feat(controls): ship artipacked (ISSUE-307)

[stephrobert]

Summary

checkoutMustNotPersistCredentials (rule artipacked, ISSUE-307, severity
high) is implemented in policies/artipacked.rego but benched in
configuration/registry.go — its findings are dropped before scoring and
output. This issue tracks promoting it to a shipping GitHub control.

Defends against: credential exfiltration through .git/config. See
docs/EXPLOIT_PATH_COVERAGE.md (path E6, Tier 1).

What to detect

A job with an actions/checkout step that does not set
with.persist-credentials: false.

By default actions/checkout writes the GITHUB_TOKEN into the cloned repo's
.git/config, where it survives for the lifetime of the job. Any later step
that uploads .git as part of an artefact, or that runs fork-controlled code,
can exfiltrate the token. The check accepts both the boolean false and the
quoted "false" form.

# vulnerable — token persisted in .git/config
- uses: actions/checkout@v4

Remediation (for docs/GITHUB_ISSUES.md)

Disable credential persistence unless a later step genuinely needs to push with
the token. It is a one-line change.

# fixed
- uses: actions/checkout@v4
  with:
    persist-credentials: false

Acceptance criteria

• Remove checkoutMustNotPersistCredentials from benchedControls[ProviderGitHub] in configuration/registry.go.
• ≥3 test cases in policies/rules_test.go with policies/testdata/ fixtures: checkout with no with: (flag), with: block without persist-credentials (flag), persist-credentials: false (silent).
• Add checkoutMustNotPersistCredentials to the GitHub controls: block of .plumber.yaml with enabled: true.
• Verify the ISSUE-307 entry in docs/GITHUB_ISSUES.md.
• make build && make test && make lint green.

Example workflow: lab-plumber-advisories/.github/workflows/artipacked.yml (VULN + SAFE cases).

[Joseph94m]

Hi, I'll have a look at this asap