 100644
index 000000000..afe914345
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/artifact-signed.md
@@ -0,0 +1,47 @@
+---
+sidebar_label: Require SBOM Signature
+title: Require SBOM Signature
+---
+# Require SBOM Signature
+**Type:** Rule
+**ID:** `sbom-signed`
+**Source:** [v2/rules/sbom/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/artifact-signed.yaml)
+**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/artifact-signed.rego)
+**Labels:** SBOM, Blueprint
+
+Verify the SBOM is signed.
+
+:::note
+This rule requires Signed SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+> Evidence **IS** required for this rule and will fail if missing.
+:::
+:::tip
+Signed Evidence for this rule **IS** required by default.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by product and target.
+:::
+
+## Usage example
+
+```yaml
+uses: sbom/artifact-signed@v2
+```
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| content_body_type | cyclonedx-json |
+| signed | True |
+
+## Rule Parameters (`with`)
+| Parameter | Default |
+|-----------|---------|
+| identity | `{'common-names': [], 'emails': []}` |
+
diff --git a/docs/configuration/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/initiatives/rules/sbom/banned-licenses.md
new file mode 100644
index 000000000..b04282513
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/banned-licenses.md
@@ -0,0 +1,68 @@
+---
+sidebar_label: Restrict Disallowed SBOM Licenses
+title: Restrict Disallowed SBOM Licenses
+---
+# Restrict Disallowed SBOM Licenses
+**Type:** Rule
+**ID:** `sbom-disallowed-licenses`
+**Source:** [v2/rules/sbom/banned-licenses.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-licenses.yaml)
+**Rego Source:** [banned-licenses.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-licenses.rego)
+**Labels:** SBOM, Image
+
+Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold.
+
+:::note
+This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by product and target.
+:::
+
+## Usage example
+
+```yaml
+uses: sbom/banned-licenses@v2
+with:
+ blocklist:
+ - "GPL-2.0"
+ - "GPL-3.0"
+ blocklisted_limit: 1
+```
+
+## Mitigation
+Ensures that the software components used in the artifact comply with organizational policies by restricting the use of disallowed licenses. This helps prevent legal and compliance issues that may arise from using components with incompatible or risky licenses.
+
+
+## Description
+This rule inspects the CycloneDX SBOM evidence for the artifact to verify that the number of components with disallowed licenses
+remains below the specified threshold. It performs the following steps:
+
+1. Iterates over the components listed in the SBOM.
+2. Checks each component's license against the blocklist provided in the `with.blocklist` configuration.
+3. Counts the number of components with disallowed licenses.
+ - If the count exceeds the specified `with.blocklisted_limit`, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided in the CycloneDX JSON format.
+- The SBOM must include a list of components with their licenses.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| blocklist | array | False | A list of disallowed licenses. |
+| blocklisted_limit | integer | False | The maximum number of components with disallowed licenses allowed. |
+
diff --git a/docs/configuration/initiatives/rules/sbom/banned-users.md b/docs/configuration/initiatives/rules/sbom/banned-users.md
new file mode 100644
index 000000000..589f7c1fa
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/banned-users.md
@@ -0,0 +1,41 @@
+---
+sidebar_label: Disallow Specific Users in SBOM
+title: Disallow Specific Users in SBOM
+---
+# Disallow Specific Users in SBOM
+**Type:** Rule
+**ID:** `sbom-disallowed-users`
+**Source:** [v2/rules/sbom/banned-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-users.yaml)
+**Rego Source:** [banned-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-users.rego)
+**Labels:** SBOM, Image
+
+Verify specific users are not allowed in an SBOM.
+
+:::note
+This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: sbom/banned-users@v2
+```
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+
+## Rule Parameters (`with`)
+| Parameter | Default |
+|-----------|---------|
+| users | ['root'] |
+
diff --git a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md
new file mode 100644
index 000000000..68340e1f6
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md
@@ -0,0 +1,46 @@
+---
+sidebar_label: Restrict Disallowed Dependencies
+title: Restrict Disallowed Dependencies
+---
+# Restrict Disallowed Dependencies
+**Type:** Rule
+**ID:** `sbom-disallow-dependencies`
+**Source:** [v2/rules/sbom/blocklist-packages.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/blocklist-packages.yaml)
+**Rego Source:** [blocklist-packages.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/blocklist-packages.rego)
+**Labels:** SBOM, Image, Blueprint
+
+Verify the number of disallowed dependencies remains below the specified threshold.
+
+:::note
+This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by product and target.
+:::
+
+## Usage example
+
+```yaml
+uses: sbom/blocklist-packages@v2
+```
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+
+## Rule Parameters (`with`)
+| Parameter | Default |
+|-----------|---------|
+| blocklist | [] |
+| blocklisted_limit | 0 |
+
diff --git a/docs/configuration/initiatives/rules/sbom/complete-licenses.md b/docs/configuration/initiatives/rules/sbom/complete-licenses.md
new file mode 100644
index 000000000..092a58aac
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/complete-licenses.md
@@ -0,0 +1,56 @@
+---
+sidebar_label: Enforce SBOM License Completeness
+title: Enforce SBOM License Completeness
+---
+# Enforce SBOM License Completeness
+**Type:** Rule
+**ID:** `sbom-require-complete-license-set`
+**Source:** [v2/rules/sbom/complete-licenses.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/complete-licenses.yaml)
+**Rego Source:** [complete-licenses.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/complete-licenses.rego)
+**Labels:** SBOM, Image
+
+Verify all dependencies in the artifact have a license.
+
+:::note
+This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by product and target.
+:::
+
+## Usage example
+
+```yaml
+uses: sbom/complete-licenses@v2
+```
+
+## Mitigation
+Ensures that all dependencies have a complete set of licenses, reducing the risk of legal issues and ensuring compliance with open-source licenses.
+
+
+## Description
+This rule inspects the CycloneDX SBOM evidence for the artifact to verify that all dependencies have a complete set of licenses.
+It performs the following steps:
+
+1. Iterates over the dependencies listed in the SBOM.
+2. Checks each dependency for the presence of a license.
+ - If a dependency does not have a license, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided in the CycloneDX JSON format.
+- The SBOM must include a list of dependencies with their licenses.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+
diff --git a/docs/configuration/initiatives/rules/sbom/evidence-exists.md b/docs/configuration/initiatives/rules/sbom/evidence-exists.md
new file mode 100644
index 000000000..8575c67c2
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/evidence-exists.md
@@ -0,0 +1,42 @@
+---
+sidebar_label: Require SBOM Existence
+title: Require SBOM Existence
+---
+# Require SBOM Existence
+**Type:** Rule
+**ID:** `require-sbom`
+**Source:** [v2/rules/sbom/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/evidence-exists.yaml)
+**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/evidence-exists.rego)
+**Labels:** SBOM, Blueprint
+
+Verify the SBOM exists as evidence.
+
+:::note
+This rule requires SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+> Evidence **IS** required for this rule and will fail if missing.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by product and target.
+:::
+
+## Usage example
+
+```yaml
+uses: sbom/evidence-exists@v2
+```
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| content_body_type | cyclonedx-json |
+| signed | False |
+
diff --git a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md
new file mode 100644
index 000000000..2cb34b7bf
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md
@@ -0,0 +1,62 @@
+---
+sidebar_label: Enforce SBOM Freshness
+title: Enforce SBOM Freshness
+---
+# Enforce SBOM Freshness
+**Type:** Rule
+**ID:** `fresh-sbom`
+**Source:** [v2/rules/sbom/fresh-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/fresh-sbom.yaml)
+**Rego Source:** [fresh-sbom.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/fresh-sbom.rego)
+**Labels:** SBOM
+
+Verify the SBOM is not older than the specified duration.
+
+:::note
+This rule requires SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by product and target.
+:::
+
+## Usage example
+
+```yaml
+uses: sbom/fresh-sbom@v2
+with:
+ max_days: 30
+```
+
+## Mitigation
+Ensures that the SBOM is up-to-date, reducing the risk of outdated information and ensuring accurate tracking of components.
+
+
+## Description
+This rule inspects the CycloneDX SBOM evidence for the artifact to verify that it is not older than the specified duration.
+It performs the following steps:
+
+1. Checks the creation date of the SBOM.
+2. Compares the creation date against the maximum allowed age specified in the `with.max_days` configuration.
+ - If the SBOM is older than the allowed duration, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided in the CycloneDX JSON format.
+- The SBOM must include a creation date.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| max_days | integer | False | The maximum allowed age of the SBOM in days. |
+
diff --git a/docs/configuration/initiatives/rules/sbom/require-sbom.md b/docs/configuration/initiatives/rules/sbom/require-sbom.md
new file mode 100644
index 000000000..26af45b64
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/require-sbom.md
@@ -0,0 +1,56 @@
+---
+sidebar_label: Require SBOM Existence
+title: Require SBOM Existence
+---
+# Require SBOM Existence
+**Type:** Rule
+**ID:** `require-sbom`
+**Source:** [v2/rules/sbom/require-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/require-sbom.yaml)
+**Rego Source:** [require-sbom.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/require-sbom.rego)
+**Labels:** SBOM, Blueprint, Image, Git
+
+Verify the SBOM exists as evidence.
+
+:::note
+This rule requires SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+> Evidence **IS** required for this rule and will fail if missing.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by product and target.
+:::
+
+## Usage example
+
+```yaml
+uses: sbom/require-sbom@v2
+```
+
+## Mitigation
+Ensures that an SBOM is present, which is essential for tracking and managing software components and their dependencies.
+
+
+## Description
+This rule verifies the existence of an SBOM as evidence.
+It performs the following steps:
+
+1. Checks for the presence of an SBOM.
+ - If the SBOM is missing, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided in the CycloneDX JSON format.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| content_body_type | cyclonedx-json |
+| signed | False |
+
diff --git a/docs/configuration/initiatives/rules/sbom/required-packages.md b/docs/configuration/initiatives/rules/sbom/required-packages.md
new file mode 100644
index 000000000..7f588770f
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/required-packages.md
@@ -0,0 +1,67 @@
+---
+sidebar_label: Enforce SBOM Dependencies
+title: Enforce SBOM Dependencies
+---
+# Enforce SBOM Dependencies
+**Type:** Rule
+**ID:** `sbom-required-dependencies`
+**Source:** [v2/rules/sbom/required-packages.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/required-packages.yaml)
+**Rego Source:** [required-packages.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/required-packages.rego)
+**Labels:** SBOM, Image
+
+Verify the artifact includes all required dependencies.
+
+:::note
+This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by product and target.
+:::
+
+## Usage example
+
+```yaml
+uses: sbom/required-packages@v2
+with:
+ required_pkgs:
+ - "pkg:maven/org.apache.commons/commons-lang3@3.9"
+ - "pkg:npm/lodash@4.17.15"
+ violations_limit: 0
+```
+
+## Mitigation
+Ensures that all required dependencies are included in the SBOM, reducing the risk of missing critical components and ensuring compliance with dependency requirements.
+
+
+## Description
+This rule verifies that the artifact includes all required dependencies as specified.
+It performs the following steps:
+
+1. Iterates over the dependencies listed in the SBOM.
+2. Checks each dependency against the required dependencies specified in the `with.required_pkgs` configuration.
+ - If a required dependency is missing, the rule flags it as a violation.
+
+**Evidence Requirements:**
+- Evidence must be provided in the CycloneDX JSON format.
+- The SBOM must include a list of dependencies.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| required_pkgs | array | True | A list of required dependencies specified as PURLs. |
+| violations_limit | integer | False | The maximum number of allowed violations. |
+
diff --git a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md
new file mode 100644
index 000000000..8e23d65e8
--- /dev/null
+++ b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md
@@ -0,0 +1,69 @@
+---
+sidebar_label: Require Specified SBOM Licenses
+title: Require Specified SBOM Licenses
+---
+# Require Specified SBOM Licenses
+**Type:** Rule
+**ID:** `sbom-hf-license`
+**Source:** [v2/rules/sbom/verify-huggingface-license.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/verify-huggingface-license.yaml)
+**Rego Source:** [verify-hf-license.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/verify-hf-license.rego)
+**Labels:** SBOM, Image
+
+Verify the artifact includes all specified licenses.
+
+:::note
+This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details.
+:::
+:::note
+Ensure that the SBOM includes all specified licenses to meet compliance requirements. This rule accesses the Hugging Face API to validate the licenses.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by product and target.
+:::
+
+## Usage example
+
+```yaml
+uses: sbom/verify-huggingface-license@v2
+with:
+ licenses:
+ - "MIT"
+ - "Apache-2.0"
+```
+
+## Mitigation
+Ensures that all specified licenses are included in the SBOM, reducing the risk of legal issues and ensuring compliance with open-source licenses.
+
+
+## Description
+This rule verifies that the artifact includes all specified licenses.
+It performs the following steps:
+
+1. Iterates over the dependencies listed in the SBOM.
+2. Checks each dependency for the presence of the specified licenses in the `with.licenses` configuration.
+ - If a specified license is missing, the rule flags it as a violation.
+3. Accesses the Hugging Face API to validate the licenses.
+
+**Evidence Requirements:**
+- Evidence must be provided in the CycloneDX JSON format.
+- The SBOM must include a list of dependencies with their licenses.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| licenses | array | True | A list of specified licenses. |
+
diff --git a/docs/configuration/initiatives/rules/slsa/_category_.json b/docs/configuration/initiatives/rules/slsa/_category_.json
new file mode 100644
index 000000000..da652e8f6
--- /dev/null
+++ b/docs/configuration/initiatives/rules/slsa/_category_.json
@@ -0,0 +1,4 @@
+{
+ "label": "SLSA",
+ "position": 1
+}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md
new file mode 100644
index 000000000..740abf350
--- /dev/null
+++ b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md
@@ -0,0 +1,41 @@
+---
+sidebar_label: Disallow dependencies in SLSA Provenance Document
+title: Disallow dependencies in SLSA Provenance Document
+---
+# Disallow dependencies in SLSA Provenance Document
+**Type:** Rule
+**ID:** `slsa-builder-unallowed-dependencies`
+**Source:** [v2/rules/slsa/banned-builder-deps.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/banned-builder-deps.yaml)
+**Rego Source:** [banned-builder-deps.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/banned-builder-deps.rego)
+**Labels:** SLSA, Image
+
+Verify that dependencies in the block list do not appear in the SLSA Proveance document.
+
+:::note
+This rule requires SLSA Provenance. See [here](/docs/valint/help/valint_slsa) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: slsa/banned-builder-deps@v2
+```
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | slsa |
+| target_type | container |
+
+## Rule Parameters (`with`)
+| Parameter | Default |
+|-----------|---------|
+| blocklist | [] |
+
diff --git a/docs/configuration/initiatives/rules/slsa/build-time.md b/docs/configuration/initiatives/rules/slsa/build-time.md
new file mode 100644
index 000000000..15078ca55
--- /dev/null
+++ b/docs/configuration/initiatives/rules/slsa/build-time.md
@@ -0,0 +1,43 @@
+---
+sidebar_label: Verify build time
+title: Verify build time
+---
+# Verify build time
+**Type:** Rule
+**ID:** `slsa-build-time`
+**Source:** [v2/rules/slsa/build-time.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/build-time.yaml)
+**Rego Source:** [build-time.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/build-time.rego)
+**Labels:** SLSA, Image
+
+Verify the artifact was created within the specified time window.
+
+:::note
+This rule requires SLSA Provenance. See [here](/docs/valint/help/valint_slsa) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: slsa/build-time@v2
+```
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | slsa |
+| target_type | container |
+
+## Rule Parameters (`with`)
+| Parameter | Default |
+|-----------|---------|
+| start_hour | 8 |
+| end_hour | 20 |
+| workdays | ['Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday'] |
+
diff --git a/docs/configuration/initiatives/rules/slsa/field-exists.md b/docs/configuration/initiatives/rules/slsa/field-exists.md
new file mode 100644
index 000000000..f8f51dd61
--- /dev/null
+++ b/docs/configuration/initiatives/rules/slsa/field-exists.md
@@ -0,0 +1,42 @@
+---
+sidebar_label: SLSA Field Exists in Provenance Document
+title: SLSA Field Exists in Provenance Document
+---
+# SLSA Field Exists in Provenance Document
+**Type:** Rule
+**ID:** `slsa-field-exists`
+**Source:** [v2/rules/slsa/field-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/field-exists.yaml)
+**Rego Source:** [field-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/field-exists.rego)
+**Labels:** SLSA, Image
+
+Verify the specified field exists in the provenance document.
+
+:::note
+This rule requires SLSA Provenance. See [here](/docs/valint/help/valint_slsa) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: slsa/field-exists@v2
+```
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | slsa |
+| target_type | container |
+
+## Rule Parameters (`with`)
+| Parameter | Default |
+|-----------|---------|
+| paths | [] |
+| violations_threshold | 0 |
+
diff --git a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md
new file mode 100644
index 000000000..c145190e5
--- /dev/null
+++ b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md
@@ -0,0 +1,47 @@
+---
+sidebar_label: Verify Provenance Document Exists
+title: Verify Provenance Document Exists
+---
+# Verify Provenance Document Exists
+**Type:** Rule
+**ID:** `SLSA.L1`
+**Source:** [v2/rules/slsa/l1-provenance-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l1-provenance-exists.yaml)
+**Rego Source:** [l1-provenance-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l1-provenance-exists.rego)
+**Help:** https://slsa.dev/spec/v1.0/requirements
+**Labels:** SLSA
+
+Verify that the Provenance document evidence exists.
+
+:::note
+This rule requires SLSA Provenance. See [here](/docs/valint/help/valint_slsa) for more details.
+:::
+:::tip
+> Evidence **IS** required for this rule and will fail if missing.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by product and target.
+:::
+
+## Usage example
+
+```yaml
+uses: slsa/l1-provenance-exists@v2
+```
+
+## Mitigation
+Recording comprehensive provenance metadata allows organizations to verify the integrity of the build process and ensures that only authorized and untampered artifacts are deployed.
+
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | slsa |
+
diff --git a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md
new file mode 100644
index 000000000..b41e03755
--- /dev/null
+++ b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md
@@ -0,0 +1,52 @@
+---
+sidebar_label: Verify that provenance is authenticated
+title: Verify that provenance is authenticated
+---
+# Verify that provenance is authenticated
+**Type:** Rule
+**ID:** `SLSA.L2`
+**Source:** [v2/rules/slsa/l2-provenance-authenticated.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l2-provenance-authenticated.yaml)
+**Rego Source:** [l2-provenance-authenticated.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l2-provenance-authenticated.rego)
+**Help:** https://slsa.dev/spec/v1.0/requirements
+**Labels:** SLSA
+
+Verify the artifact is signed.
+
+:::note
+This rule requires Signed SLSA Provenance. See [here](/docs/valint/help/valint_slsa) for more details.
+:::
+:::tip
+> Evidence **IS** required for this rule and will fail if missing.
+:::
+:::tip
+Signed Evidence for this rule **IS** required by default.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+:::info
+Rule is scoped by product and target.
+:::
+
+## Usage example
+
+```yaml
+uses: slsa/l2-provenance-authenticated@v2
+```
+
+## Mitigation
+Cryptographic authentication prevents tampering with provenance data, ensuring that only valid and secure build information is used to establish the integrity of the software supply chain.
+
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | True |
+| content_body_type | slsa |
+
+## Rule Parameters (`with`)
+| Parameter | Default |
+|-----------|---------|
+| identity | `{'common-names': [], 'emails': []}` |
+
diff --git a/docs/configuration/initiatives/rules/slsa/verify-builder.md b/docs/configuration/initiatives/rules/slsa/verify-builder.md
new file mode 100644
index 000000000..dcf1cad98
--- /dev/null
+++ b/docs/configuration/initiatives/rules/slsa/verify-builder.md
@@ -0,0 +1,42 @@
+---
+sidebar_label: Verify that artifact was created by the specified builder
+title: Verify that artifact was created by the specified builder
+---
+# Verify that artifact was created by the specified builder
+**Type:** Rule
+**ID:** `slsa-verify-builder`
+**Source:** [v2/rules/slsa/verify-builder.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-builder.yaml)
+**Rego Source:** [verify-builder.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-builder.rego)
+**Labels:** SLSA, Image
+
+Verify the artifact was created by the specified builder.
+
+:::note
+This rule requires SLSA Provenance. See [here](/docs/valint/help/valint_slsa) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::info
+Rule is scoped by pipeline and product.
+:::
+
+## Usage example
+
+```yaml
+uses: slsa/verify-builder@v2
+```
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| filter-by | ['pipeline', 'product'] |
+| signed | False |
+| content_body_type | slsa |
+| target_type | container |
+
+## Rule Parameters (`with`)
+| Parameter | Default |
+|-----------|---------|
+| id | `{{ .Env.HOSTNAME }}` |
+
diff --git a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md
new file mode 100644
index 000000000..4e8cb7128
--- /dev/null
+++ b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md
@@ -0,0 +1,41 @@
+---
+sidebar_label: Verify that artifact has no disallowed builder dependencies
+title: Verify that artifact has no disallowed builder dependencies
+---
+# Verify that artifact has no disallowed builder dependencies
+**Type:** Rule
+**ID:** `slsa-verify-byproducts`
+**Source:** [v2/rules/slsa/verify-byproducts.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-byproducts.yaml)
+**Rego Source:** [verify-byproducts.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-byproducts.rego)
+**Labels:** SLSA, Image
+
+Verify the artifact has no disallowed builder dependencies.
+
+:::note
+This rule requires SLSA Provenance. See [here](/docs/valint/help/valint_slsa) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: slsa/verify-byproducts@v2
+```
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | slsa |
+| target_type | container |
+
+## Rule Parameters (`with`)
+| Parameter | Default |
+|-----------|---------|
+| byproducts | [] |
+
diff --git a/docs/configuration/initiatives/rules/slsa/verify-custom-fields.md b/docs/configuration/initiatives/rules/slsa/verify-custom-fields.md
new file mode 100644
index 000000000..00f59e02f
--- /dev/null
+++ b/docs/configuration/initiatives/rules/slsa/verify-custom-fields.md
@@ -0,0 +1,53 @@
+---
+sidebar_label: SLSA Field Value Matches in Provenance Document
+title: SLSA Field Value Matches in Provenance Document
+---
+# SLSA Field Value Matches in Provenance Document
+**Type:** Rule
+**ID:** `slsa-field-matches`
+**Source:** [v2/rules/slsa/verify-custom-fields.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-custom-fields.yaml)
+**Rego Source:** [verify-custom-fields.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-custom-fields.rego)
+**Labels:** SLSA
+
+Verify the specified field value matches in the provenance document.
+
+:::note
+This rule requires SLSA Provenance. See [here](/docs/valint/help/valint_slsa) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: slsa/verify-custom-fields@v2
+with:
+ fields:
+ "predicate/buildDefinition/externalParameters/key": "value"
+```
+
+## Mitigation
+Ensure that the field exists in the provenance document and that its value matches the expected value.
+
+
+## Description
+This rule verifies that the specified field value matches in the provenance document.
+It checks if the field exists and if its value matches the expected value.
+The parameters are passed as key-value pairs.
+The key must be a path within the Provenance document, and the value must be a string.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | slsa |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| fields | object | False | The expected field values to match in the provenance document given as a `key:value` map. |
+
diff --git a/docs/configuration/initiatives/rules/slsa/verify-external-parameters.md b/docs/configuration/initiatives/rules/slsa/verify-external-parameters.md
new file mode 100644
index 000000000..f78b080ee
--- /dev/null
+++ b/docs/configuration/initiatives/rules/slsa/verify-external-parameters.md
@@ -0,0 +1,64 @@
+---
+sidebar_label: SLSA External Parameters Match in Provenance Document
+title: SLSA External Parameters Match in Provenance Document
+---
+# SLSA External Parameters Match in Provenance Document
+**Type:** Rule
+**ID:** `slsa-external-parameters`
+**Source:** [v2/rules/slsa/verify-external-parameters.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-external-parameters.yaml)
+**Rego Source:** [verify-external-parameters.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-external-parameters.rego)
+**Labels:** SLSA
+
+Verify the specified external parameters value match in the provenance document.
+
+:::note
+This rule requires SLSA Provenance. See [here](/docs/valint/help/valint_slsa) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: slsa/verify-external-parameters@v2
+with:
+ parameters:
+ "key_1": "value_1" # match the value exactly
+ "key_2": # match any of the values in the array
+ - "value_2"
+ - "value_3"
+ "key_3": # match any of the values in the numeric array
+ - 4
+ - 5
+ "key_4": # match a number between min and max
+ "min": 1
+ "max": 10
+```
+
+## Mitigation
+Ensure that the external parameters field is present in the provenance document and that its value matches the expected value. To add such a field, pass it as `key=value` in the `--external` flag for the `valint slsa` command.
+
+
+## Description
+This rule verifies that the specified external parameters value matches in the provenance document.
+It checks if the external parameters field exists and if its value matches the expected value.
+The allowed parameters values can be passed to the rule in the `key: value` format, where `value` can be:
+- `string` or `number` -- requires a direct match
+- `array` of `strings` or `numbers` -- requires the actual value to match one of the values in the array
+- `object` with `min` and `max` -- requires the actual value to be a number between the min and max values
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | slsa |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| parameters | object | False | The expected external parameters to match in the provenance document given as `key:value` map. |
+
diff --git a/docs/configuration/initiatives/slsa.l1.md b/docs/configuration/initiatives/slsa.l1.md
new file mode 100644
index 000000000..f7972a389
--- /dev/null
+++ b/docs/configuration/initiatives/slsa.l1.md
@@ -0,0 +1,47 @@
+---
+sidebar_label: SLSA L1 Framework
+title: SLSA L1 Framework
+---
+# SLSA L1 Framework
+**Type:** Initiative
+**ID:** `SLSA.L1`
+**Version:** `1.0.0`
+**Bundle-Version:** `v2`
+**Source:** [v2/initiatives/slsa.l1.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/slsa.l1.yaml)
+**Help:** https://slsa.dev/
+
+Evaluate SLSA Level 1
+
+## **Description**
+
+This initiative ensures that every critical build artifact includes the minimum required provenance metadata as specified in SLSA Level 1. By recording detailed information about the build process—such as timestamps, authors, and build details— organizations establish a traceable chain-of-custody for their software artifacts.
+
+## Controls Overview
+
+| Control Name | Control Description | Mitigation |
+|--------------|---------------------|------------|
+| [[provenance] Provenance exists](#provenance-provenance-exists) | This control verifies that essential provenance metadata is present for each build artifact. | Ensure that provenance metadata is present for critical build artifacts to support supply chain integrity. |
+
+## Evidence Defaults
+
+| Field | Value |
+|-------|-------|
+| signed | False |
+
+---
+
+# Detailed Controls
+
+## [provenance] Provenance exists
+
+This control verifies that essential provenance metadata is present for each build artifact.
+
+
+### Mitigation
+Ensure that provenance metadata is present for critical build artifacts to support supply chain integrity.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [provenance-exists](rules/slsa/l1-provenance-exists.md) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. |
diff --git a/docs/configuration/initiatives/slsa.l2.md b/docs/configuration/initiatives/slsa.l2.md
new file mode 100644
index 000000000..54513ea07
--- /dev/null
+++ b/docs/configuration/initiatives/slsa.l2.md
@@ -0,0 +1,48 @@
+---
+sidebar_label: SLSA L2 Framework
+title: SLSA L2 Framework
+---
+# SLSA L2 Framework
+**Type:** Initiative
+**ID:** `SLSA.L2`
+**Version:** `1.0.0`
+**Bundle-Version:** `v2`
+**Source:** [v2/initiatives/slsa.l2.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/slsa.l2.yaml)
+**Help:** https://slsa.dev/
+
+Evaluate SLSA Level 2
+
+## **Description**
+
+Evaluate SLSA L2 and ensure that provenance information is both recorded and authenticated. This helps protect against unauthorized modifications and ensures artifact integrity."
+
+## Controls Overview
+
+| Control Name | Control Description | Mitigation |
+|--------------|---------------------|------------|
+| [[provenance] Provenance authenticated](#provenance-provenance-authenticated) | Ensure that provenance metadata for build artifacts is authenticated, confirming that it originates from a trusted source. | Authentication of provenance data prevents attackers from forging or modifying build metadata, ensuring the integrity of the software supply chain. |
+
+## Evidence Defaults
+
+| Field | Value |
+|-------|-------|
+| signed | False |
+
+---
+
+# Detailed Controls
+
+## [provenance] Provenance authenticated
+
+Ensure that provenance metadata for build artifacts is authenticated, confirming that it originates from a trusted source.
+
+
+### Mitigation
+Authentication of provenance data prevents attackers from forging or modifying build metadata, ensuring the integrity of the software supply chain.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [provenance-exists](rules/slsa/l1-provenance-exists.md) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Ensure that provenance metadata is present for each build artifact, enabling traceability and verification. |
+| [provenance-authn](rules/slsa/l2-provenance-authenticated.md) | [Provenance authenticated](rules/slsa/l2-provenance-authenticated.md) | Verify that provenance metadata is cryptographically authenticated, ensuring it has not been tampered with. |
diff --git a/docs/configuration/initiatives/sp-800-190.md b/docs/configuration/initiatives/sp-800-190.md
new file mode 100644
index 000000000..d7f0538c5
--- /dev/null
+++ b/docs/configuration/initiatives/sp-800-190.md
@@ -0,0 +1,68 @@
+---
+sidebar_label: NIST Application Container Security Initiative
+title: NIST Application Container Security Initiative
+---
+# NIST Application Container Security Initiative
+**Type:** Initiative
+**ID:** `SP-800-190`
+**Version:** `1.0.0`
+**Bundle-Version:** `v2`
+**Source:** [v2/initiatives/sp-800-190.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/sp-800-190.yaml)
+**Help:** https://csrc.nist.gov/publications/detail/sp/800-190/final
+
+This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines.
+
+## Controls Overview
+
+| Control Name | Control Description | Mitigation |
+|--------------|---------------------|------------|
+| [[4.1] IMAGE COUNTERMEASURES](#41-41-image-countermeasures) | Implements security controls to reduce risks associated with container images, such as vulnerabilities, misconfigurations, and unauthorized images. The policies enforce CVE scanning, mandatory security settings, and allow only trusted sources. | Ensures that all container images meet organizational security policies before deployment. Helps reduce the attack surface by blocking images with vulnerabilities, misconfigurations, or unauthorized sources. |
+| [[4.2] REGISTRY COUNTERMEASURES](#42-42-registry-countermeasures) | Implements controls to secure container image registries by enforcing HTTPS connections, verifying image freshness, and preventing stale images from being used. | Reduces risks associated with registry security, stale images, and unauthorized image pulls. Ensures that images are kept up-to-date and only retrieved from secure sources. |
+
+## Evidence Defaults
+
+| Field | Value |
+|-------|-------|
+| signed | False |
+
+---
+
+# Detailed Controls
+
+## [4.1] 4.1 IMAGE COUNTERMEASURES
+
+Implements security controls to reduce risks associated with container images, such as vulnerabilities, misconfigurations, and unauthorized images. The policies enforce CVE scanning, mandatory security settings, and allow only trusted sources.
+
+
+### Mitigation
+Ensures that all container images meet organizational security policies before deployment. Helps reduce the attack surface by blocking images with vulnerabilities, misconfigurations, or unauthorized sources.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [trivy-verify-vulnerability-findings](rules/sarif/trivy/verify-cve-severity.md) | [4.1.1 Severity-Based Vulnerabilities (Trivy)](rules/sarif/trivy/verify-cve-severity.md) | Ensures that images do not contain high-severity vulnerabilities. Blocks images if any CVEs exceed the defined severity threshold. |
+| [trivy-blocklist-cve](rules/sarif/trivy/blocklist-cve.md) | [4.1.1 High-Profile Vulnerabilities (Trivy)](rules/sarif/trivy/blocklist-cve.md) | Blocks images that contain specific high-profile CVEs that are actively exploited or widely known. |
+| [sbom-disallowed-users](rules/images/banned-users.md) | [4.1.2 Default Non-Root User](rules/images/banned-users.md) | Ensures that containers do not run as the root user. |
+| [images-banned-ports](rules/images/banned-ports.md) | [4.1.2 Banned Open Port 22](rules/images/banned-ports.md) | Blocks images that expose SSH (port 22), which should not be used in containerized applications. |
+| [images-require-healthcheck](rules/images/require-healthcheck.md) | [4.1.3 Set HEALTHCHECK Instruction](rules/images/require-healthcheck.md) | Ensures that container images include a HEALTHCHECK instruction to monitor their runtime health. |
+| [image-labels](rules/images/verify-labels.md) | [4.1.3 Verify Required Image Labels](rules/images/verify-labels.md) | Enforces the presence of essential OpenContainers labels, such as creation time, version, and source repository. |
+| [images-allowed-base-image](rules/images/allowed-base-image.md) | [4.1.5 Approved Source Base Images](rules/images/allowed-base-image.md) | Ensures that base images originate from approved and trusted sources. |
+| [images-allowed-image-source](rules/images/allowed-image-source.md) | [4.1.5 Approved Source Images](rules/images/allowed-image-source.md) | Ensures that application images are built from approved sources. |
+| [images-require-signed-image](rules/images/image-signed.md) | [4.1.5 Signed Images](rules/images/image-signed.md) | Ensures that images are cryptographically signed before execution. |
+
+## [4.2] 4.2 REGISTRY COUNTERMEASURES
+
+Implements controls to secure container image registries by enforcing HTTPS connections, verifying image freshness, and preventing stale images from being used.
+
+
+### Mitigation
+Reduces risks associated with registry security, stale images, and unauthorized image pulls. Ensures that images are kept up-to-date and only retrieved from secure sources.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [images-registry-https-check](rules/images/enforce-https-registry.md) | [4.2.1 Registry Connection Enforcement](rules/images/enforce-https-registry.md) | Ensures that images are only pulled from registries using HTTPS. |
+| [images-fresh-base-image](rules/images/fresh-base-image.md) | [4.2.2 Up-to-Date Base Images](rules/images/fresh-base-image.md) | Ensures that base images are not older than a specified time limit. |
+| [fresh-image](rules/images/fresh-image.md) | [4.2.2 Up-to-Date Derived Images](rules/images/fresh-image.md) | Ensures that derived images are refreshed regularly and not outdated. |
diff --git a/docs/configuration/initiatives/sp-800-53.md b/docs/configuration/initiatives/sp-800-53.md
new file mode 100644
index 000000000..9a709a36a
--- /dev/null
+++ b/docs/configuration/initiatives/sp-800-53.md
@@ -0,0 +1,80 @@
+---
+sidebar_label: NIST Supply Chain Integrity Initiative
+title: NIST Supply Chain Integrity Initiative
+---
+# NIST Supply Chain Integrity Initiative
+**Type:** Initiative
+**ID:** `SP-800-53`
+**Version:** `1.0.0`
+**Bundle-Version:** `v2`
+**Source:** [v2/initiatives/sp-800-53.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/sp-800-53.yaml)
+**Help:** https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final
+
+This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include:
+ - A Software Bill of Materials (SBOM) to ensure component inventory and traceability,
+ addressing requirements from SR-4 and CM-8.
+ - Provenance data to support architectural traceability, as outlined in SA-8.
+Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12.
+
+## Controls Overview
+
+| Control Name | Control Description | Mitigation |
+|--------------|---------------------|------------|
+| [[SR4_CM8] SBOM Requirement](#sr4_cm8-sbom-requirement) | Enforce that every container build includes a Software Bill of Materials (SBOM), ensuring that all components are inventoried and traceable. This requirement addresses both SR-4 and the component inventory aspects of CM-8. | Ensures complete visibility into container components, reducing the risk of unvetted or vulnerable code entering the supply chain. |
+| [[SA8] Provenance Requirement](#sa8-provenance-requirement) | Enforce that every container build includes provenance data, supporting traceability within the security architecture as required by SA-8. | Provides a clear audit trail of the build process, mitigating risks related to unidentified or untraceable changes. |
+| [[SA12] SBOM Signature Enforcement](#sa12-sbom-signature-enforcement) | Enforce that the SBOM is cryptographically signed to verify its integrity and authenticity, aligning with SA-12 requirements. | Prevents unauthorized modifications by ensuring that only signed SBOMs are accepted. |
+
+## Evidence Defaults
+
+| Field | Value |
+|-------|-------|
+| signed | False |
+
+---
+
+# Detailed Controls
+
+## [SR4_CM8] SBOM Requirement
+
+Enforce that every container build includes a Software Bill of Materials (SBOM), ensuring that all components are inventoried and traceable. This requirement addresses both SR-4 and the component inventory aspects of CM-8.
+
+
+### Mitigation
+Ensures complete visibility into container components, reducing the risk of unvetted or vulnerable code entering the supply chain.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [require-sbom](rules/sbom/require-sbom.md) | [Require SBOM](rules/sbom/require-sbom.md) | Ensure an SBOM is provided for all container builds. |
+| [image-labels](rules/images/verify-labels.md) | [Verify Supply Chain Labels](rules/images/verify-labels.md) | Confirm that container images include required `opencontainers` labels: |
+| [NTIA-compliance](rules/sbom/NTIA-compliance.md) | [NTIA SBOM Compliance Check](rules/sbom/NTIA-compliance.md) | Verifies that the SBOM includes valid authors and supplier data following NTIA guidelines. Optionally enforces a required_author and required_supplier if provided. |
+
+## [SA8] Provenance Requirement
+
+Enforce that every container build includes provenance data, supporting traceability within the security architecture as required by SA-8.
+
+
+### Mitigation
+Provides a clear audit trail of the build process, mitigating risks related to unidentified or untraceable changes.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [SLSA.L1](rules/slsa/l1-provenance-exists.md) | [Require Provenance](rules/slsa/l1-provenance-exists.md) | Ensure provenance data is present for container builds. |
+
+## [SA12] SBOM Signature Enforcement
+
+Enforce that the SBOM is cryptographically signed to verify its integrity and authenticity, aligning with SA-12 requirements.
+
+
+### Mitigation
+Prevents unauthorized modifications by ensuring that only signed SBOMs are accepted.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [require-sbom](rules/sbom/require-sbom.md) | [Signed SBOM Requirement](rules/sbom/require-sbom.md) | Validate that the SBOM is cryptographically signed. |
+| [SLSA.L2](rules/slsa/l2-provenance-authenticated.md) | [Signed Provenance Requirement](rules/slsa/l2-provenance-authenticated.md) | Validate that the provenance data is cryptographically signed. |
diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md
new file mode 100644
index 000000000..23e1c8fe2
--- /dev/null
+++ b/docs/configuration/initiatives/ssdf.md
@@ -0,0 +1,94 @@
+---
+sidebar_label: SSDF Client Initiative
+title: SSDF Client Initiative
+---
+# SSDF Client Initiative
+**Type:** Initiative
+**ID:** `SSDF`
+**Version:** `1.0.0`
+**Bundle-Version:** `v2`
+**Source:** [v2/initiatives/ssdf.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/ssdf.yaml)
+**Help:** https://csrc.nist.gov/pubs/sp/800/218/final
+
+Evaluate PS rules from the SSDF initiative
+
+## Controls Overview
+
+| Control Name | Control Description | Mitigation |
+|--------------|---------------------|------------|
+| [[PS/PS.1/PS.1.1] Store all forms of code based on the principle of least privilege](#psps1ps11-store-all-forms-of-code-based-on-the-principle-of-least-privilege) | Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that only authorized personnel, tools, services, etc. have access. | Implement strict access controls, enforce multi-factor authentication (MFA), and regularly audit access logs to ensure only authorized personnel can access and modify the code. Use branch protection rules, require signed commits, and make repositories private to prevent unauthorized access and tampering. |
+| [[PS/PS.2/PS.2.1] Make software integrity verification information available to software acquirers](#psps2ps21-make-software-integrity-verification-information-available-to-software-acquirers) | Help software acquirers ensure that the software they acquire is legitimate and has not been tampered with. | Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Ensure that the signing keys are stored securely and that access to them is restricted. Implement automated processes to sign releases and verify their integrity before distribution. Regularly audit the signing process and keys to ensure their security and integrity. |
+| [[PS/PS.3/PS.3.1] Securely archive the necessary files and supporting data to be retained for each software release](#psps3ps31-securely-archive-the-necessary-files-and-supporting-data-to-be-retained-for-each-software-release) | Securely archive the necessary files and supporting data (e.g., integrity verification information, provenance data) to be retained for each software release | Use secure, version-controlled repositories to store software releases and their supporting data. Implement access controls to restrict who can modify or delete these repositories. Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Regularly back up the repositories to prevent data loss and ensure that software releases are preserved even in the event of a system failure. |
+| [[PS/PS.3/PS.3.2] Collect, safeguard, maintain, and share provenance data for all components of each software release](#psps3ps32-collect-safeguard-maintain-and-share-provenance-data-for-all-components-of-each-software-release) | Collect, safeguard, maintain, and share provenance data for all components of each software release (e.g., in a software bill of materials [SBOM]) | Use software bill of materials (SBOM) to document the provenance of each software release and its components. Store SBOMs in a secure, version-controlled repository to ensure they can be retrieved and analyzed in the future. Implement access controls to restrict who can modify or delete SBOMs. Use cryptographic signatures to sign SBOMs and provide a way for users to verify these signatures. Regularly back up the repository to prevent data loss and ensure that SBOMs are preserved even in the event of a system failure. Document the SBOM creation process and train personnel on its importance and proper handling procedures. |
+
+## Evidence Defaults
+
+| Field | Value |
+|-------|-------|
+| signed | False |
+
+---
+
+# Detailed Controls
+
+## [PS/PS.1/PS.1.1] Store all forms of code based on the principle of least privilege
+
+Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that only authorized personnel, tools, services, etc. have access.
+
+
+### Mitigation
+Implement strict access controls, enforce multi-factor authentication (MFA), and regularly audit access logs to ensure only authorized personnel can access and modify the code. Use branch protection rules, require signed commits, and make repositories private to prevent unauthorized access and tampering.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [2fa](rules/github/org/2fa.md) | [Enforce 2FA](rules/github/org/2fa.md) | PS.1 Require 2FA for accessing code |
+| [max-admins](rules/github/org/max-admins.md) | [Limit admins](rules/github/org/max-admins.md) | PS.1 Restrict the maximum number of organization admins |
+| [web-commit-signoff](rules/github/org/web-commit-signoff.md) | [Require signoff on web commits](rules/github/org/web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface |
+| [branch-protection](rules/github/repository/branch-protection.md) | [Branch protected](rules/github/repository/branch-protection.md) | PS.1 Require branch protection for the repository |
+| [repo-is-private](rules/github/repository/repo-private.md) | [Repo private](rules/github/repository/repo-private.md) | PS.1 Assure the repository is private |
+
+## [PS/PS.2/PS.2.1] Make software integrity verification information available to software acquirers
+
+Help software acquirers ensure that the software they acquire is legitimate and has not been tampered with.
