Dev

.github/workflows/export.yaml

@@ -11,7 +11,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-20.04] # TODO: only build
+        os: [ubuntu-24.04] # TODO: only build
         repo: ["valint", "action-bom", "action-verify", "action-slsa", "orbs", "azure-tasks", "helm-charts", "valint-pipe"]
     runs-on: ${{ matrix.os }}
     defaults:
@@ -52,4 +52,4 @@ jobs:
           branch: docs_import_${{ steps.extract_branch.outputs.branch }}
           path: sub/${{ matrix.repo }}
           token: ${{ secrets.PR_PAT }}
-          title: autogen - docs export
+          title: autogen - docs export

docs/configuration/_category_.json

@@ -0,0 +1,4 @@
+{
+  "label": "Configuration",
+  "position": 999
+}

docs/configuration/initiatives/_category_.json

@@ -0,0 +1,4 @@
+{
+  "label": "Reference: Policies and Configuration Guide",
+  "position": 999
+}

docs/configuration/initiatives/rules/_category_.json

@@ -0,0 +1,4 @@
+{
+  "label": "Rule Configuration",
+  "position": 999
+}

docs/configuration/initiatives/rules/api/_category_.json

@@ -0,0 +1,4 @@
+{
+  "label": "Scribe API",
+  "position": 1
+}

docs/configuration/initiatives/rules/api/scribe-api-cve-product.md

@@ -0,0 +1,38 @@
+---
+sidebar_label: Verify No Critical or High Vulnerabilities in Product
+title: Verify No Critical or High Vulnerabilities in Product
+---  
+# Verify No Critical or High Vulnerabilities in Product  
+**Type:** Rule  
+**ID:** `scribe-cve-product`  
+**Source:** [v2/rules/api/scribe-api-cve-product.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-cve-product.yaml)  
+**Rego Source:** [scribe-api.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.rego)  
+**Labels:** SCA, Blueprint, Scribe  
+
+Verify via Scribe API that there are no critical or high severity vulnerabilities in any deliverable component of the product.
+
+:::tip 
+Evidence **IS NOT** required for this rule.  
+::: 
+:::tip 
+Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the `valint` utility.  
+::: 
+
+## Usage example
+
+```yaml
+uses: api/scribe-api-cve-product@v2
+```
+
+## Mitigation  
+Ensure that all critical or high severity vulnerabilities are addressed before delivering the product.
+
+
+## Description  
+This rule ensures that there are no critical or high severity vulnerabilities in any deliverable component of the product by verifying via the Scribe API.
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| cve | array | True | List of CVEs to check against the product components. |
+

docs/configuration/initiatives/rules/api/scribe-api-cve.md

@@ -0,0 +1,57 @@
+---
+sidebar_label: Verify No Critical or High Vulnerabilities
+title: Verify No Critical or High Vulnerabilities
+---  
+# Verify No Critical or High Vulnerabilities  
+**Type:** Rule  
+**ID:** `scribe-cve`  
+**Source:** [v2/rules/api/scribe-api-cve.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-cve.yaml)  
+**Rego Source:** [scribe-api-cve.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-cve.rego)  
+**Labels:** SCA, Blueprint, Scribe  
+
+Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.).
+
+:::tip 
+Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the `valint` utility.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by product and target.  
+:::  
+
+## Usage example
+
+```yaml
+uses: api/scribe-api-cve@v2
+with:
+  superset:
+    cve:
+      max: 0
+      severity: 6
+```
+
+## Mitigation  
+Ensure that all critical or high severity vulnerabilities are addressed before delivering the product.
+
+
+## Description  
+This rule ensures that there are no critical or high severity vulnerabilities in any deliverable component of the product by verifying via the Scribe API.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+| target_type | container |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| superset | object | False | The superset of CVEs to check for, including the following format [cve: [max: int, severity: int]] |
+

