Dev

.github/workflows/export.yaml

@@ -12,7 +12,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-24.04] # TODO: only build
-        repo: ["valint", "action-bom", "action-verify", "action-slsa", "orbs", "azure-tasks", "helm-charts", "valint-pipe"]
+        repo: ["valint", "action-bom", "action-verify", "action-slsa", "action-evidence", "orbs", "azure-tasks", "helm-charts", "valint-pipe"]
     runs-on: ${{ matrix.os }}
     defaults:
       run:

docs/configuration/initiatives/index.md

@@ -10,7 +10,8 @@
 | [SLSA L1 Framework](/docs/configuration/initiatives/slsa.l1.md) | Evaluate SLSA Level 1 |
 | [SLSA L2 Framework](/docs/configuration/initiatives/slsa.l2.md) | Evaluate SLSA Level 2 |
 | [SSDF Client Initiative](/docs/configuration/initiatives/ssdf.md) | Evaluate PS rules from the SSDF initiative |
-| [Secure Software Pipeline Blueprint](/docs/configuration/initiatives/sspb.md) | Blueprint for secure pipelines - Gitlab |
+| [Secure Software Pipeline Blueprint](/docs/configuration/initiatives/sspb-gl.md) | Blueprint for secure pipelines - Gitlab |
+| [Secure Software Pipeline Blueprint](/docs/configuration/initiatives/sspb-gh.md) | Blueprint for secure pipelines - GitHub |
 
 ## Rules
 
@@ -32,7 +33,6 @@
 
 | Rule Name | Description |
 |-----------|-------------|
-| [Verify File Integrity](/docs/configuration/initiatives/rules/multievidence/files_integrity.md) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. |
 | [Verify Image Labels](/docs/configuration/initiatives/rules/images/verify-labels.md) | Verify specified labels key-value pairs exist in the image. |
 | [Forbid Large Images](/docs/configuration/initiatives/rules/images/forbid-large-images.md) | Verify the image size is below the specified threshold. |
 | [Disallow Container Shell Entrypoint](/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md) | Verify the container image disallows shell entrypoint. |
@@ -92,6 +92,7 @@
 
 | Rule Name | Description |
 |-----------|-------------|
+| [3rd Party Scanner Violations](/docs/configuration/initiatives/rules/generic/3rd-pty.md) | Limit allowed violations in 3rd party scanner reports |
 | [Required Trivy Evidence Exists](/docs/configuration/initiatives/rules/generic/trivy-exists.md) | Verify required Trivy evidence exists |
 | [Required Generic Evidence Exists](/docs/configuration/initiatives/rules/generic/evidence-exists.md) | Verify required evidence exists. |
 | [Generic Artifact Signed](/docs/configuration/initiatives/rules/generic/artifact-signed.md) | Verify required evidence is signed. |
@@ -128,6 +129,7 @@
 
 | Rule Name | Description |
 |-----------|-------------|
+| [Pull request approval policy check for GitHub repository](/docs/configuration/initiatives/rules/github/repository/approvals-policy-check.md) | Verify the repository's pull request approval policy |
 | [Verify secret scanning.](/docs/configuration/initiatives/rules/github/repository/validity-checks.md) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. |
 | [Verify Dependabot security updates setting](/docs/configuration/initiatives/rules/github/repository/dependabot.md) | Verify Dependabot security updates are configured in the GitHub repository. |
 | [Verify Repository Is Private](/docs/configuration/initiatives/rules/github/repository/repo-private.md) | Verify the GitHub repository is private. |