+
+
+### Mitigation
+Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Ensure that the signing keys are stored securely and that access to them is restricted. Implement automated processes to sign releases and verify their integrity before distribution. Regularly audit the signing process and keys to ensure their security and integrity.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [sbom-is-signed](rules/sbom/artifact-signed.md) | [Image-verifiable](rules/sbom/artifact-signed.md) | PS.2 Provide a mechanism to verify the integrity of the image |
+
+## [PS/PS.3/PS.3.1] Securely archive the necessary files and supporting data to be retained for each software release
+
+Securely archive the necessary files and supporting data (e.g., integrity verification information, provenance data) to be retained for each software release
+
+
+### Mitigation
+Use secure, version-controlled repositories to store software releases and their supporting data. Implement access controls to restrict who can modify or delete these repositories. Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Regularly back up the repositories to prevent data loss and ensure that software releases are preserved even in the event of a system failure.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [provenance-exists](rules/slsa/l1-provenance-exists.md) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | PS.3 Provenance exists
+Ensure that provenance information is available for each software release
+ |
+
+## [PS/PS.3/PS.3.2] Collect, safeguard, maintain, and share provenance data for all components of each software release
+
+Collect, safeguard, maintain, and share provenance data for all components of each software release (e.g., in a software bill of materials [SBOM])
+
+
+### Mitigation
+Use software bill of materials (SBOM) to document the provenance of each software release and its components. Store SBOMs in a secure, version-controlled repository to ensure they can be retrieved and analyzed in the future. Implement access controls to restrict who can modify or delete SBOMs. Use cryptographic signatures to sign SBOMs and provide a way for users to verify these signatures. Regularly back up the repository to prevent data loss and ensure that SBOMs are preserved even in the event of a system failure. Document the SBOM creation process and train personnel on its importance and proper handling procedures.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [sbom-is-signed](rules/sbom/artifact-signed.md) | [SBOM archived](rules/sbom/artifact-signed.md) | PS.3 Archive SBOM |
diff --git a/docs/configuration/initiatives/sspb.md b/docs/configuration/initiatives/sspb.md
new file mode 100644
index 000000000..5a0380551
--- /dev/null
+++ b/docs/configuration/initiatives/sspb.md
@@ -0,0 +1,251 @@
+---
+sidebar_label: Secure Software Pipeline Blueprint
+title: Secure Software Pipeline Blueprint
+---
+# Secure Software Pipeline Blueprint
+**Type:** Initiative
+**ID:** `SSPB`
+**Version:** `1.0.0`
+**Bundle-Version:** `v2`
+**Source:** [v2/initiatives/sspb.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/sspb.yaml)
+**Help:** https://github.com/Venafi/blueprint-securesoftwarepipeline
+
+Blueprint for secure pipelines - Gitlab
+
+## **Description**
+
+This initiative defines a set of best practices and technical guidelines designed to safeguard every stage of the software delivery process—from code development and build, to testing and production deployment. It emphasizes the importance of ensuring code integrity, authenticating build artifacts, and continuously monitoring system changes to mitigate the risk of supply chain attacks. The framework is adaptable to various environments and aligned with industry standards, providing organizations with actionable steps to enhance their overall security posture.
+
+## Controls Overview
+
+| Control Name | Control Description | Mitigation |
+|--------------|---------------------|------------|
+| [[CTL-1] Restrict administrative access to CI/CD tools](#ctl-1-restrict-administrative-access-to-cicd-tools) | Restrict administrative access to CI/CD tools | Limit administrative privileges to a minimal, controlled group to reduce the risk of unauthorized pipeline changes. |
+| [[CTL-2] Only accept commits signed with a developer GPG key](#ctl-2-only-accept-commits-signed-with-a-developer-gpg-key) | The use of these two rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab | Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. |
+| [[CTL-3] Automation access keys expire automatically](#ctl-3-automation-access-keys-expire-automatically) | Automation access keys expire automatically | Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited. |
+| [[CTL-4] Reduce automation access to read-only](#ctl-4-reduce-automation-access-to-read-only) | Reduce automation access to read-only | Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage. |
+| [[CTL-6] Any critical or high severity vulnerability breaks the build](#ctl-6-any-critical-or-high-severity-vulnerability-breaks-the-build) | Any critical or high severity vulnerability breaks the build | Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation. |
+| [[CTL-8] Validate artifact digest](#ctl-8-validate-artifact-digest) | Validate artifact digest | Validate the artifact’s digest before deployment to ensure it has not been tampered with and maintains software integrity. |
+| [[CTL-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged](#ctl-9-pull-requests-require-two-reviewers-including-one-default-reviewer-and-a-passing-build-to-be-merged) | Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged | Enforce a review process requiring at least two reviewers and a passing build, ensuring thorough evaluation and testing before code is merged. |
+| [[CTL-11] Available container images don’t have any high or critical vulnerabilities](#ctl-11-available-container-images-dont-have-any-high-or-critical-vulnerabilities) | Available container images don’t have any high or critical vulnerabilities | Continuously scan container images for vulnerabilities and ensure that only images without high or critical issues are deployed. |
+| [[CTL-12] Validate artifact signatures and digests](#ctl-12-validate-artifact-signatures-and-digests) | Validate artifact signatures and digests | Ensure that artifacts are properly signed and their digests validated, confirming authenticity and preventing tampering. |
+| [[CTL-13] Scan deployed images in production](#ctl-13-scan-deployed-images-in-production) | Scan deployed images in production | Continuously monitor and scan production images to ensure ongoing compliance with security standards. |
+
+## Evidence Defaults
+
+| Field | Value |
+|-------|-------|
+| signed | True |
+
+---
+
+# Detailed Controls
+
+## [CTL-1] Restrict administrative access to CI/CD tools
+
+Restrict administrative access to CI/CD tools
+
+
+### Mitigation
+Limit administrative privileges to a minimal, controlled group to reduce the risk of unauthorized pipeline changes.
+
+### **Description**
+
+It's important to ensure that only authorized persons can make administrative changes to the CI/CD system. If an unauthorized person gains access, they could modify pipeline definitions and subvert other controls.
+
+Both host and application-layer access to CI/CD tools should be protected with multi-factor authentication.
+
+> :skull: Instead of manipulating code, attackers may target the CI/CD pipeline itself, leading to undetected breaches and long-term damage.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [max-admins](rules/gitlab/org/max-admins.md) | [max-admins](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. |
+
+## [CTL-2] Only accept commits signed with a developer GPG key
+
+The use of these two rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab
+
+
+### Mitigation
+Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications.
+
+### **Description**
+
+Unsigned code commits are difficult to trace and pose a risk to the integrity of the codebase. Requiring commits to be signed with a developer GPG key ensures nonrepudiation and increases the burden on attackers.
+
+> :skull: Attackers may exploit unsigned commits by stealing credentials or infecting developer machines, allowing them to inject malicious code.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [disallow-committing-unsigned](rules/gitlab/project/reject-unsigned-commits.md) | [disallow-committing-unsigned](rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. |
+| [all-commits-signed](rules/gitlab/project/check-signed-commits.md) | [all-commits-signed](rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. |
+
+## [CTL-3] Automation access keys expire automatically
+
+Automation access keys expire automatically
+
+
+### Mitigation
+Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited.
+
+### **Description**
+
+Ensuring that access keys used by automation expire periodically reduces the risk when keys are compromised.
+
+> :skull: Automated systems run continuously and are attractive targets; compromised keys with a short lifespan minimize potential damage.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [token-excessive-lifespan](rules/gitlab/org/longlive-tokens.md) | [token-excessive-lifespan](rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. |
+
+## [CTL-4] Reduce automation access to read-only
+
+Reduce automation access to read-only
+
+
+### Mitigation
+Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage.
+
+### **Description**
+
+CI systems should have read access only to source code repositories to limit the risk from compromised automation accounts.
+
+> :skull: Attackers who gain write access via automation credentials can bypass review processes; restricting access reduces this risk.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [disallowed-token-scope](rules/gitlab/org/forbid-token-scopes.md) | [disallowed-token-scope](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. |
+
+## [CTL-6] Any critical or high severity vulnerability breaks the build
+
+Any critical or high severity vulnerability breaks the build
+
+
+### Mitigation
+Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation.
+
+### **Description**
+
+Supply chain attacks may introduce code vulnerabilities. Using SAST and SCA to identify serious security issues and failing the build prevents insecure code from being merged.
+
+> NOTE: This control complements Control-4 by ensuring no critical vulnerabilities are ignored.
+
+Early detection reduces remediation costs, but also requires a well-defined vulnerability exception process.
+
+> :skull: Vulnerabilities, if undetected, can proliferate quickly and cause widespread damage.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). |
+
+## [CTL-8] Validate artifact digest
+
+Validate artifact digest
+
+
+### Mitigation
+Validate the artifact’s digest before deployment to ensure it has not been tampered with and maintains software integrity.
+
+### **Description**
+
+Before deployment, an artifact’s digest is checked against the expected value to confirm it has not been compromised.
+
+> :skull: Attackers often attempt to alter artifacts; validating the digest helps ensure integrity.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [require-sbom](rules/sbom/evidence-exists.md) | [Require SBOM Existence](rules/sbom/evidence-exists.md) | Verify the SBOM exists as evidence. |
+
+## [CTL-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged
+
+Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged
+
+
+### Mitigation
+Enforce a review process requiring at least two reviewers and a passing build, ensuring thorough evaluation and testing before code is merged.
+
+### **Description**
+
+Requiring multiple code reviews and successful tests helps ensure that no changes are merged without proper oversight.
+
+> :skull: Without proper reviews, attackers can insert malicious changes; this control mitigates that risk.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [merge-approval](rules/gitlab/project/approvals-policy-check.md) | [merge-approval](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. |
+
+## [CTL-11] Available container images don’t have any high or critical vulnerabilities
+
+Available container images don’t have any high or critical vulnerabilities
+
+
+### Mitigation
+Continuously scan container images for vulnerabilities and ensure that only images without high or critical issues are deployed.
+
+### **Description**
+
+Container images must be scanned before deployment to prevent the inclusion of images with serious vulnerabilities.
+
+> :skull: Vulnerable containers can be a major attack vector; this control helps prevent their use.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). |
+
+## [CTL-12] Validate artifact signatures and digests
+
+Validate artifact signatures and digests
+
+
+### Mitigation
+Ensure that artifacts are properly signed and their digests validated, confirming authenticity and preventing tampering.
+
+### **Description**
+
+Validating the signature and digest of an artifact ensures that it has not been altered between testing and deployment.
+
+> :skull: This control helps prevent the deployment of artifacts that may have been modified by attackers.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [sbom-is-signed](rules/sbom/artifact-signed.md) | [sbom-is-signed](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. |
+
+## [CTL-13] Scan deployed images in production
+
+Scan deployed images in production
+
+
+### Mitigation
+Continuously monitor and scan production images to ensure ongoing compliance with security standards.
+
+### **Description**
+
+Production images should be validated to ensure that controls enforced during earlier stages continue to be effective in production.
+
+> :skull: Ongoing monitoring helps detect any security issues that may emerge post-deployment.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [sbom-is-signed](rules/sbom/artifact-signed.md) | [sbom-is-signed](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. |
+| [disallow-dependencies](rules/sbom/blocklist-packages.md) | [disallow-dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. |
+| [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). |
diff --git a/docs/glossary.md b/docs/glossary.md
index c8d19f813..36f6a81d1 100644
--- a/docs/glossary.md
+++ b/docs/glossary.md
@@ -3,24 +3,35 @@ sidebar_position: 16
sidebar_label: "Glossary"
title: Glossary
---
-### Code Integrity Validation
+
+### Asset
+
+An asset is a resource that is valuable to an organization. In the context of Scribe, an asset is a target from which you want to collect evidence. This could be an image, a file, a GIT repository, or a platform discovery target, like GitHub organization configuration or a K8s pod instance.
+
+### Code Integrity Validation
+
Code Integrity Validation is a test that verifies that files were not modified unlawfully between the source repository and the final image. In Scribe this test uses hash values generated during the evidence collection and so doesn't require looking at the actual code. Even a single bit changed in a file would generate a different hash value so by comparing hash values generated by files in the source repository and the ones in the final image we're able to identify and files that do not match.
### CycloneDX
+
OWASP CycloneDX is a lightweight Bill of Materials (BOM) standard designed for use in application security contexts and supply chain component analysis. The specification excels in: Software Bill of Materials (SBOM) Software-as-a-Service Bill of Materials (SaaSBOM), and Operations Bill of Materials (OBOM).
You can read more about CycloneDX SBOM [here](https://cyclonedx.org/capabilities/sbom/ "OWASP CycloneDX SBOM").
### Dependencies
+
A software dependency is a code library or package that is reused in a new piece of software. For example, a machine learning project written in Python might call a Python library to build models. The benefit of software dependencies is that they allow developers to more quickly deliver software by building on previous work. Most code dependencies are open source packages. Transitive dependencies are referring to 'a dependency of a dependency'. Since most code is built using other libraries that is true for your dependencies as well. That means that your dependencies have their own dependencies and so on down the line. This chain of dependencies is part of what is known as the software supply chain.
### DevSecOps
+
DevSecOps stands for development + security + operations. It's an approach that combines application development, security, operations and infrastructure as code (IaC) in an automated continuous integration/continuous delivery (CI/CD) pipeline.
### Evidence
+
In this context, evidence is proof of something that happened (or didn't happen) during the development process and/or build pipeline. This evidence would usually take the form of a log or file. In order to make sure that the evidence is trustworthy and unfalsifiable, it is considered a best practice to sign it cryptographically to turn it into an attestation.
### Evidence collection target
+
Scribe knows how to collect evidence from several entities:
* An image - Image formats supported are currently docker manifest v2 and Oracle Cloud Infrastructure (OCI)
* A folder
@@ -32,20 +43,41 @@ Targeting one of these entities with the Scribe tool allows you to collect evide
You can view which environments are supported by Scribe's tool [here](how-to-run-scribe/ci-integrations/ "integrating Scribe into a pipeline").
### Hash Value
+
A hash value is a numeric value of a fixed length that uniquely identifies data. Hash values represent large amounts of data as much smaller numeric values. Since each piece of data generates a unique hash value these strings can be used in algorithms comparing data pieces or files.
### In-toto
+
In-toto is a framework built to secure the integrity of software supply chains. The framework was designed for securing the way in which software is developed, built, tested, and packaged (i.e., the software supply chain). In-toto attests to the integrity and verifiability of all the actions performed while writing code, compiling, testing, and deploying software. It does so by making it transparent to the user what steps were performed, by whom and in what order. As a result, given guidance by the group creating the software, in-toto allows the user to verify if a step in the supply chain was intended to be performed, if the step was performed by the right actor, and attests that materials (e.g., source code) were not tampered with between steps.
You can read more about in-toto [here](https://in-toto.io/ "in-toto framework").
-### In-toto Attestation
+### In-toto Attestation
+
An attestation is cryptographically signed piece of evidence. It's a mechanism for software to prove its identity and authenticity. The goal of attestation is to prove to a third party that the signed evidence is intact and trustworthy. An [in-toto attestation](https://github.com/in-toto/attestation "in-toto attestation GitHub link") is authenticated (cryptographically signed) metadata about one or more software artifacts, as per the [SLSA Attestation Model](https://github.com/slsa-framework/slsa/blob/main/docs/attestation-model.md "SLSA Attestation Model GitHub link").
-### In-toto Statement
+### In-toto Statement
+
An in-toto Statement is almost identical to an in-toto attestation. The only difference is that the in-toto Statement is not cryptographically signed. Other than that it's packaged in exactly the same way as an [in-toto attestation](https://github.com/in-toto/attestation "in-toto attestation GitHub link").
+### Policy Bundle
+
+A policy bundle is a collection of [rules](#policy-rule) and [initiatives](#policy-initiative) that can be used to evaluate evidence. For example, a policy bundle could be a collection of security frameworks that are used to evaluate the security posture of an application. Scribe provides a [Sample Policy Bundle](https://github.com/scribe-public/sample-policies) that includes the SSDF, SLSA L1 and L2 frameworks as well as a set of rules to verify a variety of security requirements on different types of attestations.
+
+### Policy Initiative
+
+An initiative is a high-level, abstract requirement that is comprised of a set of [controls](#policy-control). For example, a security framework such as SSDF can be represented as an initiative.
+
+### Policy Control
+
+A control is an abstract requirement that is comprised of a set of [rules](#policy-rule). For example, the SSDF framework (initiative) requires a control for protecting access to the source code.
+
+### Policy Rule
+
+A rule is a single requirement that is, in the context of Scribe, a single check that can be performed on evidence. For example, the control described in the section above can be materialized by requiring MFA, limiting the number and identity of admins, and requiring the source code repository to be private -- each of these requirements is a rule.
+
### SBOM
+
The software bill of materials (SBOM) lists all component parts and software dependencies involved in the development and delivery of an application. SBOMs are similar to bill of materials (BOMs) used in supply chains and manufacturing. There hasn’t been a common feature for all vendors in the IT industry to accurately describe the foundational code components on which an application is built.
A typical SBOM would include licensing information, version numbers, component details, and vendors. A formal list of all the facts decreases risks for both the manufacturer and the user by allowing others to understand what’s in their software and act accordingly. SBOMs aren’t new to the software industry, but they’re becoming increasingly vital as development becomes more sophisticated and expensive. They’ve lately become a basic requirement in a number of businesses.
@@ -53,6 +85,7 @@ A typical SBOM would include licensing information, version numbers, component d
You can read more about it [here](https://scribesecurity.com/sbom/ "Read more about SBOM").
### SLSA
+
The Supply chain Levels for Software Artifacts or SLSA (pronounced Salsa) is a security framework created by Google. It is a list of standards and controls meant to prevent tampering, improve file integrity, and secure packages and infrastructure in your projects, businesses, or enterprises.
SLSA consists of common-sense security measures intended for embedding security throughout the development lifecycle.
SLSA is meant to make it easier for the implementing organization to get information about its software source, build, and artifacts. At the same time, it’s meant to make it much harder for any malicious or threat actor, either within or outside of the organization, to make any unauthorized changes to files, processes, or artifacts.
@@ -60,11 +93,13 @@ SLSA is meant to make it easier for the implementing organization to get informa
You can read more about SLSA [here](https://slsa.dev/ "SLSA").
### SLSA Provenance
+
Provenance is the place of origin or earliest known history of something. SLSA provenance is a claim that some entity produced one or more software artifacts by executing some recipe or procedure, using some other artifacts as input built to the SLSA standard. It’s the verifiable information about software artifacts describing where, when and how something was produced.
You can read more about SLSA provenance and it's structure [here](https://slsa.dev/provenance/v0.2 "SLSA Provenance").
### Software Supply Chain
+
The software supply chain refers to everything involved in the development of an application throughout the entire software development life cycle (SDLC). There are many factors to consider in this regard, including custom code (in-house components), open source dependencies and libraries (third-party components), DevOps tools and infrastructure that make up the CI/CD process, and finally developers and DevOps teams.
You can read more about it [here](https://scribesecurity.com/software-supply-chain-security/ "Read more about Software Supply Chain").
diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md
new file mode 100644
index 000000000..8cf685f19
--- /dev/null
+++ b/docs/guides/enforcing-sdlc-initiative.md
@@ -0,0 +1,1264 @@
+---
+sidebar_label: "Applying Initiatives to your SDLC"
+title: Applying Initiatives to your SDLC
+sidebar_position: 3
+toc_min_heading_level: 2
+toc_max_heading_level: 5
+---
+
+You can use Scribe to apply policies at different points along your SDLC.
+For example, at the end of a build or at the admission control point to the production cluster. Use cases include:
+
+- Images must be signed, and they must have a matching CycloneDX SBOM.
+- Images must be built by a CircleCI workflow and produce signed SLSA provenance.
+- Tagged sources must be signed and verified by a set of individuals or processes.
+
+For a detailed initiative description, see the **[initiatives](../valint/initiatives)** section.
+
+## Quickstart
+
+### Creating an SBOM
+
+1. Install `valint`:
+
+ ```bash
+ curl -sSfL https://get.scribesecurity.com/install.sh | sh -s -- -t valint
+ ```
+
+2. Create an SBOM of the type you want to verify. For a Docker image, the command would be:
+
+ ```bash
+ valint bom busybox:latest -o attest \
+ --product-key -- product-version \
+ --scribe.client-secret
+ ```
+
+See [Getting started with valint](../valint/getting-started-valint.md) for more information on the `bom` command.
+
+Alternatively, you can use GitHub actions, as described in detail in [Setting up an integration in GitHub](../quick-start/set-up-integration/set-up-github.md).
+
+### Verifying an initiative
+
+1. Create an image SBOM as described in [Creating an SBOM](#creating-an-sbom).
+
+2. Verify the SBOM against an initiative. Let's take the SSDF initiative provided in the [Scribe Sample Catalog](#sample-rule-catalog):
+
+ ```bash
+ valint verify busybox:latest --initiative ssdf@v2 \
+ --product-key -- product-version \
+ --scribe.client-secret
+ ```
+
+ As a result, you will see the output table of the initiative verification. A detailed description of the fields is provided in the corresponding section of the [Policy Results](../valint/policy-results.md#policy-results-in-valint-logs) page.
+
+
+
+ Initiative results
+
+ ```bash
+ INFO PS/PS.2/PS.2.1: Control "Make software integrity verification information available to software acquirers" Evaluation Summary:
+ ┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
+ │ [PS/PS.2/PS.2.1] Control "Make software integrity verification information available to software acquirers" Evaluati │
+ │ on Summary │
+ ├────────────────┬──────────────────┬───────┬──────────┬────────┬─────────────────────────────┬────────────────────────┤
+ │ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │
+ ├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────────────┤
+ │ sbom-is-signed │ Image-verifiable │ none │ true │ pass │ Evidence signature verified │ busybox:1.36.1 (image) │
+ ├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────────────┤
+ │ CONTROL RESULT │ │ │ │ PASS │ │ │
+ └────────────────┴──────────────────┴───────┴──────────┴────────┴─────────────────────────────┴────────────────────────┘
+ INFO PS/PS.3/PS.3.1: Control "Securely archive the necessary files and supporting data to be retained for each software release" Evaluation Summary:
+ ┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
+ │ [PS/PS.3/PS.3.1] Control "Securely archive the necessary files and supporting data to be retained for each software │
+ │ release" Evaluation Summary │
+ ├───────────────────┬───────────────────┬───────┬──────────┬────────┬─────────────────────────┬────────────────────────┤
+ │ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │
+ ├───────────────────┼───────────────────┼───────┼──────────┼────────┼─────────────────────────┼────────────────────────┤
+ │ provenance-exists │ Provenance exists │ error │ false │ fail │ SLSA Provenance missing │ busybox:1.36.1 (image) │
+ ├───────────────────┼───────────────────┼───────┼──────────┼────────┼─────────────────────────┼────────────────────────┤
+ │ CONTROL RESULT │ │ │ │ FAIL │ │ │
+ └───────────────────┴───────────────────┴───────┴──────────┴────────┴─────────────────────────┴────────────────────────┘
+ INFO PS/PS.3/PS.3.2: Control "Collect, safeguard, maintain, and share provenance data for all components of each software release" Evaluation Summary:
+ ┌───────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
+ │ [PS/PS.3/PS.3.2] Control "Collect, safeguard, maintain, and share provenance data for all components of each soft │
+ │ ware release" Evaluation Summary │
+ ├────────────────┬───────────────┬───────┬──────────┬────────┬─────────────────────────────┬────────────────────────┤
+ │ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │
+ ├────────────────┼───────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────────────┤
+ │ sbom-is-signed │ SBOM archived │ none │ true │ pass │ Evidence signature verified │ busybox:1.36.1 (image) │
+ ├────────────────┼───────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────────────┤
+ │ CONTROL RESULT │ │ │ │ PASS │ │ │
+ └────────────────┴───────────────┴───────┴──────────┴────────┴─────────────────────────────┴────────────────────────┘
+ INFO SSDF: Initiative "SSDF Client Initiative" Evaluation Summary:
+ ┌────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
+ │ [SSDF] Initiative "SSDF Client Initiative" Evaluation Summary │
+ ├───────────────────┬──────────────────────────────────────────────────────────────────┬────────────────────────────┬────────┤
+ │ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │
+ ├───────────────────┼──────────────────────────────────────────────────────────────────┼────────────────────────────┼────────┤
+ │ PS/PS.2/PS.2.1 │ Make software integrity verification information available to so │ - Image-verifiable (pass) │ pass │
+ │ │ ftware acquirers │ │ │
+ ├───────────────────┼──────────────────────────────────────────────────────────────────┼────────────────────────────┼────────┤
+ │ PS/PS.3/PS.3.1 │ Securely archive the necessary files and supporting data to be r │ - Provenance exists (fail) │ fail │
+ │ │ etained for each software release │ │ │
+ ├───────────────────┼──────────────────────────────────────────────────────────────────┼────────────────────────────┼────────┤
+ │ PS/PS.3/PS.3.2 │ Collect, safeguard, maintain, and share provenance data for all │ - SBOM archived (pass) │ pass │
+ │ │ components of each software release │ │ │
+ ├───────────────────┼──────────────────────────────────────────────────────────────────┼────────────────────────────┼────────┤
+ │ INITIATIVE RESULT │ │ │ FAIL │
+ └───────────────────┴──────────────────────────────────────────────────────────────────┴────────────────────────────┴────────┘
+ Evaluation Target Name 'index.docker.io/library/busybox:latest'
+ ```
+
+
+
+ :::info
+ Only the rules that are applicable to the target (the `busybox:latest` docker image) were verified. Other rules were disabled automatically, and no result was generated for them.
+ :::
+ :::info
+ To verify the whole SSDF initiative, you need to run SCM platform discovery. See [platforms discovery](../platforms/overview).
+ :::
+
+### Running a single rule verification
+
+Similar to [initiatives](#verifying-an-initiative), you can verify a single rule. Let's take as an example the `sbom-require-complete-license-set` rule from the [Scribe Sample Catalog](#sample-rule-catalog):
+
+1. Create an image SBOM as described in [Creating an SBOM](#creating-an-sbom).
+
+2. Verify the SBOM against an existing rule from the bundle. The [Scribe Sample Rule Catalog](#sample-rule-catalog) will be used as the default rule bundle for `valint`.
+
+ ```bash
+ valint verify busybox:latest --rule sbom/complete-licenses@v2 \
+ --product-key -- product-version \
+ --scribe.client-secret
+ ```
+
+ As a result, you will see the output table of the rule verification. A detailed description of the fields is provided in the corresponding section of the [Policy Results](../valint/policy-results.md#policy-results-in-valint-logs) page.
+
+
+
+ Rule evaluation results
+
+ ```bash
+ ┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
+ │ [default] Control "Default" Evaluation Summary │
+ ├───────────────────────────────────┬───────────────────────────────────┬───────┬──────────┬────────┬────────────────────────────┬────────────────────────┤
+ │ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │
+ ├───────────────────────────────────┼───────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────┼────────────────────────┤
+ │ sbom-require-complete-license-set │ Enforce SBOM License Completeness │ error │ false │ pass │ All packages have licenses │ busybox:1.36.1 (image) │
+ ├───────────────────────────────────┼───────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────┼────────────────────────┤
+ │ CONTROL RESULT │ │ │ │ PASS │ │ │
+ └───────────────────────────────────┴───────────────────────────────────┴───────┴──────────┴────────┴────────────────────────────┴────────────────────────┘
+ ```
+
+ You will also see the results table of the initiative evaluation:
+
+ ```bash
+ ┌─────────────────────────────────────────────────────────────────────────────────────────────┐
+ │ [client-initiative] Initiative "client-initiative" Evaluation Summary │
+ ├───────────────────┬───────────────┬────────────────────────────────────────────────┬────────┤
+ │ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │
+ ├───────────────────┼───────────────┼────────────────────────────────────────────────┼────────┤
+ │ default │ Default │ sbom-require-complete-license-set(pass) │ pass │
+ ├───────────────────┼───────────────┼────────────────────────────────────────────────┼────────┤
+ │ INITIATIVE RESULT │ │ │ PASS │
+ └───────────────────┴───────────────┴────────────────────────────────────────────────┴────────┘
+ ```
+
+
+
+ :::info
+ The rule was put in the `client-initiative` initiative. To change that, you can use the `--initiative-name` and `--initiative-id` flags.
+ It was also put in the `default` control. This cannot be changed unless you provide a full initiative config with custom names and IDs for your controls.
+ :::
+
+### Targetless Run
+
+Some of the rules in this catalog can also be run in "targetless" mode,
+meaning that the evidence will be looked up based only on the product name, version, and options specified in the rule config.
+No target for preliminary analysis is needed.
+This is usually helpful for third-party reports, such as security scans and [platform discoveries](../platforms/overview).
+
+As an example, let's run `trivy` to create a SARIF report:
+
+```bash
+trivy image --format sarif --output results.sarif ubuntu:latest
+```
+
+Then, create evidence from this report:
+
+```bash
+valint evidence results.sarif \
+ --product-key -- product-version \
+ --scribe.client-secret
+```
+
+Finally, verify the evidence against the rule. Note that we don't need to provide `valint` with the target report:
+
+```bash
+valint verify --rule sarif/trivy/verify-trivy-report@v2 \
+ --product-key -- product-version \
+ --scribe.client-secret
+```
+
+`valint` will use the latest evidence for the specified product name and version that meets the other rule requirements.
+In our example, the rule needs an evidence created by the "Trivy Vulnerability Scanner" tool,
+so `valint` was able to find it just by this partial context.
+
+
+
+Initiative results
+
+```bash
+┌────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
+│ [default] Control "Default" Evaluation Summary │
+├────────────────┬──────────────────────────────────────┬───────┬──────────┬────────┬────────────────────────────────┬───────────────┤
+│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │
+├────────────────┼──────────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────┼───────────────┤
+│ trivy-report │ Verify Trivy SARIF Report Compliance │ error │ false │ fail │ 113 violations | 0 max allowed │ results.sarif │
+├────────────────┼──────────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────┼───────────────┤
+│ CONTROL RESULT │ │ │ │ FAIL │ │ │
+└────────────────┴──────────────────────────────────────┴───────┴──────────┴────────┴────────────────────────────────┴───────────────┘
+
+┌────────────────────────────────────────────────────────────────────────┐
+│ [client-initiative] Initiative "client-initiative" Evaluation Summary │
+├───────────────────┬───────────────┬───────────────────────────┬────────┤
+│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │
+├───────────────────┼───────────────┼───────────────────────────┼────────┤
+│ default │ Default │ trivy-report(fail) │ fail │
+├───────────────────┼───────────────┼───────────────────────────┼────────┤
+│ INITIATIVE RESULT │ │ │ FAIL │
+└───────────────────┴───────────────┴───────────────────────────┴────────┘
+```
+
+
+
+### Whole initiative verification
+
+If you want to verify an initiative on all existing attestations, provide `valint` with the `--all-evidence` flag.
+It disables using of target for evidence filtering and verifies all matching attestations for each rule.
+
+```bash
+valint verify --initiative ssdf@v2 --all-evidence \
+ --product-key -- product-version \
+ --scribe.client-secret
+```
+
+
+
+Initiative results
+
+```bash
+INFO PS/PS.3/PS.3.1: Control "Securely archive the necessary files and supporting data to be retained for each software release" Evaluation Summary:
+┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
+│ [PS/PS.3/PS.3.1] Control "Securely archive the necessary files and supporting data to be retained for each software │
+│ release" Evaluation Summary │
+├───────────────────┬───────────────────┬───────┬──────────┬────────┬─────────────────────────┬────────────────────────┤
+│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │
+├───────────────────┼───────────────────┼───────┼──────────┼────────┼─────────────────────────┼────────────────────────┤
+│ provenance-exists │ Provenance exists │ error │ false │ fail │ SLSA Provenance missing │ busybox:1.36.1 (image) │
+├───────────────────┼───────────────────┼───────┼──────────┼────────┼─────────────────────────┼────────────────────────┤
+│ CONTROL RESULT │ │ │ │ FAIL │ │ │
+└───────────────────┴───────────────────┴───────┴──────────┴────────┴─────────────────────────┴────────────────────────┘
+INFO PS/PS.3/PS.3.2: Control "Collect, safeguard, maintain, and share provenance data for all components of each software release" Evaluation Summary:
+┌───────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
+│ [PS/PS.3/PS.3.2] Control "Collect, safeguard, maintain, and share provenance data for all components of each soft │
+│ ware release" Evaluation Summary │
+├────────────────┬───────────────┬───────┬──────────┬────────┬─────────────────────────────┬────────────────────────┤
+│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │
+├────────────────┼───────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────────────┤
+│ sbom-is-signed │ SBOM archived │ none │ true │ pass │ Evidence signature verified │ busybox:1.36.1 (image) │
+├────────────────┼───────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────────────┤
+│ CONTROL RESULT │ │ │ │ PASS │ │ │
+└────────────────┴───────────────┴───────┴──────────┴────────┴─────────────────────────────┴────────────────────────┘
+INFO PS/PS.1/PS.1.1: Control "Store all forms of code based on the principle of least privilege" Evaluation Summary:
+┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
+│ [PS/PS.1/PS.1.1] Control "Store all forms of code based on the principle of least privilege" Evaluation Summary │
+├────────────────────┬────────────────────────────────┬───────┬──────────┬────────┬────────────────────────────────────────┬───────────────────────────────────────┤
+│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │
+├────────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤
+│ 2fa │ Enforce 2FA │ error │ true │ fail │ 2FA authentication is NOT enabled │ my-org (github organization) │
+├────────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤
+│ branch-protection │ Branch protected │ error │ true │ fail │ 1 unprotected branches | 0 max allowed │ my-repo (github repo) │
+├────────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤
+│ max-admins │ Limit admins │ error │ true │ fail │ 6 admins | 3 max allowed │ my-org (github organization) │
+├────────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤
+│ repo-is-private │ Repo private │ none │ true │ pass │ The repository is private │ my-repo (github repo) │
+├────────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤
+│ web-commit-signoff │ Require signoff on web commits │ error │ true │ fail │ web_commit_signoff_required is NOT set │ my-org (github organization) │
+├────────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤
+│ CONTROL RESULT │ │ │ │ FAIL │ │ │
+└────────────────────┴────────────────────────────────┴───────┴──────────┴────────┴────────────────────────────────────────┴───────────────────────────────────────┘
+INFO PS/PS.2/PS.2.1: Control "Make software integrity verification information available to software acquirers" Evaluation Summary:
+┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
+│ [PS/PS.2/PS.2.1] Control "Make software integrity verification information available to software acquirers" Evaluati │
+│ on Summary │
+├────────────────┬──────────────────┬───────┬──────────┬────────┬─────────────────────────────┬────────────────────────┤
+│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │
+├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────────────┤
+│ sbom-is-signed │ Image-verifiable │ none │ true │ pass │ Evidence signature verified │ busybox:1.36.1 (image) │
+├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────────────┤
+│ CONTROL RESULT │ │ │ │ PASS │ │ │
+└────────────────┴──────────────────┴───────┴──────────┴────────┴─────────────────────────────┴────────────────────────┘
+INFO SSDF: Initiative "SSDF Client Initiative" Evaluation Summary:
+┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
+│ [SSDF] Initiative "SSDF Client Initiative" Evaluation Summary │
+├───────────────────┬──────────────────────────────────────────────────────────────────┬─────────────────────────────────────────┬────────┤
+│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │
+├───────────────────┼──────────────────────────────────────────────────────────────────┼─────────────────────────────────────────┼────────┤
+│ PS/PS.1/PS.1.1 │ Store all forms of code based on the principle of least privileg │ - Branch protected (fail), │ fail │
+│ │ e │ - Repo private (pass), │ │
+│ │ │ - Enforce 2FA (fail), │ │
+│ │ │ - Limit admins (fail), │ │
+│ │ │ - Require signoff on web commits (fail) │ │
+├───────────────────┼──────────────────────────────────────────────────────────────────┼─────────────────────────────────────────┼────────┤
+│ PS/PS.2/PS.2.1 │ Make software integrity verification information available to so │ - Image-verifiable (pass) │ pass │
+│ │ ftware acquirers │ │ │
+├───────────────────┼──────────────────────────────────────────────────────────────────┼─────────────────────────────────────────┼────────┤
+│ PS/PS.3/PS.3.1 │ Securely archive the necessary files and supporting data to be r │ - Provenance exists (fail) │ fail │
+│ │ etained for each software release │ │ │
+├───────────────────┼──────────────────────────────────────────────────────────────────┼─────────────────────────────────────────┼────────┤
+│ PS/PS.3/PS.3.2 │ Collect, safeguard, maintain, and share provenance data for all │ - SBOM archived (pass) │ pass │
+│ │ components of each software release │ │ │
+├───────────────────┼──────────────────────────────────────────────────────────────────┼─────────────────────────────────────────┼────────┤
+│ INITIATIVE RESULT │ │ │ FAIL │
+└───────────────────┴──────────────────────────────────────────────────────────────────┴─────────────────────────────────────────┴────────┘
+```
+
+
+
+In this case, no rule was disabled, and all of them were verified.
+
+### Migration from an older version
+
+Before initiatives were introduced in `valint v2.0.0`, a slightly different format of configs was used for the policy engine. Essentially, there were only `rule` and `policy` configs, so if you're using one of those, here's how you can migrate to the new format.
+
+#### Rule configs migration
+
+In general, older rule configs can be used in `valint v2.0.0` and newer with some minor changes. The main difference is that, from now on, `valint` requires each config to state its format. The only change needed is to add this line to your rule config:
+
+```yaml
+config-type: rule
+```
+
+After that, you can pass the rule config to `valint` using the same `--rule` flag as before.
+
+#### Policy configs migration
+
+Policy configs were deprecated in `valint v2.0.0`. Policies themselves were renamed to _controls_ and are now consumed as part of the _initiative_ config. The migration process is slightly more complex but still quite straightforward.
+
+If you use a single policy config, you can copy it entirely under the `controls` key in the new initiative config. For example, if you have a policy config like this:
+
+```yaml
+name: "MyPolicy"
+rules:
+ - uses: images/blocklist-build-scripts@v1
+ level: error
+ with:
+ blocklist:
+ - "wget"
+ - "curl"
+```
+
+then the new initiative config will look like this:
+
+```yaml
+config-type: "initiative"
+name: "MyInitiative"
+controls:
+ - name: "MyControl"
+ rules:
+ - uses: images/blocklist-build-scripts@v1
+ level: error
+ with:
+ blocklist:
+ - "wget"
+ - "curl"
+```
+
+If you use multiple policies at once, you can copy all of them under the `controls` key in the new initiative config.
+
+The next important step is to ensure that the referenced rules work with the new `valint` version. If you use rules from the [Scribe Sample Catalog](#sample-policy-catalog), you only need to change the referenced rule version from `@v1` to `@v2`. If your rule is not listed in the updated catalog, please check whether it was renamed or moved to a different folder. As a result, the initiative configuration will look like this:
+
+```yaml
+config-type: "initiative"
+name: "MyInitiative"
+controls:
+ - name: "MyControl"
+ rules:
+ - uses: images/blocklist-build-scripts@v2
+ level: error
+ with:
+ blocklist:
+ - "wget"
+ - "curl"
+```
+
+This configuration can be passed to `valint` using the `--initiative` flag.
+
+If you're using custom rules, update them as shown in the section above.
+
+:::tip
+Note that initiatives provide more flexibility and control over rules and controls than policies,
+including smart filtering as shown in the [Rule Filtering](../valint/initiatives#rule-filtering) section. Depending on the scenario, it might be useful to place all controls in a single initiative and filter them by gate or target.
+:::
+
+:::note
+Starting with `valint v2.0.0`, some initiatives are shipped as part of the Scribe Catalog. See [this section](#example) and [this section](#sample-policy-catalog) for more details.
+:::
+
+#### Example
+
+Let's take SLSA L2 as an example. Prior to `valint v2.0.0`, one could verify a single SLSA L2 rule using the following command:
+
+```bash
+valint verify alpine:latest --rule slsa/l2-provenance-authenticated@v1 --product-key --product-version
+```
+
+This command would verify the `alpine:latest` image against the `slsa/l2-provenance-authenticated` rule.
+
+To run v2 of the same rule, you could simply replace `@v1` with `@v2` in the command shown above.
+However, with the initiatives available, it is recommended to run the following command:
+
+```bash
+valint verify alpine:latest --initiative slsa.l2@v2 --product-key --product-version
+```
+
+This command will verify the `alpine:latest` image against all rules in the SLSA L2 initiative, including `slsa/l2-provenance-authenticated`.
+
+We recommend using the initiative configuration also for SLSA L1, as it provides better result descriptions and integration with the Scribe service.
+In that case, the command will look like this:
+
+```bash
+valint verify alpine:latest --initiative slsa.l1@v2 --product-key --product-version
+```
+
+To get more information about initiatives provided in the Scribe Policy Catalog, see the [Sample Policy Catalog](#sample-policy-catalog) section.
+
+## Sample Policy Catalog
+
+We provide a set of sample initiatives and rules that can be used to verify the compliance of your software supply chain. This catalog is used by `valint` by default.
+To use a different version of this catalog, use the `--bundle-tag` valint flag.
+
+To use a custom initiatives rule catalog, you can specify the path to the catalog in the `--bundle` flag (it may be a local path or a git repo). Additionally, `--bundle-branch` and `--bundle-tag` flags can be used to specify the branch or tag of the catalog git repo.
