diff --git a/docs/docs.json b/docs/docs.json index 0935edb9..b7b847cb 100644 --- a/docs/docs.json +++ b/docs/docs.json @@ -141,6 +141,7 @@ "opengraph/extensions/github/nodes/gh_branch", "opengraph/extensions/github/nodes/gh_branchprotectionrule", "opengraph/extensions/github/nodes/gh_environment", + "opengraph/extensions/github/nodes/gh_environmentbranchpolicy", "opengraph/extensions/github/nodes/gh_environmentsecret", "opengraph/extensions/github/nodes/gh_environmentvariable", "opengraph/extensions/github/nodes/gh_externalidentity", @@ -172,12 +173,16 @@ "opengraph/extensions/github/edges/gh_addlabel", "opengraph/extensions/github/edges/gh_addmember", "opengraph/extensions/github/edges/gh_adminto", + "opengraph/extensions/github/edges/gh_approvesdeploymentto", "opengraph/extensions/github/edges/gh_bypassbranchprotection", "opengraph/extensions/github/edges/gh_bypasspullrequestallowances", "opengraph/extensions/github/edges/gh_callsworkflow", "opengraph/extensions/github/edges/gh_canaccess", "opengraph/extensions/github/edges/gh_canassumeidentity", "opengraph/extensions/github/edges/gh_cancreatebranch", + "opengraph/extensions/github/edges/gh_cancreateenvironment", + "opengraph/extensions/github/edges/gh_candeploytoenvironment", + "opengraph/extensions/github/edges/gh_caneditenvironment", "opengraph/extensions/github/edges/gh_caneditprotection", "opengraph/extensions/github/edges/gh_canpwnrequest", "opengraph/extensions/github/edges/gh_canreadsecretscanningalert", @@ -207,19 +212,14 @@ "opengraph/extensions/github/edges/gh_editrepometadata", "opengraph/extensions/github/edges/gh_editrepoprotections", "opengraph/extensions/github/edges/gh_hasbaserole", - "opengraph/extensions/github/edges/gh_hasbranch", - "opengraph/extensions/github/edges/gh_hasenvironment", "opengraph/extensions/github/edges/gh_hasexternalidentity", - "opengraph/extensions/github/edges/gh_hasjob", "opengraph/extensions/github/edges/gh_hasmember", "opengraph/extensions/github/edges/gh_haspersonalaccesstoken", "opengraph/extensions/github/edges/gh_haspersonalaccesstokenrequest", "opengraph/extensions/github/edges/gh_hasrole", "opengraph/extensions/github/edges/gh_hassamlidentityprovider", "opengraph/extensions/github/edges/gh_hassecret", - "opengraph/extensions/github/edges/gh_hasstep", "opengraph/extensions/github/edges/gh_hasvariable", - "opengraph/extensions/github/edges/gh_hasworkflow", "opengraph/extensions/github/edges/gh_installedas", "opengraph/extensions/github/edges/gh_invitemember", "opengraph/extensions/github/edges/gh_jumpmergequeue", @@ -236,6 +236,7 @@ "opengraph/extensions/github/edges/gh_managewebhooks", "opengraph/extensions/github/edges/gh_mapstouser", "opengraph/extensions/github/edges/gh_markasduplicate", + "opengraph/extensions/github/edges/gh_matchesenvironmentpolicy", "opengraph/extensions/github/edges/gh_memberof", "opengraph/extensions/github/edges/gh_orgbypasscodescanningdismissalrequests", "opengraph/extensions/github/edges/gh_orgbypasssecretscanningclosurerequests", diff --git a/docs/images/extensions/github/gh_app.png b/docs/images/extensions/github/gh_app.png index e3d3ba18..6a0c53b2 100644 Binary files a/docs/images/extensions/github/gh_app.png and b/docs/images/extensions/github/gh_app.png differ diff --git a/docs/images/extensions/github/gh_appinstallation.png b/docs/images/extensions/github/gh_appinstallation.png index 94f6d08d..e57d1424 100644 Binary files a/docs/images/extensions/github/gh_appinstallation.png and b/docs/images/extensions/github/gh_appinstallation.png differ diff --git a/docs/images/extensions/github/gh_branch.png b/docs/images/extensions/github/gh_branch.png index 22f4d484..46ac1270 100644 Binary files a/docs/images/extensions/github/gh_branch.png and b/docs/images/extensions/github/gh_branch.png differ diff --git a/docs/images/extensions/github/gh_branchprotectionrule.png b/docs/images/extensions/github/gh_branchprotectionrule.png index 9dbf139c..1b1de833 100644 Binary files a/docs/images/extensions/github/gh_branchprotectionrule.png and b/docs/images/extensions/github/gh_branchprotectionrule.png differ diff --git a/docs/images/extensions/github/gh_enterprise.png b/docs/images/extensions/github/gh_enterprise.png new file mode 100644 index 00000000..d55feda0 Binary files /dev/null and b/docs/images/extensions/github/gh_enterprise.png differ diff --git a/docs/images/extensions/github/gh_enterprisemanageduser.png b/docs/images/extensions/github/gh_enterprisemanageduser.png new file mode 100644 index 00000000..4f94f1c9 Binary files /dev/null and b/docs/images/extensions/github/gh_enterprisemanageduser.png differ diff --git a/docs/images/extensions/github/gh_enterpriserole.png b/docs/images/extensions/github/gh_enterpriserole.png new file mode 100644 index 00000000..43262e1a Binary files /dev/null and b/docs/images/extensions/github/gh_enterpriserole.png differ diff --git a/docs/images/extensions/github/gh_enterpriseteam.png b/docs/images/extensions/github/gh_enterpriseteam.png new file mode 100644 index 00000000..70e00bf5 Binary files /dev/null and b/docs/images/extensions/github/gh_enterpriseteam.png differ diff --git a/docs/images/extensions/github/gh_environment.png b/docs/images/extensions/github/gh_environment.png index aa85643c..ad9f1dbe 100644 Binary files a/docs/images/extensions/github/gh_environment.png and