docs/configuration/initiatives/rules/api/scribe-api-findings.md

@@ -0,0 +1,60 @@
+---
+sidebar_label: Verify No 3rd Party Findings via Scribe API
+title: Verify No 3rd Party Findings via Scribe API
+---  
+# Verify No 3rd Party Findings via Scribe API  
+**Type:** Rule  
+**ID:** `scribe-findings`  
+**Source:** [v2/rules/api/scribe-api-findings.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-findings.yaml)  
+**Rego Source:** [scribe-api-findings.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-findings.rego)  
+**Labels:** SCA, Blueprint, Scribe  
+
+Verify via Scribe API that there are no findings reported by 3rd party tools in the target product.
+
+:::tip 
+Evidence **IS NOT** required for this rule.  
+::: 
+:::tip 
+Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the `valint` utility.  
+::: 
+
+## Usage example
+
+```yaml
+uses: api/scribe-api-findings@v2
+with:
+  superset:
+    findings:
+      severities:
+        - Critical
+        - High
+      tools:
+        - Trivy
+        - Snyk
+      titles:
+        - "CVE-2023-1234"
+        - "CVE-2023-5678"
+        - "CVE-2025"
+      cwes:
+        - "CWE-123"
+        - "CWE-456"
+      descriptions:
+        - "Vulnerability in component X"
+        - "Misconfiguration in component Y"
+      descriptions_to_ignore:
+        - "False positive in component Z"
+        - "Known issue in component A"
+```
+
+## Mitigation  
+Ensure that all findings reported by 3rd party tools are addressed before delivering the product.
+
+
+## Description  
+This rule ensures that there are no findings, such as vulnerabilities, misconfigurations, or other issues reported by 3rd party tools, in any component of the product by verifying via the Scribe API.
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| superset | object | False | Filters for the findings. See usage example. |
+

docs/configuration/initiatives/rules/api/scribe-api-published.md

@@ -0,0 +1,47 @@
+---
+sidebar_label: Scribe Published Policy
+title: Scribe Published Policy
+---  
+# Scribe Published Policy  
+**Type:** Rule  
+**ID:** `scribe-published-policy`  
+**Source:** [v2/rules/api/scribe-api-published.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-published.yaml)  
+**Rego Source:** [scribe-api-published.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-published.rego)  
+**Labels:** Scribe  
+
+Verify image Scribe Publish flag is set for container image.
+
+:::tip 
+Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the `valint` utility.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: api/scribe-api-published@v2
+```
+
+## Mitigation  
+Ensure that all critical or high severity vulnerabilities are addressed before delivering the product.
+
+
+## Description  
+This rule ensures that the product is published only after all critical or high severity vulnerabilities are addressed.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | cyclonedx-json |
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| superset | `{'published': None}` |
+

docs/configuration/initiatives/rules/api/scribe-api.md

@@ -0,0 +1,44 @@
+---
+sidebar_label: Apply Scribe Template Policy
+title: Apply Scribe Template Policy
+---  
+# Apply Scribe Template Policy  
+**Type:** Rule  
+**ID:** `scribe-template`  
+**Source:** [v2/rules/api/scribe-api.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.yaml)  
+**Rego Source:** [scribe-api.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.rego)  
+**Labels:** Scribe  
+
+Verify XX using the Scribe API template rule.
+
+:::tip 
+Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the `valint` utility.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+:::info  
+Rule is scoped by product and target.  
+:::  
+
+## Usage example
+
+```yaml
+uses: api/scribe-api@v2
+```
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| filter-by | ['product', 'target'] |
+| signed | False |
+| content_body_type | cyclonedx-json |
+
+## Rule Parameters (`with`)  
+| Parameter | Default |
+|-----------|---------|
+| superset | `{'cve': {'max': 0, 'severity': 6}, 'licences': {'max': 500}, 'unmaintained': {'max': 2000}, 'images': {'max': 20}}` |
+

docs/configuration/initiatives/rules/bitbucket/_category_.json

@@ -0,0 +1,4 @@
+{
+  "label": "Bitbucket",
+  "position": 1
+}

docs/configuration/initiatives/rules/bitbucket/project/_category_.json

@@ -0,0 +1,4 @@
+{
+  "label": "Project",
+  "position": 1
+}

docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md

@@ -0,0 +1,61 @@
+---
+sidebar_label: Allowed Project Admins
+title: Allowed Project Admins
+---  
+# Allowed Project Admins  
+**Type:** Rule  
+**ID:** `bb-project-allowed-project-admins`  
+**Source:** [v2/rules/bitbucket/project/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-admins.yaml)  
+**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-admins.rego)  
+
+Verify only users specified in the Allowed List have admin privileges in the Bitbucket project.
+
+:::note 
+This rule requires Bitbucket Project Discovery Evidence. See [here](/docs/platforms/discover#bitbucket-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: bitbucket/project/allow-admins@v2
+with:
+  allowed_admins:
+    - "user1"
+    - "user2"
+    - "user3"
+```
+
+## Mitigation  
+Ensure that only users in the Allowed List have admin privileges in the Bitbucket project to reduce the risk of unauthorized changes.
+
+
+## Description  
+This rule ensures that only users in the Allowed List have admin privileges in the Bitbucket project.
+It performs the following steps:
+
+1. Checks the settings of the Bitbucket project.
+2. Verifies that only users in the Allowed List have admin privileges.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket project resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=bitbucket<br/>- asset_type=project |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| allowed_admins | array | False | List of users allowed to have admin privileges in the Bitbucket project. |
+