+
+
+| Name | Description |
+|------|-------------|
+| [NIST Application Container Security Initiative](/docs/configuration/initiatives/sp-800-190.md) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. |
+| [NIST Supply Chain Integrity Initiative](/docs/configuration/initiatives/sp-800-53.md) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. |
+| [SLSA L1 Framework](/docs/configuration/initiatives/slsa.l1.md) | Evaluate SLSA Level 1 |
+| [SLSA L2 Framework](/docs/configuration/initiatives/slsa.l2.md) | Evaluate SLSA Level 2 |
+| [SSDF Client Initiative](/docs/configuration/initiatives/ssdf.md) | Evaluate PS rules from the SSDF initiative |
+| [Secure Software Pipeline Blueprint](/docs/configuration/initiatives/sspb.md) | Blueprint for secure pipelines - Gitlab |
+
+## Rules
+
+### SBOM
+
+**Evidence Type:** [SBOM](/docs/valint/sbom)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Apply Scribe Template Policy](/docs/configuration/initiatives/rules/api/scribe-api.md) | Verify XX using the Scribe API template rule. |
+| [Scribe Published Policy](/docs/configuration/initiatives/rules/api/scribe-api-published.md) | Verify image Scribe Publish flag is set for container image. |
+| [NTIA SBOM Compliance Check](/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. |
+| [Enforce SBOM Freshness](/docs/configuration/initiatives/rules/sbom/fresh-sbom.md) | Verify the SBOM is not older than the specified duration. |
+| [Require SBOM Existence](/docs/configuration/initiatives/rules/sbom/evidence-exists.md) | Verify the SBOM exists as evidence. |
+| [Require SBOM Signature](/docs/configuration/initiatives/rules/sbom/artifact-signed.md) | Verify the SBOM is signed. |
+| [Require SBOM Existence](/docs/configuration/initiatives/rules/sbom/require-sbom.md) | Verify the SBOM exists as evidence. |
+
+### Image SBOM
+
+**Evidence Type:** [Image SBOM](/docs/valint/sbom)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify File Integrity](/docs/configuration/initiatives/rules/multievidence/files_integrity.md) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. |
+| [Verify Image Labels](/docs/configuration/initiatives/rules/images/verify-labels.md) | Verify specified labels key-value pairs exist in the image. |
+| [Forbid Large Images](/docs/configuration/initiatives/rules/images/forbid-large-images.md) | Verify the image size is below the specified threshold. |
+| [Disallow Container Shell Entrypoint](/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md) | Verify the container image disallows shell entrypoint. |
+| [Fresh Base Image](/docs/configuration/initiatives/rules/images/fresh-base-image.md) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. |
+| [Banned Ports](/docs/configuration/initiatives/rules/images/banned-ports.md) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. |
+| [Disallow Specific Users in SBOM](/docs/configuration/initiatives/rules/images/banned-users.md) | Verify specific users are not allowed in an SBOM. |
+| [Restrict Build Scripts](/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md) | Verify no build scripts commands appear in block list. |
+| [Registry Connection HTTPS](/docs/configuration/initiatives/rules/images/enforce-https-registry.md) | Checks if the container's registry scheme is HTTPS |
+| [Require Image Labels](/docs/configuration/initiatives/rules/images/verify-labels-exist.md) | Verify the image has the specified labels. |
+| [Require Healthcheck](/docs/configuration/initiatives/rules/images/require-healthcheck.md) | Checks that the container image includes at least one healthcheck property. |
+| [Allowed Base Image](/docs/configuration/initiatives/rules/images/allowed-base-image.md) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. |
+| [Fresh Image](/docs/configuration/initiatives/rules/images/fresh-image.md) | Verify the image is not older than the specified threshold. |
+| [Allowed Main Image Source](/docs/configuration/initiatives/rules/images/allowed-image-source.md) | Ensures the main container image referenced in the SBOM is from an approved source. |
+| [Require Signed Container Image](/docs/configuration/initiatives/rules/images/image-signed.md) | Enforces that container images (target_type=container) are cryptographically signed. |
+| [Verify No Critical or High Vulnerabilities](/docs/configuration/initiatives/rules/api/scribe-api-cve.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). |
+| [Disallow Specific Users in SBOM](/docs/configuration/initiatives/rules/sbom/banned-users.md) | Verify specific users are not allowed in an SBOM. |
+| [Enforce SBOM Dependencies](/docs/configuration/initiatives/rules/sbom/required-packages.md) | Verify the artifact includes all required dependencies. |
+| [Enforce SBOM License Completeness](/docs/configuration/initiatives/rules/sbom/complete-licenses.md) | Verify all dependencies in the artifact have a license. |
+| [Restrict Disallowed SBOM Licenses](/docs/configuration/initiatives/rules/sbom/banned-licenses.md) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. |
+| [Enforce Allowed SBOM Components](/docs/configuration/initiatives/rules/sbom/allowed-components.md) | Verify the artifact contains only allowed components. |
+| [Require Specified SBOM Licenses](/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md) | Verify the artifact includes all specified licenses. |
+| [Restrict Disallowed Dependencies](/docs/configuration/initiatives/rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. |
+
+### Git SBOM
+
+**Evidence Type:** [Git SBOM](/docs/valint/sbom)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Restrict Coding Permissions](/docs/configuration/initiatives/rules/git/coding-permissions.md) | Verify only allowed users committed to the repository. |
+| [Required Git Evidence Exists](/docs/configuration/initiatives/rules/git/evidence-exists.md) | Verify required Git evidence exists. |
+| [Git Artifact Signed](/docs/configuration/initiatives/rules/git/artifact-signed.md) | Verify the Git artifact is signed. |
+| [Disallow Commits to Main Branch](/docs/configuration/initiatives/rules/git/no-commit-to-main.md) | Verify commits made directly to the main branch are disallowed. |
+| [Disallow Unsigned Commits](/docs/configuration/initiatives/rules/git/no-unsigned-commits.md) | Verify all commits are signed. |
+
+### SARIF Evidence
+
+**Evidence Type:** [SARIF Evidence](/docs/valint/sarif)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify Attack Vector Exists in SARIF](/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md) | Verify required evidence validates attack vectors in the SARIF report. |
+| [Verify IaC Misconfiguration Threshold in SARIF](/docs/configuration/initiatives/rules/sarif/report-iac-errors.md) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. |
+| [Verify Required Evidence in SARIF](/docs/configuration/initiatives/rules/sarif/evidence-exists.md) | Verify all required evidence exists as defined by the SARIF policy. |
+| [Verify Artifact Signature in SARIF](/docs/configuration/initiatives/rules/sarif/artifact-signed.md) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. |
+| [Verify Rule Compliance in SARIF](/docs/configuration/initiatives/rules/sarif/verify-sarif.md) | Verify the SARIF report complies with defined generic rules for compliance and security. vulnerability profiles. |
+| [Verify Tool Evidence in SARIF](/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md) | Verify required tools were used to generate the SARIF report. |
+| [Verify Semgrep Rule in SARIF](/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. |
+| [Verify Trivy SARIF Report Compliance](/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. |
+| [Verify IaC Misconfiguration Threshold in Trivy SARIF](/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. |
+| [Trivy Blocklist CVE Check](/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md) | Verify a CVE Blocklist against a SARIF report |
+| [Trivy Vulnerability Findings Check](/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. |
+| [Verify Attack Vector Threshold in Trivy SARIF](/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. |
+| [SARIF Update Needed](/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md) | Verify no security packages require updates. |
+| [K8s Jailbreak](/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold |
+
+### Generic Statement
+
+**Evidence Type:** [Generic Statement](/docs/valint/generic)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Required Trivy Evidence Exists](/docs/configuration/initiatives/rules/generic/trivy-exists.md) | Verify required Trivy evidence exists |
+| [Required Generic Evidence Exists](/docs/configuration/initiatives/rules/generic/evidence-exists.md) | Verify required evidence exists. |
+| [Generic Artifact Signed](/docs/configuration/initiatives/rules/generic/artifact-signed.md) | Verify required evidence is signed. |
+
+### Github Organization Discovery Evidence
+
+**Evidence Type:** [Github Organization Discovery Evidence](/docs/platforms/discover#github-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify members_can_create_repositories setting](/docs/configuration/initiatives/rules/github/org/create-repos.md) | Verify only allowed users can create repositories in the GitHub organization. |
+| [Verify `secret_scanning_push_protection` Setting](/docs/configuration/initiatives/rules/github/org/push-protection-sa.md) | Verify secret scanning push protection is configured in the GitHub repository. |
+| [Verify `secret_scanning_validity_checks_enabled` Setting](/docs/configuration/initiatives/rules/github/org/validity-checks.md) | Verify validity checks for secrets are configured for the GitHub repository. |
+| [Verify dependabot_security_updates_enabled_for_new_repositories setting](/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. |
+| [Verify `secret_scanning` Setting in `security_and_analysis`](/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md) | Verify secret scanning is configured in the GitHub repository. |
+| [Limit Admin Number in GitHub Organization](/docs/configuration/initiatives/rules/github/org/max-admins.md) | Verify the maximum number of GitHub organization admins is restricted. |
+| [Verify `advanced_security_enabled_for_new_repositories` setting](/docs/configuration/initiatives/rules/github/org/advanced-security.md) | Verify Advanced Security is enabled for new repositories in the GitHub organization. |
+| [Verify dependency_graph_enabled_for_new_repositories setting](/docs/configuration/initiatives/rules/github/org/dependency-graph.md) | Verify dependency graph is enabled for new repositories in the GitHub organization. |
+| [Verify GitHub Organization Requires Signoff on Web Commits](/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md) | Verify contributors sign commits through the GitHub web interface. |
+| [Verify Two-Factor Authentication (2FA) Requirement Enabled](/docs/configuration/initiatives/rules/github/org/2fa.md) | Verify Two-factor Authentication is required in the GitHub organization. |
+| [Verify GitHub Organization Secrets Are Not Too Old](/docs/configuration/initiatives/rules/github/org/old-secrets.md) | Verify secrets in the GitHub organization are not older than the specified threshold. |
+| [Allowed GitHub Organization Admins](/docs/configuration/initiatives/rules/github/org/allow-admins.md) | Verify only users in the Allowed List have admin privileges in the GitHub organization. |
+| [Verify secret_scanning_enabled_for_new_repositories setting](/docs/configuration/initiatives/rules/github/org/secret-scanning.md) | Verify secret scanning is configured for new repositories in the GitHub organization. |
+| [Allowed GitHub Organization Users](/docs/configuration/initiatives/rules/github/org/allow-users.md) | Verify only users in the Allowed List have user access to the GitHub organization. |
+| [Verify `secret_scanning_push_protection_custom_link_enabled` Setting](/docs/configuration/initiatives/rules/github/org/pp-custom-link.md) | Verify secret scanning push protection custom link is enabled in the GitHub organization. |
+| [Verify dependabot_security_updates setting in security_and_analysis](/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md) | Verify Dependabot security updates are configured in the GitHub organization. |
+| [Verify that members can create private repositories setting is configured](/docs/configuration/initiatives/rules/github/org/create-private-repos.md) | Verify only allowed users can create private repositories in the GitHub organization. |
+| [Verify Repo Visibility Setting](/docs/configuration/initiatives/rules/github/org/repo-visibility.md) | Verify only repositories in the Allowed List are public in the GitHub organization. |
+| [Verify `secret_scanning_validity_checks` Setting in `security_and_analysis`](/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md) | Verify validity checks for secrets are configured for the GitHub organization. |
+| [Verify `secret_scanning_push_protection_enabled_for_new_repositories` Setting](/docs/configuration/initiatives/rules/github/org/push-protection.md) | Verify secret scanning push protection is enabled for new repositories in the GitHub organization. |
+| [Verify dependabot_alerts_enabled_for_new_repositories setting](/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. |
+
+### Github Repository Discovery Evidence
+
+**Evidence Type:** [Github Repository Discovery Evidence](/docs/platforms/discover#github-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify secret scanning.](/docs/configuration/initiatives/rules/github/repository/validity-checks.md) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. |
+| [Verify Dependabot security updates setting](/docs/configuration/initiatives/rules/github/repository/dependabot.md) | Verify Dependabot security updates are configured in the GitHub repository. |
+| [Verify Repository Is Private](/docs/configuration/initiatives/rules/github/repository/repo-private.md) | Verify the GitHub repository is private. |
+| [Verify Repository Requires Commit Signoff](/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. |
+| [Verify Default Branch Protection](/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md) | Verify the default branch protection is configured in the GitHub repository. |
+| [Verify No Old Secrets Exist in Repository](/docs/configuration/initiatives/rules/github/repository/old-secrets.md) | Verify secrets in the GitHub repository are not older than the specified threshold. |
+| [Verify No Organization Secrets Exist in Repository](/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md) | Verify no organization secrets exist in the GitHub repository. |
+| [Verify Branch Verification Setting](/docs/configuration/initiatives/rules/github/repository/branch-verification.md) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. |
+| [Verify Branch Protection Setting](/docs/configuration/initiatives/rules/github/repository/branch-protection.md) | Verify branch protection is configured in the GitHub repository. |
+| [Verify All Commits Are Signed in Repository](/docs/configuration/initiatives/rules/github/repository/signed-commits.md) | Verify all commits are signed in a repository attestation. |
+| [Verify secret_scanning setting](/docs/configuration/initiatives/rules/github/repository/secret-scanning.md) | Verify `secret_scanning` is configured in the GitHub repository. |
+| [Verify No Cache Usage Exists in Repository](/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md) | Verify the GitHub repository has no cache usage. |
+| [Verify All Commits Are Signed in Repository](/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md) | Verify all commits in the GitHub repository are signed. |
+| [Verify Only Ephemeral Runners Exist in Repository](/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md) | Verify self-hosted runners are disallowed in the GitHub repository. |
+| [Allowed Public Repositories](/docs/configuration/initiatives/rules/github/repository/visibility.md) | Verify only GitHub repositories in the Allowed List are public. |
+| [Verify Push Protection Setting](/docs/configuration/initiatives/rules/github/repository/push-protection.md) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. |
+
+### Gitlab Organization Discovery Evidence
+
+**Evidence Type:** [Gitlab Organization Discovery Evidence](/docs/platforms/discover#gitlab-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Limit Admins in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. |
+| [Ensure Active Projects in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md) | Verify no GitLab organization projects are inactive. |
+| [Restrict Public Visibility in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md) | Verify only allowed projects in the GitLab organization have public visibility. |
+| [Allowed Admins in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md) | Verify only users in the Allowed List have admin privileges in the GitLab organization. |
+| [Forbid Long-Lived Tokens in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. |
+| [Forbid Unused Tokens in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md) | Verify there are no unused GitLab organization tokens. |
+| [Allowed Users in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/allow-users.md) | Verify only users in the Allowed List have access to the GitLab organization. |
+| [Restrict Token Scopes in GitLab](/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. |
+| [Block Users in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md) | Verify no users in the GitLab organization are on the block list. |
+| [Prevent Token Expiration in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md) | Verify no GitLab organization tokens are about to expire. |
+| [Forbid Token Scopes in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. |
+
+### Gitlab Project Discovery Evidence
+
+**Evidence Type:** [Gitlab Project Discovery Evidence](/docs/platforms/discover#gitlab-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Merge approval policy check for GitLab project](/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. |
+| [Set Push Rules for GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md) | Verify push rules are set for the GitLab project. |
+| [Disable Committers' Approval for Merge Requests in GitLab](/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. |
+| [Restrict Commit Authors in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md) | Verify only GitLab project users in the Allowed List have commit author permissions. |
+| [Require Minimal Approvers in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md) | Verify the required number of approvers for the GitLab project is met. |
+| [Enforce Medium Severity Limit](/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md) | Verify the maximum allowed medium severity alerts for the GitLab project. |
+| [Enforce Merge Access Level Policy for GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md) | Verify the GitLab project's merge access level complies with requirements. |
+| [Set Author Email Regex in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md) | Verify the `author_email_regex` for the GitLab project is set to the specified value. |
+| [Check CWE Compliance](/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md) | Verify that specified CWEs were not detected in the GitLab project. |
+| [Enforce Critical Severity Limit](/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md) | Verify the maximum allowed critical severity alerts for the GitLab project. |
+| [Verify Commit Message Format](/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md) | Verify that commit messages in the GitLab project adhere to the specified format template. |
+| [Enable Member Check for GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/member-check.md) | Verify `member_check` is enabled for the GitLab project. |
+| [Restrict Selective Code Owner Removals in GitLab](/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md) | Verify `selective_code_owner_removals` is set for the GitLab project. |
+| [Run Secrets Scanning in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md) | Verify secrets scanning is performed for the GitLab project. |
+| [Reset Approvals on Push in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md) | Verify `reset_approvals_on_push` is set for the GitLab project. |
+| [Reject Unsigned Commits in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. |
+| [Enable Commit Committer Check in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md) | Verify `commit_committer_check` is enabled for the GitLab project. |
+| [Protect CI Secrets in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md) | Verify secrets in the GitLab project are not shared. |
+| [Validate All Commits in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md) | Verify all commits in the GitLab project are validated. |
+| [Disallow Banned Approvers](/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md) | Verify approvers in the GitLab project are not on the banned list. |
+| [Allowed Committer Emails in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md) | Verify only users in the Allowed List use committer email addresses in the GitLab project. |
+| [Set Push Access Level in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md) | Verify the GitLab project's push access level policy complies with requirements. |
+| [Disallow Force Push in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. |
+| [Set Visibility Level in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md) | Verify the GitLab project's visibility matches the required level. |
+| [Restrict Approvers Per Merge Request](/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. |
+| [Allowed Commit Authors in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md) | Verify only users in the Allowed List author commits in the GitLab project. |
+| [Disable Author Approval for Merge Requests in GitLab](/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. |
+| [Enable Secrets Prevention in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md) | Verify `prevent_secrets` is enabled for the GitLab project. |
+| [Ensure All Commits Are Signed in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. |
+| [Check Description Substring](/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. |
+| [Verify Project Activity](/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md) | Verify the GitLab project is active for a specified duration. |
+| [Allowed Committer Names in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md) | Verify only users in the Allowed List commit by name in the GitLab project. |
+| [Check Message Substring](/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. |
+| [Run SAST Scanning in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md) | Verify SAST scanning is performed for the GitLab project. |
+| [Require Code Owner Approval in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md) | Verify code owner approval is required for specific branches in the GitLab project. |
+| [Ensure SAST Scanning Passes](/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md) | Verify SAST scanning is successful for the GitLab project. |
+| [Ensure Secrets Scanning Passes](/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md) | Verify secrets scanning is successful for the GitLab project. |
+| [Require Password for Approvals in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md) | Verify the binary field `require_password_to_approve` is set for the GitLab project. |
+
+### K8s Namespace Discovery Evidence
+
+**Evidence Type:** [K8s Namespace Discovery Evidence](/docs/platforms/discover#k8s-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Allowed Container Images](/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. |
+| [Verify Namespace Termination](/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. |
+| [Allowed Namespaces](/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md) | Verify only namespaces specified in the Allowed List are allowed within the cluster. |
+| [Verify Namespace Runtime Duration](/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. |
+| [Allowed Namespace Registries](/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. |
+| [Allowed Pods in Namespace](/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. |
+
+### K8s Pod Discovery Evidence
+
+**Evidence Type:** [K8s Pod Discovery Evidence](/docs/platforms/discover#k8s-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify Pod Runtime Duration](/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. |
+| [Verify Pod Termination](/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. |
+| [Allowed Pods](/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md) | Verify only pods explicitly listed in the Allowed List are allowed to run. |
+
+### Bitbucket Project Discovery Evidence
+
+**Evidence Type:** [Bitbucket Project Discovery Evidence](/docs/platforms/discover#bitbucket-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Prevent Long-Lived Tokens](/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md) | Verify Bitbucket API tokens expire before the maximum time to live. |
+| [Allowed Project Admins](/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. |
+| [Allowed Project Users](/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket project. |
+| [Prevent Credential Exposure](/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. |
+
+### Bitbucket Repository Discovery Evidence
+
+**Evidence Type:** [Bitbucket Repository Discovery Evidence](/docs/platforms/discover#bitbucket-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Allowed Repository Admins](/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. |
+| [Verify Default Branch Protection Setting Is Configured](/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md) | Verify the default branch protection is enabled in the Bitbucket repository. |
+| [Allowed Repository Users](/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. |
+
+### Bitbucket Workspace Discovery Evidence
+
+**Evidence Type:** [Bitbucket Workspace Discovery Evidence](/docs/platforms/discover#bitbucket-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Allowed Workspace Admins](/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. |
+| [Allowed Workspace Users](/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. |
+
+### Discovery Evidence
+
+**Evidence Type:** [Discovery Evidence](/docs/platforms/discover)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify GitLab Pipeline Labels](/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md) | Verify the pipeline includes all required label keys and values. |
+| [GitLab pipeline verify labels exist](/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md) | Verify the pipeline has all required label keys and values. |
+| [Verify Exposed Credentials](/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md) | Verify there are no exposed credentials. |
+
+### Dockerhub Project Discovery Evidence
+
+**Evidence Type:** [Dockerhub Project Discovery Evidence](/docs/platforms/discover#dockerhub-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify DockerHub Tokens are Active](/docs/configuration/initiatives/rules/dockerhub/token-expiration.md) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. |
+| [Verify no unused Dockerhub](/docs/configuration/initiatives/rules/dockerhub/token-not-used.md) | Verify that there are no unused Dockerhub. |
+
+### Jenkins Instance Discovery Evidence
+
+**Evidence Type:** [Jenkins Instance Discovery Evidence](/docs/platforms/discover#jenkins-discovery)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Disallow Unused Users](/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md) | Verify there are no users with zero activity. |
+| [Verify Inactive Users](/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md) | Verify there are no inactive users. |
+
+### SLSA Provenance
+
+**Evidence Type:** [SLSA Provenance](/docs/valint/help/valint_slsa)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [SLSA External Parameters Match in Provenance Document](/docs/configuration/initiatives/rules/slsa/verify-external-parameters.md) | Verify the specified exterenal parameters value match in the provenance document. |
+| [Verify that provenance is authenticated](/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md) | Verify the artifact is signed. |
+| [SLSA Field Exists in Provenance Document](/docs/configuration/initiatives/rules/slsa/field-exists.md) | Verify the specified field exists in the provenance document. |
+| [Verify Provenance Document Exists](/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. |
+| [Disallow dependencies in SLSA Provenance Document](/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. |
+| [Verify build time](/docs/configuration/initiatives/rules/slsa/build-time.md) | Verify the artifact was created within the specified time window. |
+| [Verify that artifact was created by the specified builder](/docs/configuration/initiatives/rules/slsa/verify-builder.md) | Verify the artifact was created by the specified builder. |
+| [Verify that artifact has no disallowed builder dependencies](/docs/configuration/initiatives/rules/slsa/verify-byproducts.md) | Verify the artifact has no disallowed builder dependencies. |
+| [SLSA Field Value Matches in Provenance Document](/docs/configuration/initiatives/rules/slsa/verify-custom-fields.md) | Verify the specified field value matches in the provenance document. |
+
+### Statement
+
+**Evidence Type:** [Statement](/docs/valint/generic)
+
+| Rule Name | Description |
+|-----------|-------------|
+| [Verify Selected Commits Are Signed API](/docs/configuration/initiatives/rules/github/api/signed-commits-list.md) | Verify selected commits are signed in the GitHub organization. |
+| [Branch protection enabled in GitHub repository](/docs/configuration/initiatives/rules/github/api/branch-protection.md) | Verify GitHub branch protection rules |
+| [Disallow Unsigned Commits In Time Range](/docs/configuration/initiatives/rules/github/api/signed-commits-range.md) | Verify commits in the specified time range are signed. |
+| [Sign Selected Commits in GitLab](/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md) | Verify the selected commits are signed in the GitLab organization. |
+| [Set Push Rules in GitLab](/docs/configuration/initiatives/rules/gitlab/api/push-rules.md) | Verify GitLab push rules are configured via the API. |
+| [Sign Selected Commit Range in GitLab](/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md) | Verify the selected range of commits is signed via the GitLab API. |
+| [Verify No Critical or High Vulnerabilities in Product](/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in any deliverable component of the product. |
+
+
+
+### General Information
+
+Most of the policy rules in this bundle consist of two files: a `.yaml` and a `.rego`.
+
+The first is a rule configuration file that should be referenced by on runtime or merged to the actual `valint.yaml`.
+The second is a rego script that contains the actual verifyer code. It can be used as is or merged to the `.yaml` using `script` option.
+
+#### Modifying rules in the Catalog
+
+Each rule in this catalog consists of a `rego` script and `yaml` configuration file.
+In order to run a rule, its script file should be referred by a rule config. Each `.yaml` represents such a config and is ready for use.
+
+### SBOM
+
+An example of creating an SBOM evidence:
+
+```bash
+valint bom ubuntu:latest -o statement
+```
+
+To verify the evidence against the rule, run:
+
+```bash
+valint verify ubuntu:latest -i statement-cyclonedx-json --rule sbom/rule_config@v2
+```
+
+#### Require SBOM Signature
+
+This rule ([artifact-signed.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/artifact-signed.yaml)) verifies that the SBOM is signed and the signer identity equals to a given value.
+
+If you have not created an SBOM yet, create an sbom attestation, for example:
+
+In [artifact-signed.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/artifact-signed.yaml) file,
+edit policy parameters ```attest.cocosign.policies.rules.input identity``` to reflect the expected signers identity.
+
+You can also edit `target_type` to refelct the artifact type.
+
+:::info
+Optional target types are `git`,`directory`, `image`, `file`, `generic`.
+:::
+
+```yaml
+evidence:
+ target_type: container
+with:
+ identity:
+ emails:
+ - example@company.com
+```
+
+#### Restrict Disallowed Dependencies
+
+This rule ([blocklist-packages.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/blocklist-packages.yaml), [blocklist-packages.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/blocklist-packages.rego)) verifies an SBOM does not include packages in the list of risky packages.
+
+`rego` code for This rule can be found in the [blocklist-packages.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/blocklist-packages.rego) file.
+
+Edit the list of the risky licenses in the `input.rego.args` parameter in file [blocklist-packages.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/blocklist-packages.yaml):
+
+```yaml
+with:
+ blocklist:
+ - "pkg:deb/ubuntu/tar@1.34+dfsg-1ubuntu0.1.22.04.1?arch=arm64&distro=ubuntu-22.04"
+ - "log4j"
+ blocklisted_limit: 0
+```
+
+#### Enforce SBOM Dependencies
+
+This rule ([required-packages.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/required-packages.yaml), [required-packages.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/required-packages.rego)) verifies that the SBOM includes packages from the list of required packages.
+
+Edit the list of the required packages in the `input.rego.args` parameter in file [required-packages.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/required-packages.yaml):
+
+```yaml
+with:
+ required_pkgs:
+ - "pkg:deb/ubuntu/bash@5.1-6ubuntu1?arch=amd64\u0026distro=ubuntu-22.04"
+ violations_limit: 1
+```
+
+The rule checks if there is a package listed in SBOM whose name contains the name of a required package as a substring. For example, if the package name is ```pkg:deb/ubuntu/bash@5.1-6ubuntu1?arch=amd64\u0026distro=ubuntu-22.04```, it will match any substring, like just ```bash``` or ```bash@5.1-6ubuntu1```.
+
+#### Restrict Disallowed SBOM Licenses
+
+This rule ([banned-licenses.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/banned-licenses.yaml), [banned-licenses.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/banned-licenses.rego)) verifies that the SBOM does not include licenses from the list of risky licenses.
+
+Edit the list of the risky licenses in the `input.rego.args` parameter in file [banned-licenses.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/banned-licenses.yaml):
+
+```yaml
+rgs:
+ blocklist:
+ - GPL
+ - MPL
+ blocklisted_limit : 10
+```
+
+#### Enforce SBOM License Completeness
+
+This rule ([complete-licenses.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/complete-licenses.yaml), [complete-licenses.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/complete-licenses.rego)) verifies that every package in the SBOM has a license.
+
+It doesn't have any additional parameters.
+
+#### Enforce SBOM Freshness
+
+This rule ([fresh-sbom.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/fresh-sbom.yaml), [fresh-sbom.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/fresh-sbom.rego)) verifies that the SBOM is not older than a given number of days.
+
+Edit the config `input.rego.args` parameter in file [fresh-sbom.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/fresh-sbom.yaml):
+
+```yaml
+with:
+ max_days : 30
+```
+
+### Images
+
+An example of creating an evidence:
+
+```bash
+valint bom ubuntu:latest -o statement
+```
+
+To verify the evidence against the rule:
+
+```bash
+valint verify ubuntu:latest -i statement --rule images/rule_config@v2
+```
+
+#### Disallow Container Shell Entrypoint
+
+This rule ([restrict-shell-entrypoint.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/restrict-shell-entrypoint.yaml), [restrict-shell-entrypoint.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/restrict-shell-entrypoint.rego)) verifies that the image entrypoint does not provide shell access by default. It does so by verifying that both `Entrypoint` and `Cmd` don't contain `sh` (there's an exclusion for `.sh` though).
+
+This rule is not configurable.
+
+#### Restrict Build Scripts
+
+This rule ([blocklist-build-scripts.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/blocklist-build-scripts.yaml), [blocklist-build-scripts.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/blocklist-build-scripts.rego)) verifies that the image did not run blocklisted scripts on build.
+
+Edit the list of the blocklisted scripts in the `input.rego.args` parameter in file [blocklist-build-scripts.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/no-build-scripts.yaml):
+
+```yaml
+with:
+ blocklist:
+ - curl
+```
+
+#### Verify Image Labels
+
+This rule ([verify-labels.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/verify-labels.yaml), [verify-labels.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/verify-labels.rego)) verifies that image has labels with required values.
+
+Edit the list of the required labels in the config object in file [verify-labels.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/verify-labels.yaml):
+
+```yaml
+with:
+ labels:
+ - label: "org.opencontainers.image.version"
+ value: "22.04"
+```
+
+#### Fresh Image
+
+This rule ([fresh-image.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/fresh-image.yaml), [fresh-image.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/fresh-image.rego)) verifies that the image is not older than a given number of days.
+
+Edit the config `input.rego.args` parameter in file [fresh-image.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/fresh-image.yaml):
+
+```yaml
+with:
+ max_days: 183
+```
+
+#### Forbid Large Images
+
+This rule ([forbid-large-images.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/forbid-large-images.yaml), [forbid-large-images.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/forbid-large-images.rego)) verifies that the image is not larger than a given size.
+
+Set max size in bytes in the `input.rego.args` parameter in file [forbid-large-images.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/forbid-large-images.yaml):
+
+```yaml
+with:
+ max_size: 77808811
+```
+
+### Git
+
+An example of creating a Git evidence:
+
+```bash
+valint bom git:https://github.com/golang/go -o statement
+```
+
+To verify the evidence against the rule:
+
+```bash
+valint verify git:https://github.com/golang/go -i statement --rule git/rule_config@v2
+```
+
+#### Restrict Coding Permissions
+
+This rule ([coding-permissions.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/git/coding-permissions.yaml), [coding-permissions.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/git/coding-permissions.rego)) verifies that files from the specified list were modified by authorized users only.
+
+For This rule be able to run, the evidence must include a reference to the files that were modified in the commit. This can be done by adding parameter `--components commits,files` to the `valint bom` command.
+
+For specifying the list of files and identities, edit the `input.rego.args` parameter in file [coding-permissions.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/git/coding-permissions.yaml).
+This example for repository [Golang Build](https://github.com/golang/build) verifies that files `build.go` and `internal/https/README.md` were modified only by identities containing `@golang.com` and `@golang.org`:
+
+```yaml
+with:
+ ids:
+ - "@golang.com"
+ - "@golang.org"
+ files:
+ - "a.txt"
+ - "somedir/b.txt"
+```
+
+#### Disallow Unsigned Commits
+
+This rule ([no-unsigned-commits.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/git/no-unsigned-commits.yaml), [no-unsigned-commits.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/git/no-unsigned-commits.rego)) verifies that evidence has no unsigned commits. It does not verify the signatures though.
+
+#### Disallow Commits to Main Branch
+
+This rule ([no-commit-to-main.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/git/no-commit-to-main.yaml), [no-commit-to-main.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/git/no-commit-to-main.rego)) verifies that evidence has no commits made to main branch.
+
+### SLSA
+
+Example of creating a SLSA statement:
+
+```bash
+valint slsa ubuntu:latest -o statement
+```
+
+Example of verifying a SLSA statement:
+
+```bash
+valint verify ubuntu:latest -i statement-slsa --rule slsa/rule_config@v2
+```
+
+#### Verify that artifact was created by the specified builder
+
+This rule ([verify-builder.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/verify-builder.yaml), [verify-builder.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/verify-builder.rego)) verifies that the builder name of the SLSA statement equals to a given value.
+
+Edit config `input.rego.args` parameter in file [verify-builder.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/verify-builder.yaml):
+
+```yaml
+with:
+ id: "local"
+```
+
+#### Disallow dependencies in SLSA Provenance Document
+
+This rule ([banned-builder-deps.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/banned-builder-deps.yaml), [banned-builder-deps.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/banned-builder-deps.rego)) verifies that the builder used to build an artifact does not have banned dependencies (such as an old openSSL version).
+
+Edit config `input.rego.args` parameter in file [banned-builder-deps.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/banned-builder-deps.yaml):
+
+```yaml
+with:
+ blocklist:
+ - name: "valint"
+ version: "0.0.0"
+```
+
+#### Verify Build Time
+
+This rule ([build-time.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/build-time.yaml), [build-time.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/build-time.rego)) verifies that the build time of the SLSA statement is within a given time window The timezone is derived from the timestamp in the statement.
+
+Edit config `input.rego.args` parameter in file [build-time.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/build-time.yaml):
+
+```yaml
+with:
+ start_hour: 8
+ end_hour: 20
+ workdays:
+ - "Sunday"
+ - "Monday"
+ - "Tuesday"
+ - "Wednesday"
+ - "Thursday"
+```
+
+#### Verify that artifact has no disallowed builder dependencies
+
+This rule ([verify-byproducts.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/verify-byproducts.yaml), [verify-byproducts.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/verify-byproducts.rego)) verifies that the SLSA statement contains all the required byproducts.
+According to the SLSA Provenance [documentation](https://slsa.dev/spec/v1.0/provenance), there are no mandatory fields in the description of a byproduct, but at least one of `uri, digest, content` should be specified.
+So, the rule checks if each byproduct specified in the configuration is present in one of those fields of any byproduct in the SLSA statement. It does so by calling the `contains` function, so the match is not exact.
+
+Before running the rule, specify desired byproducts in the `input.rego.args` parameter in file [verify-byproducts.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/verify-byproducts.yaml):
+
+```yaml
+with:
+ byproducts:
+ - 4693057ce2364720d39e57e85a5b8e0bd9ac3573716237736d6470ec5b7b7230
+```
+
+#### SLSA Field Exists in Provenance Document
+
+This rule ([field-exists.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/field-exists.yaml), [field-exists.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/field-exists.rego)) verifies that the SLSA statement contains a field with the given path.
+
+Before running the rule, specify desired paths in the `input.rego.args` parameter in file [field-exists.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/field-exists.yaml):
+
+```yaml
+with:
+ paths:
+ - "predicate/runDetails/builder/builderDependencies"
+ violations_threshold: 0
+```
+
+### Sarif Reports
+
+#### Generic SARIF Rule
+
+This rule ([verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-sarif.yaml), [verify-sarif.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-sarif.rego)) allows to verify any SARIF report against a given rule. The rule has several parameters to check against:
+
+- ruleLevel: the level of the rule, can be "error", "warning", "note", "none"
+- ruleIds: the list of the rule IDs to check against
+- precision: the precision of the check, can be "exact", "substring", "regex"
+- ignore: the list of the rule IDs to ignore
+- maxAllowed: the maximum number of violations allowed
+
+These values can be changed in the `input.rego.args` section in the [verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-sarif.yaml) file.
+
+##### Creating a BOM out of a SARIF report
+
+Create a trivy sarif report of the vulnerabilities of an image:
+
+```bash
+trivy image ubuntu:latest -f sarif -o ubuntu-cve.json
+```
+
+Create an evidence from this report:
+
+```bash
+valint evidence ubuntu-cve.json -o statement
+```
+
+Verify the attestation against the rule:
+
+```bash
+valint verify ubuntu-cve.json -i statement-generic --rule sarif/verify-sarif@v2
+```
+
+###### Running Trivy On Docker Container Rootfs
+
+As an alternative, one can run `trivy` against an existing Docker container rootfs:
+
+```bash
+docker run --rm -it alpine:3.11
+```
+
+Then, inside docker run:
+
+```bash
+curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+trivy rootfs / -f sarif -o rootfs.json
+```
+
+Then, outside docker run this to copy the report from the container:
+
+```bash
+docker cp $(docker ps -lq):/rootfs.json .
+```
+
+After that create the evidence and verify it as described above.
+
+##### Verify Rule Compliance in SARIF
+
+To verify that the SARIF report complies with defined generic rules for compliance and security, set the following parameters in the `rego.args` section in the[verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-sarif.yaml) file:
+
+```yaml
+with:
+ rule_level: []
+ precision: []
+ rule_ids: []
+ ignore: []
+ max_allowed: 0
+```
+
+For example, to alarm on specific rule levels & rule IDs, modify config as follows:
+
+```yaml
+with:
+ rule_level:
+ - "error"
+ - "warning"
+ - "note"
+ - "none"
+ precision: []
+ rule_ids:
+ - "CVE-2021-1234"
+ - "CVE-2021-5678"
+ ignore: []
+ max_allowed: 0
+```
+
+##### Do Not Allow Vulnerabilities Based On Specific Attack Vector
+
+Trivy/grype reports usually contain descriptions for some CVEs, like impact and attack vector.
+This rule ([verify-attack-vector.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-attack-vector.yaml), [verify-attack-vector.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-attack-vector.rego)) is meant to restrict number of vulnerabilities with specific attack vectors.
+For example, to restrict vulnerabilities with attack vector "stack buffer overflow", set the following parameters in the `rego.args` section in the [verify-attack-vector.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-attack-vector.yaml) file:
+
+```yaml
+with:
+ attack_vectors:
+ - "stack buffer overflow"
+ violations_threshold: 0
+```
+
+Then run the rule against the SARIF report as described above.
+
+#### Verify IaC Misconfiguration Threshold in SARIF
+
+This rule ([report-iac-errors.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/report-iac-errors.yaml), [report-iac-errors.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/report-iac-errors.rego)) allows to verify a Trivy IaC report and check if there are any errors in the configuration.
+
+First, create a trivy report of the misconfigurations of a Dockerfile:
+
+```bash
+trivy config -f sarif -o my-image-dockerfile.json
+```
+
+Create an evidence from this report:
+
+```bash
+valint evidence my-image-dockerfile.json -o statement
+```
+
+Verify the attestation against the rule:
+
+```bash
+valint verify my-image-dockerfile.json -i statement-generic --rule sarif/report-iac-errors@v2
+```
+
+The only configurable parameter in [report-iac-errors.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/report-iac-errors.yaml) is `violations_threshold`, which is the maximum number of errors allowed in the report:
+
+```yaml
+with:
+ violations_threshold: 0
+```
+
+#### Verify Semgrep Rule in SARIF
+
+`semgrep`, a code analysis tool, can produce SARIF reports, which later can be verified by `valint` against a given rule.
+
+This rule ([verify-semgrep-report.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-semgrep-report.yaml), [verify-semgrep-report.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-semgrep-report.rego)) allows to verify that given SARIF report does not contain specific rules violations.
+
+First, one needs to create a semgrep report (say, for the `openvpn` repo):
+
+```bash
+cd openvpn/
+semgrep scan --config auto -o semgrep-report.sarif --sarif
+```
+
+Then, create an evidence from this report:
+
+```bash
+valint evidence semgrep-report.sarif -o statement
+```
+
+Configuration of This rule is done in the file [verify-semgrep-report.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-semgrep-report.yaml). In this example we forbid any violations of the `use-after-free` rule:
+
+```yaml
+with:
+ rule_ids:
+ - "use-after-free"
+ violations_threshold: 0
+```
+
+Then, run `valint verify` as usual:
+
+```bash
+valint verify semgrep-report.sarif -i statement-generic --rule sarif/verify-semgrep-report@v2
+```
+
+If any violations found, the output will contain their description, including the violated rule and the file where the violation was found.
+
+#### Verify Tool Evidence in SARIF
+
+This rule ([verify-tool-evidence.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-tool-evidence.yaml)) allows to verify the existence of an evidence of SARIF report created by a specified tool. By default, the rule checks for an evidence created out of _any_ SARIF report. To specify a tool, use the `tool` parameter in the `evidence` section of the rule configuration. For example, to verify that there is an evidence of a SARIF report created by `trivy`, use the following configuration:
+
+```yaml
+uses: sarif/verify-tool-evidence@v2
+evidence:
+ tool: "Trivy Vulnerability Scanner"
+```
+
+### K8s Jailbreak
+
+Trivy k8s analysis can highlight some misconfigurations which allow container to access host filesystem or network. The goal of This rule is to detect such misconfigurations.
+
+To run this rule one has to create a Trivy k8s report and create a generic statement with `valint` from it. Then, simply verify the statement against this rule. No additional configuration required.
+
+## Writing Rule Files
+
+Rego policy rules can be written either as snippets in the yaml file, or as separate rego files.
+
+An example of such a rego script is given in the [verify-sarif.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-sarif.rego) file, that is consumed by the [verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-sarif.yaml) configuraion. To evaluate the rule, run
+
+```bash
+valint verify ubuntu-cve.json -i statement-generic --rule sarif/verify-sarif@v2
+```
diff --git a/docs/guides/enforcing-sdlc-policy.md b/docs/guides/enforcing-sdlc-policy.md
deleted file mode 100644
index 3c625141d..000000000
--- a/docs/guides/enforcing-sdlc-policy.md
+++ /dev/null
@@ -1,673 +0,0 @@
----
-sidebar_label: "Applying Policies to your SDLC"
-title: Applying Policies to your SDLC
-sidebar_position: 3
-toc_min_heading_level: 2
-toc_max_heading_level: 5
----
-
-You can use Scribe to apply policies at different points along your SDLC.
-For example, at the end of a build or at the admission control point to the production cluster. Use cases for example:
-
-- Images must be signed, and they must have a matching CycloneDX SBOM.
-- Images must be built by a CircleCI workflow and produce a signed SLSA provenance.
-- Tagged sources must be signed and verified by a set of individuals or processes.
-- Released binaries must be built by Azure DevOps from a specific git repository and have unsigned SLSA provenance.
-
-For the detailed policy description, see **[policies](../valint/policies)** section.
-
-## Sample Rule Bundle
-
-The following is a description of a sample rule bundle (*please note that the feature is in early availability*) that can be used to build a policy for your SDLC.
-
-## Quickstart
-
-1. Install `valint`:
-
- ```bash
- curl -sSfL https://get.scribesecurity.com/install.sh | sh -s -- -t valint
- ```
-
-2. Create an SBOM of a type you want to verify
-
- ```bash
- valint bom busybox:latest -o statement
- ```
-
- Additional options:
- * To explore other evidence types, use commands like `valint slsa` or `valint evidence`.
- * Specify `-o attest` for signed evidence.
-
-3. Verify the SBOM against a policy. The current catalogue will be used as a default bundle for `valint`.
-
- ```bash
- valint verify busybox:latest --rule sboms/complete-licenses@v1 # path within a repo
- ```
-
- If you want to use a specific (say, early-access version or outdated) of this catalogue, use `--git-tag` flag for `valint`:
-
- ```bash
- valint verify busybox:latest --git-tag v1.0.0 --rule sboms/complete-licenses@v1
- ```
-
-### Targetless Run
-
- All of the policy rules in this catalogue can also be run in "targetless" mode, meaning that the evidence will be looked up based on the product name and version. To do so, first create an SBOM providing these values:
-
- ```bash
- valint bom busybox:latest -o statement --product-name busybox --product-version v1.36.1
- ```
-
- Then, run
-
- ```bash
- valint verify --rule sboms/complete-licenses@v1 --product-name busybox --product-version v1.36.1
- ```
-
- Valint will use the latest evidence for the specified product name and version that meets the other rule requirements.
-
-## Modifying Rules in This Catalogue
-
-Each rule in this catalogue consists of a `rego` script and `yaml` configuration file.
-In order to run a rule, its script file should be referred by a rule config. Each `.yaml` represents such a config and is ready for use. If you modify or add your own rules, don't forget to fulfill this requirement.
-
-If you fork this ruleset or create your own, in order to use it you need to specify its location in `valint` flag `--bundle` either in cmd args or a `valint.yaml` config file:
-
-```bash
-valint verify busybox:latest --bundle https://github.com/scribe-public/sample-policies --rule sboms/complete-licenses@v1
-```
-
-## Policy Rule Catalogue
-
-| Rule | Description | Additional Info |
-| --- | --- | --- |
-| [Forbid Unsigned Artifacts](#forbid-unsigned-artifacts) | Verify the artifact's authenticity and signer identity. | [SBOM](#sboms) |
-| [Blocklist Packages](#blocklist-packages) | Prevent risky packages in the artifact. | [SBOM](#sboms) |
-| [Required Packages](#required-packages) | Ensure mandatory packages/files in the artifact. | [SBOM](#sboms) |
-| [Banned Licenses](#banned-licenses) | Restrict inclusion of certain licenses in the artifact. | [SBOM](#sboms) |
-| [Complete Licenses](#complete-licenses) | Guarantee all packages have valid licenses. | [SBOM](#sboms) |
-| [Fresh Artifact](#fresh-artifact) | Verify an artifact's freshness. | [SBOM](#sboms) |
-| [Fresh Image](#fresh-image) | Ensure an image freshness. | [Image SBOM](#images) |
-| [Restrict Shell Image Entrypoint](#restrict-shell-image-entrypoint) | Prevent shell as image entrypoint. | [SBOM](#sboms) |
-| [Blocklist Image Build Scripts](#blocklist-image-build-scripts) | Restrict build scripts in image build. | [Image SBOM](#images) |
-| [Verify Image Lables/Annotations](#verify-image-lablesannotations) | Ensure image has required labels (e.g., git-commit). | [SBOM](#sboms) |
-| [Forbid Huge Images](#forbid-large-images) | Limit image size. | [Image SBOM](#images) |
-| [Coding Permissions](#coding-permissions) | Control file modifications by authorized identities. | [Git SBOM](#git) |
-| Merging Permissions | Ensure authorized identities merge to main. | Counterpart to [Forbid Commits To Main](#forbid-commits-to-main)? |
-| [Forbid Unsigned Commits](#forbid-unsigned-commits) | Prevent unsigned commits in evidence. | [Git SBOM](#git) |
-| [Forbid Commits To Main](#forbid-commits-to-main) | Verify there were no commits to the main branch. | [Git SBOM](#git) |
-| [Verify Use of Specific Builder](#builder-name) | Enforce use of a specific builder for artifact. | [SLSA-Prov](#slsa) |
-| [Banned Builder Dependencies](#banned-builder-dependencies) | Restrict banned builder dependencies. | [SLSA-Prov](#slsa) |
-| [Verify Build Time](#build-time) | Validate build time within window. | [SLSA-Prov](#slsa) |
-| [Verify Byproducts Produced](#produced-byproducts) | Ensure that specific byproducts are produced. | [SLSA-Prov](#slsa) |
-| [Verify That Field Exists](#verify-that-field-exists) | Ensure that specific field exists in the SLSA statement. | [SLSA-Prov](#slsa) |
-| [No Critical CVEs](#no-critical-cves) | Prohibit ANY critical CVEs. | [SARIF](#sarif-reports) |
-| [Limit High CVEs](#limit-high-cves) | Limit high CVEs. | [SARIF](#sarif-reports) |
-| [Do Not Allow Specific CVEs](#do-not-allow-specific-cves) | Prevent specific CVEs in the artifact. | [SARIF](#sarif-reports) |
-| [No Static Analysis Errors](#no-static-analysis-errors) | Prevent static analysis errors in the artifact. | [SARIF](#sarif-reports) |
-| [Limit Static Analysis Warnings](#limit-static-analysis-warnings) | Restrict static analysis warnings count. | [SARIF](#sarif-reports) |
-| [Do Not Allow Specific Static Analysis Rules](#do-not-allow-specific-static-analysis-rules) | Restrict specific static analysis warnings. | [SARIF](#sarif-reports) |
-| [Do Not Allow Vulnerabilities Based On Specific Attack Vector](#do-not-allow-vulnerabilities-based-on-specific-attack-vector) | Restrict vulnerabilities based on specific attack vector. | [SARIF](#sarif-reports) |
-| [Report IaC Configuration errors](#report-iac-configuration-errors) | Check if there are any IaC configuration errors. | [SARIF](#sarif-reports) |
-| [Verify Semgrep SARIF report](#verify-semgrep-sarif-report) | Check for specific violations in a semgrep report. | [SARIF](#sarif-reports) |
-| [Verify Scanner Tool Evidence](#verify-tool-evidence) | Check the existance of an evidence of SARIF report created by specified tool | [SARIF](#sarif-reports) |
-| [Forbid Accessing Host](#forbid-accessing-host) | Do not allow images with detected vulnerabilities giving access to the host system. | Generic Evidence | [Generic](#generic) |
-| No Package Downgrading | Restrict package downgrades. | src and dst [SBOM](#sboms) |
-| No License Modification | Prevent license modifications. | src and dst [SBOM](#sboms) |
-| Verify Source code Integrity | Verify that the artifact source code has not been modified | src and dst [Git SBOM](#git) |
-| Verify Dependencies Integrity | Verify that specific files or folders have not been modified | src and dst [SBOM](#sboms) |
-| [Verify Github Branch Protection](https://github.com/scribe-public/sample-policies/tree/main/v1/apis/github-branch-protection.md) | Verify that the branch protection rules are compliant to required | None |
-| [Verify GitLab Push Rules](https://github.com/scribe-public/sample-policies/tree/main/v1/apis/gitlab-push-rules.md) | Verify that the push rules are compliant to required. GitLabs push rules overlap some of GitHub's branch protection rules | None |
-
-### General Information
-
-Most of the policy rules in this bundle consist of two files: a `.yaml` and a `.rego`.