b/docs/images/extensions/github/gh_environment.png differ diff --git a/docs/images/extensions/github/gh_environmentbranchpolicy.png b/docs/images/extensions/github/gh_environmentbranchpolicy.png new file mode 100644 index 00000000..b6d04650 Binary files /dev/null and b/docs/images/extensions/github/gh_environmentbranchpolicy.png differ diff --git a/docs/images/extensions/github/gh_environmentsecret.png b/docs/images/extensions/github/gh_environmentsecret.png index 7942c4d2..365a384b 100644 Binary files a/docs/images/extensions/github/gh_environmentsecret.png and b/docs/images/extensions/github/gh_environmentsecret.png differ diff --git a/docs/images/extensions/github/gh_environmentvariable.png b/docs/images/extensions/github/gh_environmentvariable.png index bee0e845..fe436e25 100644 Binary files a/docs/images/extensions/github/gh_environmentvariable.png and b/docs/images/extensions/github/gh_environmentvariable.png differ diff --git a/docs/images/extensions/github/gh_externalidentity.png b/docs/images/extensions/github/gh_externalidentity.png index 0522f245..28b20e12 100644 Binary files a/docs/images/extensions/github/gh_externalidentity.png and b/docs/images/extensions/github/gh_externalidentity.png differ diff --git a/docs/images/extensions/github/gh_organization.png b/docs/images/extensions/github/gh_organization.png index 402f4152..ad054181 100644 Binary files a/docs/images/extensions/github/gh_organization.png and b/docs/images/extensions/github/gh_organization.png differ diff --git a/docs/images/extensions/github/gh_orgrole.png b/docs/images/extensions/github/gh_orgrole.png index 93a4fd8e..b2d069ff 100644 Binary files a/docs/images/extensions/github/gh_orgrole.png and b/docs/images/extensions/github/gh_orgrole.png differ diff --git a/docs/images/extensions/github/gh_orgrunner.png b/docs/images/extensions/github/gh_orgrunner.png new file mode 100644 index 00000000..169a0691 Binary files /dev/null and b/docs/images/extensions/github/gh_orgrunner.png differ diff --git a/docs/images/extensions/github/gh_orgsecret.png b/docs/images/extensions/github/gh_orgsecret.png index 2c5c82a1..011a9939 100644 Binary files a/docs/images/extensions/github/gh_orgsecret.png and b/docs/images/extensions/github/gh_orgsecret.png differ diff --git a/docs/images/extensions/github/gh_orgvariable.png b/docs/images/extensions/github/gh_orgvariable.png index b3a86390..f5e09e57 100644 Binary files a/docs/images/extensions/github/gh_orgvariable.png and b/docs/images/extensions/github/gh_orgvariable.png differ diff --git a/docs/images/extensions/github/gh_personalaccesstoken.png b/docs/images/extensions/github/gh_personalaccesstoken.png index f33a2da1..665d6ea1 100644 Binary files a/docs/images/extensions/github/gh_personalaccesstoken.png and b/docs/images/extensions/github/gh_personalaccesstoken.png differ diff --git a/docs/images/extensions/github/gh_personalaccesstokenrequest.png b/docs/images/extensions/github/gh_personalaccesstokenrequest.png index 1f5d4712..a2c9a28e 100644 Binary files a/docs/images/extensions/github/gh_personalaccesstokenrequest.png and b/docs/images/extensions/github/gh_personalaccesstokenrequest.png differ diff --git a/docs/images/extensions/github/gh_reporole.png b/docs/images/extensions/github/gh_reporole.png index 949369c4..b9fab705 100644 Binary files a/docs/images/extensions/github/gh_reporole.png and b/docs/images/extensions/github/gh_reporole.png differ diff --git a/docs/images/extensions/github/gh_reporunner.png b/docs/images/extensions/github/gh_reporunner.png new file mode 100644 index 00000000..443cddb2 Binary files /dev/null and b/docs/images/extensions/github/gh_reporunner.png differ diff --git a/docs/images/extensions/github/gh_reposecret.png b/docs/images/extensions/github/gh_reposecret.png index 56acb8d5..389ead9e 100644 Binary files a/docs/images/extensions/github/gh_reposecret.png and b/docs/images/extensions/github/gh_reposecret.png differ diff --git a/docs/images/extensions/github/gh_repository.png b/docs/images/extensions/github/gh_repository.png index 94aa3156..587de709 100644 Binary files a/docs/images/extensions/github/gh_repository.png and b/docs/images/extensions/github/gh_repository.png differ diff --git a/docs/images/extensions/github/gh_repovariable.png b/docs/images/extensions/github/gh_repovariable.png index b724af68..2231534c 100644 Binary files a/docs/images/extensions/github/gh_repovariable.png and b/docs/images/extensions/github/gh_repovariable.png differ diff --git a/docs/images/extensions/github/gh_runnergroup.png b/docs/images/extensions/github/gh_runnergroup.png new file mode 100644 index 00000000..f98aadda Binary files /dev/null and b/docs/images/extensions/github/gh_runnergroup.png differ diff --git a/docs/images/extensions/github/gh_samlidentityprovider.png b/docs/images/extensions/github/gh_samlidentityprovider.png index e43ef683..1e092269 100644 Binary files a/docs/images/extensions/github/gh_samlidentityprovider.png and b/docs/images/extensions/github/gh_samlidentityprovider.png differ diff --git a/docs/images/extensions/github/gh_secretscanningalert.png b/docs/images/extensions/github/gh_secretscanningalert.png index 167e40f6..fa3e235b 100644 Binary files a/docs/images/extensions/github/gh_secretscanningalert.png and b/docs/images/extensions/github/gh_secretscanningalert.png differ diff --git a/docs/images/extensions/github/gh_team.png b/docs/images/extensions/github/gh_team.png index cc8c3c43..3fe10049 100644 Binary files a/docs/images/extensions/github/gh_team.png and b/docs/images/extensions/github/gh_team.png differ diff --git a/docs/images/extensions/github/gh_teamrole.png b/docs/images/extensions/github/gh_teamrole.png index facdd141..8289a0c4 100644 Binary files a/docs/images/extensions/github/gh_teamrole.png and b/docs/images/extensions/github/gh_teamrole.png differ diff --git a/docs/images/extensions/github/gh_user.png b/docs/images/extensions/github/gh_user.png index 1bdd04c8..bc23908c 100644 Binary files a/docs/images/extensions/github/gh_user.png and b/docs/images/extensions/github/gh_user.png differ diff --git a/docs/images/extensions/github/gh_workflow.png b/docs/images/extensions/github/gh_workflow.png index b318aad0..4cc95c55 100644 Binary files a/docs/images/extensions/github/gh_workflow.png and b/docs/images/extensions/github/gh_workflow.png differ diff --git a/docs/images/extensions/github/gh_workflowjob.png b/docs/images/extensions/github/gh_workflowjob.png index bff53724..89fa0ae4 100644 Binary files a/docs/images/extensions/github/gh_workflowjob.png and b/docs/images/extensions/github/gh_workflowjob.png differ diff --git a/docs/images/extensions/github/gh_workflowstep.png b/docs/images/extensions/github/gh_workflowstep.png index 536e94bd..bc8b0879 100644 Binary files a/docs/images/extensions/github/gh_workflowstep.png and b/docs/images/extensions/github/gh_workflowstep.png differ diff --git a/docs/images/extensions/github/github_bloodhound.png b/docs/images/extensions/github/github_bloodhound.png deleted file mode 100644 index ed3af22e..00000000 Binary files a/docs/images/extensions/github/github_bloodhound.png and /dev/null differ diff --git a/docs/images/extensions/github/org-admins.png b/docs/images/extensions/github/org-admins.png deleted file mode 100644 index cf56c488..00000000 Binary files a/docs/images/extensions/github/org-admins.png and /dev/null differ diff --git a/docs/images/extensions/github/pat/1_proile_settings.png b/docs/images/extensions/github/pat/1_proile_settings.png deleted file mode 100644 index 45f0ee29..00000000 Binary files a/docs/images/extensions/github/pat/1_proile_settings.png and /dev/null differ diff --git a/docs/images/extensions/github/pat/2_developer_settings.png b/docs/images/extensions/github/pat/2_developer_settings.png deleted file mode 100644 index 48f5329f..00000000 Binary files a/docs/images/extensions/github/pat/2_developer_settings.png and /dev/null differ diff --git a/docs/images/extensions/github/pat/3_fine-grained_tokens.png b/docs/images/extensions/github/pat/3_fine-grained_tokens.png deleted file mode 100644 index d2029a0f..00000000 Binary files a/docs/images/extensions/github/pat/3_fine-grained_tokens.png and /dev/null differ diff --git a/docs/images/extensions/github/pat/4_generate_token.png b/docs/images/extensions/github/pat/4_generate_token.png deleted file mode 100644 index ffcfaa0f..00000000 Binary files a/docs/images/extensions/github/pat/4_generate_token.png and /dev/null differ diff --git a/docs/images/extensions/github/pat/5_all_repositories.png b/docs/images/extensions/github/pat/5_all_repositories.png deleted file mode 100644 index 51bc64df..00000000 Binary files a/docs/images/extensions/github/pat/5_all_repositories.png and /dev/null differ diff --git a/docs/images/extensions/github/pat/7_save_pat.png b/docs/images/extensions/github/pat/7_save_pat.png deleted file mode 100644 index 0afb9959..00000000 Binary files a/docs/images/extensions/github/pat/7_save_pat.png and /dev/null differ diff --git a/docs/images/extensions/github/sso-users.png b/docs/images/extensions/github/sso-users.png deleted file mode 100644 index 74bb526f..00000000 Binary files a/docs/images/extensions/github/sso-users.png and /dev/null differ diff --git a/docs/images/extensions/github/user-repo.png b/docs/images/extensions/github/user-repo.png deleted file mode 100644 index d7586cf1..00000000 Binary files a/docs/images/extensions/github/user-repo.png and /dev/null differ diff --git a/docs/images/extensions/github/who-repo.png b/docs/images/extensions/github/who-repo.png deleted file mode 100644 index 6e7876d5..00000000 Binary files a/docs/images/extensions/github/who-repo.png and /dev/null differ diff --git a/docs/opengraph/extensions/github/edges/gh_addassignee.mdx b/docs/opengraph/extensions/github/edges/gh_addassignee.mdx index ef610b8a..a9ee9644 100644 --- a/docs/opengraph/extensions/github/edges/gh_addassignee.mdx +++ b/docs/opengraph/extensions/github/edges/gh_addassignee.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_AddAssignee' -description: '[Repository] Repo role can assign users to issues and pull requests' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_AddAssignee' +description: '[Repository] Repo role can assign users to issues and pull requests' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_AddAssignee edge represents a role's ability to assign users to issues and pull requests. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\triage") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_AddAssignee --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_addcollaborator.mdx b/docs/opengraph/extensions/github/edges/gh_addcollaborator.mdx index 60db62cc..e431f27c 100644 --- a/docs/opengraph/extensions/github/edges/gh_addcollaborator.mdx +++ b/docs/opengraph/extensions/github/edges/gh_addcollaborator.mdx @@ -1,24 +1,14 @@ ---- -title: 'GH_AddCollaborator' -description: '[Organization] Org role can add outside collaborators' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) -- Destination: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_AddCollaborator' +description: '[Organization] Org role can add outside collaborators' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_AddCollaborator edge represents that a role has the ability to add outside collaborators to organization repositories. This permission is typically restricted to Owners, as it grants repository access to external users who are not members of the organization. Outside collaborators bypass organizational membership controls, making this permission significant for security because it can be used to grant access to untrusted external identities without the visibility that full membership provides. - - -```mermaid -graph LR - node1("GH_OrgRole SpecterOps\\Owners") - node2("GH_Organization SpecterOps") - node1 -- GH_AddCollaborator --> node2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_addlabel.mdx b/docs/opengraph/extensions/github/edges/gh_addlabel.mdx index 2d07d6ce..0791fc88 100644 --- a/docs/opengraph/extensions/github/edges/gh_addlabel.mdx +++ b/docs/opengraph/extensions/github/edges/gh_addlabel.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_AddLabel' -description: '[Repository] Repo role can add labels to issues and pull requests' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_AddLabel' +description: '[Repository] Repo role can add labels to issues and pull requests' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_AddLabel edge represents a role's ability to add labels to issues and pull requests. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\triage") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_AddLabel --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_addmember.mdx b/docs/opengraph/extensions/github/edges/gh_addmember.mdx index 042a24a2..367ec3f3 100644 --- a/docs/opengraph/extensions/github/edges/gh_addmember.mdx +++ b/docs/opengraph/extensions/github/edges/gh_addmember.mdx @@ -1,28 +1,14 @@ ---- -title: 'GH_AddMember' -description: 'Team role can add members to the team (maintainer privilege)' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_TeamRole](/opengraph/extensions/github/nodes/gh_teamrole) -- Destination: [GH_Team](/opengraph/extensions/github/nodes/gh_team) -- Traversable: ✅ - -## General Information - -The traversable GH_AddMember edge indicates that a team role with the Maintainer permission level can add new members to the team. This edge is traversable because the ability to add members grants indirect access -- a maintainer can add any user to the team, and that user then inherits all of the team's repository permissions, effectively expanding the attack surface. - - -```mermaid -graph LR - user("GH_User alice") - maintainerRole("GH_TeamRole security-team\\maintainer") - team("GH_Team security-team") - repoRole("GH_RepoRole GitHound\\admin") - user -- GH_HasRole --> maintainerRole - maintainerRole -- GH_AddMember --> team - team -- GH_HasRole --> repoRole -``` \ No newline at end of file +--- +title: 'GH_AddMember' +description: 'Team role can add members to the team (maintainer privilege)' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +The non-traversable GH_AddMember edge indicates that a team role with the Maintainer permission level can add new members to the team. Maintainers already inherit the team's repository permissions through [GH_MemberOf](/opengraph/extensions/github/edges/gh_memberof), so this edge preserves the membership-management capability as context without creating a second access path to the same team. diff --git a/docs/opengraph/extensions/github/edges/gh_adminto.mdx b/docs/opengraph/extensions/github/edges/gh_adminto.mdx index 28d66470..53441c03 100644 --- a/docs/opengraph/extensions/github/edges/gh_adminto.mdx +++ b/docs/opengraph/extensions/github/edges/gh_adminto.mdx @@ -1,30 +1,14 @@ ---- -title: 'GH_AdminTo' -description: '[Repository] Repo role has admin access to the repository.' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - -The non-traversable GH_AdminTo edge represents a role's full administrative access to the repository. Admin is the highest built-in repository role and grants control over all repository settings, including dangerous operations like deleting the repository or modifying its visibility. Admin access bypasses most protections including branch protection rules, unless `enforce_admins` is explicitly enabled on the branch protection rule. This edge is a key permission in the computed branch access model and is a high-value target in attack path analysis. - - -```mermaid -graph LR - user1("GH_User alice") - adminRole("GH_RepoRole GitHound\admin") - repo("GH_Repository GitHound") - orgOwners("GH_OrgRole SpecterOps\Owners") - allRepoAdmin("GH_RepoRole SpecterOps\all_repo_admin") - user1 -- GH_HasRole --> adminRole - adminRole -- GH_AdminTo --> repo - orgOwners -- GH_HasBaseRole --> allRepoAdmin - allRepoAdmin -- GH_AdminTo --> repo -``` \ No newline at end of file +--- +title: 'GH_AdminTo' +description: '[Repository] Repo role has admin access to the repository.' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable GH_AdminTo edge represents a role's full administrative access to the repository. Admin is the highest built-in repository role and grants control over all repository settings, including dangerous operations like deleting the repository or modifying its visibility. Admin access bypasses most protections including branch protection rules, unless `enforce_admins` is explicitly enabled on the branch protection rule. This edge is a key permission in the computed branch access model and is a high-value target in attack path analysis. diff --git a/docs/opengraph/extensions/github/edges/gh_approvesdeploymentto.mdx b/docs/opengraph/extensions/github/edges/gh_approvesdeploymentto.mdx new file mode 100644 index 00000000..8a1ff709 --- /dev/null +++ b/docs/opengraph/extensions/github/edges/gh_approvesdeploymentto.mdx @@ -0,0 +1,18 @@ +--- +title: 'GH_ApprovesDeploymentTo' +description: 'User or team is configured as a required reviewer for this environment' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +The non-traversable GH_ApprovesDeploymentTo edge represents that a user or team is configured as a required reviewer for a GitHub Environment. + +This edge is emitted from [GH_User](/opengraph/extensions/github/nodes/gh_user) or [GH_Team](/opengraph/extensions/github/nodes/gh_team) nodes to [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) nodes when the environment includes a required reviewer protection rule. Required reviewers act as an approval gate before jobs referencing the environment can continue. + +The edge is non-traversable because it records reviewer configuration rather than direct deployment access. When self-review is allowed, the same reviewer may also receive a traversable [GH_CanDeployToEnvironment](/opengraph/extensions/github/edges/gh_candeploytoenvironment) edge because they can satisfy the approval gate themselves. When prevent_self_review is enabled, GH_ApprovesDeploymentTo remains context only because the split-principal approval flow is not currently modeled. diff --git a/docs/opengraph/extensions/github/edges/gh_bypassbranchprotection.mdx b/docs/opengraph/extensions/github/edges/gh_bypassbranchprotection.mdx index 81805e11..77e1da36 100644 --- a/docs/opengraph/extensions/github/edges/gh_bypassbranchprotection.mdx +++ b/docs/opengraph/extensions/github/edges/gh_bypassbranchprotection.mdx @@ -1,28 +1,14 @@ ---- -title: 'GH_BypassBranchProtection' -description: '[Repository] Repo role can bypass merge-gate branch protections (PR reviews, lock branch). Suppressed by enforce_admins.' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_BypassBranchProtection' +description: '[Repository] Repo role can bypass merge-gate branch protections (PR reviews, lock branch). Suppressed by enforce_admins.' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_BypassBranchProtection edge represents a role's ability to bypass branch protection rules on the repository. This permission is available to Admin roles and custom roles that have been granted this specific permission. Bypassing branch protection allows merging pull requests without satisfying required review or status check requirements, effectively circumventing the merge gate. This bypass is suppressed when `enforce_admins` is enabled on the branch protection rule, which forces even admins to comply with the protection policy. - - -```mermaid -graph LR - user1("GH_User alice") - adminRole("GH_RepoRole GitHound\admin") - customRole("GH_RepoRole GitHound\release_manager") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> adminRole - adminRole -- GH_BypassBranchProtection --> repo - customRole -- GH_BypassBranchProtection --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_bypasspullrequestallowances.mdx b/docs/opengraph/extensions/github/edges/gh_bypasspullrequestallowances.mdx index 947c1dfd..bc3542b1 100644 --- a/docs/opengraph/extensions/github/edges/gh_bypasspullrequestallowances.mdx +++ b/docs/opengraph/extensions/github/edges/gh_bypasspullrequestallowances.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_BypassPullRequestAllowances' -description: 'User or team can bypass pull request requirements on a branch protection rule' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_User](/opengraph/extensions/github/nodes/gh_user), [GH_Team](/opengraph/extensions/github/nodes/gh_team) -- Destination: [GH_BranchProtectionRule](/opengraph/extensions/github/nodes/gh_branchprotectionrule) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_BypassPullRequestAllowances' +description: 'User or team can bypass pull request requirements on a branch protection rule' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_BypassPullRequestAllowances edge represents a per-actor allowance that bypasses the pull request review requirement on a branch protection rule. This edge identifies specific users or teams that can merge code without going through the normal PR review process. This is a significant security concern because these actors can push or merge changes directly, circumventing code review controls that protect branch integrity. Note that this bypass is suppressed when `enforce_admins` is enabled