stacklok-profile-remediate.yaml

---
# Stacklok profile
version: v1
type: profile
name: stacklok-remediate-profile
display_name: Stacklok example remedation profile
context:
  provider: github
alert: "off"
remediate: "on"
repository:
  - type: actions_check_pinned_tags
    def:
      exclude:
        - slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0
  - type: automatic_branch_deletion
    def:
      enabled: true
  - type: secret_scanning
    def:
      enabled: true
      skip_private_repos: true
  - type: secret_push_protection
    def:
      enabled: true
      skip_private_repos: true
  - type: default_workflow_permissions
    def:
      default_workflow_permissions: read
      can_approve_pull_request_reviews: false
  - type: dockerfile_no_latest_tag
    def: {}
  - type: branch_protection_enabled
    params:
      branch: main
    def: {}
  - type: branch_protection_allow_deletions
    params:
      branch: main
    def:
      allow_deletions: false
  - type: branch_protection_allow_force_pushes
    params:
      branch: main
    def:
      allow_force_pushes: false
  - type: branch_protection_enforce_admins
    params:
      branch: main
    def:
      enforce_admins: true
  - type: branch_protection_lock_branch
    params:
      branch: main
    def:
      lock_branch: false
  - type: branch_protection_require_conversation_resolution
    params:
      branch: main
    def:
      required_conversation_resolution: false
  - type: branch_protection_require_pull_request_approving_review_count
    params:
      branch: main
    def:
      required_approving_review_count: 1
  - type: branch_protection_require_pull_request_code_owners_review
    params:
      branch: main
    def:
      require_code_owner_reviews: false
  - type: branch_protection_require_pull_request_dismiss_stale_reviews
    params:
      branch: main
    def:
      dismiss_stale_reviews: true
  - type: branch_protection_require_pull_request_last_push_approval
    params:
      branch: main
    def:
      require_last_push_approval: true
  - type: branch_protection_require_pull_requests
    params:
      branch: main
    def:
      required_pull_request_reviews: true
  - type: branch_protection_require_signatures
    params:
      branch: main
    def:
      required_signatures: false
artifact:
  - type: artifact_signature
    params:
      tags: [latest]
      name: minder/server
    def:
      is_signed: true
      is_verified: true
      repository: https://github.com/stacklok/minder
      branch: main
      runner_environment: github-hosted
      signer_identity: chart-publish.yml
      cert_issuer: https://token.actions.githubusercontent.com
pull_request:
  - type: pr_vulnerability_check
    def:
      action: review
      ecosystem_config:
        - name: npm
          vulnerability_database_type: osv
          vulnerability_database_endpoint: https://api.osv.dev/v1/query
          package_repository:
            url: https://registry.npmjs.org
        - name: go
          vulnerability_database_type: osv
          vulnerability_database_endpoint: https://api.osv.dev/v1/query
          package_repository:
            url: https://proxy.golang.org
          sum_repository:
            url: https://sum.golang.org
        - name: pypi
          vulnerability_database_type: osv
          vulnerability_database_endpoint: https://api.osv.dev/v1/query
          package_repository:
            url: https://pypi.org/pypi