-
-The first is a rule configuration file that should be referenced by on runtime or merged to the actual `valint.yaml`.
-The second is a rego script that contains the actual verifyer code. It can be used as is or merged to the `.yaml` using `script` option.
-
-### SBOMs
-
-An example of creating an SBOM evidence:
-
-```bash
-valint bom ubuntu:latest -o statement
-```
-
-To verify the evidence against the rule, run:
-
-```bash
-valint verify ubuntu:latest -i statement-cyclonedx-json --rule sboms/rule_config@v1
-```
-
-#### Forbid Unsigned Artifacts
-
-This rule ([artifact-signed.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/artifact-signed.yaml)) verifies that the SBOM is signed and the signer identity equals to a given value.
-
-If you have not created an SBOM yet, create an sbom attestation, for example:
-
-In [artifact-signed.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/artifact-signed.yaml) file,
-edit policy parameters ```attest.cocosign.policies.rules.input identity``` to reflect the expected signers identity.
-
-You can also edit `target_type` to refelct the artifact type.
-
-> Optional target types are `git`,`directory`, `image`, `file`, `generic`.
-
-```yaml
-evidence:
- target_type: image
-with:
- identity:
- emails:
- - example@company.com
-```
-
-#### Blocklist Packages
-
-This rule ([blocklist-packages.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/blocklist-packages.yaml), [blocklist-packages.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/blocklist-packages.rego)) verifies an SBOM does not include packages in the list of risky packages.
-
-`rego` code for This rule can be found in the [blocklist-packages.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/blocklist-packages.rego) file.
-
-Edit the list of the risky licenses in the `input.rego.args` parameter in file [blocklist-packages.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/blocklist-packages.yaml):
-
-```yaml
-with:
- blocklist:
- - "pkg:deb/ubuntu/tar@1.34+dfsg-1ubuntu0.1.22.04.1?arch=arm64&distro=ubuntu-22.04"
- - "log4j"
- blocklisted_limit: 0
-```
-
-#### Required Packages
-
-This rule ([required-packages.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/required-packages.yaml), [required-packages.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/required-packages.rego)) verifies that the SBOM includes packages from the list of required packages.
-
-Edit the list of the required packages in the `input.rego.args` parameter in file [required-packages.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/required-packages.yaml):
-
-```yaml
-with:
- required_pkgs:
- - "pkg:deb/ubuntu/bash@5.1-6ubuntu1?arch=amd64\u0026distro=ubuntu-22.04"
- violations_limit: 1
-```
-
-The rule checks if there is a package listed in SBOM whose name contains the name of a required package as a substring. For example, if the package name is ```pkg:deb/ubuntu/bash@5.1-6ubuntu1?arch=amd64\u0026distro=ubuntu-22.04```, it will match any substring, like just ```bash``` or ```bash@5.1-6ubuntu1```.
-
-#### Banned Licenses
-
-This rule ([banned-licenses.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/banned-licenses.yaml), [banned-licenses.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/banned-licenses.rego)) verifies that the SBOM does not include licenses from the list of risky licenses.
-
-Edit the list of the risky licenses in the `input.rego.args` parameter in file [banned-licenses.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/banned-licenses.yaml):
-
-```yaml
-rgs:
- blocklist:
- - GPL
- - MPL
- blocklisted_limit : 10
-```
-
-#### Complete Licenses
-
-This rule ([complete-licenses.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/complete-licenses.yaml), [complete-licenses.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/complete-licenses.rego)) verifies that every package in the SBOM has a license.
-
-It doesn't have any additional parameters.
-
-#### Fresh Artifact
-
-This rule ([fresh-sbom.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/fresh-sbom.yaml), [fresh-sbom.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/fresh-sbom.rego)) verifies that the SBOM is not older than a given number of days.
-
-Edit the config `input.rego.args` parameter in file [fresh-sbom.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/fresh-sbom.yaml):
-
-```yaml
-with:
- max_days : 30
-```
-
-### Images
-
-An example of creating an evidence:
-
-```bash
-valint bom ubuntu:latest -o statement
-```
-
-To verify the evidence against the rule:
-
-```bash
-valint verify ubuntu:latest -i statement --rule images/rule_config@v1
-```
-
-#### Restrict Shell Image Entrypoint
-
-This rule ([restrict-shell-entrypoint.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/images/restrict-shell-entrypoint.yaml), [restrict-shell-entrypoint.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/images/restrict-shell-entrypoint.rego)) verifies that the image entrypoint does not provide shell access by default. It does so by verifying that both `Entrypoint` and `Cmd` don't contain `sh` (there's an exclusion for `.sh` though).
-
-This rule is not configurable.
-
-#### Blocklist Image Build Scripts
-
-This rule ([blocklist-build-scripts.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/images/blocklist-build-scripts.yaml), [blocklist-build-scripts.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/images/blocklist-build-scripts.rego)) verifies that the image did not run blocklisted scripts on build.
-
-Edit the list of the blocklisted scripts in the `input.rego.args` parameter in file [blocklist-build-scripts.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/images/no-build-scripts.yaml):
-
-```yaml
-with:
- blocklist:
- - curl
-```
-
-#### Verify Image Lables/Annotations
-
-This rule ([verify-labels.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/images/verify-labels.yaml), [verify-labels.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/images/verify-labels.rego)) verifies that image has labels with required values.
-
-Edit the list of the required labels in the config object in file [verify-labels.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/images/verify-labels.yaml):
-
-```yaml
-with:
- labels:
- - label: "org.opencontainers.image.version"
- value: "22.04"
-```
-
-#### Fresh Image
-
-This rule ([fresh-image.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/images/fresh-image.yaml), [fresh-image.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/images/fresh-image.rego)) verifies that the image is not older than a given number of days.
-
-Edit the config `input.rego.args` parameter in file [fresh-image.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/images/fresh-image.yaml):
-
-```yaml
-with:
- max_days: 183
-```
-
-#### Forbid Large Images
-
-This rule ([forbid-large-images.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/images/forbid-large-images.yaml), [forbid-large-images.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/images/forbid-large-images.rego)) verifies that the image is not larger than a given size.
-
-Set max size in bytes in the `input.rego.args` parameter in file [forbid-large-images.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/images/forbid-large-images.yaml):
-
-```yaml
-with:
- max_size: 77808811
-```
-
-### Git
-
-An example of creating a Git evidence:
-
-```bash
-valint bom git:https://github.com/golang/go -o statement
-```
-
-To verify the evidence against the rule:
-
-```bash
-valint verify git:https://github.com/golang/go -i statement --rule git/rule_config@v1
-```
-
-#### Coding Permissions
-
-This rule ([coding-permissions.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/git/coding-permissions.yaml), [coding-permissions.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/git/coding-permissions.rego)) verifies that files from the specified list were modified by authorized users only.
-
-For This rule be able to run, the evidence must include a reference to the files that were modified in the commit. This can be done by adding parameter `--components commits,files` to the `valint bom` command.
-
-For specifying the list of files and identities, edit the `input.rego.args` parameter in file [coding-permissions.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/git/coding-permissions.yaml).
-This example for repository [Golang Build](https://github.com/golang/build) verifies that files `build.go` and `internal/https/README.md` were modified only by identities containing `@golang.com` and `@golang.org`:
-
-```yaml
-with:
- ids:
- - "@golang.com"
- - "@golang.org"
- files:
- - "a.txt"
- - "somedir/b.txt"
-```
-
-#### Forbid Unsigned Commits
-
-This rule ([no-unsigned-commits.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/git/no-unsigned-commits.yaml), [no-unsigned-commits.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/git/no-unsigned-commits.rego)) verifies that evidence has no unsigned commits. It does not verify the signatures though.
-
-#### Forbid Commits To Main
-
-This rule ([no-commit-to-main.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/git/no-commit-to-main.yaml), [no-commit-to-main.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/git/no-commit-to-main.rego)) verifies that evidence has no commits made to main branch.
-
-### SLSA
-
-Example of creating a SLSA statement:
-
-```bash
-valint slsa ubuntu:latest -o statement
-```
-
-Example of verifying a SLSA statement:
-
-```bash
-valint verify ubuntu:latest -i statement-slsa --rule slsa/rule_config@v1
-```
-
-#### Builder Name
-
-This rule ([verify-builder.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/verify-builder.yaml), [verify-builder.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/verify-builder.rego)) verifies that the builder name of the SLSA statement equals to a given value.
-
-Edit config `input.rego.args` parameter in file [verify-builder.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/verify-builder.yaml):
-
-```yaml
-with:
- id: "local"
-```
-
-#### Banned Builder Dependencies
-
-This rule ([banned-builder-deps.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/banned-builder-deps.yaml), [banned-builder-deps.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/banned-builder-deps.rego)) verifies that the builder used to build an artifact does not have banned dependencies (such as an old openSSL version).
-
-Edit config `input.rego.args` parameter in file [banned-builder-deps.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/banned-builder-deps.yaml):
-
-```yaml
-with:
- blocklist:
- - name: "valint"
- version: "0.0.0"
-```
-
-#### Build Time
-
-This rule ([build-time.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/build-time.yaml), [build-time.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/build-time.rego)) verifies that the build time of the SLSA statement is within a given time window The timezone is derived from the timestamp in the statement.
-
-Edit config `input.rego.args` parameter in file [build-time.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/build-time.yaml):
-
-```yaml
-with:
- start_hour: 8
- end_hour: 20
- workdays:
- - "Sunday"
- - "Monday"
- - "Tuesday"
- - "Wednesday"
- - "Thursday"
-```
-
-#### Produced Byproducts
-
-This rule ([verify-byproducts.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/verify-byproducts.yaml), [verify-byproducts.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/verify-byproducts.rego)) verifies that the SLSA statement contains all the required byproducts.
-According to the SLSA Provenance [documentation](https://slsa.dev/spec/v1.0/provenance), there are no mandatory fields in the description of a byproduct, but at least one of `uri, digest, content` should be specified.
-So, the rule checks if each byproduct specified in the configuration is present in one of those fields of any byproduct in the SLSA statement. It does so by calling the `contains` function, so the match is not exact.
-
-Before running the rule, specify desired byproducts in the `input.rego.args` parameter in file [verify-byproducts.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/verify-byproducts.yaml):
-
-```yaml
-with:
- byproducts:
- - 4693057ce2364720d39e57e85a5b8e0bd9ac3573716237736d6470ec5b7b7230
-```
-
-#### Verify That Field Exists
-
-This rule ([field-exists.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/field-exists.yaml), [field-exists.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/field-exists.rego)) verifies that the SLSA statement contains a field with the given path.
-
-Before running the rule, specify desired paths in the `input.rego.args` parameter in file [field-exists.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/field-exists.yaml):
-
-```yaml
-with:
- paths:
- - "predicate/runDetails/builder/builderDependencies"
- violations_threshold: 0
-```
-
-### Sarif Reports
-
-#### Generic SARIF Rule
-
-This rule ([verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-sarif.yaml), [verify-sarif.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-sarif.rego)) allows to verify any SARIF report against a given rule. The rule has several parameters to check against:
-
-* ruleLevel: the level of the rule, can be "error", "warning", "note", "none"
-* ruleIds: the list of the rule IDs to check against
-* precision: the precision of the check, can be "exact", "substring", "regex"
-* ignore: the list of the rule IDs to ignore
-* maxAllowed: the maximum number of violations allowed
-
-These values can be changed in the `input.rego.args` section in the [verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-sarif.yaml) file.
-
-##### Creating a BOM out of a SARIF report
-
-Create a trivy sarif report of the vulnerabilities of an image:
-
-```bash
-trivy image ubuntu:latest -f sarif -o ubuntu-cve.json
-```
-
-Create an evidence from this report:
-
-```bash
-valint evidence ubuntu-cve.json -o statement
-```
-
-Verify the attestation against the rule:
-
-```bash
-valint verify ubuntu-cve.json -i statement-generic --rule sarif/verify-sarif@v1
-```
-
-###### Running Trivy On Docker Container Rootfs
-
-As an alternative, one can run `trivy` against an existing Docker container rootfs:
-
-```bash
-docker run --rm -it alpine:3.11
-```
-
-Then, inside docker run:
-
-```bash
-curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
-trivy rootfs / -f sarif -o rootfs.json
-```
-
-Then, outside docker run this to copy the report from the container:
-
-```bash
-docker cp $(docker ps -lq):/rootfs.json .
-```
-
-After that create the evidence and verify it as described above.
-
-##### No Critical CVEs
-
-To verify that the SARIF report does not contain any critical CVEs, set the following parameters in the `rego.args` section in the[verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-sarif.yaml) file:
-
-```yaml
-with:
- rule_level:
- - critical
- precision: []
- rule_ids: []
- ignore: []
- max_allowed: 0
-```
-
-##### Limit High CVEs
-
-To verify that the SARIF report does not contain more than specified number of CVEs with high level (let's say 10), set the following parameters in the `rego.args` section in the[verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-sarif.yaml) file:
-
-```yaml
-with:
- rule_level: high,
- precision: []
- rule_ids: []
- ignore: []
- max_allowed: 10
-```
-
-##### Do Not Allow Specific CVEs
-
-To verify that the SARIF report does not contain certain CVEs (let's say CVE-2021-1234 and CVE-2021-5678), set the following parameters in the `rego.args` section in the[verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-sarif.yaml) file:
-
-```yaml
-with:
- rule_level:
- - "error"
- - "warning"
- - "note"
- - "none"
- precision: []
- rule_ids:
- - "CVE-2021-1234"
- - "CVE-2021-5678"
- ignore: []
- max_allowed: 0
-```
-
-##### No Static Analysis Errors
-
-To verify that the SARIF report does not contain any static analysis errors, set the following parameters in the `rego.args` section in the[verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-sarif.yaml) file:
-
-```yaml
-with:
- rule_level:
- - "error"
- precision: []
- rule_ids: []
- ignore: []
- max_allowed: 0
-```
-
-##### Limit Static Analysis Warnings
-
-To verify that the SARIF report does not contain more than specified number of static analysis warnings (let's say 10), set the following parameters in the `rego.args` section in the[verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-sarif.yaml) file:
-
-```yaml
-with:
- rule_level:
- - "warning"
- precision: []
- rule_ids: []
- ignore: []
- max_allowed: 10
-```
-
-##### Do Not Allow Specific Static Analysis Rules
-
-To verify that the SARIF report does not contain static analysis warnings from the following rules: "rule1", "rule2", "rule3", set the following parameters in the `rego.args` section in the[verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-sarif.yaml) file:
-
-```yaml
-with:
- rule_level:
- - "error"
- - "warning"
- - "note"
- - "none"
- precision: []
- rule_ids:
- - "rule1"
- - "rule2"
- - "rule3"
- ignore: []
- max_allowed: 0
-```
-
-##### Do Not Allow Vulnerabilities Based On Specific Attack Vector
-
-Trivy/grype reports usually contain descriptions for some CVEs, like impact and attack vector.
-This rule ([verify-attack-vector.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-attack-vector.yaml), [verify-attack-vector.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-attack-vector.rego)) is meant to restrict number of vulnerabilities with specific attack vectors.
-For example, to restrict vulnerabilities with attack vector "stack buffer overflow", set the following parameters in the `rego.args` section in the [verify-attack-vector.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-attack-vector.yaml) file:
-
-```yaml
-with:
- attack_vectors:
- - "stack buffer overflow"
- violations_threshold: 0
-```
-
-Then run the rule against the SARIF report as described above.
-
-#### Report IaC Configuration errors
-
-This rule ([report-iac-errors.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/report-iac-errors.yaml), [report-iac-errors.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/report-iac-errors.rego)) allows to verify a Trivy IaC report and check if there are any errors in the configuration.
-
-First, create a trivy report of the misconfigurations of a Dockerfile:
-
-```bash
-trivy config -f sarif -o my-image-dockerfile.json
-```
-
-Create an evidence from this report:
-
-```bash
-valint evidence my-image-dockerfile.json -o statement
-```
-
-Verify the attestation against the rule:
-
-```bash
-valint verify my-image-dockerfile.json -i statement-generic --rule sarif/report-iac-errors@v1
-```
-
-The only configurable parameter in [report-iac-errors.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/report-iac-errors.yaml) is `violations_threshold`, which is the maximum number of errors allowed in the report:
-
-```yaml
-with:
- violations_threshold: 0
-```
-
-#### Verify Semgrep SARIF report
-
-`semgrep`, a code analysis tool, can produce SARIF reports, which later can be verified by `valint` against a given rule.
-
-This rule ([verify-semgrep-report.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-semgrep-report.yaml), [verify-semgrep-report.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-semgrep-report.rego)) allows to verify that given SARIF report does not contain specific rules violations.
-
-First, one needs to create a semgrep report (say, for the `openvpn` repo):
-
-```bash
-cd openvpn/
-semgrep scan --config auto -o semgrep-report.sarif --sarif
-```
-
-Then, create an evidence from this report:
-
-```bash
-valint evidence semgrep-report.sarif -o statement
-```
-
-Configuration of This rule is done in the file [verify-semgrep-report.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-semgrep-report.yaml). In this example we forbid any violations of the `use-after-free` rule:
-
-```yaml
-with:
- rule_ids:
- - "use-after-free"
- violations_threshold: 0
-```
-
-Then, run `valint verify` as usual:
-
-```bash
-valint verify semgrep-report.sarif -i statement-generic --rule sarif/verify-semgrep-report@v1
-```
-
-If any violations found, the output will contain their description, including the violated rule and the file where the violation was found.
-
-#### Verify Tool Evidence
-
-This rule ([verify-tool-evidence.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-tool-evidence.yaml)) allows to verify the existence of an evidence of SARIF report created by a specified tool. By default, the rule checks for an evidence created out of *any* SARIF report. To specify a tool, use the `tool` parameter in the `evidence` section of the rule configuration. For example, to verify that there is an evidence of a SARIF report created by `trivy`, use the following configuration:
-
-```yaml
-uses: sarif/verify-tool-evidence@v1
-evidence:
- tool: "Trivy Vulnerability Scanner"
-```
-
-### Forbid Accessing Host
-
-Trivy k8s analysis can highlight some misconfigurations which allow container to access host filesystem or network. The goal of This rule is to detect such misconfigurations.
-
-To run this rule one has to create a Trivy k8s report and create a generic statement with `valint` from it. Then, simply verify the statement against this rule. No additional configuration required.
-
-## Writing Rule Files
-
-Rego policy rules can be written either as snippets in the yaml file, or as separate rego files.
-
-An example of such a rego script is given in the [verify-sarif.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-sarif.rego) file, that is consumed by the [verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-sarif.yaml) configuraion. To evaluate the rule, run
-
-```bash
-valint verify ubuntu-cve.json -i statement-generic --rule sarif/verify-sarif@v1
-```
diff --git a/docs/integrating-scribe/admission-controller/gatekeeper-provider.md b/docs/integrating-scribe/admission-controller/gatekeeper-provider.md
index 414f57c81..03f1885fb 100644
--- a/docs/integrating-scribe/admission-controller/gatekeeper-provider.md
+++ b/docs/integrating-scribe/admission-controller/gatekeeper-provider.md
@@ -212,7 +212,7 @@ select:
name: require_signed_images
rules:
- name: error_on_unsigned_image
- uses: sbom/artifact-signed@v1
+ uses: sbom/artifact-signed@v2
level: error
```
@@ -364,7 +364,7 @@ select:
name: cluster-policy
rules:
- name: fresh-image
- uses: images/fresh-image@v1
+ uses: images/fresh-image@v2
level: warning
with:
max_days: 356
@@ -390,7 +390,7 @@ select:
name: cluster-policy
rules:
- name: fresh-image
- uses: images/fresh-image@v1
+ uses: images/fresh-image@v2
level: warning
with:
max_days: 356
@@ -415,7 +415,7 @@ select:
name: pipeline-scanners
rules:
- name: check-vulnerabilities
- uses: sarif/verify-sarif@v1
+ uses: sarif/verify-sarif@v2
evidence:
tool: "Trivy Vulnerability Scanner"
with:
@@ -464,7 +464,7 @@ select:
name: pipeline-scanners
rules:
- name: check-vulnerabilities
- uses: sarif/verify-sarif@v1
+ uses: sarif/verify-sarif@v2
evidence:
tool: "Trivy Vulnerability Scanner"
with:
@@ -535,7 +535,7 @@ select:
name: default-provider-policy
rules:
- name: warn_on_unsigned_image
- uses: sbom/artifact-signed@v1
+ uses: sbom/artifact-signed@v2
level: "warning"
```
@@ -699,7 +699,7 @@ select:
name: require_signed_images
rules:
- name: error_on_unsigned_image
- uses: sbom/artifact-signed@v1
+ uses: sbom/artifact-signed@v2
level: error
```
diff --git a/docs/integrating-scribe/admission-controller/kyverno.md b/docs/integrating-scribe/admission-controller/kyverno.md
index 6bac4c945..000ea3a44 100644
--- a/docs/integrating-scribe/admission-controller/kyverno.md
+++ b/docs/integrating-scribe/admission-controller/kyverno.md
@@ -28,10 +28,10 @@ valint [bom,slsa] image -o attest --oci [--oci-repo repo]
#### **Example**
```bash
-valint my_account/my_image:latest -o attest --oci --oci-repo my_account/evidence --provenance
+valint [bom, slsa, verify] [image] -o attest --oci --oci-repo my_account/evidence --provenance
```
-This command generates both SBOM and SLSA provenance and attaches them to the OCI store.
+This command generates both SBOM and SLSA provenance or Policy Results and attaches them to the image on the OCI store.
---
@@ -44,6 +44,8 @@ Use Valint to verify attestations or validate them against specific Kyverno poli
valint verify [image] -i [attest, attest-slsa] --oci [--oci-repo evidence_repo]
```
+
+
## Step 3 **Setting Kyverno `verifyImages` Rules**
For detailed guidance on setting up Kyverno to verify image signatures, refer to the official **[Kyverno Verify Images documentation](https://kyverno.io/docs/writing-policies/verify-images/sigstore/#verifying-image-signatures)**.
@@ -84,6 +86,7 @@ spec:
url: https://rekor.sigstore.dev
```
+
### **X509 Key-Based Verification**
Generate SLSA and Cyclonedx attestations signed with X509 certificates using the following command:
@@ -226,3 +229,69 @@ X509v3 extensions:
...
```
+### Verifying Policy Initiative Results
+
+When Valint produces SARIF attestations, you may want to **enforce** that a specific **initiative** or **control** has passed before the image can run. For instance, you might block images unless their **`initiative-id`** is `"SP-800-190"` and **`initiative-result`** is `"pass"`, or you might need a particular control ID—like `"SP-800-190/4.1"`—to pass.
+
+Below is an example **Kyverno** policy snippet showing how to reference these fields under `conditions` in the `verifyImages` rule. **Uncomment or edit** the checks that meet your needs:
+
+```yaml
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+ name: check-image-keyless-evidence
+spec:
+ validationFailureAction: Enforce
+ webhookTimeoutSeconds: 30
+ rules:
+ - name: check-evidence
+ match:
+ any:
+ - resources:
+ kinds:
+ - Pod
+ verifyImages:
+ - imageReferences:
+ - "my_account/my_image*"
+ repository: "my_account/evidence/container"
+ attestations:
+ - predicateType: "http://docs.oasis-open.org/sarif/sarif/2.1.0"
+ attestors:
+ - entries:
+ - keyless:
+ subject: "mdstrauss91@gmail.com"
+ issuer: "https://github.com/login/oauth"
+ rekor:
+ url: "https://rekor.sigstore.dev"
+ conditions:
+ - all:
+ # Uncomment the checks you wish to enforce:
+
+ # 1) Ensure the initiative result is "pass":
+ - key: "{{ content.runs[0].invocations[0].properties.\"initiative-result\" }}"
+ operator: Equals
+ value: "pass"
+
+ # 2) Verify the initiative ID is "SP-800-190":
+ - key: "{{ content.runs[0].invocations[0].properties.\"initiative-id\" }}"
+ operator: Equals
+ value: "SP-800-190"
+
+ # 3) Confirm a specific control ID—"SP-800-190/4.1"—passed:
+ - key: "{{ content.runs[0].invocations[0].properties.\"control-result\".\"control-id:SP-800-190/4.1\" }}"
+ operator: Equals
+ value: "pass"
+```
+
+To generate and evaluate evidence for `sp-800-190` in this example, run:
+
+```bash
+trivy image --format sarif -o my_image_trivy_report.sarif my_account/my_image:latest
+
+valint verify my_account/my_image:latest \
+ --bom \ # Required for container-targeted rules
+ --input my_image_trivy_report.sarif \ # Required for CVE rules
+ --oci --oci-repo my_account/evidence/container \
+ --initiative sp-800-190@v2 \
+ -o attest
+```
\ No newline at end of file
diff --git a/docs/integrating-scribe/ci-integrations/azure.md b/docs/integrating-scribe/ci-integrations/azure.md
index 5e13c4ee9..d92d186c7 100644
--- a/docs/integrating-scribe/ci-integrations/azure.md
+++ b/docs/integrating-scribe/ci-integrations/azure.md
@@ -45,8 +45,8 @@ In your Azure DevOps project make sure you have a file named `azure-pipelines.ym
vmImage: 'ubuntu-latest'
steps:
- - task: ScribeInstall@0
- - task: ValintCli@0
+ - task: ScribeInstall@2
+ - task: ValintCli@2
displayName: SBOM image `busybox:latest`.
command: bom
target: nginx
@@ -62,7 +62,7 @@ In your Azure DevOps project make sure you have a file named `azure-pipelines.ym
Generate an SBOM for an image in a public registry
```YAML
-- task: ValintCli@0
+- task: ValintCli@2
displayName: Generate cyclonedx json SBOM
inputs:
commandName: bom
@@ -104,9 +104,9 @@ jobs:
SUPPLIER_PHONE: 001-001-0011
steps:
- - task: scribeInstall@0
+ - task: ScribeInstall@2
- - task: ValintCli@0
+ - task: ValintCli@2
inputs:
command: bom
target: nginx
@@ -122,7 +122,7 @@ jobs:
supplier-email: $(SUPPLIER_EMAIL)
supplier-phone: $(SUPPLIER_PHONE)
- - task: ValintCli@0
+ - task: ValintCli@2
inputs:
command: verify
target: nginx
@@ -138,7 +138,7 @@ jobs:
Generate SLSA provenance for an image in a public registry
```YAML
-- task: ValintCli@0
+- task: ValintCli@2
displayName: Generate SLSA provenance
inputs:
commandName: slsa
@@ -154,7 +154,7 @@ jobs:
Generate an SBOM for for an image built with local docker
```YAML
-- task: ValintCli@0
+- task: ValintCli@2
displayName: Generate cyclonedx json SBOM
inputs:
commandName: bom
@@ -169,7 +169,7 @@ jobs:
Generate SLSA provenance for for an image built with local docker
```YAML
-- task: ValintCli@0
+- task: ValintCli@2
displayName: Generate SLSA provenance
inputs:
commandName: slsa
@@ -186,7 +186,7 @@ jobs:
> Add a `docker login` task before the adding the following task:
```YAML
-- task: ValintCli@0
+- task: ValintCli@2
displayName: Generate cyclonedx json SBOM
inputs:
commandName: bom
@@ -203,7 +203,7 @@ jobs:
> Before the following task add a `docker login` task
```YAML
-- task: ValintCli@0
+- task: ValintCli@2
displayName: Generate SLSA provenance
inputs:
commandName: slsa
@@ -229,7 +229,7 @@ jobs:
vmImage: 'ubuntu-latest'
steps:
- - task: ValintCli@0
+ - task: ValintCli@2
displayName: Generate cyclonedx json SBOM - add metadata - labels, envs, name
inputs:
commandName: bom
@@ -256,7 +256,7 @@ jobs:
vmImage: 'ubuntu-latest'
steps:
- - task: ValintCli@0
+ - task: ValintCli@2
displayName: Generate cyclonedx json SBOM - add metadata - labels, envs, name
inputs:
commandName: slsa
@@ -275,7 +275,7 @@ jobs:
> Use `format` input argumnet to set the format.
```YAML
-- task: ValintCli@0
+- task: ValintCli@2
displayName: SBOM image `busybox:latest`.
inputs:
command: bom
@@ -301,7 +301,7 @@ jobs:
> Use `format` input argumnet to set the format.
```YAML
-- task: ValintCli@0
+- task: ValintCli@2
displayName: SLSA image `busybox:latest`.
inputs:
command: slsa
@@ -329,7 +329,7 @@ jobs:
mkdir testdir
echo "test" > testdir/test.txt
-- task: ValintCli@0
+- task: ValintCli@2
displayName: SBOM local directory.
inputs:
command: bom
@@ -348,7 +348,7 @@ jobs:
mkdir testdir
echo "test" > testdir/test.txt
-- task: ValintCli@0
+- task: ValintCli@2
displayName: SLSA local directory.
inputs:
command: slsa
@@ -366,7 +366,7 @@ jobs:
For a remote git repo:
```YAML
-- task: ValintCli@0
+- task: ValintCli@2
displayName: SBOM remote git repository.
inputs:
command: bom
@@ -381,7 +381,7 @@ For a local git repo:
```YAML
- checkout: self
-- task: ValintCli@0
+- task: ValintCli@2
displayName: SBOM local git repository.
inputs:
command: bom
@@ -396,7 +396,7 @@ For a local git repo:
For a remote git repo:
```YAML
-- task: ValintCli@0
+- task: ValintCli@2
displayName: SBOM remote git repository.
inputs:
command: slsa
@@ -410,7 +410,7 @@ For a remote git repo:
```YAML
- checkout: self
-- task: ValintCli@0
+- task: ValintCli@2
displayName: SLSA local git repository.
inputs:
command: slsa
@@ -441,9 +441,9 @@ Related flags:
steps:
- script: echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin [my_registry]
- - task: scribeInstall@0
+ - task: ScribeInstall@2
- - task: ValintCli@0
+ - task: ValintCli@2
inputs:
commandName: bom
target: [target]
@@ -452,7 +452,7 @@ Related flags:
oci: true
ociRepo: [oci_repo]
- - task: ValintCli@0
+ - task: ValintCli@2
inputs:
commandName: verify
target: [target]
@@ -471,7 +471,7 @@ Related flags:
Create SBOM for remote `busybox:latest` image.
```YAML
-- task: ValintCli@0
+- task: ValintCli@2
displayName: Generate cyclonedx json SBOM
inputs:
commandName: bom
@@ -517,9 +517,9 @@ For example, using `docker login` command.
steps:
- script: echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin [my_registry]
- - task: scribeInstall@0
+ - task: ScribeInstall@2
- - task: ValintCli@0
+ - task: ValintCli@2
inputs:
commandName: bom
target: [target]
@@ -528,7 +528,7 @@ For example, using `docker login` command.
oci: true
ociRepo: [oci_repo]
- - task: ValintCli@0
+ - task: ValintCli@2
inputs:
commandName: verify
target: [target]
diff --git a/docs/integrating-scribe/ci-integrations/bitbucket.md b/docs/integrating-scribe/ci-integrations/bitbucket.md
index 27bbde689..00288f358 100644
--- a/docs/integrating-scribe/ci-integrations/bitbucket.md
+++ b/docs/integrating-scribe/ci-integrations/bitbucket.md
@@ -10,10 +10,13 @@ Use the following instructions to integrate your Bitbucket with Scribe.
Add the following snippet to the script section of your `bitbucket-pipelines.yml` file:
```yaml
-- pipe: scribe-security/valint-pipe:1.1.0
+- pipe: scribe-security/valint-pipe:2.0.0
variables:
COMMAND_NAME: ""
TARGET: ""
+ # INITIATIVE: ""
+ # INITIATIVE_ID: ""
+ # INITIATIVE_NAME: ""
# VERBOSE: '' # Optional
# CONFIG:'' # Optional
# FORMAT: '' # Optional
@@ -71,6 +74,8 @@ Add the following snippet to the script section of your `bitbucket-pipelines.yml
# SCRIBE_URL: '' # Optional
# STRUCTURED: '' # Optional
# TIMEOUT: '' # Optional
+ # BOM: '' # Optional
+ # PROVENANCE: '' # Optional
```
### Required Variables
@@ -116,7 +121,6 @@ Flags for all `valint` subcommands
| OUTPUT_FILE | Output file name | |
| PIPELINE_NAME | Pipeline name | |
| PLATFORM | Select target platform, examples=windows/armv6, arm64 ..) | |
-| POLICY_ARGS | Policy arguments | [] |
| PREDICATE_TYPE | Custom Predicate type (generic evidence format) | "http://scribesecurity.com/evidence/generic/v0.1" | any |
| PRODUCT_KEY | Product Key | |
| PRODUCT_VERSION | Product Version | |
@@ -190,36 +194,95 @@ if `COMMAND` is set to `evidence`:
| TOOL_VENDOR | Tool vendor | |
| TOOL_VERSION | Tool version | |
| (*) = required variable. | | |
+Ah, I see! You want to include the **initiative flags** (e.g., `INITIATIVE`, `INITIATIVE_ID`, `INITIATIVE_NAME`) in the **Verify Command Variables** section. Here's the updated table with the initiative flags included:
+
+---
### Verify Command Variables
-if `COMMAND` is set to `verify`:
+If `COMMAND` is set to `verify`:
+
+| Variable | Usage | Default |
+| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- |
+| `ATTESTATION` | Attestation for target | Required |
+| `BUNDLE` | Policy bundle URI/path (early-availability) | `https://github.com/scribe-public/sample-policies` |
+| `COMMON_NAME` | Default policy allowed common names | Optional |
+| `EMAIL` | Default policy allowed emails | Optional |
+| `FORCE` | Force skip cache | Optional |
+| `HELP` | Show help message | Optional |
+| `INPUT_FORMAT` | Evidence format, options: `[attest-cyclonedx-json, attest-slsa, statement-slsa, statement-cyclonedx-json, statement-generic, attest-generic]` | `attest-cyclonedx-json` |
+| `RULE` | Rule configuration file path (early-availability) | Optional |
+| `SKIP_BUNDLE` | Skip bundle download | Optional |
+| `SKIP_REPORT` | Skip policy report stage | Optional |
+| `URI` | Default policy allowed URIs | Optional |
+| `INITIATIVE` | Initiative name (optional) | Optional |
+| `INITIATIVE_ID` | Initiative ID (optional) | Optional |
+| `INITIATIVE_NAME` | Full name of the initiative (optional) | Optional |
-| Variable | Usage | Default |
-| -------------- | -------------------------------------------------------------- | --- |
-| ATTESTATION | Attestation for target | |
-| BUNDLE | Policy bundle uri/path (early-availability) | "https://github.com/scribe-public/sample-policies" |
-| COMMON_NAME | Default policy allowed common names | |
-| EMAIL | Default policy allowed emails | |
-| FORCE | Force skip cache | |
-| HELP | Show help message | |
-| INPUT_FORMAT | Evidence format, options=[attest-cyclonedx-json attest-slsa statement-slsa statement-cyclonedx-json statement-generic attest-generic] | "attest-cyclonedx-json" |
-| RULE | Rule configuration file path (early-availability) | |
-| SKIP_BUNDLE | Skip bundle download | |
-| SKIP_REPORT | Skip Policy report stage | |
-| URI | Default policy allowed uris | |
+---
-### Usage
+# Example: Enforcing SP 800-190 Controls with Valint Initiatives
+
+This workflow demonstrates how to leverage Valint’s initiative engine to automatically generate evidence (SBOM and vulnerability reports), submit it to Valint, and enforce SP 800-190 controls on your container image.
```yaml
- - pipe: scribe-security/valint-pipe:1.1.0
- variables:
- COMMAND_NAME: bom
- TARGET: busybox:latest
- VERBOSE: 2
- FORCE: "true"
+pipelines:
+ pull-requests:
+ '**':
+ - step:
+ name: Build Docker image
+ image: docker:stable-git
+ services:
+ - docker
+ caches:
+ - docker
+ script:
+ # Build the image tagged with the commit SHA
+ - docker build -t my_image:latest -f Dockerfile .
+
+ - step:
+ name: Scan image with Trivy
+ image: docker:stable-git
+ services:
+ - docker
+ caches:
+ - docker
+ script:
+ # Install Trivy CLI
+ - curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \
+ | sh -s -- -b /usr/local/bin
+ # Scan and emit SARIF
+ - trivy image \
+ --format sarif \
+ --output trivy-report.sarif \
+ --exit-code 0 \
+ --ignore-unfixed \
+ --severity CRITICAL,HIGH \
+ my_image:latest
+
+ - step:
+ name: Collect Evidence & Evaluate SP 800-190 Initiative
+ image: docker:stable-git
+ services:
+ - docker
+ script:
+ - pipe: scribe-security/valint-pipe:2.0.0
+ variables:
+ COMMAND_NAME: "verify"
+ INITIATIVE: "sp-800-190@v2"
+ TARGET: "my_image:latest"
+ BOM: "true" # auto-generate SBOM
+ BASE_IMAGE: "Dockerfile" # include base-image evidence
+ INPUT: "sarif:trivy-report.sarif" # vulnerability evidence
+ INPUT_FORMAT: "attest" # treat SARIF as attest
+ BEAUTIFY: "true"
+
```
+
+> **Note:** Enabling `BOM`, `provenance` `PROVENANCE`, or `INPUT` flags ensures Valint generates and ingests the necessary evidence before policy evaluation.
+
+
# Scribe integration
### 1. Obtain a Scribe Hub API Token
@@ -247,7 +310,7 @@ Add the Scribe Hub API token as `SCRIBE_TOKEN` by following the [Bitbucket instr
Generate an SBOM for an image in a public registry
```yaml
-- pipe: scribe-security/valint-pipe:1.1.0
+- pipe: scribe-security/valint-pipe:2.0.0
variables:
COMMAND: bom
TARGET: busybox:latest
@@ -258,7 +321,7 @@ Add the Scribe Hub API token as `SCRIBE_TOKEN` by following the [Bitbucket instr
Generate SLSA provenance for an image in a public registry
```yaml
-- pipe: scribe-security/valint-pipe:1.1.0
+- pipe: scribe-security/valint-pipe:2.0.0
variables:
COMMAND: slsa
TARGET: busybox:latest
@@ -269,7 +332,7 @@ Add the Scribe Hub API token as `SCRIBE_TOKEN` by following the [Bitbucket instr
Generate evidence from a third party tool output
```yaml
-- pipe: scribe-security/valint-pipe:1.1.0
+- pipe: scribe-security/valint-pipe:2.0.0
variables:
COMMAND: evidence
TARGET: some_security_report.json
@@ -280,7 +343,7 @@ Add the Scribe Hub API token as `SCRIBE_TOKEN` by following the [Bitbucket instr
Generate an SBOM for an image built with local docker
```yaml
-- pipe: scribe-security/valint-pipe:1.1.0
+- pipe: scribe-security/valint-pipe:2.0.0
variables:
COMMAND: bom
TARGET: image_name:latest
@@ -292,7 +355,7 @@ Add the Scribe Hub API token as `SCRIBE_TOKEN` by following the [Bitbucket instr
Generate SLSA provenance for an image built with local docker
```yaml
-- pipe: scribe-security/valint-pipe:1.1.0
+- pipe: scribe-security/valint-pipe:2.0.0
variables:
COMMAND: slsa
TARGET: image_name:latest
@@ -305,7 +368,7 @@ Add the Scribe Hub API token as `SCRIBE_TOKEN` by following the [Bitbucket instr
> Add a `docker login` task before adding the following task:
```yaml
-- pipe: scribe-security/valint-pipe:1.1.0
+- pipe: scribe-security/valint-pipe:2.0.0
variables:
COMMAND: bom
TARGET: scribesecurity/example:latest
@@ -318,7 +381,7 @@ Add the Scribe Hub API token as `SCRIBE_TOKEN` by following the [Bitbucket instr
> Add a `docker login` task before adding the following task:
```yaml
-- pipe: scribe-security/valint-pipe:1.1.0
+- pipe: scribe-security/valint-pipe:2.0.0
variables:
COMMAND: slsa
TARGET: scribesecurity/example:latest
@@ -413,7 +476,7 @@ step:
script:
- mkdir testdir
- echo "test" > testdir/test.txt
- - pipe: scribe-security/valint-pipe:1.1.0
+ - pipe: scribe-security/valint-pipe:2.0.0
variables:
COMMAND: bom
TARGET: dir:./testdir
@@ -429,7 +492,7 @@ step:
script:
- mkdir testdir
- echo "test" > testdir/test.txt
- - pipe: scribe-security/valint-pipe:1.1.0
+ - pipe: scribe-security/valint-pipe:2.0.0
variables:
COMMAND: slsa
TARGET: dir:./testdir
@@ -529,7 +592,7 @@ pipelines:
name: scribe-bitbucket-oci-pipeline
script:
- docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD [my_registry]
- - pipe: scribe-security/valint-pipe:1.1.0
+ - pipe: scribe-security/valint-pipe:2.0.0
variables:
COMMAND_NAME: [bom,slsa,evidence]
TARGET: [target]
@@ -537,7 +600,7 @@ pipelines:
OCI: true
OCI_REPO: [oci_repo]
- - pipe: scribe-security/valint-pipe:1.1.0
+ - pipe: scribe-security/valint-pipe:2.0.0
variables:
COMMAND_NAME: verify
TARGET: [target]
diff --git a/docs/integrating-scribe/ci-integrations/github/action-bom.md b/docs/integrating-scribe/ci-integrations/github/action-bom.md
index d23169dc7..2db76b1eb 100644
--- a/docs/integrating-scribe/ci-integrations/github/action-bom.md
+++ b/docs/integrating-scribe/ci-integrations/github/action-bom.md
@@ -89,11 +89,11 @@ To overcome the limitation install tool directly - **[installer](https://github.
oci-repo:
description: Select OCI custom attestation repo
package-exclude-type:
- description: Exclude package type, options=[ruby python javascript java dpkg apk rpm go dotnet r rust binary sbom nix conan alpm cocoapods swift dart elixir php erlang github portage haskell kernel wordpress lua]
+ description: Exclude package type, options=[ruby python javascript java dpkg apk rpm go dotnet r rust binary sbom nix conan alpm cocoapods swift dart elixir php erlang github portage haskell kernel wordpress lua bitnami terraform]
package-group:
description: Select package group, options=[index install all]
package-type:
- description: Select package type, options=[ruby python javascript java dpkg apk rpm go dotnet r rust binary sbom nix conan alpm cocoapods swift dart elixir php erlang github portage haskell kernel wordpress lua]
+ description: Select package type, options=[ruby python javascript java dpkg apk rpm go dotnet r rust binary sbom nix conan alpm cocoapods swift dart elixir php erlang github portage haskell kernel wordpress lua bitnami terraform]
pass:
description: Private key password
payload:
@@ -104,6 +104,8 @@ To overcome the limitation install tool directly - **[installer](https://github.
description: Include SLSA Provenance evidence
pubkey:
description: Public key path
+ skip-confirmation:
+ description: Skip Sigstore Confirmation
supplier-email:
description: Set supplier email
supplier-name:
@@ -120,8 +122,10 @@ To overcome the limitation install tool directly - **[installer](https://github.
description: Mark as deliverable, options=[true, false]
env:
description: Environment keys to include in evidence
- gate:
+ gate-name:
description: Policy Gate name
+ gate-type:
+ description: Policy Gate type
input:
description: Input Evidence target, format (\:\ or \:\:\)
label:
@@ -173,7 +177,7 @@ To overcome the limitation install tool directly - **[installer](https://github.