on the branch protection rule, meaning even listed actors must follow the PR review requirement. - - -```mermaid -graph LR - user1("GH_User alice") - team1("GH_Team release-managers") - bpr1("GH_BranchProtectionRule main") - user1 -- GH_BypassPullRequestAllowances --> bpr1 - team1 -- GH_BypassPullRequestAllowances --> bpr1 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_callsworkflow.mdx b/docs/opengraph/extensions/github/edges/gh_callsworkflow.mdx index e676200b..b948a8f8 100644 --- a/docs/opengraph/extensions/github/edges/gh_callsworkflow.mdx +++ b/docs/opengraph/extensions/github/edges/gh_callsworkflow.mdx @@ -1,23 +1,21 @@ ---- -title: 'GH_CallsWorkflow' -description: '[Workflow] Job calls a reusable workflow — GH_WorkflowJob → GH_Workflow' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_WorkflowJob](/opengraph/extensions/github/nodes/gh_workflowjob) -- Destination: [GH_Workflow](/opengraph/extensions/github/nodes/gh_workflow) -- Traversable: ❌ - -## General Information - -The traversable GH_CallsWorkflow edge links a workflow job to a reusable workflow it invokes via the `uses:` key at the job level. This edge captures the reusable workflow call graph, enabling analysts to trace inherited permissions and secret access through called workflows. - -### Local vs. remote reusable workflows - -- **Local** (`./. github/workflows/_ci.yml`): the destination is matched by `name` against workflows in the same repository. -- **Remote** (`org/repo/.github/workflows/file.yml@ref`): the destination is matched by the full reference string. If the called workflow has not been collected, the edge destination will not resolve. - +--- +title: 'GH_CallsWorkflow' +description: '[Workflow] Job calls a reusable workflow — GH_WorkflowJob → GH_Workflow' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +The traversable GH_CallsWorkflow edge links a workflow job to a reusable workflow it invokes via the `uses:` key at the job level. This edge captures the reusable workflow call graph, enabling analysts to trace inherited permissions and secret access through called workflows. + +### Local vs. remote reusable workflows + +- **Local** (`./. github/workflows/_ci.yml`): the destination is matched by `name` against workflows in the same repository. +- **Remote** (`org/repo/.github/workflows/file.yml@ref`): the destination is matched by the full reference string. If the called workflow has not been collected, the edge destination will not resolve. + The `reusable_ref` property on the edge always contains the raw `uses:` value from the workflow file. diff --git a/docs/opengraph/extensions/github/edges/gh_canaccess.mdx b/docs/opengraph/extensions/github/edges/gh_canaccess.mdx index fd57f2e3..1ce45ba7 100644 --- a/docs/opengraph/extensions/github/edges/gh_canaccess.mdx +++ b/docs/opengraph/extensions/github/edges/gh_canaccess.mdx @@ -1,28 +1,14 @@ ---- -title: 'GH_CanAccess' -description: 'Personal access token or app installation can access this repository or organization' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_PersonalAccessToken](/opengraph/extensions/github/nodes/gh_personalaccesstoken), [GH_AppInstallation](/opengraph/extensions/github/nodes/gh_appinstallation) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_CanAccess' +description: 'Personal access token or app installation can access this repository or organization' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_CanAccess edge indicates that a personal access token or app installation has been granted access to specific repositories. This edge represents the scope of access granted to a token or app rather than a direct attack path, providing visibility into which repositories are reachable through non-human credentials. It is non-traversable because token and app access does not transitively extend to other principals. - - -```mermaid -graph LR - pat("GH_PersonalAccessToken pat-alice-readonly") - install("GH_AppInstallation ci-bot#6789") - repo1("GH_Repository GitHound") - repo2("GH_Repository BloodHound") - pat -- GH_CanAccess --> repo1 - install -- GH_CanAccess --> repo1 - install -- GH_CanAccess --> repo2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_canassumeidentity.mdx b/docs/opengraph/extensions/github/edges/gh_canassumeidentity.mdx index 32772b91..087aee84 100644 --- a/docs/opengraph/extensions/github/edges/gh_canassumeidentity.mdx +++ b/docs/opengraph/extensions/github/edges/gh_canassumeidentity.mdx @@ -1,29 +1,14 @@ ---- -title: 'GH_CanAssumeIdentity' -description: 'Repository can assume this cloud identity via OIDC federation (Azure workload identity or AWS IAM role)' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_Branch](/opengraph/extensions/github/nodes/gh_branch), [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) -- Destination: [AZFederatedIdentityCredential](/resources/nodes/az-federated-identity-credential), `AWSRole` -- Traversable: ✅ - -## General Information - +--- +title: 'GH_CanAssumeIdentity' +description: 'Repository can assume this cloud identity via OIDC federation (Azure workload identity or AWS IAM role)' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + The traversable GH_CanAssumeIdentity edge is a hybrid edge connecting GitHub OIDC token sources to cloud identity targets configured for GitHub Actions federation. This