docs/configuration/initiatives/rules/generic/3rd-pty.md

@@ -0,0 +1,79 @@
+---
+sidebar_label: 3rd Party Scanner Violations
+title: 3rd Party Scanner Violations
+---  
+# 3rd Party Scanner Violations  
+**Type:** Rule  
+**ID:** `3rd-pty`  
+**Source:** [v2/rules/generic/3rd-pty.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/3rd-pty.yaml)  
+**Rego Source:** [3rd-pty.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/3rd-pty.rego)  
+**Labels:** 3rd-pty, SCA  
+
+Limit allowed violations in 3rd party scanner reports
+
+:::note 
+This rule requires Generic Statement. See [here](/docs/valint/generic) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: generic/3rd-pty@v2
+with:
+  severities:
+    - Critical
+    - High
+  titles:
+    - "CVE-2023-1234"
+    - "CVE-2023-5678"
+    - "CVE-2025"
+  cwes:
+    - "CWE-123"
+    - "CWE-456"
+  descriptions:
+    - "Vulnerability in component X"
+    - "Misconfiguration in component Y"
+  descriptions_to_ignore:
+    - "False positive in component Z"
+    - "Known issue in component A"
+  component_names:
+    - library-x
+    - library-y
+```
+
+## Mitigation  
+Restricts the number and type of violations from third-party scanner reports, helping to enforce organizational security and compliance policies.
+
+
+## Description  
+This rule verifies that the number and type of violations reported by third-party scanners are within allowed thresholds.
+It checks the evidence for findings matching the specified severities, titles, CWEs, descriptions, and component names.
+Violations are recorded if any findings exceed the configured limits or match blocklisted criteria.
+
+### **Evidence Requirements**
+- Evidence must be provided by a supported third-party scanner and formatted as generic findings (see the `--parser` flag in `valint`).
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/finding/v0.1 |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| severities | array | False | List of severities to filter by. |
+| titles | array | False | List of titles to filter by. |
+| cwes | array | False | List of CWE identifiers to filter by. |
+| descriptions | array | False | List of descriptions to filter by. |
+| descriptions_to_ignore | array | False | List of descriptions to ignore from findings. |
+| component_names | array | False | List of component names to filter by. |
+

docs/configuration/initiatives/rules/github/repository/approvals-policy-check.md

@@ -0,0 +1,59 @@
+---
+sidebar_label: Pull request approval policy check for GitHub repository
+title: Pull request approval policy check for GitHub repository
+---  
+# Pull request approval policy check for GitHub repository  
+**Type:** Rule  
+**ID:** `github-repo-pr-approval`  
+**Source:** [v2/rules/github/repository/approvals-policy-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/approvals-policy-check.yaml)  
+**Rego Source:** [approvals-policy-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/approvals-policy-check.rego)  
+**Labels:** Blueprint, GitHub, Repository  
+
+Verify the repository's pull request approval policy
+
+:::note 
+This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.  
+::: 
+:::tip 
+Signed Evidence for this rule **IS NOT** required by default but is recommended.  
+::: 
+:::warning  
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+::: 
+
+## Usage example
+
+```yaml
+uses: github/repository/approvals-policy-check@v2
+with:
+  approvals_required_min: 1
+```
+
+## Mitigation  
+Ensure that the repository's PR approval policy complies with requirements to prevent unauthorized merges.
+
+
+## Description  
+This rule ensures that the repository's PR approval policy complies with requirements.
+It performs the following steps:
+
+1. Checks the settings of the GitHub repository.
+2. Verifies that the repository's PR approval policy requires a minimum number of approvals as specified in the 'approvals_required_min' field.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository resources.
+
+## Evidence Requirements  
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github<br/>- asset_type=repository |
+
+## Input Definitions  
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| approvals_required_min | number | True | Minimum number of approvals required for pull requests. |
+

docs/configuration/initiatives/rules/images/allowed-base-image.md

@@ -63,4 +63,5 @@ is found, a violation is recorded indicating that the necessary base image infor
 | Parameter | Type | Required | Description |
 |-----------|------|----------|-------------|
 | approved_sources | array | False | A list of approved base image  pattern. |
+| fail_on_no_base_image | boolean | False | Whether to fail the rule if no base image is found. |