Containerized action can be used on Linux runners as following
```yaml
- name: Generate cyclonedx json SBOM
- uses: scribe-security/action-bom@v1.5.19
+ uses: scribe-security/action-bom@v2.0.0
with:
target: 'busybox:latest'
```
@@ -181,7 +185,7 @@ Containerized action can be used on Linux runners as following
Composite Action can be used on Linux or Windows runners as following
```yaml
- name: Generate cyclonedx json SBOM
- uses: scribe-security/action-bom-cli@v1.5.19
+ uses: scribe-security/action-bom-cli@v2.0.0
with:
target: 'hello-world:latest'
```
diff --git a/docs/integrating-scribe/ci-integrations/github/action-evidence.md b/docs/integrating-scribe/ci-integrations/github/action-evidence.md
index cfe6da83f..5ec62566d 100644
--- a/docs/integrating-scribe/ci-integrations/github/action-evidence.md
+++ b/docs/integrating-scribe/ci-integrations/github/action-evidence.md
@@ -71,6 +71,8 @@ The `valint evidence` action is a versatile action designed to include various t
description: Private key password
pubkey:
description: Public key path
+ skip-confirmation:
+ description: Skip Sigstore Confirmation
tool:
description: Evidence Tool name
tool-vendor:
@@ -85,8 +87,10 @@ The `valint evidence` action is a versatile action designed to include various t
description: Mark as deliverable, options=[true, false]
env:
description: Environment keys to include in evidence
- gate:
+ gate-name:
description: Policy Gate name
+ gate-type:
+ description: Policy Gate type
input:
description: Input Evidence target, format (\:\ or \:\:\)
label:
@@ -138,7 +142,7 @@ The `valint evidence` action is a versatile action designed to include various t
Containerized action can be used on Linux runners as following
```yaml
- name: Include evidence derived from a file
- uses: scribe-security/action-evidence@v1.5.19
+ uses: scribe-security/action-evidence@v2.0.0
with:
target: some_file.json
```
@@ -146,7 +150,7 @@ Containerized action can be used on Linux runners as following
Composite Action can be used on Linux or Windows runners as following
```yaml
- name: Include evidence derived from a file
- uses: scribe-security/action-evidence-cli@v1.5.19
+ uses: scribe-security/action-evidence-cli@v2.0.0
with:
target: some_file.json
```
diff --git a/docs/integrating-scribe/ci-integrations/github/action-slsa.md b/docs/integrating-scribe/ci-integrations/github/action-slsa.md
index d6d392b0e..b5dbe3eb1 100644
--- a/docs/integrating-scribe/ci-integrations/github/action-slsa.md
+++ b/docs/integrating-scribe/ci-integrations/github/action-slsa.md
@@ -92,6 +92,8 @@ To overcome the limitation install tool directly - [installer](https://github.co
description: Import predicate path
pubkey:
description: Public key path
+ skip-confirmation:
+ description: Skip Sigstore Confirmation
started-on:
description: Set metadata started time (YYYY-MM-DDThh:mm:ssZ)
statement:
@@ -104,8 +106,10 @@ To overcome the limitation install tool directly - [installer](https://github.co
description: Mark as deliverable, options=[true, false]
env:
description: Environment keys to include in evidence
- gate:
+ gate-name:
description: Policy Gate name
+ gate-type:
+ description: Policy Gate type
input:
description: Input Evidence target, format (\:\ or \:\:\)
label:
@@ -157,7 +161,7 @@ To overcome the limitation install tool directly - [installer](https://github.co
Containerized action can be used on Linux runners as following
```yaml
- name: Generate SLSA provenance
- uses: scribe-security/action-slsa@v1.5.19
+ uses: scribe-security/action-slsa@v2.0.0
with:
target: 'busybox:latest'
```
@@ -165,7 +169,7 @@ Containerized action can be used on Linux runners as following
Composite Action can be used on Linux or Windows runners as following
```yaml
- name: Generate cyclonedx json SBOM
- uses: scribe-security/action-slsa-cli@v1.5.19
+ uses: scribe-security/action-slsa-cli@v2.0.0
with:
target: 'hello-world:latest'
```
diff --git a/docs/integrating-scribe/ci-integrations/github/action-verify.md b/docs/integrating-scribe/ci-integrations/github/action-verify.md
index badbaca5e..17e97014d 100644
--- a/docs/integrating-scribe/ci-integrations/github/action-verify.md
+++ b/docs/integrating-scribe/ci-integrations/github/action-verify.md
@@ -25,6 +25,8 @@ The command allows users to verify any target against its evidence.
target:
description: Target object name format=[, , ] (Optional)
required: true
+ all-evidence:
+ description: Run all evidence verification
attest-config:
description: Attestation config path
attest-default:
@@ -33,6 +35,8 @@ The command allows users to verify any target against its evidence.
description: Attestation for target
base-image:
description: Base image for the target
+ beautify:
+ description: Enhance the output using ANSI and Unicode characters
bom:
description: Create target SBOM evidence
bundle:
@@ -76,13 +80,19 @@ The command allows users to verify any target against its evidence.
git-tag:
description: Git tag in the repository
initiative:
- description: Run only rules with specified initiative
+ description: Initiative configuration file path (early-availability)
+ initiative-id:
+ description: Initiative id
+ initiative-name:
+ description: Initiative name
input-format:
description: Input Evidence format, options=[attest-cyclonedx-json attest-slsa statement-slsa statement-cyclonedx-json statement-generic attest-generic ]
key:
description: x509 Private key path
kms:
description: Provide KMS key reference
+ md:
+ description: Output Initiative result markdown report file
oci:
description: Enable OCI store
oci-repo:
@@ -93,8 +103,6 @@ The command allows users to verify any target against its evidence.
description: path of the decoded payload
platform:
description: Select target platform, examples=windows/armv6, arm64 ..)
- policy:
- description: Policy configuration file path (early-availability)
provenance:
description: Create target SLSA Provenance evidence
pubkey:
@@ -109,6 +117,8 @@ The command allows users to verify any target against its evidence.
description: Run only rules with specified label
skip-bundle:
description: Skip bundle download
+ skip-confirmation:
+ description: Skip Sigstore Confirmation
skip-report:
description: Skip Policy report stage
uri:
@@ -121,8 +131,10 @@ The command allows users to verify any target against its evidence.
description: Mark as deliverable, options=[true, false]
env:
description: Environment keys to include in evidence
- gate:
+ gate-name:
description: Policy Gate name
+ gate-type:
+ description: Policy Gate type
input:
description: Input Evidence target, format (\:\ or \:\:\)
label:
@@ -162,6 +174,7 @@ The command allows users to verify any target against its evidence.
description: Timeout duration
verbose:
description: Log verbosity level [-v,--verbose=1] = info, [-vv,--verbose=2] = debug
+
```
### Usage
@@ -169,7 +182,7 @@ Containerized action can be used on Linux runners as following
```yaml
- name: valint verify
id: valint_verify
- uses: scribe-security/action-verify@v1.5.19
+ uses: scribe-security/action-verify@v2.0.0
with:
target: 'busybox:latest'
```
@@ -177,7 +190,7 @@ Containerized action can be used on Linux runners as following
Composite Action can be used on Linux or Windows runners as following
```yaml
- name: Generate cyclonedx json SBOM
- uses: scribe-security/action-verify-cli@v1.5.19
+ uses: scribe-security/action-verify-cli@v2.0.0
with:
target: 'hello-world:latest'
```
@@ -230,6 +243,60 @@ jobs:
scribe-client-secret: ${{ secrets.SCRIBE_TOKEN }}
```
+#### Example: Enforcing SP 800-190 Controls with Valint Initiatives
+
+This workflow demonstrates how to leverage Valint’s initiative engine to automatically generate evidence (SBOM and vulnerability reports), submit it to Valint, and enforce SP 800-190 controls on your container image.
+
+```yaml
+name: sp-800-190-policy-check
+
+on:
+ pull_request:
+
+jobs:
+ image-policy-check:
+ runs-on: ubuntu-latest
+
+ steps:
+ - name: Checkout code
+ uses: actions/checkout@v4
+
+ - name: Build Docker image
+ uses: docker/build-push-action@v2
+ with:
+ context: .
+ file: Dockerfile
+ push: false
+ tags: |
+ ${{ github.sha }}
+
+ - name: Scan image with Trivy
+ uses: aquasecurity/trivy-action@0.28.0
+ continue-on-error: true
+ with:
+ image-ref: ${{ github.sha }}
+ format: sarif
+ output: trivy-report.sarif
+ vuln-type: os,library
+ severity: CRITICAL,HIGH
+ ignore-unfixed: true
+ exit-code: 0
+
+ - name: Collect Evidence & Evaluate SP 800-190 Initiative
+ uses: scribe-security/action-verify@main
+ with:
+ initiative: sp-800-190@v2
+ target: ${{ github.sha }}
+ bom: true # Generate CycloneDX SBOM
+ base-image: Dockerfile # Include base image in SBOM
+ input: sarif:trivy-report.sarif
+ input-format: attest
+ beautify: true
+```
+
+> **Note:** Enabling `bom`, `provenance`, or `input` flags ensures Valint generates and ingests the necessary evidence before policy evaluation.
+
+
### Configuration
If you prefer using a custom configuration file instead of specifying arguments directly, you have two choices. You can either place the configuration file in the default path, which is `.valint.yaml`, or you can specify a custom path using the `config` argument.
diff --git a/docs/integrating-scribe/ci-integrations/gitlabci.md b/docs/integrating-scribe/ci-integrations/gitlabci.md
index 3da866867..073b70923 100644
--- a/docs/integrating-scribe/ci-integrations/gitlabci.md
+++ b/docs/integrating-scribe/ci-integrations/gitlabci.md
@@ -63,6 +63,41 @@ scribe-gitlab-job:
-P $SCRIBE_TOKEN
```
+#### Example: Enforcing SP 800-190 Controls with Valint Initiatives
+
+In this example, we use Valint’s initiative framework to apply a suite of SP 800-190 policies against a container image. The job automatically generates evidence (SBOM or provenance), feeds it into Valint, and evaluates the defined controls.
+
+```yaml
+image: ubuntu:latest
+
+before_script:
+ - apt update
+ - apt install -y git curl
+ - curl -sSfL https://get.scribesecurity.com/install.sh | sh -s -- -b /usr/local/bin
+ - curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+
+stages:
+ - validate
+
+validate-image:
+ stage: validate
+ script:
+ # Run Trivy to produce a SARIF report:
+ - trivy image --format sarif --output scan_report_trivy.sarif ubuntu:latest
+
+ # Verify the image against SP 800-190 initiatives:
+ - valint verify [target]
+ -i attest
+ --bom # Auto-generate the SBOM for evidence
+ --base-image Dockerfile # Specify the Dockerfile or base image
+ --input sarif:scan_report_trivy.sarif
+ --context-type gitlab
+ --output-directory ./scribe/valint
+ -P $SCRIBE_TOKEN
+```
+
+> **Note:** The `--bom`, `--provenance`, or `--input` flags ensure that Valint includes evidence generation as part of the verification process.
+
#### Using custom x509 keys
Utilizing X509 Keys on Gitlab CI.
diff --git a/docs/valint/cosign.md b/docs/valint/cosign.md
index 2d236bf3c..f69962222 100644
--- a/docs/valint/cosign.md
+++ b/docs/valint/cosign.md
@@ -106,3 +106,92 @@ X509v3 extensions:
...
```
+Below is an **example** of how you can fill in three new headings regarding verifying SBOMs, SLSA, and policy results with Cosign. Each section uses **keyless** signing as an example, though the same commands can be adapted for key-based or certificate-based flows.
+
+---
+
+### Verifying SBOMs with Cosign
+
+If you’ve generated an SBOM (for example, CycloneDX) and pushed it to the registry as an attestation, you can verify its authenticity with Cosign. In this **keyless** example, Cosign retrieves the SBOM attestation from the registry and checks its signature:
+
+```bash
+# Generate and attach SBOM attestation with Valint
+valint bom my_account/my_image:latest --oci -o attest
+
+# Verify the SBOM attestation using cosign
+cosign verify-attestation my_account/my_image:latest \
+ --type https://cyclonedx.org/bom/v1.5 \
+ --certificate-identity="name@example.com" \
+ --certificate-oidc-issuer="https://github.com/login/oauth"
+```
+
+> **Note**: `--type https://cyclonedx.org/bom/v1.5` tells Cosign to fetch only SBOM attestations of that type.
+> **Reminder**: These examples use Cosign **keyless** signing.
+---
+
+### Verifying SLSA with Cosign
+
+Valint can generate an **SLSA** (Supply chain Levels for Software Artifacts) provenance statement. After signing and pushing it to your OCI registry, you can confirm its validity with Cosign:
+
+```bash
+# Generate and attach SLSA provenance
+valint slsa my_account/my_image:latest --oci -o attest
+
+# Verify the SLSA attestation using cosign (keyless flow)
+cosign verify-attestation my_account/my_image:latest \
+ --type https://slsa.dev/provenance/v1 \
+ --certificate-identity="name@example.com" \
+ --certificate-oidc-issuer="https://github.com/login/oauth"
+```
+
+This ensures your SLSA provenance is signed by the correct subject and issuer.
+
+> **Reminder**: These examples use Cosign **keyless** signing.
+---
+
+### Verifying Policy Results with Cosign
+
+You might also store policy or compliance results (e.g., from Valint scanning) as an attestation—often in SARIF format. Cosign can verify these policy-result attestations, ensuring they’re both **trusted** and **unaltered**:
+
+```bash
+# Generate and push SARIF-based policy results
+valint verify my_account/my_image:latest --oci \
+ --predicate results.sarif \
+ --type "http://docs.oasis-open.org/sarif/sarif/2.1.0" \
+ -o attest
+
+# Verify the SARIF attestation with Cosign (keyless)
+cosign verify-attestation my_account/my_image:latest \
+ --type http://docs.oasis-open.org/sarif/sarif/2.1.0 \
+ --certificate-identity="name@example.com" \
+ --certificate-oidc-issuer="https://github.com/login/oauth"
+```
+
+By confirming the attestation’s signature, you ensure the **policy results** remain **authentic** and tamper-free when consumed by other parts of your supply chain (e.g., an admission controller).
+
+> **Reminder**: These examples use Cosign **keyless** signing.
+---
+
+### Using `--oci-repo` and the `COSIGN_REPOSITORY` Environment Variable
+
+When using **Valint** with the `--oci-repo` flag to push evidence (SBOMs, SLSA, policy results) to an OCI registry, you typically need to align your **Cosign** settings accordingly. Specifically, **Cosign** references an environment variable called `COSIGN_REPOSITORY` to know which path in the registry to store or fetch attestation artifacts.
+
+1. **Valint** pushes evidence to `--oci-repo`, suffixed with `"/container"` for container artifacts.
+2. **Cosign** must have `COSIGN_REPOSITORY` set to **` + "/container"`** so it looks in the correct path.
+
+For example, if you run:
+
+```bash
+valint [bom, verify, slsa, etc.] my_account/my_image:latest \
+ --oci \
+ --oci-repo my_account/evidence \
+ -o attest
+```
+Valint will place container artifacts under `my_account/evidence/container` in the registry.
+To ensure Cosign sees them correctly, set:
+```bash
+export COSIGN_REPOSITORY="my_account/evidence/container"
+```
+
+> **Why the `/container` suffix?**
+> Valint (and many OCI-based workflows) distinguish different artifact types (like source code vs. container images) by placing them in subdirectories. This lets you store other assets (e.g., “source” or “sbom” paths) in the same repository without collisions.
\ No newline at end of file
diff --git a/docs/valint/help/valint.md b/docs/valint/help/valint.md
index eb83aaf16..64d6962bd 100644
--- a/docs/valint/help/valint.md
+++ b/docs/valint/help/valint.md
@@ -19,7 +19,7 @@ Flags for `valint`
| -e | --env | Environment keys to include in evidence | |
| -G | --gate | Policy Gate name | |
| -h | --help | help for valint | |
-| | --input | Input Evidence target, format (\:\ or \:\:\) | |
+| | --input | Input Evidence target, format (\:\ or \:\:\) | |
| -L | --label | Add Custom labels | |
| | --level | Log depth level, options=[panic fatal error warning info debug trace] | |
| | --log-context | Attach context to all logs | |
diff --git a/docs/valint/help/valint_bom.md b/docs/valint/help/valint_bom.md
index 4c51188d3..f18c6ba72 100644
--- a/docs/valint/help/valint_bom.md
+++ b/docs/valint/help/valint_bom.md
@@ -70,7 +70,7 @@ Flags for all `valint` subcommands
| | --deliverable | Mark as deliverable, options=[true, false] | |
| -e | --env | Environment keys to include in evidence | |
| -G | --gate | Policy Gate name | |
-| | --input | Input Evidence target, format (\:\ or \:\:\) | |
+| | --input | Input Evidence target, format (\:\ or \:\:\) | |
| -L | --label | Add Custom labels | |
| | --level | Log depth level, options=[panic fatal error warning info debug trace] | |
| | --log-context | Attach context to all logs | |
diff --git a/docs/valint/help/valint_diff.md b/docs/valint/help/valint_diff.md
index d6cfb9900..17c204504 100644
--- a/docs/valint/help/valint_diff.md
+++ b/docs/valint/help/valint_diff.md
@@ -2,13 +2,13 @@
Compare differences between source and destination sboms
-```
+```bash
valint diff [SOURCE_SBOM] [DESTINATION_SBOM] [flags]
```
### Examples for running `valint diff`
-```
+```bash
valint diff
valint diff --integrity validated,modified
valint diff --package npm,deb
@@ -22,7 +22,8 @@ valint diff [SOURCE_SBOM] [DESTINATION_SBOM] [flags]
```
-### Options flags
+### Options flags
+
specific flags for command
| Short | Long | Description | Default |
@@ -37,8 +38,8 @@ specific flags for command
| | --regex-src | Select diff scope regex source paths | |
| | --synopsis | Enable synopsis | true |
-
### Global options flags
+
global flag for all commands
@@ -49,7 +50,7 @@ global flag for all commands
| -C | --context-type | CI context type, options=[jenkins github circleci local gitlab] | "local" |
| -L | --label | Add Custom labels | |
| -D | --level | Log depth level, options=[panic fatal error warning info debug trace] | |
-| -d | --output-directory | Output directory path | "${XDG_CACHE_HOME}/valint" |
+| -d | --output-directory | Output directory path | "$\{XDG_CACHE_HOME\}/valint" |
| -O | --output-file | Output file name | |
| -n | --product-key | Scribe Project Key | |
| -q | --quiet | Suppress all logging output | |
@@ -59,7 +60,6 @@ global flag for all commands
| -u | --scribe.url | Scribe API Url | "https://airflow.scribesecurity.com" |
| -v | --verbose | Log verbosity level (-v = info, -vv = debug) | |
-
### SEE ALSO
-* [valint](valint.md) - supply chain integrity tool
+* [valint](valint.md) - supply chain integrity tool
diff --git a/docs/valint/help/valint_discard.md b/docs/valint/help/valint_discard.md
index cbc893b6a..93fce86f9 100644
--- a/docs/valint/help/valint_discard.md
+++ b/docs/valint/help/valint_discard.md
@@ -36,7 +36,7 @@ Flags for all `valint` subcommands
| | --deliverable | Mark as deliverable, options=[true, false] | |
| -e | --env | Environment keys to include in evidence | |
| -G | --gate | Policy Gate name | |
-| | --input | Input Evidence target, format (\:\ or \:\:\) | |
+| | --input | Input Evidence target, format (\:\ or \:\:\) | |
| -L | --label | Add Custom labels | |
| | --level | Log depth level, options=[panic fatal error warning info debug trace] | |
| | --log-context | Attach context to all logs | |
diff --git a/docs/valint/help/valint_download.md b/docs/valint/help/valint_download.md
index 2f2a03052..a6368c654 100644
--- a/docs/valint/help/valint_download.md
+++ b/docs/valint/help/valint_download.md
@@ -32,7 +32,7 @@ Flags for all `valint` subcommands
| | --deliverable | Mark as deliverable, options=[true, false] | |
| -e | --env | Environment keys to include in evidence | |
| -G | --gate | Policy Gate name | |
-| | --input | Input Evidence target, format (\:\ or \:\:\) | |
+| | --input | Input Evidence target, format (\:\ or \:\:\) | |
| -L | --label | Add Custom labels | |
| | --level | Log depth level, options=[panic fatal error warning info debug trace] | |
| | --log-context | Attach context to all logs | |
diff --git a/docs/valint/help/valint_evidence.md b/docs/valint/help/valint_evidence.md
index 6161a0ad7..b7ce82e20 100644
--- a/docs/valint/help/valint_evidence.md
+++ b/docs/valint/help/valint_evidence.md
@@ -54,7 +54,7 @@ Flags for all `valint` subcommands
| | --deliverable | Mark as deliverable, options=[true, false] | |
| -e | --env | Environment keys to include in evidence | |
| -G | --gate | Policy Gate name | |
-| | --input | Input Evidence target, format (\:\ or \:\:\) | |
+| | --input | Input Evidence target, format (\:\ or \:\:\) | |
| -L | --label | Add Custom labels | |
| | --level | Log depth level, options=[panic fatal error warning info debug trace] | |
| | --log-context | Attach context to all logs | |
diff --git a/docs/valint/help/valint_list.md b/docs/valint/help/valint_list.md
index ff0f3da48..65c37a5dc 100644
--- a/docs/valint/help/valint_list.md
+++ b/docs/valint/help/valint_list.md
@@ -43,7 +43,7 @@ Flags for all `valint` subcommands
| | --deliverable | Mark as deliverable, options=[true, false] | |
| -e | --env | Environment keys to include in evidence | |
| -G | --gate | Policy Gate name | |
-| | --input | Input Evidence target, format (\:\ or \:\:\) | |
+| | --input | Input Evidence target, format (\:\ or \:\:\) | |
| -L | --label | Add Custom labels | |
| | --level | Log depth level, options=[panic fatal error warning info debug trace] | |
| | --log-context | Attach context to all logs | |
diff --git a/docs/valint/help/valint_slsa.md b/docs/valint/help/valint_slsa.md
index dd78e93db..6b7797c9c 100644
--- a/docs/valint/help/valint_slsa.md
+++ b/docs/valint/help/valint_slsa.md
@@ -65,7 +65,7 @@ Flags for all `valint` subcommands
| | --deliverable | Mark as deliverable, options=[true, false] | |
| -e | --env | Environment keys to include in evidence | |
| -G | --gate | Policy Gate name | |
-| | --input | Input Evidence target, format (\:\ or \:\:\) | |
+| | --input | Input Evidence target, format (\:\ or \:\:\) | |
| -L | --label | Add Custom labels | |
| | --level | Log depth level, options=[panic fatal error warning info debug trace] | |
| | --log-context | Attach context to all logs | |
diff --git a/docs/valint/help/valint_verify.md b/docs/valint/help/valint_verify.md
index b98d0aa11..5be7bfdbc 100644
--- a/docs/valint/help/valint_verify.md
+++ b/docs/valint/help/valint_verify.md
@@ -76,7 +76,7 @@ Flags for all `valint` subcommands
| | --deliverable | Mark as deliverable, options=[true, false] | |
| -e | --env | Environment keys to include in evidence | |
| -G | --gate | Policy Gate name | |
-| | --input | Input Evidence target, format (\:\ or \:\:\) | |
+| | --input | Input Evidence target, format (\:\ or \:\:\) | |
| -L | --label | Add Custom labels | |
| | --level | Log depth level, options=[panic fatal error warning info debug trace] | |
| | --log-context | Attach context to all logs | |
diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md
new file mode 100644
index 000000000..778767bbc
--- /dev/null
+++ b/docs/valint/initiatives.md
@@ -0,0 +1,1034 @@
+---
+sidebar_label: "Adopting initiatives"
+title: Adopting initiatives
+author: viktor kartashov - Scribe
+sidebar_position: 5
+date: December 10, 2024
+geometry: margin=2cm
+toc_max_heading_level: 3
+---
+
+## What is an initiative?
+
+An `initiative` is a high-level, abstract requirement that comprises a set of `controls`. For example, a security framework such as SSDF can be represented as an `initiative`. A `control` is an abstract requirement that comprises a set of `rules`. For example, the SSDF framework (initiative) requires a `control` of protecting access to the source code. This `control` can be materialized by requiring MFA, limiting the number and identity of admins, and requiring the source code repository to be private -- each of the requirements is a `rule`.
+
+The outcome of an initiative evaluation is an initiative result report that details the rule evaluation results and references the verified assets and statements/attestations. `valint` produces initiative results in the SARIF format and uploads them as an in-toto statement of SARIF to Scribe Hub. For more details on this, see the [Initi] [Policy Results](./policy-results.md) page.
+
+Rules can be defined inline in the initiative config or reuse existing ones from a bundle. See the [Rule configuration](#rule-configuration-format), [Initiative configuration](#initiative-configuration), and [Using a private bundle](#using-a-private-bundle) sections for more details.
+
+### Evidence
+
+Scribe rules operate on evidence; each rule consumes evidence previously created. Each rule specifies which evidence it requires by providing criteria for fetching the evidence. This allows for abstracting the rules and avoiding the need to know an exact evidence id; so instead of specifying "use the SBOM of alpine@sha:ab87ehk..." the user can specify "use the SBOM created in this pipeline", or "use the SBOM of this product". See the [Evidence Lookup](#evidence-lookup) section for more details.
+
+### Gates
+
+Initiative evaluation may require evaluating different rules in different locations in the supply chain. For example, an SBOM of a built image would be tested for vulnerabilities on the build pipeline, while evaluating DAST results would happen on a different testing pipeline. Scribe initiatives support specifying for each control the gate it should be evaluated at; when evaluating an initiative the user can specify the "current location" - the gate that should be evaluated. A gate is defined by its name (serves for human readability of the results, optional) and type (required to use the filtering feature). See the [Rule filtering](#rule-filtering) section for more details.
+
+## Initiative configuration
+
+```yaml
+config-type: initiative
+required-valint-version: "2.0.0"
+id:
+name:
+version:
+description:
+help:
+
+defaults:
+ evidence:
+ signed:
+ content_body_type:
+ filter-by: []
+
+env:
+ :
+
+controls:
+ - name:
+ id:
+ description:
+ disable:
+ when:
+ gate:
+ rules: []
+```
+
+### Initiative configuration fields
+
+#### `config-type`
+
+- **Type:** String
+- **Required:** Yes
+- **Description:** Specifies the type of configuration. For initiatives, this should be set to `initiative`.
+
+#### `required-valint-version`
+
+- **Type:** String
+- **Required:** No
+- **Description:** The minimum version of Valint required to run the initiative.
+- **Example:** `"2.0.0"`
+- **Default:** No `valint` version matching check is performed.
+
+#### `id`
+
+- **Type:** String
+- **Required:** No
+- **Description:** A unique identifier for the initiative. It cannot contain the `::` string. IDs can be seen in the UI and are needed in Scribe Hub to define rule uniqueness. If no ID is provided, it is generated from the name.
+- **Default:** If no `id` is provided, the value is calculated from the `name` field.
+
+#### `name`
+
+- **Type:** String
+- **Required:** Yes
+- **Description:** The name of the initiative.
+
+#### `version`
+
+- **Type:** String
+- **Required:** No
+- **Description:** The version of the initiative.
+- **Default:** If no value is provided, initiative versioning is not applied.
+
+#### `description`
+
+- **Type:** String
+- **Required:** No
+- **Description:** A brief description of the initiative.
+- **Default:** If no value is provided, it is omitted in the output data.
+
+#### `help`
+
+- **Type:** String (URL)
+- **Required:** No
+- **Description:** A URL pointing to the help or documentation for the initiative.
+- **Default:** If no value is provided, it is omitted in the output data.
+
+#### `defaults`
+
+- **Type:** Object
+- **Required:** No
+- **Description:** Optional parameters to override the existing evidence lookup and other parameters for each rule in the initiative. It is recommended to start adopting the initiative with the `defaults.signed` value set to `false` and set it to `true` when certificates and keys are deployed.
+- **Default:** If no value is provided, the rules' values are used.
+
+##### `defaults.level`
+
+- **Type:** String
+- **Required:** No
+- **Description:** Rule level to use for all rules in the initiative. It is recommended to start with a `warning` level and only after the security controls have been adopted, set it to "error".
+- **Default:** If no value is provided, the original rules' levels are used.
+
+##### `defaults.evidence`
+
+- **Type:** Object
+- **Required:** No
+- **Description:** Evidence lookup parameters. Any field from the evidence context can be used here.
+- **Default:** If no value is provided, the rules' values are used.
+
+#### `env`
+
+- **Type:** Object
+- **Required:** No
+- **Description:** File-wide environment variables for the template engine.
+- **Default:** If no value is provided, only the variables from the actual environment are used.
+
+#### `controls`
+
+- **Type:** Array of Objects
+- **Required:** Yes
+- **Description:** A list of controls for the initiative.
+
+##### `controls[].name`
+
+- **Type:** String
+- **Required:** Yes
+- **Description:** The name of the control.
+
+##### `controls[].id`
+
+- **Type:** String
+- **Required:** No
+- **Description:** A unique identifier for the control. Cannot contain the `::` string. If no ID is provided, it is generated from the name.
+
+##### `controls[].description`
+
+- **Type:** String
+- **Required:** No
+- **Description:** A brief description of the control.
+
+##### `controls[].disable`
+
+- **Type:** Boolean
+- **Required:** No
+- **Default:** `false`
+- **Description:** Indicates whether the control should be disabled. If set to `true`, the control will not be evaluated.
+
+##### `controls[].when`
+
+- **Type:** Object
+- **Required:** No
+- **Description:** Optional filters for when the control should be run. Currently only `gate` filters are supported (see below).
+- **Default:** If no value is provided, no user-defined control filters are applied.
+
+###### `controls[].when.gate`
+
+- **Type:** String
+- **Required:** No
+- **Description:** The type of gate on which to run the control. This value is used to filter controls when the `--gate-type` input is provided to `valint`. See the [Rule filtering](#rule-filtering) section below for more details.
+- **Default:** If no value is provided, the control will run on all gates.
+
+##### `controls[].rules`
+
+- **Type:** Array of Objects
+- **Description:** A list of rules for the control. For details, see the [Rules](#rule-configuration-format) section below.
+
+:::info
+For `valint` configuration details, see the [configuration](./configuration.md) section.
+:::
+:::info
+For PKI configuration, see the [attestations](./attestations.md) section.
+:::
+
+An example of an initiative is:
+
+```yaml
+config-type: initiative
+required-valint-version: "2.0.0"
+id: my-initiative
+name: "My Initiative"
+version: "v1.0.0"
+description: "This initiative enforces a couple of simple checks on Docker images"
+
+defaults:
+ evidence:
+ signed: true
+
+controls:
+ - name: "My Control"
+ when:
+ gate: "Build"
+ rules:
+ uses: sbom/blocklist-packages@v2
+ with:
+ blocklist:
+ - "liblzma5@5.6.0"
+ - "liblzma5@5.6.1"
+ - "xz-utils@5.6.0"
+ - "xz-utils@5.6.1"
+ - name: "my-rule-2"
+ uses: sbom/banned-licenses@v2
+ level: warning
+ with:
+ identity:
+ emails:
+ - my@email.com
+ banned-licenses:
+ - "GPL-2.0"
+ - "GPL-3.0"
+ - name: "Control-2"
+ when:
+ gate: "Deploy"
+ rules:
+ - name: "my-rule-3"
+ uses: sbom/evidence-exists@v2
+```
+
+## Rule configuration format
+
+Each rule that is used separately via the `--rule` argument or as part of an initiative should be defined in YAML:
+
+```yaml
+config-type: rule
+required-valint-version: "2.0.0"
+disable:
+id:
+name:
+path:
+uses:
+description:
+help:
+
+labels: []
+
+level:
+
+require-scribe-api:
+fail-on-missing-evidence:
+skip-evidence:
+aggregate-results:
+
+evidence: {}
+
+with: {}
+```
+
+### Rule configuration fields
+
+#### `config-type`
+
+- **Type:** String
+- **Required:** Yes
+- **Description:** Specifies the type of configuration. For rule configuration files, this should be set to `rule`. For rules defined inline in the initiative config, this field is omitted.
+
+#### `required-valint-version`
+
+- **Type:** String
+- **Required:** No
+- **Description:** The minimum version of Valint required to run the initiative.
+- **Default:** No `valint` version matching check is performed.
+- **Example:** `"2.0.0"`
+
+#### `disable`
+
+- **Type:** Boolean
+- **Required:** No
+- **Default:** `false`
+- **Description:** Indicates whether the rule should be disabled. If set to `true`, the rule will not be evaluated.
+
+#### `id`
+
+- **Type:** String
+- **Required:** No
+- **Description:** A unique identifier for the rule. Cannot contain the `::` string. Must be unique within the initiative. If no ID is provided, it is generated from the name.
+- **Default:** If no value is provided, it is generated from the name.
+
+#### `name`
+
+- **Type:** String
+- **Required:** Yes
+- **Description:** The name of the rule. This should be unique within the initiative.
+
+#### `path`
+
+- **Type:** String
+- **Required:** No
+- **Description:** The path to a custom external script, if used. Should be relative to the rule file.
+- **Default:** If no value is provided, no external script file is used for the rule.
+
+#### `uses`
+
+- **Type:** String
+- **Required:** No
+- **Description:** A reference to a rule in a bundle that should be used as a base rule. The format is `@`. When used, the current rule's values will override the external rule's ones.
+- **Default:** If no value is provided, no external rule is used as a base rule.
+
+#### `description`
+
+- **Type:** String
+- **Required:** No
+- **Description:** A brief description of the rule.
+- **Default:** If no value is provided, the value is omitted in the output data.
+
+#### `help`
+
+- **Type:** String (URL)
+- **Required:** No
+- **Description:** A URL pointing to the help or documentation for the rule.
+- **Default:** If no value is provided, it is omitted in the output data.
+
+#### `labels`
+
+- **Type:** Array of Strings
+- **Required:** No
+- **Description:** A list of user-specified labels for the rule itself. These labels can be used for filtering out the rules to be run with the `--rule-label` valint flag. A rule will be run if at least one of its labels matches one of the `--rule-label` values. Label filters are used within the whole initiative, regardless of the controls. See the [Rule filtering](#rule-filtering) section below for more details.
+- **Default:** No labels used.
+
+#### `level`
+
+- **Type:** String
+- **Required:** No
+- **Description:** The level of the rule. Can be `error`, `warning`, or `note`. Default is `error`. The levels affect how rule results affect the overall initiative result: `valint` run overall would fail only if there are `error` level violations. Results on Scribe Hub are also displayed according to the levels.
+- **Default:** `error`
+
+#### `require-scribe-api`
+
+- **Type:** Boolean
+- **Required:** No
+- **Description:** Indicates whether the Scribe API is required. See the details in the [Rules that require the Scribe API](#rules-that-require-the-scribe-api) section.
+- **Default:** `false`
+
+#### `fail-on-missing-evidence`
+
+- **Type:** Boolean
+- **Required:** No
+- **Description:** Indicates whether the rule should fail if evidence is missing. If set to `false` (default), the rule will have the `open` result if no evidence is found.
+- **Default:** `false`
+
+#### `skip-evidence`
+
+- **Type:** Boolean
+- **Required:** No
+- **Description:** Indicates whether the rule should skip evidence downloading and go straight to the rule evaluation. Can be helpful for rules that don't require evidence, like API rules.
+- **Default:** `false`
+
+#### `aggregate-results`
+
+- **Type:** Boolean
+- **Required:** No
+- **Description:** Indicates whether the rule results should be aggregated. If set to `true`, the rule will return a single result for all the violations found.
+- **Default:** `false`
+
+#### `evidence`
+
+- **Type:** Object
+- **Required:** No
+- **Description:** Evidence lookup parameters. Any field from the evidence context can be used here. See the [Evidence Lookup](#evidence-lookup) section for more details.
+- **Default:** No user-specified options will be used for the evidence lookup.
+
+##### `evidence.filter-by`
+
+- **Type:** List of Strings
+- **Required:** No
+- **Description:** A list of parameters in the environment to filter the evidence by (see [Evidence Lookup](#evidence-lookup)).
+- **Default:** `[target, product]`
+
+#### `with`
+
+- **Type:** Object
+- **Required:** No
+- **Description:** Rule input, depending on the rule script.
+- **Default:** Depends on the rule script.
+
+Examples of rules and initiatives can be found in the [sample-policies bundle](https://github.com/scribe-public/sample-policies).
+
+An example of a rule is:
+
+```yaml
+config-type: rule
+id: require-sbom
+name: Require SBOM Existence
+path: require-sbom.rego
+
+description: Verify the SBOM exists as evidence.
+
+fail-on-missing-evidence: true
+
+evidence:
+ filter-by:
+ - product
+ - target
+ content_body_type: cyclonedx-json
+ signed: false
+```
+
+This rule requires a CycloneDX SBOM to be present as evidence for the product and target. The rule accepts both signed and unsigned SBOMs and fails if no SBOM is found. It uses an external `rego` script to provide some additional logic (in this specific case, it's just used to fetch some additional data from the SBOM and return it in the result).
+
+## How to adopt an initiative?
+
+An initiative is defined as a file that can be consumed locally or from an external bundle. To run an initiative, one first needs to create the required statements and attestations, for example:
+
+```bash
+valint bom : \
+ --product-key -- product-version \
+ --scribe.client-secret
+```
+
+
+
+Additional options
+
+In addition, other type of statements can be created. See the [Getting started with valint](./getting-started-valint.md) guide for more details.
+
+- SLSA Provenance
+
+```bash
+valint slsa : \
+ --product-key -- product-version \
+ --scribe.client-secret
+```
+
+- Generic evidence from a 3rd party tool report:
+
+```bash
+valint evidence \
+ --product-key -- product-version \
+ --scribe.client-secret
+```
+
+
+
+-------------------
+Then, a local initiative can be run with the following command:
+
+```bash
+valint verify --initiative initiative.yaml \
+ --product-key -- product-version \
+ --scribe.client-secret
+```
+
+To run an initiative from the [Scribe sample bundle](https://github.com/scribe-public/sample-policies), use the following command:
+
+```bash
+valint verify --initiative ssdf@v2 \
+ --product-key -- product-version \
+ --scribe.client-secret
+```
+
+To run a part of an initiative filtered by gate type, use the following command:
+
+```bash
+valint verify --initiative ssdf@v2 \
+ --product-key -- product-version \
+ --scribe.client-secret \
+ --gate-type Build --gate-name "Build of My Product"
+```
+
+## Using a private bundle
+
+Rules and initiatives can be provided locally or reused either from the public Scribe bundle or a private bundle managed by the user. By default, the public Scribe bundle is used.
+To use a private bundle instead, the following rules should be followed:
+
+1. The private bundle should be a git repository referenced in `valint` command with the `--bundle` flag, for example:
+
+ ```bash
+ valint verify ... --bundle https://github.com/scribe-public/sample-policies ...
+ ```
+
+2. If git authentication is required, it can be provided either in the git URL or through the `--bundle-auth` flag.
+
+3. A specific branch, tag, or commit can be provided using the `--bundle-branch`, `--bundle-tag`, or `--bundle-commit` flags respectively.
+
+4. The file structure within the bundle is up to the administrator, but when referencing the rules in initiative configs, the path should be relative to the bundle root and at least one level deep.
+For example, this is how to reference a rule from the public Scribe bundle:
+
+ ```yaml
+ ...
+ rules:
+ - uses: sbom/blocklist-packages@v2
+ ...
+ ```
+
+Here `sbom/blocklist-packages@v2` means that the rule path within the bundle is`v2/rules/sbom/blocklist-packages.yaml`.
+Note that the `.yaml` extension is omitted in the path and replaced with `@v2`, which is used here as a version tag.
+
+## Rule configuration
+
+Rules are defined as a combination of a `.yaml` configuration file and a `.rego` script. The `.yaml` file contains the rule configuration, while the `.rego` script contains the rule logic.
+The rule configuration is described above along with the initiative configuration.
+
+The rego script gets two inputs: verifying evidence as `input.evidence` and configurable args as `input.config.args`, the latter is specified in the rule config as a `with` object.
+
+The rego script should produce an output object in the following format:
+
+```go
+package verify
+default allow = false
+
+verify = {
+ "allow": true | false,
+ "violation": {
+ "type": "violation_type",
+ "details": [{}], // arbitrary object list
+ },
+ "asset": asset,
+ "summary": [{
+ "allow": true | false,
+ "violations": count(violations),
+ "reason": "some reason string"
+ }],
+}
+```
+
+To generate the asset object, the script should call the built-in function `get_asset_data()`, providing it with the input evidence like this:
+
+```go
+import data.scribe as scribe
+default asset = {}
+asset := scribe.get_asset_data(input.evidence)
+```
+
+## Technical Details
+
+### Evidence Lookup
+
+In order to run a policy rule, `valint` requires relevant evidence, which can be found in storage using several parameters.
+These parameters can be set manually by the user or automatically derived from the context.
+
+Parameters that can be derived automatically by `valint` are categorized into three context groups: `target`, `pipeline`, and `product`.
+By default, the `product` group is enabled for each rule.
+
+1. The `target` context group specifies parameters that can be derived from the target provided to the `valint verify` command (a docker image, a git repo or a file). These parameters are:
+ - `target_type` - the type of the target provided (e.g., image, git, generic, etc.)
+ - `sbomversion` - the version of the SBOM provided (usually it's sha256 or sha1 hash)
+
+ :::info
+ If this parameter is set and no target is provided, the rule is disabled with a warning.
+ :::
+ :::info
+ If `target_type` is set manually in the rule config and a target of a different type is provided, the rule is disabled with a warning.
+ :::
+
+2. The `pipeline` context group specifies parameters that can be derived from the running environment. These parameters are:
+ - `context_type` - the type of the environment (e.g., local, github, etc.)
+ - `git_url` - the git URL of the repository (if any)
+ - `git_commit` - the git commit of the current repository state (if any)
+ - `run_id` - the run ID (if any)
+ - `build_num` - the build number (if any)
+
+3. The `product` context group specifies product parameters that can be derived from the command line arguments. These parameters are:
+ - `name` - the name of the product (provided to `valint` as a `--product-key` argument)
+ - `product_version` - the version of the product (provided to `valint` as a `--product-version` argument)
+
+Users can specify any combination of these three groups or a special value `none` to indicate that the parameter should not be derived automatically.
+By default, the `product` group is used.
+The list of groups to be used should be provided to the `.evidence.filter-by` field in the configuration file. Any value provided overrides the default list.
+See the usage example below for more details.
+
+-------------------
+
+In addition, one can specify other parameters that they want to be matched by evidence.
+In most of the rules, the following parameters would be used to define the type of statement:
+
+| Field | Description | Examples |
+|--------------------|----------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------|
+| `signed` | Specifies whether the evidence is required to be signed. When set to `false`, both unsigned (statements) and signed (attestations) are accepted, and signature verification failure for the signed ones doesn't affect the rule result. | `true`, `false` |
+| `content_body_type`| Defines the content type of the attestation. | `cyclonedx-json`, `generic`, `slsa` |
+| `target_type` | The type of the target that was used to create the evidence. | `container` for Docker images `git` for Git repositories `policy-results` for `valint` SARIFs `data` for generic data files |
+| `predicate_type` | The type of the predicate used in `generic` evidence, usually a URI. | `http://scribesecurity.com/evidence/discovery/v0.1` `http://docs.oasis-open.org/sarif/sarif/2.1.0` |
+
+The following example requires an unsigned statement of Scribe Security discovery evidence:
+
+```yaml
+...