edge represents a verified path from GitHub Actions to cloud resource access. It is traversable because an attacker who can execute workflows in the source repository, branch, or environment can obtain an OIDC token that the cloud provider will accept, granting access to the associated cloud identity and its permissions. This edge is critical for identifying cross-cloud lateral movement paths from GitHub into Azure and AWS. - - -```mermaid -graph LR - repo("GH_Repository GitHound") - branch("GH_Branch main") - env("GH_Environment production") - azFic("AZFederatedIdentityCredential gh-deploy-prod") - awsRole("AWSRole gh-actions-deploy-prod") - repo -- GH_CanAssumeIdentity --> azFic - branch -- GH_CanAssumeIdentity --> awsRole - env -- GH_CanAssumeIdentity --> azFic -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_cancreatebranch.mdx b/docs/opengraph/extensions/github/edges/gh_cancreatebranch.mdx index 2865ed6e..0e637ee3 100644 --- a/docs/opengraph/extensions/github/edges/gh_cancreatebranch.mdx +++ b/docs/opengraph/extensions/github/edges/gh_cancreatebranch.mdx @@ -1,66 +1,65 @@ ---- -title: 'GH_CanCreateBranch' -description: '[Repository - Computed] Role can create new branches in this repository (unprotected branches that bypass the merge gate)' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole), [GH_User](/opengraph/extensions/github/nodes/gh_user), [GH_Team](/opengraph/extensions/github/nodes/gh_team) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ✅ - -## General Information - -The traversable GH_CanCreateBranch edge is a computed edge indicating that a role or actor can create new branches in a repository. The computation evaluates whether a wildcard (`*`) BPR with push restrictions and `blocks_creations` exists. If no such BPR exists, any write-capable role can create branches. If one exists, admin or `push_protected_branch` permission is required, or the actor must be listed in pushAllowances. Per-actor edges from [GH_User](/opengraph/extensions/github/nodes/gh_user) or [GH_Team](/opengraph/extensions/github/nodes/gh_team) are only emitted when BPR allowances grant branch creation access beyond what the role provides. Each edge includes a `reason` property and a `query_composition` Cypher query showing the underlying graph evidence. -## Scenarios - -### `no_protection` — No wildcard BPR blocking creations - -No wildcard (`*`) BPR with `blocks_creations` exists. Any write-capable role can create new branches. - -```mermaid -graph LR - role("GH_RepoRole write") -->|GH_WriteRepoContents| repo("GH_Repository") - role ==>|GH_CanCreateBranch| repo -``` - -### `admin` — Admin bypasses wildcard BPR - -A wildcard BPR with `push_restrictions` and `blocks_creations` prevents branch creation. The admin role bypasses this restriction. - -```mermaid -graph LR - role("GH_RepoRole admin") -->|GH_AdminTo| repo("GH_Repository") - repo -->|GH_HasBranch| branch("GH_Branch main") - bpr("GH_BranchProtectionRule\npattern=*\npush_restrictions\nblocks_creations") -->|GH_ProtectedBy| branch - role ==>|GH_CanCreateBranch| repo -``` - -### `push_protected_branch` — Push-protected role bypasses wildcard BPR - -A wildcard BPR blocks creations. The [GH_PushProtectedBranch](/opengraph/extensions/github/edges/gh_pushprotectedbranch) permission bypasses the push gate regardless of `enforce_admins`. - -```mermaid -graph LR - role("GH_RepoRole maintain") -->|GH_WriteRepoContents| repo("GH_Repository") - role -->|GH_PushProtectedBranch| repo - repo -->|GH_HasBranch| branch("GH_Branch main") - bpr("GH_BranchProtectionRule\npattern=*\npush_restrictions\nblocks_creations") -->|GH_ProtectedBy| branch - role ==>|GH_CanCreateBranch| repo -``` - -### `push_allowance` — Per-actor push restriction bypass - -User or Team listed in the wildcard BPR's `pushAllowances` can create branches. This is a per-actor delta edge — only emitted when the actor's role doesn't already grant [GH_CanCreateBranch](/opengraph/extensions/github/edges/gh_cancreatebranch). - -```mermaid -graph LR - user("GH_User alice") -->|GH_HasRole| role("GH_RepoRole write") - role -->|GH_WriteRepoContents| repo("GH_Repository") - repo -->|GH_HasBranch| branch("GH_Branch main") - bpr("GH_BranchProtectionRule\npattern=*\npush_restrictions\nblocks_creations") -->|GH_ProtectedBy| branch - user -->|GH_RestrictionsCanPush| bpr - user ==>|GH_CanCreateBranch| repo +--- +title: 'GH_CanCreateBranch' +description: '[Repository - Computed] Role can create new branches in this repository (unprotected branches that bypass the merge gate)' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable GH_CanCreateBranch edge is a computed edge indicating that a role or actor can create new branches in a repository. The computation evaluates whether a wildcard (`*`) BPR with push restrictions and `blocks_creations` exists. If no such BPR exists, any write-capable role can create branches. If one exists, admin or `push_protected_branch` permission is required, or the actor must be listed in pushAllowances. Per-actor edges from [GH_User](/opengraph/extensions/github/nodes/gh_user) or [GH_Team](/opengraph/extensions/github/nodes/gh_team) are only emitted when BPR allowances grant branch creation access beyond what the role provides. Each edge includes a `reason` property and a `query_composition` Cypher query