+evidence:
+ signed: false
+ content_body_type: generic
+ target_type: data
+ predicate_type: http://scribesecurity.com/evidence/discovery/v0.1
+...
+```
+
+
+ Full list of supported parameters
+
+The parameters are named the same way as they are in the evidence context.
+
+```yaml
+name
+product_version
+labels
+predicate_type
+input_name
+input_scheme
+input_tag
+
+content_body_type
+context_type
+target_type
+signed
+
+tool
+tool_vendor
+tool_version
+format_encoding
+format_type
+format_version
+gate_type
+gate_name
+
+sbomname
+sbomgroup
+sbompurl
+sbomversion
+sbomhashs
+sbomcomponents
+
+imageID
+image_name
+repoDigest
+tag
+
+git_branch
+git_uuid
+git_commit
+git_ref
+git_tag
+git_url
+
+pipeline_name
+job_name
+workflow
+run_id
+build_num
+actor
+
+target_git_brahc
+target_git_commit
+target_git_uuid
+target_git_ref
+target_git_tag
+target_git_url
+
+dir_id
+dir_path
+
+file_id
+file_path
+
+parser
+event_name
+target_k8s_name
+target_kind
+target_namespace
+content_type
+organization
+sbomtype
+
+warning
+allow
+
+asset_id
+asset_name
+asset_type
+asset_platform
+```
+
+
+
+If more than one piece of evidence is found, the newest one is used.
+
+
+ Usage
+
+An example of a rule that requires signed CycloneDX SBOM evidence and uses target and product contexts would look like this:
+
+```yaml
+config-type: rule
+name: "My Rule"
+id: my-rule
+
+evidence:
+ signed: true
+ content_body_type: "cyclonedx-json"
+ target_type: "container"
+ filter-by:
+ - target
+ - product
+```
+
+When running this rule on the `alpine:latest` image target for the `MyProduct` product of the `v1.0.0` version, the evidence lookup would be performed with the following parameters:
+
+```json
+{
+ "name": "MyProduct",
+ "product_version": "v1.0.0",
+ "content_body_type": "cyclonedx-json",
+ "signed": true,
+ "predicate_type": "https://cyclonedx.org/bom/v1.5",
+ "target_type": "container",
+ "sbomversion": "sha256:8ca4688f4f356596b5ae539337c9941abc78eda10021d35cbc52659c74d9b443"
+}
+```
+
+In this example,
+
+- The `name` (stands for _product name_) and `product_version` fields were fetched from the `valint` input because the `filter-by: product` value was set in the rule config.
+- The `sbomversion` field was set as a result of target analysis because the `filter-by: target` value was set in the rule config.
+- The `content_body_type`, `target_type`, and `signed` fields were explicitly specified in the rule config.
+- The `predicate_type` field was set to the default value for CycloneDX SBOMs (based on the `cyclonedx-json` value for `content_body_type`).
+
+
+
+### Rule filtering
+
+When running an initiative, there are several options to decide which rules will be evaluated. Some of the criteria are used by `valint` automatically based on the context, while others can be specified by the user.
+
+The following criteria are used by `valint` automatically:
+
+- Rules that have the `filter-by: target` value set in the config (see the [Evidence Lookup](#evidence-lookup) section) are disabled if no target is provided to the `valint verify` command.
+- Rules that use some of the built-in functions for template arguments are disabled if the required arguments are not provided, see the [Built-in functions](#built-in-functions) for more details.
+
+The only exception for both of these is when the `--all-evidence` flag is used, see the [Whole product evaluation](#whole-product-evaluation) section.
+
+The following criteria can be specified by the user:
+
+- The `when.gate` field is used to filter _***controls***_ by the gate type provided to the `valint verify` command using the `--gate-type` flag. When this flag is used, only controls with a matching gate and controls without a gate filter are executed. This feature operates at the _***control***_ level only.
+- The `rule.labels` field is used to filter _***rules***_ by the labels provided to the `valint verify` command using the `--rule-label` flag. This feature operates at the _***rule***_ level only and excludes rules that do not have any matching labels, regardless of the control they belong to.
+
+
+ Gate Filtering Example
+
+In the following initiative example,
+
+- The "MyBuildControl" control will be evaluated only when the `--gate-type Build` flag is used or no gate type is provided.
+- The "MyDeployControl" control will be evaluated only when the `--gate-type Deploy` flag is used or no gate type is provided.
+- The "MyGenericControl" control will be evaluated regardless of the gate type.
+
+```yaml
+config-type: initiative
+id: "my-initiative"
+name: "My Initiative"
+
+controls:
+# The following control matches the Build gate type
+ - name: "Any critical or high severity vulnerability breaks the build"
+ id: "MyBuildControl"
+ when:
+ gate: Build
+ rules:
+ - uses: api/scribe-api-cve@v2
+ with:
+ superset:
+ cve:
+ severity: 6
+ max: 0
+
+# The following control matches the Deploy gate type
+ - name: "Root and Admin users prevent image deployment"
+ id: "MyDeployControl"
+ when:
+ gate: Deploy
+ rules:
+ - uses: images/banned-users@v2
+ with:
+ users:
+ - "root"
+ - "admin"
+
+# The following control doesn't have a gate filter and will be evaluated regardless of the gate type
+ - name: "Require signed SBOM"
+ id: "MyGenericControl"
+ rules:
+ - uses: sbom/artifact-signed@v2
+```
+
+```bash
+# Running on the Build gate type
+$ valint verify alpine:latest --initiative my-initiative@v2 --gate-type Build
+...
+INFO [my-initiative] Initiative "My Initiative" Evaluation Summary:
+┌───────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
+│ [my-initiative] Initiative "My Initiative" Evaluation Summary │
+├───────────────────┬──────────────────────────────────────────────────────────────┬───────────────────┬────────┤
+│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │
+├───────────────────┼──────────────────────────────────────────────────────────────┼───────────────────┼────────┤
+│ MyBuildControl │ Any critical or high severity vulnerability breaks the build │ scribe-cve(pass) │ pass │
+├───────────────────┼──────────────────────────────────────────────────────────────┼───────────────────┼────────┤
+│ MyGenericControl │ Require signed SBOM │ sbom-signed(pass) │ pass │
+├───────────────────┼──────────────────────────────────────────────────────────────┼───────────────────┼────────┤
+│ INITIATIVE RESULT │ │ │ PASS │
+└───────────────────┴──────────────────────────────────────────────────────────────┴───────────────────┴────────┘
+```
+
+```bash
+# Running on the Deploy gate type
+$ valint verify alpine:latest --initiative my-initiative@v2 --gate-type Deploy
+...
+INFO [my-initiative] Initiative "My Initiative" Evaluation Summary:
+┌──────────────────────────────────────────────────────────────────────────────────────────────────────────┐
+│ [my-initiative] Initiative "My Initiative" Evaluation Summary │
+├───────────────────┬───────────────────────────────────────────────┬─────────────────────────────┬────────┤
+│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │
+├───────────────────┼───────────────────────────────────────────────┼─────────────────────────────┼────────┤
+│ MyDeployControl │ Root and Admin users prevent image deployment │ sbom-disallowed-users(pass) │ pass │
+├───────────────────┼───────────────────────────────────────────────┼─────────────────────────────┼────────┤
+│ MyGenericControl │ Require signed SBOM │ sbom-signed(pass) │ pass │
+├───────────────────┼───────────────────────────────────────────────┼─────────────────────────────┼────────┤
+│ INITIATIVE RESULT │ │ │ PASS │
+└───────────────────┴───────────────────────────────────────────────┴─────────────────────────────┴────────┘
+```
+
+```bash
+# Running without the gate type
+$ valint verify alpine:latest --initiative my-initiative@v2
+...
+INFO [my-initiative] Initiative "My Initiative" Evaluation Summary:
+┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
+│ [my-initiative] Initiative "My Initiative" Evaluation Summary │
+├───────────────────┬──────────────────────────────────────────────────────────────┬─────────────────────────────┬────────┤
+│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │
+├───────────────────┼──────────────────────────────────────────────────────────────┼─────────────────────────────┼────────┤
+│ MyBuildControl │ Any critical or high severity vulnerability breaks the build │ scribe-cve(pass) │ pass │
+├───────────────────┼──────────────────────────────────────────────────────────────┼─────────────────────────────┼────────┤
+│ MyDeployControl │ Root and Admin users prevent image deployment │ sbom-disallowed-users(pass) │ pass │
+├───────────────────┼──────────────────────────────────────────────────────────────┼─────────────────────────────┼────────┤
+│ MyGenericControl │ Require signed SBOM │ sbom-signed(pass) │ pass │
+├───────────────────┼──────────────────────────────────────────────────────────────┼─────────────────────────────┼────────┤
+│ INITIATIVE RESULT │ │ │ PASS │
+└───────────────────┴──────────────────────────────────────────────────────────────┴─────────────────────────────┴────────┘
+```
+
+
+
+
+ Rule Label Filtering Example
+
+In the following initiative example, the "MyRule" rule will be evaluated only when the `--rule-label` flag is used with the `MyLabel` value or no label is provided.
+
+```yaml
+config-type: initiative
+id: "my-initiative"
+name: "My Initiative"
+
+controls:
+ - name: "My Control"
+ rules:
+ - name: "My Rule"
+ id: "MyRule"
+ labels:
+ - "MyLabel"
+ uses: sbom/blocklist-packages@v2
+ with:
+ blocklist:
+ - "liblzma5@5.6.0"
+ - "liblzma5@5.6.1"
+ - "xz-utils@5.6.0"
+ - "xz-utils@5.6.1"
+ - name: "My Rule 2"
+ id: "MyRule2"
+ uses: sbom/banned-licenses@v2
+ level: warning
+ with:
+ blocklist:
+ - "GPL-2.0"
+ - "GPL-3.0"
+```
+
+```bash
+# Running with the rule label
+$ valint verify alpine:latest --initiative my-initiative@v2 --rule-label MyLabel
+...
+INFO [my-initiative] Initiative "My Initiative" Evaluation Summary:
+┌───────────────────────────────────────────────────────────────┐
+│ [my-initiative] Initiative "My Initiative" Evaluation Summary │
+├───────────────────┬───────────────┬──────────────────┬────────┤
+│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │
+├───────────────────┼───────────────┼──────────────────┼────────┤
+│ My Control │ My Control │ MyRule(pass), │ pass │
+├───────────────────┼───────────────┼──────────────────┼────────┤
+│ INITIATIVE RESULT │ │ │ PASS │
+└───────────────────┴───────────────┴──────────────────┴────────┘
+```
+
+```bash
+# Running without the rule label
+$ valint verify alpine:latest --initiative my-initiative@v2
+...
+INFO [my-initiative] Initiative "My Initiative" Evaluation Summary:
+┌───────────────────────────────────────────────────────────────┐
+│ [my-initiative] Initiative "My Initiative" Evaluation Summary │
+├───────────────────┬───────────────┬──────────────────┬────────┤
+│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │
+├───────────────────┼───────────────┼──────────────────┼────────┤
+│ My Control │ My Control │ MyRule(pass), │ pass │
+│ │ │ MyRule2(warning) │ │
+├───────────────────┼───────────────┼──────────────────┼────────┤
+│ INITIATIVE RESULT │ │ │ PASS │
+└───────────────────┴───────────────┴──────────────────┴────────┘
+```
+
+
+
+## Advanced features
+
+### Template arguments
+
+Rules can have template arguments that can be used to simplify rule configuration. For example, `github/api/branch-protection@v2` relies on several arguments provided at runtime:
+
+```yaml
+
+...
+with:
+ api_token: '{{ .Args.Token }}'
+ owner: '{{ .Args.Owner }}'
+ repo: '{{ .Args.Repo }}'
+ branch: '{{ .Args.Branch }}'
+...
+```
+
+To specify those, `valint` should be run with args `--rule-args Token=MyToken,Owner=MyOwner,Repo=MyRepo,Branch=MyBranch`.
+
+When a required template argument is not specified, the rule will be disabled with a warning.
+
+#### Built-in functions
+
+To simplify the rule-args input, the rules template engine has built-in functions that can be used to define the rule arguments. Another use of these functions is to disable filtering when the `--all-evidence` flag is used, see below.
+
+List of supported functions:
+
+- `on_target` - returns the value of the argument if the `--all-evidence` flag is not used, see below
+- `asset` -- used for specifying asset labels as they are set by `platforms`, for example: `asset_name` would result in `asset=asset_name`.
+- `asset_on_target` -- same as `asset`, but disables filtering when the `--all-evidence` flag is used.
+- `asset_if_found` -- same as `asset`, but doesn't disable the rule if no arg value is found and uses an empty string instead.
+
+
+ Example
+
+In the following rule, the `MyAsset` input arg (specified as `--rule-args MyAsset=MyAssetValue`) is used to filter the evidence by the asset label as it is set by the `platforms` tool:
+
+```yaml
+...
+with:
+ defaults:
+ evidence:
+ labels:
+ - '{{ asset .Args.MyAsset }}'
+...
+```
+
+When being run with the `--rule-args MyAsset=MyAssetValue` flag, the rule will use the `asset=MyAssetValue` label for the evidence lookup.
+
+
+
+### Whole product evaluation
+
+One can run an initiative to verify all the existing evidences in a product. In this case, the initiative will try to find all matching evidences for every rule and verify those. To do that, the `--all-evidence` flag should be used:
+
+```bash
+valint verify --initiative my-initiative@v2 --all-evidence \
+ --product-key -- product-version \
+ --scribe.client-secret
+```
+
+If template args are used within the initiative, they should be defined through built-in functions that disable filtering when the `--all-evidence` flag is used. For example, the following example filters evidence by label only when the `--all-evidence` flag is not used:
+
+```yaml
+...
+with:
+ defaults:
+ evidence:
+ labels:
+ - '{{ on_target .Args.MyLabel }}'
+...
+```
+
+Also, in this mode, the provided target doesn't affect evidence lookup, as `valint` tries to find all matching evidence for the rules.
+For the rules that fail to find any evidence, the `open` result is returned.
+
+### Rules that don't require evidence
+
+If a rule doesn't require any evidence to be verified, the `skip-evidence` flag can be used in the rule configuration:
+
+```yaml
+...
+skip-evidence: true
+...
+```
+
+### Rules that require the Scribe API
+
+If a rule requires an API call to be verified, it can use the `require-scribe-api` flag to ensure that all the uploaded attestations are processed and the API is ready to be used:
+
+```yaml
+...
+require-scribe-api: true
+...
+```
+
+`valint` will try to reach the Scribe API and wait for it to be ready. The waiting timeout is set by the `--timeout` flag and defaults to 2 minutes.
+If the API is not ready, the rule will produce the `open` result the same way as when no evidence is found. This can be changed with the `fail-on-missing-evidence` flag, see the [Rules that should fail on missing evidence](#rules-that-should-fail-on-missing-evidence) section.
+
+### Rules that should fail on missing evidence
+
+By default, if no evidence for a rule is found, it returns an "open" result, meaning that there was insufficient information to decide whether there are any violations. If a rule should fail in that case, the `fail-on-missing-evidence` flag can be used:
+
+```yaml
+...
+fail-on-missing-evidence: true
+...
+```
+
+### Rich text support in rule results
+
+To make rule results more readable, one can specify the `--beautify` flag at runtime. This allows `valint` to use emojis and hyperlinks in result tables.
+It affects both `valint` logs and other outputs, except for SARIF.
diff --git a/docs/valint/policies.md b/docs/valint/policies.md
deleted file mode 100644
index 5c56ffbc2..000000000
--- a/docs/valint/policies.md
+++ /dev/null
@@ -1,835 +0,0 @@
----
-sidebar_label: "Applying policies"
-title: Applying policies
-author: mikey strauss - Scribe
-sidebar_position: 5
-date: April 5, 2021
-geometry: margin=2cm
----
-
-# Policies
-
-Each `policy` proposes to enforce a set of requirements (aka `rules`) your supply chain must comply with. The outcome of a policy evaluation is a policy result attestation, a report that details the rule evaluatoin results and references to the provided evidence.
-Policy configuration can be set under the main configuration `policies` section.
-
-A `policy` consists of a set of `rules` and is verified if all of them are evaluated and verified.
-A `rule` is verified if ANY `evidence` is found that complies with the `rule` configuration and setting.
-
-### Usage
-
-Policies can be configured as part of Valint configuration file, under the `policies` section
-
-```yaml
-attest:
- cocosign:
- policies: # Set of policies - grouping rules
- - name:
- rules: # Set of rule settings/configuration and input
- - name: ""
- path: "" # Specify if an external script is used
- description: "A brief rule description"
- aggregate-results: false # Aggregate all of the rule violations to a single SARIF result
- labels: [] # list of user-specified labels
- initiatives: [] # list of related initatives, like SLSA, SSDF, etc.
- evidence: #Evidence lookup parameters
- signed: false
- format-type:
- filter-by: [] # A group of Context fields to use for the evidence lookup
- with: {} # rule input, depending on the rule type
-```
-
-Or as a separate file, referenced in `--policy` flag (Early Availability, [see below](#external-policy-configs---early-availability))
-
-```yaml
-defaults:
- labels: []
- initiatives: []
- evidence:
- signed: false
- format-type:
- filter-by: []
-env: # File-wise environment variables for the template engine (see below)
- ENV_VAR_1: "value"
-name:
-rules: # Set of rule settings/configuration and input
- - name: ""
- path: "" # Specify if an external script is used
- description: "A brief rule description"
- aggregate-results: false # Aggregate all of the rule violations to a single SARIF result
- labels: [] # list of user-specified labels
- initiatives: [] # list of related initatives, like SLSA, SSDF, etc.
- evidence: #Evidence lookup parameters
- signed: false
- format-type:
- filter-by: [] # A group of Context fields to use for the evidence lookup
- with: {} # rule input, depending on the rule type
-```
-
-> Note the `defaults` section, which allows you to override values for the underlying rules, including evidence lookup parameters (which are used as defaults), labels and initatives (both appended to the existing lists).
-
-> Also note file-wise `env` values, used by `valint` for the [templating engine](#templating-policy-params).
-
-A single rule can also be described in a separate file and referenced by `--rule` flag (Early Availability, [see below](#external-policy-configs---early-availability))
-
-```yaml
-name: ""
-path: "" # Specify if an external script is used
-description: "A brief rule description"
-aggregate-results: false # Aggregate all of the rule violations to a single SARIF result
-labels: [] # list of user-specified labels
-initiatives: [] # list of related initatives, like SLSA, SSDF, etc.
-evidence: #Evidence lookup parameters
- signed: false
- format-type:
- filter-by: [] # A group of Context fields to use for the evidence lookup
-with: {} # rule input, depending on the rule type
-```
-
-> For configuration details, see the [configuration](./configuration.md) section.
-
-> For PKI configuration, see the [attestations](https://scribe-security.netlify.app/docs/valint/attestations) section.
-
-### Policy
-
-Policy support the following fields:
-
-* `disable`, disable rule (default _false_).
-* `name`, policy name (**required**).
-* `rules`, list of policy rule configuration.
-
-The field `name` can be omitted. In this case, the policy will be evaluated as a default policy.
-If `rules` section is empty, the whole policy will be omitted.
-
-# Policy rules
-
-A rule is a compliance check that you can configure to your specific organization's requirements.
-
-* `disable`, disable rule (default _false_).
-* `name`, policy rule name (**required**).
-* `type`, type of the rule, currently supporting only `verify-artifact` (which is used as a default and therefore can be omitted).
-* `description`, rule description (_optional_).
-* `labels`, list of user-specified labels (_optional_).
-* `initiatives`, list of related initiatives, like SLSA, SSDF, etc. (_optional_).
-* `path`, path to a custom rule script **OR** `script`, embedded rule script.
-* `script-lang` script language, currently only `rego` is supported.
-* `evidence`, match on evidence with a specified parameters (see full description below).
-* `with`, rule-specific configuration parameters (for the detailed description, see the docs for the specific rule).
-
-> For `evidence` details, see [Rule Configuration](#configuration) section.
-> For `with` details, see related rule section.
-
-## Verify Artifact rule type
-
----
-A rule of Verify Artifact type verifies some properties of an artifact. Examples of such checks are:
-
-* Signed Evidence: The artifact should include signed or unsigned evidence, as specified by the `signed` field in the input.
-* Signing Identity: The artifact should be signed by a specific identity, as specified by the `identity` fields in the input (for signed evidence).
-* Evidence Format: The evidence format should follow the specified format(s) provided in the `format-type` field of the input.
-* Origin of artifact: The artifact should originate from an expected source, as specified by the `evidence` [origin labels](##origin-context).
-For instance, you can verify that an artifact is generated from a particular pipeline or repository.
-* Artifact details: The rule applies to a specific artifact or any group of artifacts, as specified by the `evidence` [subject labels](##subject-context).
-* Policy as code: The rule allows extension of the verification using custom scripts, as specified by the `path` or `script` input.
-
-### Use cases
-
-A rule of `verify-artifact` type can be used to enforce compliance with specific supply chain requirements, such as:
-
-* Images must be signed and have a matching CycloneDX SBOM.
-* Images must be built by a CircleCI workflow and produce a signed SLSA provenance.
-* Tagged sources must be signed and verified by a set of individuals or processes.
-* Released binaries must be built by Azure DevOps on a specific git repository using unsigned SLSA provenance.
-
-### Configuration
-
-```yaml
-- name: "" # Any user provided name
- description: "A brief rule description"
- aggregate-results: false # Aggregate all of the rule violations to a single SARIF result
- evidence:
- signed: # Define if target should be signed
- format-type: "" # Expected evidence format
- filter-by: [] # A group of Context fields to use for the evidence lookup
- {environment-context} # Any Evidence Context field is also supported for matching
- with:
- identity:
- emails: [] # Signed email identities
- uris: [] # Signed URIs identities
- common-names: [] # Signed common name identities
- {custom script input} # Any rule-specific input
- path: # OR script
- script-lang: rego # Currently only rego is supported
- script: | # OR path
- package verify
-
- verify = v {
- v := {
- "allow": {Custom policy validation}
- }
- }
-```
-
-### Examples
-
-Copy the Examples into a file named `.valint.yaml` in the same directory as running Valint commands.
-
-> For configuration details, see [configuration](./configuration.md) section.
-
-
- Signed Images policy
-In this example, the policy rule named `signed_image` will evaluate images where signed by `mycompony.com` using `attest-cyclondex-json` format.
-
-```yaml
-attest:
- cocosign:
- policies:
- - name: my_policy
- rules:
- - name: signed_image
- evidence:
- signed: true
- format-type: cyclonedx
- target_type: image
- with:
- identity:
- common-names:
- - mycompany.com
-```
-
-**Command:**
-Run the command on the required supply chain location.
-
-```bash
-# Generate required evidence, requires signing capabilities.
-valint bom busybox:latest -o attest
-
-# Verify policy (cache store)
-valint verify busybox:latest
-```
-
-
-
-
- Image SLSA provenance policy
-In this example, the policy rule named `slsa_prov_rule` will evaluate images where signed by `bob@mycompany.com` or `alice@mycompany.com` using `attest-slsa` format.
-
-```yaml
-attest:
- cocosign:
- policies:
- - name: my_policy
- rules:
- - name: slsa_prov_rule
- evidence:
- signed: true
- format-type: slsa
- target_type: image
- with:
- identity:
- emails:
- - bob@mycompany.com
- - alice@mycompany.com
-```
-
-***Command:**
-Run the command on the required supply chain location.
-
-```bash
-# Generate required evidence, requires signing capabilities.
-valint bom busybox:latest -o attest-slsa
-
-# Verify policy (cache store)
-valint verify busybox:latest
-```
-
-
-
-
- Signed tagged sourced rule
-In this example, the policy rule named "tagged_git_rule" will evaluate sources' `mycompany/somerepo` tags where defined in the `main` branch and signed by `bob@mycompany.com`.
-
-> The policy requires only the **HEAD** of the git target to comply to the policy not the entire history.
-
-```yaml
-attest:
- cocosign:
- policies:
- - name: my_policy
- rules:
- - name: tagged_git_rule
- evidence:
- signed: true
- format-type: slsa
- target_type: git
- target_git_url: git@github.com:mycompany/somerepo.git # Git url of the target.
- branch: main
- with:
- identity:
- emails:
- - bob@mycompany.com
-```
-
-***Command:**
-Run the command on the required supply chain location.
-
-```bash
-# Generate required evidence, requires signing capabilities.
-valint bom git:github.com:your_org/your_repo.git --tag 0.1.3 -o attest-slsa
-
-# Verify policy (cache store)
-valint verify git:github.com:your_org/your_repo.git --tag 0.1.3 -i statement-slsa
-```
-
-
-
-
- Binary verification
-In this example, the policy, named "binary_origin" enforces requirements on the binary `my_binary.exe` was Originated from which Azure DevOps triggered by the `https://dev.azure.com/mycompany/somerepo` repo.
-The policy rule also enforces an unsigned SLSA provenance statement is produced as evidence.
-
-```yaml
-attest:
- cocosign:
- policies:
- - name: my_policy
- rules:
- - name: binary_origin
- evidence:
- signed: false
- format-type: slsa
- target_type: file
- context_type: azure
- git_url: https://dev.azure.com/mycompany/somerepo # Git url of the environment.
- input_name: my_binary.exe
-```
-
-***Command:**
-Run the command on the required supply chain location.
-
-```bash
-# Generate required evidence
-valint bom file:my_binary.exe -o statement-slsa
-
-# Verify policy (cache store)
-valint verify file:my_binary.exe
-```
-
-
-
-
- 3rd party verification
-In this example, the policy rule named "3rd-party-scan" will evaluate scanned `3rd-party-scan.json` file, Originated from Azure DevOps triggered by the `https://dev.azure.com/mycompany/somerepo` and signed by `bob@mycompany.com`.
-
-```yaml
-attest:
- cocosign:
- policies:
- - name: my_policy
- rules:
- - name: 3rd-party-rule
- evidence:
- signed: true
- format-type: generic
- target_type: generic
- context_type: azure
- git_url: https://dev.azure.com/mycompany/somerepo
- git_branch: main
- input_name: 3rd-party-scan.json
- with:
- identity:
- emails:
- - bob@mycompany.com
-```
-
-***Command:**
-Run the command on the required supply chain location.
-
-```bash
-# Generate required evidence
-valint evidence 3rd-party-scan.json -o attest --predicate-type https://scanner.com/scan_format
-
-# Verify policy (cache store)
-valint verify 3rd-party-scan.json -i attest-generic --predicate-type https://scanner.com/scan_format
-```
-
-
-
-### Policy as Code
-
-You can define custom policies for artifacts verified by the rule by attaching them as code. After the rule enforces the origin and subject of the evidence, you can further analyze and customize the content to meet your organization's requirements.
-
-### Usage
-
-The following rule verifies the predicate of the evidence in a custom Rego script embedded in the policy.
-
-```yaml
-- name: signed_image_custom_policy
- evidence:
- signed: true
- format-type: cyclonedx
- target_type: image
- with:
- identity:
- common-names:
- - mycompany.com
- script: |
- package verify
- default allow = false
- verify = {
- "allow": allow
- }
-
- allow = {
- input.evidence.predicate-type == "https://cyclonedx.org/bom"
- }
-```
-
-#### Rego script
-
-In order to add a verification script you must provide a `verify` rule in your script.
-A Rego script can be provided in two forms: as an embedded code snippet in the `script` section or as a dedicated file using the `path` field.
-
-> By default `valint` looks for a `.valint.rego` file.
-
-Use the following rule structure.
-
-```bash
-package verify
-default allow = false
-
-verify = {
- "allow": false,
- "violation": {
- "type": "violation_type",
- "details": [],
- },
- "summary": [{
- "allow": false,
- "violations": count(violations),
- "reason": "some reason string"
- }],
-}
-```
-
-#### Input structure
-
-Script input has the following structure.
-
-```yaml
-evidence: {Intoto-statment}
-verifier: {verifier-context}
-config:
-args: {custom script input}
-stores:
- oci: {OCI store configuration}
- cache: {Cache store configuration}
- scribe: {Scribe store configuration}
-```
-
-> When using Signed Attestations, the Custom Rego script receives the raw In-toto statement along with the identity of the signer.
-
-#### Output structure
-
-Script output must provide the following structure.
-
-```json
-{
- "allow": bool, # Required
- "summary": [ # Optional
- {
- "allow": bool,
- "type": "string",
- "details": "string",
- "violations": "int",
- "reason": "string"
- },
- ],
- "errors": [], # Optional
- "violation": [ # Optional
- {
- "type": "string",
- "details": [{}],
- },
- ]
-}
-```
-
-### Examples
-
-Copy the Examples into a file named `.valint.yaml` and Copy Examples custom script into file name `.valint.rego`.
-Files should be in the same directory as running Valint commands.
-
-> For configuration details, see [configuration](./configuration.md) section.
-> You may also use `path` field to set a custom path for your script.
-
-
-
- Custom package policy
-In this example, the policy rule named `custom-package-policy` to verify a custom package requirements.
-In the example Alpine packages are forbidden.
-
-```yaml
-attest:
- cocosign:
- policies:
- - name: my_policy
- rules:
- - name: signed_image
- evidence:
- signed: true
- format-type: cyclonedx
- target_type: image
- script: |
- package verify
- import data.policies.sbom_parser as parser
- default allow = false
-
- verify = v {
- v := {
- "allow": allow,
- "violation": violation(input.evidence.predicate.bom.components),
- }
- }
-
- allow {
- v := violation(input.evidence.predicate.bom.components)
- count(v) == 0
- input.evidence.predicateType == "https://cyclonedx.org/bom"
- }
-
- violation(components) = v {
- v := { x |
- some i
- comp := components[i]
- comp.type == "library"
- comp.group == "apk"
- x := comp["purl"]
- }
- }
-```
-
-**Command:**
-Run the command on the required supply chain location.
-
-```bash
-# Generate required evidence, requires signing capabilities.
-valint bom busybox:latest -o attest
-
-# Verify policy (cache store)
-valint verify busybox:latest
-```
-
-
-
-## Default policy
-
-When no policy configuration is found, the signed artifact policy is used.
-
-By default, the following command runs a signature and identity verification on the target provided:
-
-```bash
-valint verify [target] --input-format [attest, attest-slsa] \
- --email [email] --common-name --uri [uri]
-```
-
-In other words, the Signed Artifact policy allows you to verify signature compliance and format of artifacts in your supply chain.
-
-> For full command details, see [valint verify](#evidence-verification---verify-command) section.
-
-
- Default Policy Evaluation
-The default policy can also be evaluated as the following policy configuration:
-
-```yaml
-attest:
- cocosign:
- policies:
- - name: default-policy
- rules:
- name: "default-rule"
- evidence:
- signed: true
- format: ${current.content_type} # Populated by --input-format flag.
- sbomversion: ${current.sbomversion} # Populated from the artifact version provided to verify command.
- with:
- identity: # Populated by `--email`, `--uri` and `--common-name flags sets
-```
-
-> For rule details, see [verify artifact rule](#verify-artifact-rule) section.
-
-
-
-## Templating policy params
-
-The template engine for policy configuration provides users with a flexible mechanism to define and customize policies through the use of template arguments. These template arguments act as placeholders within the policy configuration, allowing users to dynamically substitute values before the policy is evaluated.
-
-Currently `valint` supports three groups of template arguments:
-
-1. Context-defined
-Context arguments are derived from the evidence context, enabling users to directly reference any field within it. The syntax for referencing a context variable is as follows: `{{ .Context. }}`.
-Replace `` with the specific variable name from the evidence context that you want to use. Foe example, `{{ .Context.git_commit }}`.
-
-2. Environment-defined
-Environment arguments are derived from the environment variables. The syntax for referencing an environment variable is as follows: `{{ .Env. }}`.
-Note that one can define file-wise environment variables in the policy configuration file under the `env` field. These variables will only be used for the template evaluations in the file where they are defined.
-
-3. User-defined
-Users can pass custom arguments through the command line using the `--rule-args` flag. These user-defined arguments are then referenced in the policy configuration using the following syntax: `{{ .Args. }}`.
-
-For example,
-
-```bash
-valint verify git:repo.git --rule-args "my_arg"="foo"
-```
-
-In the policy configuration: `{{ .Args.my_arg }}`.
-
-***Replacement and Error Handling***
-
-Before a policy is evaluated, template engine performs a substitution of templated arguments with the corresponding values.
-If the replacement process encounters an issue, such as no value provided for a variable used by the configuration, an error is issued and policy evaluation is halted.
-
-
- Usage
-
-This example demonstrates the use of template arguments in a policy configuration. The policy requires that the evidence is generated from a specific git repository and branch. The git repository and branch should beare passed as arguments to the policy using the `--rule-args` flag as `--rule-args git_url= --rule-args git_branch=`. The target_type is passed as a field from the evidence context.
-
-```yaml
-attest:
- cocosign:
- policies:
- - name: my_policy
- rules:
- - name: my_rule
- with:
- signed: true
- format-type: cyclonedx
- target_type: '{{ .Context.target_type }}'
- git_url: '{{ .Args.git_url }}'
- git_branch: '{{ .Args.git_branch }}'
-```
-
-
-
-## Filtering Policy Rules (Early Availability)
-
-Since policy rules can be labeled with user-defined labels and also can be a part of one ore more initiatives, it's possible to filter them by these parameters on runtime. For this purpose, `valint` has flags `--rule-label` and `--initiative` respectively.
-
-When using these flags, `valint` will only evaluate the rules that match the provided labels and/or initiatives. In order to be run, a rule should match all the provided labels and/or any of the initiatives. If a rule doesn't match the requirements, it will be disabled. Similarly, if no rules in a policy match the requirements, the policy will be omitted.
-
-## Evidence Lookup
-
-In order to run a policy rule, `valint` requires relevant evidence, which can be found in a storage using a number of parameters. These parameters can be set manually by the user or automatically derived from the context. Parameters that can be derived automatically are categorized into three context groups: "target," "pipeline", and "product".
-
-1. `target` context group specifies parameters that can be derived from the target provided (if any). Those parameters are:
- * `target_type` - the type of the target provided (e.g., image, git, generic etc.)
- * `sbomversion` - the version of the SBOM provided (usually it's sha256 or sha1 hash)
-
-2. `pipeline` context group specifies parameters that can be derived from the running environment. Those parameters are:
- * `context_type` - type of the environment (e.g., local, github, etc.)
- * `git_url` - git url of the repository (if any)
- * `git_commit` - git commit of the current repository state (if any)
- * `run_id` - run id
- * `build_num` - build number
-
-3. `product` context group specifies product parameters that can be derived from the command line arguments. Those parameters are:
- * `name` - name of the product
- * `product_version` - version of the product
- * `predicate_type` - type of the predicate (e.g., https://cyclonedx.org/bom, https://slsa.dev/provenance/v0.1, etc.)
-
-User can specify any combination of these three groups or a special value `none` to indicate that the parameter should not be derived automatically.
-By default `target` and `product` groups are used.
-The list of groups to be used should be provided to the `attest.cocosign.policies..rules..evidence.filter-by` field in the configuration file.
-
-In addition, one can manually specify any parameters that they want to be matched by an evidence. For example, these can be `git_url` or `timestamp`.
-
-If more than one evidence is found, the newest one is used.
-
-
- Usage
-
-An example of using the `target` context group and a specific timestamp value is shown below:
-
-```yaml
-attest:
- cocosign:
- policies:
- - name: my_policy
- rules:
- - name: my_rule
- evidence:
- signed: true
- format-type: cyclonedx
- timestamp: "2023-11-16T09:46:25+02:00" # manually specified timestamp
- filter-by:
- - target
-```
-
-
-
-### Targetless Run
-
-Using `evidence` field it's possible to run a policy rule without providing a target. In this case, the evidence will be looked up using the provided parameters for each rule and no values from any target will be used (simply, the `filter-by: target` flag will be ignored).
-To be able to run `valint verify` in targetless mode, the `evidence` field in a rule config should describe the needed evidence well enough.
-In the following example, the newest evidence of `target_type: image` for the provided product (defined by the name & version) will be used.
-
-```yaml
-# my_policy.yaml
-attest:
- cocosign:
- policies:
- - name: my_policy
- rules:
- - name: my_rule
- evidence:
- signed: true
- format-type: cyclonedx
- target_ttpe: image
- filter-by:
- - product
- with:
- identity:
- emails:
- - my@email.com
-```
-
-```bash
-valint bom busybox:latest -o attest --product-key my_product --product-version 1.0.0
-```
-
-```bash
-valint verify --product-key my_product --product-version 1.0.0 -c my_policy.yaml
-```
-
-## External policy configs - Early Availability
-
-Policy or rule configuration can be set not only in the main configuration file but also in external files. This can be useful when you want to reuse the same policy configuration for different targets or as a part of a configuration bundle or when you just want to keep your main configuration file clean.
-
-External policy/rule configuration can be set in a separate file and then referenced in the cmd args via the `--policy/--rule` flag correspondingly or in the main configuration file via the `attest.policy_configs` field of type `[]string`.
-
-Each extermal configuration should represent an entry to `attest.cocosign.policies` or to `attest.cocosign.policies[].rules` field of the main configuration file.
-
-For example, a policy configuration defined by the following file:
-
-```yaml
-attest:
- cocosign:
- policies:
- - name: default
- rules:
- - name: "default-rule"
- evidence:
- signed: true
- format-type: cyclonedx
- with:
- identity:
- emails:
- - my@email.com
-```
-
-Can be represented in an external `policy` file like
-
-```yaml
-name: default
-rules:
- - name: "default-rule"
- evidence:
- signed: true
- format-type: cyclonedx
- with:
- identity:
- emails:
- - my@email.com
-```
-
-or in an external `rule` file like
-
-```yaml
-name: "default-rule"
-evidence:
- signed: true
- format-type: cyclonedx
-with:
- identity:
- emails:
- - my@email.com
-```
-
-One can reference several policies/rules configs per `valint verify` run.
-
-When using `--policy/--rule` flag, `valint` will first lookup the config in local FS and if not found, will try to use a config from the bundle (if used).
-
-### Bundle policy configs - Early Availability
-
-Policy configurations along with the corresponding rego scripts can be bundled together in a directory or a git repo and then referenced in the cmd args via the `--bundle` flag or in the main configuration file via the `attest.bundle` field.
-In case of using a git repo, it's possible to also specify a branch and a commit or a tag to be used with `--git-branch`, `--git-commit` and `--git-tag` options respectively. The repo would be cloned automatically by `valint`.
-For the GitHub authentication, a token can be provided via `GITHUB_TOKEN` environment variable or as part of url like `@github.com`.
-
-To reference a policy/rule in a bundle, the relative path to the bundle root should be provided in the `--policy/--rule` flag correspondingly.
-
-#### Default bundle
-
-By default, `valint` defaults to work with [scribe-public/sample-policies](https://github.com/scribe-public/sample-policies) as a bundle. One can use its rules out of the box by providing the rule name in the `--policy/--rule` flags. If no `--policy` or `--rule` flag is provided or the `--skip-bundle` flag is used, no bundle will be downloaded.
-
-#### Reusing bundle rules
-
-The "uses" flag in rule descriptions allows users to utilize external configurations from a bundle as a base for creating custom rules. This feature simplifies reusing of bundle rules with different parameters.
-
-For example, lets reuse bundle config `v1/images/fresh-image.yaml`. Let's create a local rule config file:
-
-```yaml
-uses: images/fresh-image@v1
-with:
- max_days: 1000
-```
-
-Note that the config file extension is applied by `valint` automatically, there's no need to specify it.
-
-The value `with.max_days: 1000` will override the default from the bundle config, the other values will remain the same. If needed, one can override any other value from the bundle config.
-
-It's also possible to create a policy config utilizing multiple bundle rules:
-
-```yaml
-rules:
- - uses: images/fresh-image@v1
- with:
- max_days: 1000
- - uses: images/forbid-large-images@v1
-```
-
-Such policy configs can later be referenced in the `--policy` flag (see examples below).
-
-### Examples
-
-To run an external policy, say, on a docker image target, first we need to create an image SBOM:
-
-```bash
-valint bom busybox:latest -o attest
-```
-
-Then, if we have a policy rule like
-
-```yaml
-name: "default-rule"
-evidence:
- signed: true
- format-type: cyclonedx
-with:
- identity:
- emails:
- - my@email.com
-```
-
-saved in `path/to/rule.yaml`, we can run the policy:
-
-```bash
-valint verify busybox:latest --rule /path/to/rule.yaml
-```
-
-If the rule is a part of a bundle and the path in the bundle looks like `v1/images/rule.yaml`, then we can run it like
-
-```bash
-valint verify busybox:latest --bundle https://github.com/user/bundle --git-tag v1.0.0 --rule images/rule@v1
-```
-
-An example of policy evaluation results can be found in the [policy results](policy-results) section.
diff --git a/docs/valint/policy-results.md b/docs/valint/policy-results.md
index 2d051de99..cfe4a3c83 100644
--- a/docs/valint/policy-results.md
+++ b/docs/valint/policy-results.md
@@ -36,6 +36,27 @@ It's also possible to determine how policy results are included in the output. T
+## Policy results in valint logs
+
+After policy evaluation, the results are shown in the output log as a table. This table provides a quick overview of the evaluation results for each rule, as well as the overall control results. For an example of the output, see the [Example](#example) section.
+
+The results of the control verification are presented in a table format. The table consists of the following columns:
+
+* `RULE ID`: The unique identifier of the rule.
+* `RULE NAME`: The name of the rule.
+* `LEVEL`: The severity level of the rule. Only rules with the "error" level can fail the control.
+* `VERIFIED`: A boolean value indicating whether the evidence signature was verified. Verification failure causes the rule to fail only if the rule requires a signed attestation.
+* `RESULT`: The result of the rule verification. It can be "pass", "fail" or "open".
+* `SUMMARY`: The reason for the rule result.
+* `TARGET`: The target asset of the rule verification.
+
+The results of the initiative verification are also presented in a table format. The table consists of the following columns:
+
+* `CONTROL ID`: The unique identifier of the control.
+* `CONTROL NAME`: The name of the control.
+* `RULE LIST`: A list of rules that were verified for the control. Each rule is mentioned as many times as it was verified. In parentheses, the rule's result is shown with consideration of the rule level: for example, if the rule failed, but the level was set to `warning`, the result of the rule evaluation will also be `warning`.
+* `RESULT`: The result of the control verification. It can be "pass", "fail" or "open".
+
## Example
To illustrate the process of creating attestations and evaluating policy results, consider the following example. In this case, we'll create a signed SBOM (Software Bill of Materials) evidence for the busybox image and then evaluate it against a policy named image-fresh.
@@ -48,29 +69,70 @@ valint bom busybox:latest -o attest
We first use `valint bom` command generates a signed SBOM evidence for the busybox image using the default output format, which is an in-toto statement (attest).
-Evaluate Policy:
+Evaluate Initiative:
```bash
-valint verify busybox:latest -i attest --rule v1/images/image-fresh.yaml
+valint verify busybox:latest --initiative ssdf@v2
```
-Next we use `valint verify` command to evaluate the busybox image against the specified policy rule (`image-fresh.yaml`).
-> The `--rule` option is currently in Early Availability.
-After executing these commands, the results of the policy evaluation are displayed in the output log as a table, summarizing the evaluation for each rule:
+Next we use `valint verify` command to evaluate the busybox image against the corresponding set of rules from the SSDF initiative.
+
+After executing these commands, the results of the evaluation are displayed in the output log as a table, summarizing the evaluation for each rule:
After policy evaluation, the results are shown in the output log as a table:
```bash
-┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
-│ Policy "default" Evaluation Summary │
-├─────────────────────────┬────────┬────────────────────────┬───────────────────┬──────────────────────────────────────────────┤
-│ RULE NAME │ SIGNED │ SIGNATURE VERIFICATION │ POLICY EVALUATION │ COMMENT │
-├─────────────────────────┼────────┼────────────────────────┼───────────────────┼──────────────────────────────────────────────┤
-│ fresh-image │ true │ passed │ passed │ 1/1 evidence origin and signature verified, │
-│ │ │ │ │ image is new enough │
-├─────────────────────────┼────────┼────────────────────────┼───────────────────┼──────────────────────────────────────────────┤
-│ AGGREGATE POLICY RESULT │ │ │ PASSED │ │
-└─────────────────────────┴────────┴────────────────────────┴───────────────────┴──────────────────────────────────────────────┘
+INFO PS/PS.2/PS.2.1: Control "Make software integrity verification information available to software acquirers" Evaluation Summary:
+┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
+│ [PS/PS.2/PS.2.1] Control "Make software integrity verification information available to software acquirers" Evaluati │
+│ on Summary │
+├────────────────┬──────────────────┬───────┬──────────┬────────┬─────────────────────────────┬────────────────────────┤
+│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │
+├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────────────┤
+│ sbom-is-signed │ Image-verifiable │ none │ true │ pass │ Evidence signature verified │ busybox:1.36.1 (image) │
+├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────────────┤
+│ CONTROL RESULT │ │ │ │ PASS │ │ │
+└────────────────┴──────────────────┴───────┴──────────┴────────┴─────────────────────────────┴────────────────────────┘
+INFO PS/PS.3/PS.3.1: Control "Securely archive the necessary files and supporting data to be retained for each software release" Evaluation Summary:
+┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
+│ [PS/PS.3/PS.3.1] Control "Securely archive the necessary files and supporting data to be retained for each software │
+│ release" Evaluation Summary │
+├───────────────────┬───────────────────┬───────┬──────────┬────────┬─────────────────────────┬────────────────────────┤
+│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │
+├───────────────────┼───────────────────┼───────┼──────────┼────────┼─────────────────────────┼────────────────────────┤
+│ provenance-exists │ Provenance exists │ error │ false │ fail │ SLSA Provenance missing │ busybox:1.36.1 (image) │
+├───────────────────┼───────────────────┼───────┼──────────┼────────┼─────────────────────────┼────────────────────────┤
+│ CONTROL RESULT │ │ │ │ FAIL │ │ │
+└───────────────────┴───────────────────┴───────┴──────────┴────────┴─────────────────────────┴────────────────────────┘
+INFO PS/PS.3/PS.3.2: Control "Collect, safeguard, maintain, and share provenance data for all components of each software release" Evaluation Summary:
+┌───────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
+│ [PS/PS.3/PS.3.2] Control "Collect, safeguard, maintain, and share provenance data for all components of each soft │
+│ ware release" Evaluation Summary │
+├────────────────┬───────────────┬───────┬──────────┬────────┬─────────────────────────────┬────────────────────────┤
+│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │
+├────────────────┼───────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────────────┤
+│ sbom-is-signed │ SBOM archived │ none │ true │ pass │ Evidence signature verified │ busybox:1.36.1 (image) │
+├────────────────┼───────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────────────┤
+│ CONTROL RESULT │ │ │ │ PASS │ │ │
+└────────────────┴───────────────┴───────┴──────────┴────────┴─────────────────────────────┴────────────────────────┘
+INFO SSDF: Initiative "SSDF Client Initiative" Evaluation Summary:
+┌────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
+│ [SSDF] Initiative "SSDF Client Initiative" Evaluation Summary │
+├───────────────────┬──────────────────────────────────────────────────────────────────┬────────────────────────────┬────────┤
+│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │
+├───────────────────┼──────────────────────────────────────────────────────────────────┼────────────────────────────┼────────┤
+│ PS/PS.2/PS.2.1 │ Make software integrity verification information available to so │ - Image-verifiable (pass) │ pass │
+│ │ ftware acquirers │ │ │
+├───────────────────┼──────────────────────────────────────────────────────────────────┼────────────────────────────┼────────┤
+│ PS/PS.3/PS.3.1 │ Securely archive the necessary files and supporting data to be r │ - Provenance exists (fail) │ fail │
+│ │ etained for each software release │ │ │
+├───────────────────┼──────────────────────────────────────────────────────────────────┼────────────────────────────┼────────┤
+│ PS/PS.3/PS.3.2 │ Collect, safeguard, maintain, and share provenance data for all │ - SBOM archived (pass) │ pass │
+│ │ components of each software release │ │ │
+├───────────────────┼──────────────────────────────────────────────────────────────────┼────────────────────────────┼────────┤
+│ INITIATIVE RESULT │ │ │ FAIL │
+└───────────────────┴──────────────────────────────────────────────────────────────────┴────────────────────────────┴────────┘
+Evaluation Target Name 'index.docker.io/library/busybox:latest'
```
Moreover, the Sarif result is produced and dispatched as evidence, providing the option for it to be signed based on specific requirements. This signing capability enhances the integrity and authenticity of the generated evidence, ensuring a secure and verifiable representation of the policy evaluation results.
@@ -80,10 +142,10 @@ Moreover, the Sarif result is produced and dispatched as evidence, providing the
```bash
# Create a signed SBOM (Software Bill of Materials) evidence for the 'busybox' image
-valint bom busybox:latest -o attest
+valint bom busybox:latest -o attest
# Verify signed evidence for 'busybox' and export a signed evidence for Policy results
-valint verify busybox:latest -i attest -o attest
+valint verify busybox:latest -i attest -o attest
```
In this example, we generate a signed SBOM evidence for the 'busybox' image using the valint bom command. Subsequently, the valint verify command evaluates the signed evidence for 'busybox' (`-i attest`) and the -o flag to export a signed evidence for Policy results (`-o attest`).
@@ -97,611 +159,1498 @@ Results are also presented as a SARIF report inside an in-toto statement.
```json
{
- "_type": "https://in-toto.io/Statement/v0.1",
- "predicateType": "http://docs.oasis-open.org/sarif/sarif/2.1.0",
- "subject": [
- {
- "name": "",
- "digest": {
- "sha256": "0aad8ad1c18814a2389319186fdd0473e78ca8cd69a36a8d322bfda3fdbb5216"
- }
- }
- ],
- "predicate": {
- "environment": {
- "hostname": "runner_1",
- "user": "username",
- "name": "busybox",
- "product_version": "v0.1",
- "timestamp": "2024-01-23T15:47:22+02:00",
- "input_scheme": "docker",
- "input_name": "busybox",
- "input_tag": "latest",
- "content_type": "statement-sarif",
- "context_type": "local",
- "predicate_type": "http://docs.oasis-open.org/sarif/sarif/2.1.0",
- "tool": "valint",
- "tool_version": "1.0.0-18",
- "format_type": "sarif",
- "format_version": "2.1.0",
- "format_encoding": "json",
- "imageID": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824",
- "repoDigest": [
- "busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79"
- ],
- "tag": [
- "latest",
- "1.36.1",
- "latest"
- ],
- "size": 4261550,
- "platform": "linux/amd64",
- "target_type": "policy-results",
- "sbomgroup": "generic",
- "sbomname": "index.docker.io/library/busybox:latest",
- "sbomversion": "sha256:0aad8ad1c18814a2389319186fdd0473e78ca8cd69a36a8d322bfda3fdbb5216",
- "sbomhashs": [
- "sha256-0aad8ad1c18814a2389319186fdd0473e78ca8cd69a36a8d322bfda3fdbb5216"
- ],
- "sbompurl": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64",
- "policies": [
- "my_policy",
- "default"
- ],
- "rules": [
- "signed_image",
- "fresh-image"
- ],
- "rule_types": [
- "verify-artifact",
- "verify-artifact"
- ],
- "allow": true,
- "policy-scripts": {
- "": "",
- "fresh-image.rego": "e90241897259b16872cbcb61acad6b8cc61898b11f73d8b7f4a3f58c7d5f1319"
- }
- },
- "mimeType": "application/json",
- "content": {
- "version": "2.1.0",
- "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
- "runs": [
+ "_type": "https://in-toto.io/Statement/v0.1",
+ "predicateType": "http://docs.oasis-open.org/sarif/sarif/2.1.0",
+ "subject": [
{
- "tool": {
- "driver": {
- "informationUri": "https://scribesecurity.com",
- "name": "valint",
- "rules": [
- {
- "id": "signed_image",
- "name": "my_policy",
- "shortDescription": {
- "text": "my_policy.signed_image"
- },
- "fullDescription": {
- "text": ""
- },
- "defaultConfiguration": {
- "level": "error"
- },
- "help": {
- "text": "my_policy.signed_image",
- "markdown": "## rule details\n\u003e **Signed evidence:** yes\n\u003e **Format:** attest-cyclonedx-json\n\n\n### **Match criteria**\n```yaml\nname: busybox\nproduct_version: v0.1\ncontent_type: attest-cyclonedx-json\npredicate_type: https://cyclonedx.org/bom/v1.4\ntarget_type: image\nsbomversion: sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\n```\n\n\n### **Verified Evidence**\n```yaml\nhostname: runner_1\nuser: username\nname: busybox\nproduct_version: v0.1\ntimestamp: \"2024-01-23T15:43:58+02:00\"\ninput_scheme: docker\ninput_name: busybox\ninput_tag: latest\ncontent_type: attest-cyclonedx-json\ncontext_type: local\npredicate_type: https://cyclonedx.org/bom/v1.4\ntool: valint\ntool_version: 1.0.0-18\ntool_vendor: Scribe Security\nformat_type: cyclonedx\nformat_version: \"1.4\"\nformat_encoding: json\ngit_url: https://github.com/scribe-security/valint.git\ngit_branch: main\ngit_tag: v1.0.0-17\ngit_commit: 0a80c9d5372ecfbf4ff20a728f9ce5e68b371f45\ngit_ref: refs/heads/main\nimageID: sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\nrepoDigest:\n - busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79\ntag:\n - latest\n - 1.36.1\n - latest\nsize: 4261550\nplatform: linux/amd64\ntarget_type: image\nsbomgroup: image\nsbomname: index.docker.io/library/busybox:latest\nsbomversion: sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\nsbomhashs:\n - sha256-3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79\n - sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\nsbompurl: pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64\nref: /home/username/.cache/valint/sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824.bom.sig.json\nstore: cache\n```\n"
- },
- "properties": {
- "initiatives": null,
- "labels": null,
- "policy-name": "my_policy",
- "rule-type": "verify-artifact",
- "tags": [
- "attest-cyclonedx-json",
- "image",
- "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824",
- "https://cyclonedx.org/bom/v1.4",
- "scribe",
- "policy",
- "busybox",
- "v0.1",
- "local",
- "latest"
- ]
- }
- },
- {
- "id": "fresh-image",
- "name": "default",
- "shortDescription": {
- "text": "A rule to verify that the image is not older than a threshold"
- },
- "fullDescription": {
- "text": "The Verify Artifact rule enforces a custom policy script"
- },
- "defaultConfiguration": {
- "level": "error"
- },
- "help": {
- "text": "A rule to verify that the image is not older than a threshold",
- "markdown": "## rule details\n\u003e **Description:** A rule to verify that the image is not older than a threshold\n\u003e **Signed evidence:** yes\n\u003e **Format:** attest-cyclonedx-json\n\u003e **Script:** /home/username/scribe/sample-policies/v1/images/fresh-image.rego\n\n\n### **Match criteria**\n```yaml\nname: busybox\nproduct_version: v0.1\ncontent_type: attest-cyclonedx-json\npredicate_type: https://cyclonedx.org/bom/v1.4\ntarget_type: image\n```\n\n\n### **Policy arguments**\n```yaml\nmax_days: 1830\n```\n\n\n### **Verified Evidence**\n```yaml\nhostname: runner_1\nuser: username\nname: busybox\nproduct_version: v0.1\ntimestamp: \"2024-01-23T15:43:58+02:00\"\ninput_scheme: docker\ninput_name: busybox\ninput_tag: latest\ncontent_type: attest-cyclonedx-json\ncontext_type: local\npredicate_type: https://cyclonedx.org/bom/v1.4\ntool: valint\ntool_version: 1.0.0-18\ntool_vendor: Scribe Security\nformat_type: cyclonedx\nformat_version: \"1.4\"\nformat_encoding: json\ngit_url: https://github.com/scribe-security/valint.git\ngit_branch: main\ngit_tag: v1.0.0-17\ngit_commit: 0a80c9d5372ecfbf4ff20a728f9ce5e68b371f45\ngit_ref: refs/heads/main\nimageID: sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\nrepoDigest:\n - busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79\ntag:\n - latest\n - 1.36.1\n - latest\nsize: 4261550\nplatform: linux/amd64\ntarget_type: image\nsbomgroup: image\nsbomname: index.docker.io/library/busybox:latest\nsbomversion: sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\nsbomhashs:\n - sha256-3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79\n - sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\nsbompurl: pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64\nref: /home/username/.cache/valint/sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824.bom.sig.json\nstore: cache\n```\n"
- },
- "properties": {
- "initiatives": [
- "client-policy"
- ],
- "labels": [
- "images",
- "sample-policy-bundle"
- ],
- "policy-name": "default",
- "rule-type": "verify-artifact",
- "tags": [
- "policy",
- "busybox",
- "sample-policy-bundle",
- "v0.1",
- "attest-cyclonedx-json",
- "local",
- "image",
- "scribe",
- "client-policy",
- "images"
- ]
- }
- }
- ],
- "semanticVersion": "1.0.0-18",
- "version": "1.0.0-18"
+ "name": "index.docker.io/library/busybox:latest",
+ "digest": {
+ "sha256": "3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79"
}
- },
- "invocations": [
- {
- "commandLine": "valint verify busybox:latest --bundle=/home/username/scribe/sample-policies/ --config=/home/username/scribe/valint/valint2.yaml --policy=[v1/images/fresh-image.yaml] --product-key=busybox --product-version=v0.1 --verbose=2",
- "executionSuccessful": true,
- "exitSignalName": "passed"
+ },
+ {
+ "name": "index.docker.io/library/busybox:latest",
+ "digest": {
+ "sha256": "a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824"
}
- ],
- "results": [
- {
- "properties": {
- "verify-artifact.signed_image": [
- {
- "content_type": "attest-cyclonedx-json",
- "context_type": "local",
- "format_encoding": "json",
- "format_type": "cyclonedx",
- "format_version": "1.4",
- "git_branch": "main",
- "git_commit": "0a80c9d5372ecfbf4ff20a728f9ce5e68b371f45",
- "git_ref": "refs/heads/main",
- "git_tag": "v1.0.0-17",
- "git_url": "https://github.com/scribe-security/valint.git",
- "hostname": "runner_1",
- "imageID": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824",
- "input_name": "busybox",
- "input_scheme": "docker",
- "input_tag": "latest",
- "name": "busybox",
- "platform": "linux/amd64",
- "predicate_type": "https://cyclonedx.org/bom/v1.4",
- "product_version": "v0.1",
- "ref": "/home/username/.cache/valint/sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824.bom.sig.json",
- "repoDigest": [
- "busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79"
- ],
- "sbomgroup": "image",
- "sbomhashs": [
- "sha256-3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79",
- "sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824"
- ],
- "sbomname": "index.docker.io/library/busybox:latest",
- "sbompurl": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64",
- "sbomversion": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824",
- "size": 4261550,
- "store": "cache",
- "tag": [
- "latest",
- "1.36.1",
- "latest"
- ],
- "target_type": "image",
- "timestamp": "2024-01-23T15:43:58+02:00",
- "tool": "valint",
- "tool_vendor": "Scribe Security",
- "tool_version": "1.0.0-18",
- "user": "username"
- }
- ]
- },
- "ruleId": "signed_image",
- "ruleIndex": 0,
- "kind": "pass",
- "level": "note",
- "message": {
- "text": "Rule passed verify-artifact because 1/1 evidence origin and signature verified",
- "markdown": "Rule passed verify-artifact because 1/1 evidence origin and signature verified"
- },
- "locations": [
- {
- "physicalLocation": {
- "artifactLocation": {
- "uri": "index.docker.io/library/busybox?version=sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\u0026tag=latest"
- },
- "region": {
- "startLine": 1
- }
- },
- "message": {
- "text": "URL"
- }
- },
- {
- "physicalLocation": {
- "artifactLocation": {
- "uri": "busybox"
- },
- "region": {
- "startLine": 1
- }
- },
- "message": {
- "text": "PRODUCT"
- }
- },
- {
- "physicalLocation": {
- "artifactLocation": {
- "uri": "busybox"
- },
- "region": {
- "startLine": 1
- }
- },
- "message": {
- "text": "NAME"
- }
- },
- {
- "physicalLocation": {
- "artifactLocation": {
- "uri": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64"
- },
- "region": {
- "startLine": 1
- }
- },
- "message": {
- "text": "PURL"
- }
- },
- {
- "physicalLocation": {
- "artifactLocation": {
- "uri": "%2Fhome%2Fusername%2F.cache%2Fvalint%2Fsha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824.bom.sig.json"
- },
- "region": {
- "startLine": 1
- }
- },
- "message": {
- "text": "REF"
- }
- }
- ]
+ },
+ {
+ "name": "",
+ "digest": {
+ "sha256": "ea2388e936e9fc9ea554691cd1a425309f08bee95e57ed1b66a09b9ea286c252"
+ }
+ }
+ ],
+ "predicate": {
+ "environment": {
+ "hostname": "thinkpad",
+ "user": "user",
+ "name": "my-product",
+ "labels": [
+ "component-group=base_image",
+ "component-group=metadata"
+ ],
+ "extra_labels": [
+ "component-group=base_image",
+ "component-group=metadata"
+ ],
+ "timestamp": "2025-04-15T13:05:55+03:00",
+ "input_name": "busybox",
+ "input_tag": "latest",
+ "content_type": "statement-sarif",
+ "content_body_type": "sarif",
+ "context_type": "local",
+ "predicate_type": "http://docs.oasis-open.org/sarif/sarif/2.1.0",
+ "tool": "valint",
+ "tool_version": "2.0.0",
+ "format_type": "sarif",
+ "format_version": "2.1.0",
+ "format_encoding": "json",
+ "imageID": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824",
+ "repoDigest": [
+ "busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79"
+ ],
+ "tag": [
+ "latest",
+ "1.36.1",
+ "latest"
+ ],
+ "image_name": "index.docker.io/library/busybox:latest",
+ "size": 4261550,
+ "platform": "linux/amd64",
+ "created": "2023-07-18T23:19:33.655005962Z",
+ "file_id": "sha256:ea2388e936e9fc9ea554691cd1a425309f08bee95e57ed1b66a09b9ea286c252",
+ "file_path": "index.docker.io/library/busybox:latest",
+ "target_type": "policy-results",
+ "sbomtype": "container",
+ "sbomgroup": "data",
+ "sbomname": "index.docker.io/library/busybox:latest",
+ "sbomversion": "sha256:ea2388e936e9fc9ea554691cd1a425309f08bee95e57ed1b66a09b9ea286c252",
+ "sbomhashs": [
+ "sha256-ea2388e936e9fc9ea554691cd1a425309f08bee95e57ed1b66a09b9ea286c252"
+ ],
+ "sbompurl": "pkg:data/index.docker.io/library/busybox%3Alatest@sha256%3Aea2388e936e9fc9ea554691cd1a425309f08bee95e57ed1b66a09b9ea286c252",
+ "sbomcomponents": [
+ "base_image",
+ "metadata"
+ ],
+ "controls": [
+ "SSDF/PS/PS.2/PS.2.1",
+ "SSDF/PS/PS.3/PS.3.1",
+ "SSDF/PS/PS.3/PS.3.2"
+ ],
+ "rules": [
+ "SSDF/PS/PS.2/PS.2.1/sbom-is-signed",
+ "SSDF/PS/PS.3/PS.3.1/provenance-exists",
+ "SSDF/PS/PS.3/PS.3.2/sbom-is-signed"
+ ],
+ "rule-scripts": {
+ "artifact-signed.rego": "bb8e7472921cf089cb03c1806690e8401d2393e0b224d62ffbab0d521c71f3ad"
},
- {
- "properties": {
- "verify-artifact.fresh-image": [
- {
- "content_type": "attest-cyclonedx-json",
- "context_type": "local",
- "format_encoding": "json",
- "format_type": "cyclonedx",
- "format_version": "1.4",
- "git_branch": "main",
- "git_commit": "0a80c9d5372ecfbf4ff20a728f9ce5e68b371f45",
- "git_ref": "refs/heads/main",
- "git_tag": "v1.0.0-17",
- "git_url": "https://github.com/scribe-security/valint.git",
- "hostname": "runner_1",
- "imageID": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824",
- "input_name": "busybox",
- "input_scheme": "docker",
- "input_tag": "latest",
- "name": "busybox",
- "platform": "linux/amd64",
- "predicate_type": "https://cyclonedx.org/bom/v1.4",
- "product_version": "v0.1",
- "ref": "/home/username/.cache/valint/sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824.bom.sig.json",
- "repoDigest": [
- "busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79"
- ],
- "sbomgroup": "image",
- "sbomhashs": [
- "sha256-3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79",
- "sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824"
- ],
- "sbomname": "index.docker.io/library/busybox:latest",
- "sbompurl": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64",
- "sbomversion": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824",
- "size": 4261550,
- "store": "cache",
- "tag": [
- "latest",
- "1.36.1",
- "latest"
- ],
- "target_type": "image",
- "timestamp": "2024-01-23T15:43:58+02:00",
- "tool": "valint",
- "tool_vendor": "Scribe Security",
- "tool_version": "1.0.0-18",
- "user": "username"
- }
- ]
- },
- "ruleId": "fresh-image",
- "ruleIndex": 1,
- "kind": "pass",
- "level": "note",
- "message": {
- "text": "Rule passed verify-artifact because 1/1 evidence origin and signature verified",
- "markdown": "Rule passed verify-artifact because 1/1 evidence origin and signature verified"
- },
- "locations": [
- {
- "physicalLocation": {
- "artifactLocation": {
- "uri": "index.docker.io/library/busybox?version=sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\u0026tag=latest"
- },
- "region": {
- "startLine": 1
- }
- },
- "message": {
- "text": "URL"
- }
- },
- {
- "physicalLocation": {
- "artifactLocation": {
- "uri": "busybox"
- },
- "region": {
- "startLine": 1
- }
- },
- "message": {
- "text": "PRODUCT"
- }
- },
- {
- "physicalLocation": {
- "artifactLocation": {
- "uri": "busybox"
- },
- "region": {
- "startLine": 1
- }
- },
- "message": {
- "text": "NAME"
- }
- },
- {
- "physicalLocation": {
- "artifactLocation": {
- "uri": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64"
- },
- "region": {
- "startLine": 1
- }
- },
- "message": {
- "text": "PURL"
- }
- },
+ "bundle_info": {
+ "git_branch": "v2",
+ "git_target": "/home/user/.cache/valint/.tmp/git_tmp_2907983709",
+ "git_repo": "https://github.com/scribe-public/sample-policies.git",
+ "git_ref": "refs/heads/v2",
+ "git_commit": "45919a8c4f3ae20fceb9afa01219741f651bc2ef"
+ },
+ "initiative-name": "SSDF Client Initiative",
+ "initiative-id": "SSDF",
+ "initiative-version": "1.0.0",
+ "initiative-description": "Evaluate PS rules from the SSDF initiative",
+ "initiative-url": "https://csrc.nist.gov/pubs/sp/800/218/final",
+ "initiative-fingerprint": "d9e4049ae300a219f21eb55047c4461f3bec75bf914e84742cb18a28e29c2ca2",
+ "ref": "17700",
+ "store": "scribe"
+ },
+ "mimeType": "application/json",
+ "content": {
+ "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
+ "version": "2.1.0",
+ "runs": [
{
- "physicalLocation": {
- "artifactLocation": {
- "uri": "%2Fhome%2Fusername%2F.cache%2Fvalint%2Fsha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824.bom.sig.json"
+ "automationDetails": {
+ "id": "valint/1744711556"
},
- "region": {
- "startLine": 1
- }
- },
- "message": {
- "text": "REF"
- }
- }
- ]
- },
- {
- "properties": {
- "verify-artifact.fresh-image": [
- {
- "content_type": "attest-cyclonedx-json",
- "context_type": "local",
- "format_encoding": "json",
- "format_type": "cyclonedx",
- "format_version": "1.4",
- "git_branch": "main",
- "git_commit": "0a80c9d5372ecfbf4ff20a728f9ce5e68b371f45",
- "git_ref": "refs/heads/main",
- "git_tag": "v1.0.0-17",
- "git_url": "https://github.com/scribe-security/valint.git",
- "hostname": "runner_1",
- "imageID": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824",
- "input_name": "busybox",
- "input_scheme": "docker",
- "input_tag": "latest",
- "name": "busybox",
- "platform": "linux/amd64",
- "predicate_type": "https://cyclonedx.org/bom/v1.4",
- "product_version": "v0.1",
- "ref": "/home/username/.cache/valint/sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824.bom.sig.json",
- "repoDigest": [
- "busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79"
+ "invocations": [
+ {
+ "commandLine": "valint verify busybox:latest --format=statement --initiative=ssdf@v2",
+ "executionSuccessful": true,
+ "exitCode": 0,
+ "exitCodeDescription": "valint exited with 0, control evaluation result is: fail",
+ "properties": {
+ "control-result": {
+ "control-id:SSDF/PS/PS.2/PS.2.1": "pass",
+ "control-id:SSDF/PS/PS.3/PS.3.1": "fail",
+ "control-id:SSDF/PS/PS.3/PS.3.2": "pass"
+ },
+ "initiative-hash": "d9e4049ae300a219f21eb55047c4461f3bec75bf914e84742cb18a28e29c2ca2",
+ "initiative-id": "SSDF",
+ "initiative-name": "SSDF Client Initiative",
+ "initiative-result": "fail"
+ }
+ }
],
- "sbomgroup": "image",
- "sbomhashs": [
- "sha256-3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79",
- "sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824"
+ "language": "en-US",
+ "newlineSequences": [
+ "\r\n",
+ "\n"
],
- "sbomname": "index.docker.io/library/busybox:latest",
- "sbompurl": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64",
- "sbomversion": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824",
- "size": 4261550,
- "store": "cache",
- "tag": [
- "latest",
- "1.36.1",
- "latest"
+ "policies": [
+ {
+ "associatedComponent": {
+ "guid": "9d2a317f-93c1-5a37-b08d-21362788ca2c",
+ "index": 0,
+ "name": "SSDF Client Initiative"
+ },
+ "fullDescription": {
+ "markdown": "Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that only authorized personnel, tools, services, etc. have access.\nMitigation: Implement strict access controls, enforce multi-factor authentication (MFA), and regularly audit access logs to ensure only authorized personnel can access and modify the code. Use branch protection rules, require signed commits, and make repositories private to prevent unauthorized access and tampering.\n\n### Mitigation\nImplement strict access controls, enforce multi-factor authentication (MFA), and regularly audit access logs to ensure only authorized personnel can access and modify the code. Use branch protection rules, require signed commits, and make repositories private to prevent unauthorized access and tampering.",
+ "text": "Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that only authorized personnel, tools, services, etc. have access.\nMitigation: Implement strict access controls, enforce multi-factor authentication (MFA), and regularly audit access logs to ensure only authorized personnel can access and modify the code. Use branch protection rules, require signed commits, and make repositories private to prevent unauthorized access and tampering.\nMitigation: Implement strict access controls, enforce multi-factor authentication (MFA), and regularly audit access logs to ensure only authorized personnel can access and modify the code. Use branch protection rules, require signed commits, and make repositories private to prevent unauthorized access and tampering."
+ },
+ "guid": "e80acb74-de42-5ef3-b959-783ff48b69b2",
+ "name": "Store all forms of code based on the principle of least privilege",
+ "properties": {
+ "id": "control-id:SSDF/PS/PS.1/PS.1.1"
+ },
+ "rules": [
+ {
+ "defaultConfiguration": {
+ "level": "error",
+ "parameters": {
+ "evidence": {
+ "Match": {
+ "content_body_type": "generic",
+ "labels": [
+ "platform=github",
+ "asset_type=organization",
+ "{{- if eq (index .Context \"asset_type\") \"organization\" -}} {{- asset_on_target (index .Context \"asset_name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}"
+ ],
+ "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1",
+ "signed": false,
+ "target_type": "data"
+ }
+ },
+ "input-args": {
+ "desired_value": true
+ }
+ },
+ "rank": -1
+ },
+ "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa",
+ "id": "rule-id:SSDF/PS/PS.1/PS.1.1/2fa",
+ "name": "Enforce 2FA",
+ "shortDescription": {
+ "markdown": "PS.1 Require 2FA for accessing code",
+ "text": "PS.1 Require 2FA for accessing code"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error",
+ "parameters": {
+ "evidence": {
+ "Match": {
+ "content_body_type": "generic",
+ "labels": [
+ "platform=github",
+ "asset_type=organization",
+ "{{- if eq (index .Context \"asset_type\") \"organization\" -}} {{- asset_on_target (index .Context \"asset_name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}"
+ ],
+ "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1",
+ "signed": false,
+ "target_type": "data"
+ }
+ },
+ "input-args": {
+ "max_admins": 3
+ }
+ },
+ "rank": -1
+ },
+ "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins",
+ "id": "rule-id:SSDF/PS/PS.1/PS.1.1/max-admins",
+ "name": "Limit admins",
+ "shortDescription": {
+ "markdown": "PS.1 Restrict the maximum number of organization admins",
+ "text": "PS.1 Restrict the maximum number of organization admins"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error",
+ "parameters": {
+ "evidence": {
+ "Match": {
+ "content_body_type": "generic",
+ "labels": [
+ "platform=github",
+ "asset_type=organization",
+ "{{- if eq (index .Context \"asset_type\") \"organization\" -}} {{- asset_on_target (index .Context \"asset_name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}"
+ ],
+ "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1",
+ "signed": false,
+ "target_type": "data"
+ }
+ },
+ "input-args": {
+ "desired_value": true
+ }
+ },
+ "rank": -1
+ },
+ "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff",
+ "id": "rule-id:SSDF/PS/PS.1/PS.1.1/web-commit-signoff",
+ "name": "Require signoff on web commits",
+ "shortDescription": {
+ "markdown": "PS.1 Require contributors to sign when committing to Github through the web interface",
+ "text": "PS.1 Require contributors to sign when committing to Github through the web interface"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error",
+ "parameters": {
+ "evidence": {
+ "Match": {
+ "content_body_type": "generic",
+ "labels": [
+ "platform=github",
+ "asset_type=repository",
+ "{{- if eq (index .Context \"asset_type\") \"repository\" -}} {{- asset_on_target (index .Context \"asset_name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}"
+ ],
+ "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1",
+ "signed": false,
+ "target_type": "data"
+ }
+ },
+ "input-args": {
+ "branches": [
+ "main",
+ "master"
+ ],
+ "desired_protected": true
+ }
+ },
+ "rank": -1
+ },
+ "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection",
+ "id": "rule-id:SSDF/PS/PS.1/PS.1.1/branch-protection",
+ "name": "Branch protected",
+ "shortDescription": {
+ "markdown": "PS.1 Require branch protection for the repository",
+ "text": "PS.1 Require branch protection for the repository"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error",
+ "parameters": {
+ "evidence": {
+ "Match": {
+ "content_body_type": "generic",
+ "labels": [
+ "platform=github",
+ "asset_type=repository",
+ "{{- if eq (index .Context \"asset_type\") \"repository\" -}} {{- asset_on_target (index .Context \"asset_name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}"
+ ],
+ "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1",
+ "signed": false,
+ "target_type": "data"
+ }
+ },
+ "input-args": {
+ "desired_private": true
+ }
+ },
+ "rank": -1
+ },
+ "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/repo-private",
+ "id": "rule-id:SSDF/PS/PS.1/PS.1.1/repo-is-private",
+ "name": "Repo private",
+ "shortDescription": {
+ "markdown": "PS.1 Assure the repository is private",
+ "text": "PS.1 Assure the repository is private"
+ }
+ }
+ ],
+ "shortDescription": {
+ "markdown": "Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that only authorized personnel, tools, services, etc. have access.",
+ "text": "Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that only authorized personnel, tools, services, etc. have access."
+ }
+ },
+ {
+ "associatedComponent": {
+ "guid": "9d2a317f-93c1-5a37-b08d-21362788ca2c",
+ "index": 0,
+ "name": "SSDF Client Initiative"
+ },
+ "fullDescription": {
+ "markdown": "Help software acquirers ensure that the software they acquire is legitimate and has not been tampered with.\nMitigation: Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Ensure that the signing keys are stored securely and that access to them is restricted. Implement automated processes to sign releases and verify their integrity before distribution. Regularly audit the signing process and keys to ensure their security and integrity.\n\n### Mitigation\nUse cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Ensure that the signing keys are stored securely and that access to them is restricted. Implement automated processes to sign releases and verify their integrity before distribution. Regularly audit the signing process and keys to ensure their security and integrity.",
+ "text": "Help software acquirers ensure that the software they acquire is legitimate and has not been tampered with.\nMitigation: Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Ensure that the signing keys are stored securely and that access to them is restricted. Implement automated processes to sign releases and verify their integrity before distribution. Regularly audit the signing process and keys to ensure their security and integrity.\nMitigation: Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Ensure that the signing keys are stored securely and that access to them is restricted. Implement automated processes to sign releases and verify their integrity before distribution. Regularly audit the signing process and keys to ensure their security and integrity."
+ },
+ "guid": "e4664761-7b9b-5b70-85f3-839aaa4b36f1",
+ "name": "Make software integrity verification information available to software acquirers",
+ "properties": {
+ "id": "control-id:SSDF/PS/PS.2/PS.2.1"
+ },
+ "rules": [
+ {
+ "defaultConfiguration": {
+ "enabled": true,
+ "level": "error",
+ "parameters": {
+ "evidence": {
+ "filter-by": [
+ "product",
+ "target"
+ ],
+ "Match": {
+ "content_body_type": "cyclonedx-json",
+ "labels": null,
+ "signed": true,
+ "target_type": "container"
+ }
+ },
+ "input-args": {
+ "identity": {
+ "common-names": [],
+ "emails": []
+ }
+ }
+ },
+ "rank": -1
+ },
+ "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed",
+ "id": "rule-id:SSDF/PS/PS.2/PS.2.1/sbom-is-signed",
+ "name": "Image-verifiable",
+ "shortDescription": {
+ "markdown": "PS.2 Provide a mechanism to verify the integrity of the image",
+ "text": "PS.2 Provide a mechanism to verify the integrity of the image"
+ }
+ }
+ ],
+ "shortDescription": {
+ "markdown": "Help software acquirers ensure that the software they acquire is legitimate and has not been tampered with.",
+ "text": "Help software acquirers ensure that the software they acquire is legitimate and has not been tampered with."
+ }
+ },
+ {
+ "associatedComponent": {
+ "guid": "9d2a317f-93c1-5a37-b08d-21362788ca2c",
+ "index": 0,
+ "name": "SSDF Client Initiative"
+ },
+ "fullDescription": {
+ "markdown": "Securely archive the necessary files and supporting data (e.g., integrity verification information, provenance data) to be retained for each software release\nMitigation: Use secure, version-controlled repositories to store software releases and their supporting data. Implement access controls to restrict who can modify or delete these repositories. Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Regularly back up the repositories to prevent data loss and ensure that software releases are preserved even in the event of a system failure.\n\n### Mitigation\nUse secure, version-controlled repositories to store software releases and their supporting data. Implement access controls to restrict who can modify or delete these repositories. Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Regularly back up the repositories to prevent data loss and ensure that software releases are preserved even in the event of a system failure.",
+ "text": "Securely archive the necessary files and supporting data (e.g., integrity verification information, provenance data) to be retained for each software release\nMitigation: Use secure, version-controlled repositories to store software releases and their supporting data. Implement access controls to restrict who can modify or delete these repositories. Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Regularly back up the repositories to prevent data loss and ensure that software releases are preserved even in the event of a system failure.\nMitigation: Use secure, version-controlled repositories to store software releases and their supporting data. Implement access controls to restrict who can modify or delete these repositories. Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Regularly back up the repositories to prevent data loss and ensure that software releases are preserved even in the event of a system failure."
+ },
+ "guid": "c9de79fa-af19-5574-a99b-4f1523d7375b",
+ "name": "Securely archive the necessary files and supporting data to be retained for each software release",
+ "properties": {
+ "id": "control-id:SSDF/PS/PS.3/PS.3.1"
+ },
+ "rules": [
+ {
+ "defaultConfiguration": {
+ "enabled": true,
+ "level": "error",
+ "parameters": {
+ "evidence": {
+ "filter-by": [
+ "product",
+ "target"
+ ],
+ "Match": {
+ "content_body_type": "slsa",
+ "labels": null,
+ "signed": false
+ }
+ },
+ "input-args": {}
+ },
+ "rank": -1
+ },
+ "helpUri": "https://slsa.dev/spec/v1.0/requirements",
+ "id": "rule-id:SSDF/PS/PS.3/PS.3.1/provenance-exists",
+ "name": "Provenance exists",
+ "shortDescription": {
+ "markdown": "PS.3 Provenance exists\nEnsure that provenance information is available for each software release\n",
+ "text": "PS.3 Provenance exists\nEnsure that provenance information is available for each software release\n"
+ }
+ }
+ ],
+ "shortDescription": {
+ "markdown": "Securely archive the necessary files and supporting data (e.g., integrity verification information, provenance data) to be retained for each software release",
+ "text": "Securely archive the necessary files and supporting data (e.g., integrity verification information, provenance data) to be retained for each software release"
+ }
+ },
+ {
+ "associatedComponent": {
+ "guid": "9d2a317f-93c1-5a37-b08d-21362788ca2c",
+ "index": 0,
+ "name": "SSDF Client Initiative"
+ },
+ "fullDescription": {
+ "markdown": "Collect, safeguard, maintain, and share provenance data for all components of each software release (e.g., in a software bill of materials [SBOM])\nMitigation: Use software bill of materials (SBOM) to document the provenance of each software release and its components. Store SBOMs in a secure, version-controlled repository to ensure they can be retrieved and analyzed in the future. Implement access controls to restrict who can modify or delete SBOMs. Use cryptographic signatures to sign SBOMs and provide a way for users to verify these signatures. Regularly back up the repository to prevent data loss and ensure that SBOMs are preserved even in the event of a system failure. Document the SBOM creation process and train personnel on its importance and proper handling procedures.\n\n### Mitigation\nUse software bill of materials (SBOM) to document the provenance of each software release and its components. Store SBOMs in a secure, version-controlled repository to ensure they can be retrieved and analyzed in the future. Implement access controls to restrict who can modify or delete SBOMs. Use cryptographic signatures to sign SBOMs and provide a way for users to verify these signatures. Regularly back up the repository to prevent data loss and ensure that SBOMs are preserved even in the event of a system failure. Document the SBOM creation process and train personnel on its importance and proper handling procedures.",
+ "text": "Collect, safeguard, maintain, and share provenance data for all components of each software release (e.g., in a software bill of materials [SBOM])\nMitigation: Use software bill of materials (SBOM) to document the provenance of each software release and its components. Store SBOMs in a secure, version-controlled repository to ensure they can be retrieved and analyzed in the future. Implement access controls to restrict who can modify or delete SBOMs. Use cryptographic signatures to sign SBOMs and provide a way for users to verify these signatures. Regularly back up the repository to prevent data loss and ensure that SBOMs are preserved even in the event of a system failure. Document the SBOM creation process and train personnel on its importance and proper handling procedures.\nMitigation: Use software bill of materials (SBOM) to document the provenance of each software release and its components. Store SBOMs in a secure, version-controlled repository to ensure they can be retrieved and analyzed in the future. Implement access controls to restrict who can modify or delete SBOMs. Use cryptographic signatures to sign SBOMs and provide a way for users to verify these signatures. Regularly back up the repository to prevent data loss and ensure that SBOMs are preserved even in the event of a system failure. Document the SBOM creation process and train personnel on its importance and proper handling procedures."
+ },
+ "guid": "aaed3f57-b11e-5c28-a500-a280f861e622",
+ "name": "Collect, safeguard, maintain, and share provenance data for all components of each software release",
+ "properties": {
+ "id": "control-id:SSDF/PS/PS.3/PS.3.2"
+ },
+ "rules": [
+ {
+ "defaultConfiguration": {
+ "enabled": true,
+ "level": "error",
+ "parameters": {
+ "evidence": {
+ "filter-by": [
+ "product",
+ "target"
+ ],
+ "Match": {
+ "content_body_type": "cyclonedx-json",
+ "labels": null,
+ "signed": true
+ }
+ },
+ "input-args": {
+ "identity": {
+ "common-names": [],
+ "emails": []
+ }
+ }
+ },
+ "rank": -1
+ },
+ "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed",
+ "id": "rule-id:SSDF/PS/PS.3/PS.3.2/sbom-is-signed",
+ "name": "SBOM archived",
+ "shortDescription": {
+ "markdown": "PS.3 Archive SBOM",
+ "text": "PS.3 Archive SBOM"
+ }
+ }
+ ],
+ "shortDescription": {
+ "markdown": "Collect, safeguard, maintain, and share provenance data for all components of each software release (e.g., in a software bill of materials [SBOM])",
+ "text": "Collect, safeguard, maintain, and share provenance data for all components of each software release (e.g., in a software bill of materials [SBOM])"
+ }
+ }
],
- "target_type": "image",
- "timestamp": "2024-01-23T15:43:58+02:00",
- "tool": "valint",
- "tool_vendor": "Scribe Security",
- "tool_version": "1.0.0-18",
- "user": "username"
- }
- ]
- },
- "ruleId": "fresh-image",
- "ruleIndex": 1,
- "kind": "pass",
- "level": "note",
- "message": {
- "text": "Rule passed because image is new enough.",
- "markdown": "Rule passed because image is new enough."
- },
- "locations": [
- {
- "physicalLocation": {
- "artifactLocation": {
- "uri": "index.docker.io/library/busybox?version=sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\u0026tag=latest"
- },
- "region": {
- "startLine": 1
- }
- },
- "message": {
- "text": "URL"
- }
- },
- {
- "physicalLocation": {
- "artifactLocation": {
- "uri": "busybox"
- },
- "region": {
- "startLine": 1
- }
- },
- "message": {
- "text": "PRODUCT"
- }
- },
- {
- "physicalLocation": {
- "artifactLocation": {
- "uri": "busybox"
- },
- "region": {
- "startLine": 1
- }
- },
- "message": {
- "text": "NAME"
- }
- },
- {
- "physicalLocation": {
- "artifactLocation": {
- "uri": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64"
+ "properties": {
+ "verifier-context": {
+ "hostname": "thinkpad",
+ "user": "user",
+ "name": "my-product",
+ "labels": [
+ "component-group=base_image",
+ "component-group=metadata"
+ ],
+ "extra_labels": [
+ "component-group=base_image",
+ "component-group=metadata"
+ ],
+ "timestamp": "2025-04-15T13:05:55+03:00",
+ "input_name": "busybox",
+ "input_tag": "latest",
+ "content_type": "statement-sarif",
+ "content_body_type": "sarif",
+ "context_type": "local",
+ "predicate_type": "http://scribesecurity.com/evidence/generic/v0.1",
+ "imageID": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824",
+ "repoDigest": [
+ "busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79"
+ ],
+ "tag": [
+ "latest",
+ "1.36.1",
+ "latest"
+ ],
+ "image_name": "index.docker.io/library/busybox:latest",
+ "size": 4261550,
+ "platform": "linux/amd64",
+ "created": "2023-07-18T23:19:33.655005962Z",
+ "target_type": "policy-results",
+ "sbomtype": "container",
+ "sbomgroup": "container",
+ "sbomname": "index.docker.io/library/busybox:latest",
+ "sbomversion": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824",
+ "sbomhashs": [
+ "sha256-3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79",
+ "sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824"
+ ],
+ "sbompurl": "pkg:docker/index.docker.io/library/busybox%3Alatest@sha256%3Aa416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64",
+ "sbomcomponents": [
+ "base_image",
+ "metadata"
+ ],
+ "controls": [
+ "SSDF/PS/PS.2/PS.2.1",
+ "SSDF/PS/PS.3/PS.3.1",
+ "SSDF/PS/PS.3/PS.3.2"
+ ],
+ "rules": [
+ "SSDF/PS/PS.2/PS.2.1/sbom-is-signed",
+ "SSDF/PS/PS.3/PS.3.1/provenance-exists",
+ "SSDF/PS/PS.3/PS.3.2/sbom-is-signed"
+ ],
+ "rule-scripts": {
+ "artifact-signed.rego": "bb8e7472921cf089cb03c1806690e8401d2393e0b224d62ffbab0d521c71f3ad"
+ },
+ "bundle_info": {
+ "git_branch": "v2",
+ "git_target": "/home/user/.cache/valint/.tmp/git_tmp_2907983709",
+ "git_repo": "https://github.com/scribe-public/sample-policies.git",
+ "git_ref": "refs/heads/v2",
+ "git_commit": "45919a8c4f3ae20fceb9afa01219741f651bc2ef"
+ },
+ "initiative-name": "SSDF Client Initiative",
+ "initiative-id": "SSDF",
+ "initiative-version": "1.0.0",
+ "initiative-description": "Evaluate PS rules from the SSDF initiative",
+ "initiative-url": "https://csrc.nist.gov/pubs/sp/800/218/final",
+ "initiative-fingerprint": "d9e4049ae300a219f21eb55047c4461f3bec75bf914e84742cb18a28e29c2ca2",
+ "ref": "17700",
+ "store": "scribe"
+ }
},
- "region": {
- "startLine": 1
- }
- },
- "message": {
- "text": "PURL"
- }
- },
- {
- "physicalLocation": {
- "artifactLocation": {
- "uri": "%2Fhome%2Fusername%2F.cache%2Fvalint%2Fsha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824.bom.sig.json"
- },
- "region": {
- "startLine": 1
+ "results": [
+ {
+ "fingerprints": {
+ "sha256/v1": "7897409b0d5c3397e11d786d137ef1eb4ea8223e6545f9d5b2d3e0cf026d1390"
+ },
+ "kind": "pass",
+ "level": "none",
+ "locations": [
+ {
+ "id": -1,
+ "message": {
+ "text": "URL"
+ },
+ "physicalLocation": {
+ "artifactLocation": {
+ "index": -1,
+ "uri": "index.docker.io/library/busybox?version=sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\u0026tag=latest"
+ },
+ "region": {
+ "byteOffset": -1,
+ "charOffset": -1,
+ "startLine": 1
+ }
+ }
+ },
+ {
+ "id": -1,
+ "message": {
+ "text": "PRODUCT"
+ },
+ "physicalLocation": {
+ "artifactLocation": {
+ "index": -1,
+ "uri": "my-product"
+ },
+ "region": {
+ "byteOffset": -1,
+ "charOffset": -1,
+ "startLine": 1
+ }
+ }
+ },
+ {
+ "id": -1,
+ "message": {
+ "text": "NAME"
+ },
+ "physicalLocation": {
+ "artifactLocation": {
+ "index": -1,
+ "uri": "busybox"
+ },
+ "region": {
+ "byteOffset": -1,
+ "charOffset": -1,
+ "startLine": 1
+ }
+ }
+ },
+ {
+ "id": -1,
+ "message": {
+ "text": "PURL"
+ },
+ "physicalLocation": {
+ "artifactLocation": {
+ "index": -1,
+ "uri": "pkg:docker/index.docker.io/library/busybox%3Alatest@sha256%3Aa416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64"
+ },
+ "region": {
+ "byteOffset": -1,
+ "charOffset": -1,
+ "startLine": 1
+ }
+ }
+ },
+ {
+ "id": -1,
+ "message": {
+ "text": "REF"
+ },
+ "physicalLocation": {
+ "artifactLocation": {
+ "index": -1,
+ "uri": "17700"
+ },
+ "region": {
+ "byteOffset": -1,
+ "charOffset": -1,
+ "startLine": 1
+ }
+ }
+ }
+ ],
+ "message": {
+ "markdown": "Evidence signature verified. Signed Image-SBOM origin and signature verified",
+ "text": "Evidence signature verified. Signed Image-SBOM origin and signature verified"
+ },
+ "properties": {
+ "asset": {
+ "asset-display-name": "busybox:1.36.1 (image)",
+ "asset-id": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824",
+ "asset-name": "busybox:1.36.1",
+ "asset-type": "image"
+ },
+ "evidence": {
+ "common_name": "Keys",
+ "content_body_type": "cyclonedx-json",
+ "content_type": "attest-cyclonedx-json",
+ "context_type": "local",
+ "created": "2023-07-18T23:19:33.655005962Z",
+ "extra_labels": [
+ "component-group=packages",
+ "component-group=dep",
+ "component-group=base_image",
+ "component-group=metadata",
+ "signer=Keys",
+ "signer-issuer=Scribe-Test-CA"
+ ],
+ "format_encoding": "json",
+ "format_type": "cyclonedx",
+ "format_version": "1.5",
+ "hostname": "thinkpad",
+ "imageID": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824",
+ "image_name": "index.docker.io/library/busybox:latest",
+ "input_name": "busybox",
+ "input_scheme": "docker",
+ "input_tag": "latest",
+ "issuer": "Scribe-Test-CA",
+ "labels": [
+ "component-group=base_image",
+ "component-group=dep",
+ "component-group=metadata",
+ "component-group=packages",
+ "signer-issuer=Scribe-Test-CA",
+ "signer=Keys"
+ ],
+ "name": "my-product",
+ "platform": "linux/amd64",
+ "predicate_type": "https://cyclonedx.org/bom/v1.5",
+ "product_version": "v3.0.49",
+ "ref": "17700",
+ "repoDigest": [
+ "busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79"
+ ],
+ "sbomcomponents": [
+ "base_image",
+ "dep",
+ "metadata",
+ "packages"
+ ],
+ "sbomgroup": "container",
+ "sbomhashs": [
+ "sha256-3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79",
+ "sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824"
+ ],
+ "sbomname": "index.docker.io/library/busybox:latest",
+ "sbompurl": "pkg:docker/index.docker.io/library/busybox%3Alatest@sha256%3Aa416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64",
+ "sbomtype": "container",
+ "sbomversion": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824",
+ "signed": true,
+ "size": 4261550,
+ "store": "scribe",
+ "tag": [
+ "latest",
+ "1.36.1",
+ "latest"
+ ],
+ "target_type": "container",
+ "timestamp": "2025-04-15T12:59:46+03:00",
+ "tool": "valint",
+ "tool_vendor": "Scribe Security",
+ "tool_version": "2.0.0",
+ "user": "user"
+ },
+ "identity": {
+ "common-names": [
+ "Keys"
+ ],
+ "issuer": "Scribe-Test-CA",
+ "require-signed": true,
+ "signed-verified": true
+ }
+ },
+ "rank": -1,
+ "ruleId": "rule-id:SSDF/PS/PS.2/PS.2.1/sbom-is-signed",
+ "ruleIndex": 5
+ },
+ {
+ "fingerprints": {
+ "sha256/v1": "fa657e62d3664be07e4ad4e3f88a61149b7baef922f60d1f2f0b4b45ce1d8957"
+ },
+ "kind": "fail",
+ "level": "error",
+ "locations": [
+ {
+ "id": -1,
+ "message": {
+ "text": "URL"
+ },
+ "physicalLocation": {
+ "artifactLocation": {
+ "index": -1,
+ "uri": "scribesecurity.com"
+ },
+ "region": {
+ "byteOffset": -1,
+ "charOffset": -1,
+ "startLine": 1
+ }
+ }
+ }
+ ],
+ "message": {
+ "markdown": "SLSA Provenance missing",
+ "text": "SLSA Provenance missing"
+ },
+ "properties": {
+ "asset": {
+ "asset-display-name": "busybox:1.36.1 (image)",
+ "asset-id": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824",
+ "asset-name": "busybox:1.36.1",
+ "asset-type": "image"
+ },
+ "identity": {
+ "require-signed": false,
+ "signed-verified": false
+ }
+ },
+ "rank": -1,
+ "ruleId": "rule-id:SSDF/PS/PS.3/PS.3.1/provenance-exists",
+ "ruleIndex": 6
+ },
+ {
+ "fingerprints": {
+ "sha256/v1": "53d93583ac130044624c610f997509a0222360b508727094a1b05e237d95c62f"
+ },
+ "kind": "pass",
+ "level": "none",
+ "locations": [
+ {
+ "id": -1,
+ "message": {
+ "text": "URL"
+ },
+ "physicalLocation": {
+ "artifactLocation": {
+ "index": -1,
+ "uri": "index.docker.io/library/busybox?version=sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\u0026tag=latest"
+ },
+ "region": {
+ "byteOffset": -1,
+ "charOffset": -1,
+ "startLine": 1
+ }
+ }
+ },
+ {
+ "id": -1,
+ "message": {
+ "text": "PRODUCT"
+ },
+ "physicalLocation": {
+ "artifactLocation": {
+ "index": -1,
+ "uri": "my-product"
+ },
+ "region": {
+ "byteOffset": -1,
+ "charOffset": -1,
+ "startLine": 1
+ }
+ }
+ },
+ {
+ "id": -1,
+ "message": {
+ "text": "NAME"
+ },
+ "physicalLocation": {
+ "artifactLocation": {
+ "index": -1,
+ "uri": "busybox"
+ },
+ "region": {
+ "byteOffset": -1,
+ "charOffset": -1,
+ "startLine": 1
+ }
+ }
+ },
+ {
+ "id": -1,
+ "message": {
+ "text": "PURL"
+ },
+ "physicalLocation": {
+ "artifactLocation": {
+ "index": -1,
+ "uri": "pkg:docker/index.docker.io/library/busybox%3Alatest@sha256%3Aa416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64"
+ },
+ "region": {
+ "byteOffset": -1,
+ "charOffset": -1,
+ "startLine": 1
+ }
+ }
+ },
+ {
+ "id": -1,
+ "message": {
+ "text": "REF"
+ },
+ "physicalLocation": {
+ "artifactLocation": {
+ "index": -1,
+ "uri": "17700"
+ },
+ "region": {
+ "byteOffset": -1,
+ "charOffset": -1,
+ "startLine": 1
+ }
+ }
+ }
+ ],
+ "message": {
+ "markdown": "Evidence signature verified. Signed Image-SBOM origin and signature verified",
+ "text": "Evidence signature verified. Signed Image-SBOM origin and signature verified"
+ },
+ "properties": {
+ "asset": {
+ "asset-display-name": "busybox:1.36.1 (image)",
+ "asset-id": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824",
+ "asset-name": "busybox:1.36.1",
+ "asset-type": "image"
+ },
+ "evidence": {
+ "common_name": "Keys",
+ "content_body_type": "cyclonedx-json",
+ "content_type": "attest-cyclonedx-json",
+ "context_type": "local",
+ "created": "2023-07-18T23:19:33.655005962Z",
+ "extra_labels": [
+ "component-group=packages",
+ "component-group=dep",
+ "component-group=base_image",
+ "component-group=metadata",
+ "signer=Keys",
+ "signer-issuer=Scribe-Test-CA"
+ ],
+ "format_encoding": "json",
+ "format_type": "cyclonedx",
+ "format_version": "1.5",
+ "hostname": "thinkpad",
+ "imageID": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824",
+ "image_name": "index.docker.io/library/busybox:latest",
+ "input_name": "busybox",
+ "input_scheme": "docker",
+ "input_tag": "latest",
+ "issuer": "Scribe-Test-CA",
+ "labels": [
+ "component-group=base_image",
+ "component-group=dep",
+ "component-group=metadata",
+ "component-group=packages",
+ "signer-issuer=Scribe-Test-CA",
+ "signer=Keys"
+ ],
+ "name": "my-product",
+ "platform": "linux/amd64",
+ "predicate_type": "https://cyclonedx.org/bom/v1.5",
+ "product_version": "v3.0.49",
+ "ref": "17700",
+ "repoDigest": [
+ "busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79"
+ ],
+ "sbomcomponents": [
+ "base_image",
+ "dep",
+ "metadata",
+ "packages"
+ ],
+ "sbomgroup": "container",
+ "sbomhashs": [
+ "sha256-3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79",
+ "sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824"
+ ],
+ "sbomname": "index.docker.io/library/busybox:latest",
+ "sbompurl": "pkg:docker/index.docker.io/library/busybox%3Alatest@sha256%3Aa416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64",
+ "sbomtype": "container",
+ "sbomversion": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824",
+ "signed": true,
+ "size": 4261550,
+ "store": "scribe",
+ "tag": [
+ "latest",
+ "1.36.1",
+ "latest"
+ ],
+ "target_type": "container",
+ "timestamp": "2025-04-15T12:59:46+03:00",
+ "tool": "valint",
+ "tool_vendor": "Scribe Security",
+ "tool_version": "2.0.0",
+ "user": "user"
+ },
+ "identity": {
+ "common-names": [
+ "Keys"
+ ],
+ "issuer": "Scribe-Test-CA",
+ "require-signed": true,
+ "signed-verified": true
+ }
+ },
+ "rank": -1,
+ "ruleId": "rule-id:SSDF/PS/PS.3/PS.3.2/sbom-is-signed",
+ "ruleIndex": 7
+ }
+ ],
+ "tool": {
+ "driver": {
+ "contents": [
+ "localizedData",
+ "nonLocalizedData"
+ ],
+ "informationUri": "https://scribesecurity.com",
+ "language": "en-US",
+ "name": "valint",
+ "rules": [
+ {
+ "defaultConfiguration": {
+ "level": "error",
+ "parameters": {
+ "evidence": {
+ "Match": {
+ "content_body_type": "generic",
+ "labels": [
+ "platform=github",
+ "asset_type=organization",
+ "{{- if eq (index .Context \"asset_type\") \"organization\" -}} {{- asset_on_target (index .Context \"asset_name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}"
+ ],
+ "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1",
+ "signed": false,
+ "target_type": "data"
+ }
+ },
+ "input-args": {
+ "desired_value": true
+ }
+ },
+ "rank": -1
+ },
+ "fullDescription": {
+ "markdown": "This rule verifies that two-factor authentication (2FA) is enabled for the organization by examining the provided evidence.\nIt checks the organization's details (retrieved from the SARIF or equivalent evidence) and compares the value of the \n`organization_details.two_factor_requirement_enabled` field against the expected value.\n\nThe rule iterates over the organization data in the evidence, and if the `two_factor_requirement_enabled` field does not match \nthe desired value, a violation is recorded. This ensures that all organizational accounts enforce 2FA, providing an additional \nlayer of security against unauthorized access.\n\n### **Evidence Requirements**\n- Evidence must include organization data with a field named `organization_details.two_factor_requirement_enabled`.\n- The data should come from a trusted source (e.g., a GitHub organization scan).\n- The evidence must clearly indicate whether 2FA is enabled.\n\n### Mitigation\nEnforces two-factor authentication (2FA) for organizational accounts, significantly reducing the risk of unauthorized access through compromised credentials.",
+ "text": "This rule verifies that two-factor authentication (2FA) is enabled for the organization by examining the provided evidence.\nIt checks the organization's details (retrieved from the SARIF or equivalent evidence) and compares the value of the \n`organization_details.two_factor_requirement_enabled` field against the expected value.\n\nThe rule iterates over the organization data in the evidence, and if the `two_factor_requirement_enabled` field does not match \nthe desired value, a violation is recorded. This ensures that all organizational accounts enforce 2FA, providing an additional \nlayer of security against unauthorized access.\n\n### **Evidence Requirements**\n- Evidence must include organization data with a field named `organization_details.two_factor_requirement_enabled`.\n- The data should come from a trusted source (e.g., a GitHub organization scan).\n- The evidence must clearly indicate whether 2FA is enabled.\nMitigation: Enforces two-factor authentication (2FA) for organizational accounts, significantly reducing the risk of unauthorized access through compromised credentials."
+ },
+ "guid": "7a4aecb8-d512-55e3-989a-b6fe14fa2c31",
+ "help": {
+ "markdown": "This rule verifies that two-factor authentication (2FA) is enabled for the organization by examining the provided evidence.\nIt checks the organization's details (retrieved from the SARIF or equivalent evidence) and compares the value of the \n`organization_details.two_factor_requirement_enabled` field against the expected value.\n\nThe rule iterates over the organization data in the evidence, and if the `two_factor_requirement_enabled` field does not match \nthe desired value, a violation is recorded. This ensures that all organizational accounts enforce 2FA, providing an additional \nlayer of security against unauthorized access.\n\n### **Evidence Requirements**\n- Evidence must include organization data with a field named `organization_details.two_factor_requirement_enabled`.\n- The data should come from a trusted source (e.g., a GitHub organization scan).\n- The evidence must clearly indicate whether 2FA is enabled.",
+ "text": "This rule verifies that two-factor authentication (2FA) is enabled for the organization by examining the provided evidence.\nIt checks the organization's details (retrieved from the SARIF or equivalent evidence) and compares the value of the \n`organization_details.two_factor_requirement_enabled` field against the expected value.\n\nThe rule iterates over the organization data in the evidence, and if the `two_factor_requirement_enabled` field does not match \nthe desired value, a violation is recorded. This ensures that all organizational accounts enforce 2FA, providing an additional \nlayer of security against unauthorized access.\n\n### **Evidence Requirements**\n- Evidence must include organization data with a field named `organization_details.two_factor_requirement_enabled`.\n- The data should come from a trusted source (e.g., a GitHub organization scan).\n- The evidence must clearly indicate whether 2FA is enabled."
+ },
+ "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa",
+ "id": "rule-id:SSDF/PS/PS.1/PS.1.1/2fa",
+ "name": "Enforce 2FA",
+ "properties": {
+ "control-id": "control-id:SSDF/PS/PS.1/PS.1.1",
+ "control-name": "Store all forms of code based on the principle of least privilege",
+ "doc-url": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa",
+ "file-hash": "dbe86363a09014d6de4950d2e375cfa46ced22f7ca1908ffd2a14be8dfc95e39",
+ "labels": [
+ "GitHub",
+ "Organization"
+ ],
+ "rego-hash": "7886079cbb1645876dc699c59ed1a313d50fed2d303003def656093685504f8e",
+ "rule-hash": "1d57f5273f15bda915b3d7b2e4ede2a12b98c9942464f571c65be225235783f3",
+ "source-url": "https://github.com/scribe-public/sample-policies/blob/v2/v2/rules/github/org/2fa.yaml",
+ "tags": [
+ "GitHub",
+ "Organization"
+ ]
+ },
+ "shortDescription": {
+ "markdown": "PS.1 Require 2FA for accessing code",
+ "text": "PS.1 Require 2FA for accessing code"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error",
+ "parameters": {
+ "evidence": {
+ "Match": {
+ "content_body_type": "generic",
+ "labels": [
+ "platform=github",
+ "asset_type=organization",
+ "{{- if eq (index .Context \"asset_type\") \"organization\" -}} {{- asset_on_target (index .Context \"asset_name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}"
+ ],
+ "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1",
+ "signed": false,
+ "target_type": "data"
+ }
+ },
+ "input-args": {
+ "max_admins": 3
+ }
+ },
+ "rank": -1
+ },
+ "fullDescription": {
+ "markdown": "This rule ensures that the number of admins in the GitHub organization does not exceed the specified maximum.\nIt performs the following steps:\n\n1. Checks the list of admins in the GitHub organization.\n2. Verifies that the number of admins does not exceed the value specified in the `with.max_admins` configuration.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.\n\n### Mitigation\nEnsures that the number of admins in the GitHub organization is kept within a manageable limit, reducing the risk of unauthorized administrative actions.",
+ "text": "This rule ensures that the number of admins in the GitHub organization does not exceed the specified maximum.\nIt performs the following steps:\n\n1. Checks the list of admins in the GitHub organization.\n2. Verifies that the number of admins does not exceed the value specified in the `with.max_admins` configuration.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.\nMitigation: Ensures that the number of admins in the GitHub organization is kept within a manageable limit, reducing the risk of unauthorized administrative actions."
+ },
+ "guid": "8e55e676-bd13-586d-9a56-11aab1fb5b8b",
+ "help": {
+ "markdown": "This rule ensures that the number of admins in the GitHub organization does not exceed the specified maximum.\nIt performs the following steps:\n\n1. Checks the list of admins in the GitHub organization.\n2. Verifies that the number of admins does not exceed the value specified in the `with.max_admins` configuration.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.",
+ "text": "This rule ensures that the number of admins in the GitHub organization does not exceed the specified maximum.\nIt performs the following steps:\n\n1. Checks the list of admins in the GitHub organization.\n2. Verifies that the number of admins does not exceed the value specified in the `with.max_admins` configuration.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources."
+ },
+ "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins",
+ "id": "rule-id:SSDF/PS/PS.1/PS.1.1/max-admins",
+ "name": "Limit admins",
+ "properties": {
+ "control-id": "control-id:SSDF/PS/PS.1/PS.1.1",
+ "control-name": "Store all forms of code based on the principle of least privilege",
+ "doc-url": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins",
+ "file-hash": "5093c9dcb056f04f20fcd1d5ca485ce2a23b404afdf9b57eb602fb330fec4a68",
+ "labels": [
+ "GitHub",
+ "Organization"
+ ],
+ "rego-hash": "6db3e98fb06073d449477ab08f08bd7c507578d5be89c1ec74edc56c2f7e52b8",
+ "rule-hash": "a70d1eed7c7f5da1f77a364b5b7897910ece24da6dc6301484f33b25d534a3d9",
+ "source-url": "https://github.com/scribe-public/sample-policies/blob/v2/v2/rules/github/org/max-admins.yaml",
+ "tags": [
+ "GitHub",
+ "Organization"
+ ]
+ },
+ "shortDescription": {
+ "markdown": "PS.1 Restrict the maximum number of organization admins",
+ "text": "PS.1 Restrict the maximum number of organization admins"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error",
+ "parameters": {
+ "evidence": {
+ "Match": {
+ "content_body_type": "generic",
+ "labels": [
+ "platform=github",
+ "asset_type=organization",
+ "{{- if eq (index .Context \"asset_type\") \"organization\" -}} {{- asset_on_target (index .Context \"asset_name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}"
+ ],
+ "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1",
+ "signed": false,
+ "target_type": "data"
+ }
+ },
+ "input-args": {
+ "desired_value": true
+ }
+ },
+ "rank": -1
+ },
+ "fullDescription": {
+ "markdown": "This rule checks if the `web_commit_signoff` setting is enabled to ensure all web-based commits are signed off.\nIt performs the following steps:\n\n1. Checks the web commit signoff settings of the GitHub organization.\n2. Verifies that the web commit signoff setting is enabled.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.\n\n### Mitigation\nEnsure that the Web Commit Signoff setting under the GitHub organization is enabled to require signoff on all web-based commits, enhancing security and accountability.",
+ "text": "This rule checks if the `web_commit_signoff` setting is enabled to ensure all web-based commits are signed off.\nIt performs the following steps:\n\n1. Checks the web commit signoff settings of the GitHub organization.\n2. Verifies that the web commit signoff setting is enabled.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.\nMitigation: Ensure that the Web Commit Signoff setting under the GitHub organization is enabled to require signoff on all web-based commits, enhancing security and accountability."
+ },
+ "guid": "34acfba7-fcb7-5bc6-acef-10ed2992e32e",
+ "help": {
+ "markdown": "This rule checks if the `web_commit_signoff` setting is enabled to ensure all web-based commits are signed off.\nIt performs the following steps:\n\n1. Checks the web commit signoff settings of the GitHub organization.\n2. Verifies that the web commit signoff setting is enabled.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.",
+ "text": "This rule checks if the `web_commit_signoff` setting is enabled to ensure all web-based commits are signed off.\nIt performs the following steps:\n\n1. Checks the web commit signoff settings of the GitHub organization.\n2. Verifies that the web commit signoff setting is enabled.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources."
+ },
+ "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff",
+ "id": "rule-id:SSDF/PS/PS.1/PS.1.1/web-commit-signoff",
+ "name": "Require signoff on web commits",
+ "properties": {
+ "control-id": "control-id:SSDF/PS/PS.1/PS.1.1",
+ "control-name": "Store all forms of code based on the principle of least privilege",
+ "doc-url": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff",
+ "file-hash": "4c895ffaa308b4090cd047a494ddaa61d4f1ad9053fd51dacc0e9987655341b8",
+ "labels": [
+ "GitHub",
+ "Organization"
+ ],
+ "rego-hash": "56fea30cb520fff9d9d32ba0926857b521d8e1b5b971d081b0283ea2ae206fd8",
+ "rule-hash": "513a2bafa4019e6f0392af565698c87fa79af5f59fa540b99510f101001179f5",
+ "source-url": "https://github.com/scribe-public/sample-policies/blob/v2/v2/rules/github/org/web-commit-signoff.yaml",
+ "tags": [
+ "GitHub",
+ "Organization"
+ ]
+ },
+ "shortDescription": {
+ "markdown": "PS.1 Require contributors to sign when committing to Github through the web interface",
+ "text": "PS.1 Require contributors to sign when committing to Github through the web interface"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error",
+ "parameters": {
+ "evidence": {
+ "Match": {
+ "content_body_type": "generic",
+ "labels": [
+ "platform=github",
+ "asset_type=repository",
+ "{{- if eq (index .Context \"asset_type\") \"repository\" -}} {{- asset_on_target (index .Context \"asset_name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}"
+ ],
+ "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1",
+ "signed": false,
+ "target_type": "data"
+ }
+ },
+ "input-args": {
+ "branches": [
+ "main",
+ "master"
+ ],
+ "desired_protected": true
+ }
+ },
+ "rank": -1
+ },
+ "fullDescription": {
+ "markdown": "This rule ensures that branch protection is configured in the GitHub repository.\nIt performs the following steps:\n\n1. Checks the repository settings for branch protection.\n2. Verifies that the protection settings match the expected values.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.\n\n### Mitigation\nEnsure branch protection settings are correctly configured to reduce the risk of unauthorized changes.",
+ "text": "This rule ensures that branch protection is configured in the GitHub repository.\nIt performs the following steps:\n\n1. Checks the repository settings for branch protection.\n2. Verifies that the protection settings match the expected values.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.\nMitigation: Ensure branch protection settings are correctly configured to reduce the risk of unauthorized changes."
+ },
+ "guid": "c925c9ec-a181-5a93-b631-72452c83fa69",
+ "help": {
+ "markdown": "This rule ensures that branch protection is configured in the GitHub repository.\nIt performs the following steps:\n\n1. Checks the repository settings for branch protection.\n2. Verifies that the protection settings match the expected values.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.",
+ "text": "This rule ensures that branch protection is configured in the GitHub repository.\nIt performs the following steps:\n\n1. Checks the repository settings for branch protection.\n2. Verifies that the protection settings match the expected values.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings."
+ },
+ "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection",
+ "id": "rule-id:SSDF/PS/PS.1/PS.1.1/branch-protection",
+ "name": "Branch protected",
+ "properties": {
+ "control-id": "control-id:SSDF/PS/PS.1/PS.1.1",
+ "control-name": "Store all forms of code based on the principle of least privilege",
+ "doc-url": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection",
+ "file-hash": "f64f1ea140ea2b0de656283bce732c7c3ce516d7d86458cdd47f7a24d0682c1b",
+ "labels": [
+ "GitHub",
+ "Repository"
+ ],
+ "rego-hash": "76018c06ddb321ab19e9fae6d3fdf4ebd1b04f4425239c724081f6fb8d914647",
+ "rule-hash": "f6cc83c266be32b6c998324ebb418fcf2132905593350b7aaea56f9aca8ff658",
+ "source-url": "https://github.com/scribe-public/sample-policies/blob/v2/v2/rules/github/repository/branch-protection.yaml",
+ "tags": [
+ "GitHub",
+ "Repository"
+ ]
+ },
+ "shortDescription": {
+ "markdown": "PS.1 Require branch protection for the repository",
+ "text": "PS.1 Require branch protection for the repository"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error",
+ "parameters": {
+ "evidence": {
+ "Match": {
+ "content_body_type": "generic",
+ "labels": [
+ "platform=github",
+ "asset_type=repository",
+ "{{- if eq (index .Context \"asset_type\") \"repository\" -}} {{- asset_on_target (index .Context \"asset_name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}"
+ ],
+ "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1",
+ "signed": false,
+ "target_type": "data"
+ }
+ },
+ "input-args": {
+ "desired_private": true
+ }
+ },
+ "rank": -1
+ },
+ "fullDescription": {
+ "markdown": "This rule ensures that the GitHub repository is private.\nIt performs the following steps:\n\n1. Checks the repository settings for privacy.\n2. Verifies that the repository is private.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.\n\n### Mitigation\nEnsures that the repository is private, reducing the risk of unauthorized access.",
+ "text": "This rule ensures that the GitHub repository is private.\nIt performs the following steps:\n\n1. Checks the repository settings for privacy.\n2. Verifies that the repository is private.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.\nMitigation: Ensures that the repository is private, reducing the risk of unauthorized access."
+ },
+ "guid": "4bb28598-0f5a-50d9-836d-45a1e39020ec",
+ "help": {
+ "markdown": "This rule ensures that the GitHub repository is private.\nIt performs the following steps:\n\n1. Checks the repository settings for privacy.\n2. Verifies that the repository is private.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.",
+ "text": "This rule ensures that the GitHub repository is private.\nIt performs the following steps:\n\n1. Checks the repository settings for privacy.\n2. Verifies that the repository is private.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings."
+ },
+ "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/repo-private",
+ "id": "rule-id:SSDF/PS/PS.1/PS.1.1/repo-is-private",
+ "name": "Repo private",
+ "properties": {
+ "control-id": "control-id:SSDF/PS/PS.1/PS.1.1",
+ "control-name": "Store all forms of code based on the principle of least privilege",
+ "doc-url": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/repo-private",
+ "file-hash": "685f36b245c750260d57d82538cb28174473655d859c676a915c89592dace8e4",
+ "labels": [
+ "GitHub",
+ "Repository"
+ ],
+ "rego-hash": "d39b92225c2fbf94d2874c2e47cc1384175730db23ae9006404ee385f97385ff",
+ "rule-hash": "b12031e2be3cc944fe056782649c09a3bea25d85ae220409f4310d76062d9c60",
+ "source-url": "https://github.com/scribe-public/sample-policies/blob/v2/v2/rules/github/repository/repo-private.yaml",
+ "tags": [
+ "GitHub",
+ "Repository"
+ ]
+ },
+ "shortDescription": {
+ "markdown": "PS.1 Assure the repository is private",
+ "text": "PS.1 Assure the repository is private"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "enabled": true,
+ "level": "error",
+ "parameters": {
+ "evidence": {
+ "filter-by": [
+ "product",
+ "target"
+ ],
+ "Match": {
+ "content_body_type": "cyclonedx-json",
+ "labels": null,
+ "signed": true,
+ "target_type": "container"
+ }
+ },
+ "input-args": {
+ "identity": {
+ "common-names": [],
+ "emails": []
+ }
+ }
+ },
+ "rank": -1
+ },
+ "fullDescription": {
+ "markdown": "PS.2 Provide a mechanism to verify the integrity of the image",
+ "text": "PS.2 Provide a mechanism to verify the integrity of the image"
+ },
+ "guid": "bfc20ac6-43bd-5736-ae94-424ca894da2e",
+ "help": {
+ "markdown": "PS.2 Provide a mechanism to verify the integrity of the image",
+ "text": "PS.2 Provide a mechanism to verify the integrity of the image"
+ },
+ "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed",
+ "id": "rule-id:SSDF/PS/PS.2/PS.2.1/sbom-is-signed",
+ "name": "Image-verifiable",
+ "properties": {
+ "control-id": "control-id:SSDF/PS/PS.2/PS.2.1",
+ "control-name": "Make software integrity verification information available to software acquirers",
+ "doc-url": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed",
+ "file-hash": "97a32ff04b930f3b093d2e201585cbb7ac6ffdfd05ac8160092219d3e7cba055",
+ "labels": [
+ "SBOM",
+ "Blueprint"
+ ],
+ "rego-hash": "bb8e7472921cf089cb03c1806690e8401d2393e0b224d62ffbab0d521c71f3ad",
+ "rule-hash": "1b1c35c08c91266ca90211a4661146641258c4c5bae35c79d1dba4e42ce1c66d",
+ "source-url": "https://github.com/scribe-public/sample-policies/blob/v2/v2/rules/sbom/artifact-signed.yaml",
+ "tags": [
+ "SBOM",
+ "Blueprint"
+ ]
+ },
+ "shortDescription": {
+ "markdown": "PS.2 Provide a mechanism to verify the integrity of the image",
+ "text": "PS.2 Provide a mechanism to verify the integrity of the image"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "enabled": true,
+ "level": "error",
+ "parameters": {
+ "evidence": {
+ "filter-by": [
+ "product",
+ "target"
+ ],
+ "Match": {
+ "content_body_type": "slsa",
+ "labels": null,
+ "signed": false
+ }
+ },
+ "input-args": {}
+ },
+ "rank": -1
+ },
+ "fullDescription": {
+ "markdown": "PS.3 Provenance exists\nEnsure that provenance information is available for each software release\n\n\n### Mitigation\nRecording comprehensive provenance metadata allows organizations to verify the integrity of the build process and ensures that only authorized and untampered artifacts are deployed.",
+ "text": "PS.3 Provenance exists\nEnsure that provenance information is available for each software release\n\nMitigation: Recording comprehensive provenance metadata allows organizations to verify the integrity of the build process and ensures that only authorized and untampered artifacts are deployed."
+ },
+ "guid": "ee86e0b5-fce6-57d7-8340-b4e0400a4257",
+ "help": {
+ "markdown": "PS.3 Provenance exists\nEnsure that provenance information is available for each software release\n",
+ "text": "PS.3 Provenance exists\nEnsure that provenance information is available for each software release\n"
+ },
+ "helpUri": "https://slsa.dev/spec/v1.0/requirements",
+ "id": "rule-id:SSDF/PS/PS.3/PS.3.1/provenance-exists",
+ "name": "Provenance exists",
+ "properties": {
+ "control-id": "control-id:SSDF/PS/PS.3/PS.3.1",
+ "control-name": "Securely archive the necessary files and supporting data to be retained for each software release",
+ "doc-url": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists",
+ "file-hash": "f33680678db455905d921dbb799e84077db4136f20bd39696f5ba38dff8ac62b",
+ "help-uri": "https://slsa.dev/spec/v1.0/requirements",
+ "labels": [
+ "SLSA"
+ ],
+ "rego-hash": "2d2a69a6f9325a7eb60862a84a791ce1d2209b213840d4431d810da290227121",
+ "rule-hash": "49632226ef0db07882bc5ec0e29749bfd57d967fda1400ea5ade54646fd22482",
+ "source-url": "https://github.com/scribe-public/sample-policies/blob/v2/v2/rules/slsa/l1-provenance-exists.yaml",
+ "tags": [
+ "SLSA"
+ ]
+ },
+ "shortDescription": {
+ "markdown": "PS.3 Provenance exists\nEnsure that provenance information is available for each software release\n",
+ "text": "PS.3 Provenance exists\nEnsure that provenance information is available for each software release\n"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "enabled": true,
+ "level": "error",
+ "parameters": {
+ "evidence": {
+ "filter-by": [
+ "product",
+ "target"
+ ],
+ "Match": {
+ "content_body_type": "cyclonedx-json",
+ "labels": null,
+ "signed": true
+ }
+ },
+ "input-args": {
+ "identity": {
+ "common-names": [],
+ "emails": []
+ }
+ }
+ },
+ "rank": -1
+ },
+ "fullDescription": {
+ "markdown": "PS.3 Archive SBOM",
+ "text": "PS.3 Archive SBOM"
+ },
+ "guid": "3e48369b-35d6-5726-aa74-3f03bfaa526f",
+ "help": {
+ "markdown": "PS.3 Archive SBOM",
+ "text": "PS.3 Archive SBOM"
+ },
+ "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed",
+ "id": "rule-id:SSDF/PS/PS.3/PS.3.2/sbom-is-signed",
+ "name": "SBOM archived",
+ "properties": {
+ "control-id": "control-id:SSDF/PS/PS.3/PS.3.2",
+ "control-name": "Collect, safeguard, maintain, and share provenance data for all components of each software release",
+ "doc-url": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed",
+ "file-hash": "97a32ff04b930f3b093d2e201585cbb7ac6ffdfd05ac8160092219d3e7cba055",
+ "labels": [
+ "SBOM",
+ "Blueprint"
+ ],
+ "rego-hash": "bb8e7472921cf089cb03c1806690e8401d2393e0b224d62ffbab0d521c71f3ad",
+ "rule-hash": "0f5245e0d08f8d1a31af2b943d67fb31a0daa336111cd65e3fae52d3f4317c68",
+ "source-url": "https://github.com/scribe-public/sample-policies/blob/v2/v2/rules/sbom/artifact-signed.yaml",
+ "tags": [
+ "SBOM",
+ "Blueprint"
+ ]
+ },
+ "shortDescription": {
+ "markdown": "PS.3 Archive SBOM",
+ "text": "PS.3 Archive SBOM"
+ }
+ }
+ ],
+ "semanticVersion": "1.5.18-3",
+ "version": "1.5.18-3"
+ },
+ "extensions": [
+ {
+ "contents": [
+ "localizedData",
+ "nonLocalizedData"
+ ],
+ "guid": "9d2a317f-93c1-5a37-b08d-21362788ca2c",
+ "informationUri": "https://csrc.nist.gov/pubs/sp/800/218/final",
+ "language": "en-US",
+ "locations": [
+ {
+ "index": -1,
+ "uri": "https://github.com/scribe-public/sample-policies/blob/v2/v2/initiatives/ssdf.yaml"
+ }
+ ],
+ "name": "SSDF Client Initiative",
+ "properties": {
+ "doc-url": "https://scribe-security.netlify.app/docs/configuration/initiatives/ssdf",
+ "help-uri": "https://csrc.nist.gov/pubs/sp/800/218/final",
+ "initiative-hash": "d9e4049ae300a219f21eb55047c4461f3bec75bf914e84742cb18a28e29c2ca2",
+ "initiative-id": "SSDF",
+ "initiative-name": "SSDF Client Initiative",
+ "report-version": "2.0.0",
+ "source-url": "https://github.com/scribe-public/sample-policies/blob/v2/v2/initiatives/ssdf.yaml"
+ },
+ "shortDescription": {
+ "markdown": "Evaluate PS rules from the SSDF initiative",
+ "text": "Evaluate PS rules from the SSDF initiative"
+ },
+ "version": "1.0.0"
+ }
+ ]
}
- },
- "message": {
- "text": "REF"
- }
}
- ]
- }
- ],
- "automationDetails": {
- "id": "valint/1706017642"
- },
- "properties": {
- "verifier-context": {
- "hostname": "runner_1",
- "user": "username",
- "name": "busybox",
- "product_version": "v0.1",
- "timestamp": "2024-01-23T15:47:22+02:00",
- "input_scheme": "docker",
- "input_name": "busybox",
- "input_tag": "latest",
- "content_type": "statement-sarif",
- "context_type": "local",
- "predicate_type": "https://cyclonedx.org/bom/v1.4",
- "imageID": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824",
- "repoDigest": [
- "busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79"
- ],
- "tag": [
- "latest",
- "1.36.1",
- "latest"
- ],
- "size": 4261550,
- "platform": "linux/amd64",
- "target_type": "policy-results",
- "sbomgroup": "image",
- "sbomname": "index.docker.io/library/busybox:latest",
- "sbomversion": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824",
- "sbomhashs": [
- "sha256-3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79",
- "sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824"
- ],
- "sbompurl": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64",
- "policies": [
- "my_policy",
- "default"
- ],
- "rules": [
- "signed_image",
- "fresh-image"
- ],
- "rule_types": [
- "verify-artifact",
- "verify-artifact"
- ],
- "allow": true,
- "policy-scripts": {
- "": "",
- "fresh-image.rego": "e90241897259b16872cbcb61acad6b8cc61898b11f73d8b7f4a3f58c7d5f1319"
- }
- }
- }
+ ],
+ "properties": {}
}
- ]
}
- }
}
```
diff --git a/scripts/sync_docs.sh b/scripts/sync_docs.sh
index ce78c7d95..1c3e0fbd5 100644
--- a/scripts/sync_docs.sh
+++ b/scripts/sync_docs.sh
@@ -4,7 +4,7 @@ submodules_dir="sub"
[ ! -d "${submodules_dir}" ] && mkdir "${submodules_dir}"
base="git@github.com:scribe-security"
base_public="git@github.com:scribe-public"
-supported_repos=( "valint" "platforms_lib" "action-bom" "action-verify" "action-slsa" "action-installer" "orbs" "azure-tasks" "helm-charts" "valint-pipe" "gatekeeper-provider" "sample-policies" )
+supported_repos=( "valint" "platforms_lib" "action-bom" "action-verify" "action-slsa" "action-installer" "orbs" "azure-tasks" "helm-charts" "valint-pipe" "gatekeeper-provider" "sample-policies" )
pull_submodules() {
repos=$1
@@ -17,10 +17,23 @@ pull_submodules() {
repo_url="${base}/${repo}"
fi
repo_dir="${submodules_dir}/${repo}"
- [[ ! -d "${repo_dir}" ]] && git clone --depth 1 "${repo_url}" "${repo_dir}"
+ if [ ! -z "$BRANCH" ]; then
+ git clone --depth 1 --branch "$BRANCH" "${repo_url}" "${repo_dir}"
+ else
+ git clone --depth 1 "${repo_url}" "${repo_dir}"
+ fi
pushd "${repo_dir}"
- git checkout master || git checkout main
- git pull origin master || git pull origin main
+ # if BRANCH
+ if [ ! -z "$BRANCH" ]; then
+ git fetch origin $BRANCH
+ git checkout $BRANCH
+ git config pull.rebase false # Or `true` if you prefer rebasing
+ git pull origin $BRANCH
+ else
+ git checkout master || git checkout main
+ git pull origin master || git pull origin main
+ fi
+
popd
done
}
@@ -34,8 +47,14 @@ checkout_submodules() {
repo_dir="${submodules_dir}/${repo}"
[[ ! -d "${repo_dir}" ]] && git clone --depth 1 "${repo_url}" "${repo_dir}"
pushd "${repo_dir}"
- git checkout master || git checkout main
- git pull origin master || git pull origin main
+ if [ ! -z "$BRANCH" ]; then
+ git branch -D $BRANCH
+ git checkout -b $BRANCH
+ else
+ git checkout master || git checkout main
+ git pull origin master || git pull origin main
+ fi
+
git branch -D doc_export
git checkout -b doc_export
popd
@@ -236,28 +255,40 @@ export_orbs() {
export_file_rename ${repo} "" "${dst_dir}/circleci.md"
}
-
import_sample-policies() {
repo="sample-policies"
repo_dir="${submodules_dir}/${repo}"
dst_dir="docs/guides"
- echo '---
-sidebar_label: "Applying Policies to your SDLC"
-title: Applying Policies to your SDLC
-sidebar_position: 3
-toc_min_heading_level: 2
-toc_max_heading_level: 5
----' > "${dst_dir}/enforcing-sdlc-policy.md"
- tail -n +2 "${repo_dir}/README.md" >> "${dst_dir}/enforcing-sdlc-policy.md"
+ cp -r "${repo_dir}/docs/v2/*" "docs/configuration/"
+
+ # Create a temporary file to hold the table content from index.md
+ tmpfile=$(mktemp)
+
+ # Extract everything between and from index.md
+ # (excluding the markers themselves) into tmpfile
+ sed -n '//,// {
+ //d
+ //d
+ p
+ }' docs/configuration/initiatives/index.md > "${tmpfile}"
+
+ # Replace the block in enforcing-sdlc-initiative.md with the table content from tmpfile
+ sed -i '//,//{
+ //!{ //!d; }
+ //r '"${tmpfile}"'
+ }' "${dst_dir}/enforcing-sdlc-initiative.md"
+
+ # Clean up
+ rm "${tmpfile}"
}
export_sample-policies() {
repo="sample-policies"
repo_dir="${submodules_dir}/${repo}"
dst_dir="docs/guides"
- export_file_rename ${repo} "" "${dst_dir}/enforcing-sdlc-policy.md"
+ export_file_rename ${repo} "" "${dst_dir}/enforcing-sdlc-initiative.md"
sed -i '/^---$/,/^---$/c\
# Sample policies' "${repo_dir}/README.md"
}
@@ -376,7 +407,7 @@ EOF
parse_args() {
- while getopts "r:IESLdh?x" arg; do
+ while getopts "b:r:IESLdh?x" arg; do
case "$arg" in
x) set -x ;;
r) repos+=(${OPTARG});;
@@ -384,6 +415,7 @@ parse_args() {
E) COMMAND="export";;
S) COMMAND="status";;
L) LOCAL="true";;
+ b) BRANCH=${OPTARG};;
h | \?) usage "$0" ;;
esac
done