showing the underlying graph evidence. + +## Scenarios + +### `no_protection` — No wildcard BPR blocking creations + +No wildcard (`*`) BPR with `blocks_creations` exists. Any write-capable role can create new branches. + +```mermaid +graph LR + role("GH_RepoRole write") -->|GH_WriteRepoContents| repo("GH_Repository") + role ==>|GH_CanCreateBranch| repo +``` + +### `admin` — Admin bypasses wildcard BPR + +A wildcard BPR with `push_restrictions` and `blocks_creations` prevents branch creation. The admin role bypasses this restriction. + +```mermaid +graph LR + role("GH_RepoRole admin") -->|GH_AdminTo| repo("GH_Repository") + repo -->|GH_HasBranch| branch("GH_Branch main") + bpr("GH_BranchProtectionRule\npattern=*\npush_restrictions\nblocks_creations") -->|GH_ProtectedBy| branch + role ==>|GH_CanCreateBranch| repo +``` + +### `push_protected_branch` — Push-protected role bypasses wildcard BPR + +A wildcard BPR blocks creations. The [GH_PushProtectedBranch](/opengraph/extensions/github/edges/gh_pushprotectedbranch) permission bypasses the push gate regardless of `enforce_admins`. + +```mermaid +graph LR + role("GH_RepoRole maintain") -->|GH_WriteRepoContents| repo("GH_Repository") + role -->|GH_PushProtectedBranch| repo + repo -->|GH_HasBranch| branch("GH_Branch main") + bpr("GH_BranchProtectionRule\npattern=*\npush_restrictions\nblocks_creations") -->|GH_ProtectedBy| branch + role ==>|GH_CanCreateBranch| repo +``` + +### `push_allowance` — Per-actor push restriction bypass + +User or Team listed in the wildcard BPR's `pushAllowances` can create branches. This is a per-actor delta edge — only emitted when the actor's role doesn't already grant GH_CanCreateBranch. + +```mermaid +graph LR + user("GH_User alice") -->|GH_HasRole| role("GH_RepoRole write") + role -->|GH_WriteRepoContents| repo("GH_Repository") + repo -->|GH_HasBranch| branch("GH_Branch main") + bpr("GH_BranchProtectionRule\npattern=*\npush_restrictions\nblocks_creations") -->|GH_ProtectedBy| branch + user -->|GH_RestrictionsCanPush| bpr + user ==>|GH_CanCreateBranch| repo ``` diff --git a/docs/opengraph/extensions/github/edges/gh_cancreateenvironment.mdx b/docs/opengraph/extensions/github/edges/gh_cancreateenvironment.mdx new file mode 100644 index 00000000..f8ea5f99 --- /dev/null +++ b/docs/opengraph/extensions/github/edges/gh_cancreateenvironment.mdx @@ -0,0 +1,16 @@ +--- +title: 'GH_CanCreateEnvironment' +description: 'Repo role can create new GitHub environments in this repository by editing a workflow that references a nonexistent environment name' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable GH_CanCreateEnvironment edge is a computed edge indicating that a repository role can cause a new GitHub environment to be created in the repository. This is derived from the ability to create and modify runnable branches/workflows: if a workflow references an environment name that does not already exist, GitHub will create that environment automatically. + +This edge is useful for modeling OIDC and deployment scenarios where trust is tied to an environment name. An attacker who can create a new environment through workflow changes may be able to instantiate a trusted environment on demand, even if it was not previously configured. diff --git a/docs/opengraph/extensions/github/edges/gh_candeploytoenvironment.mdx b/docs/opengraph/extensions/github/edges/gh_candeploytoenvironment.mdx new file mode 100644 index 00000000..aede18c5 --- /dev/null +++ b/docs/opengraph/extensions/github/edges/gh_candeploytoenvironment.mdx @@ -0,0 +1,18 @@ +--- +title: 'GH_CanDeployToEnvironment' +description: '[Computed] Repository, branch, repo role, or self-approving reviewer can deploy to this GitHub environment after evaluating deployment branch policy, reviewer gates, and admin bypass behavior' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable GH_CanDeployToEnvironment edge represents the ability for a repository, branch, repository role, or self-approving reviewer to satisfy the modeled deployment constraints for a GitHub Environment. + +This edge is computed from environment deployment branch policy, branch protection state, required reviewer behavior, and administrator bypass behavior. For environments without required reviewers, unrestricted environments emit repository and branch edges, protected-branch-only environments emit edges only for protected branches unless no branch protection rules exist, and custom branch policies emit edges only for matching branches. + +When required reviewers are configured and self-review is allowed, the configured [GH_User](/opengraph/extensions/github/nodes/gh_user) or [GH_Team](/opengraph/extensions/github/nodes/gh_team) reviewer receives GH_CanDeployToEnvironment because that reviewer can satisfy the approval gate themselves. When prevent_self_review is enabled, no direct deploy edge is emitted for the reviewer because the required split-principal flow is not currently modeled. [GH_ApprovesDeploymentTo](/opengraph/extensions/github/edges/gh_approvesdeploymentto) remains non-traversable reviewer context in both cases. diff --git a/docs/opengraph/extensions/github/edges/gh_caneditenvironment.mdx b/docs/opengraph/extensions/github/edges/gh_caneditenvironment.mdx new file mode 100644 index 00000000..bcfb5c81 --- /dev/null +++ b/docs/opengraph/extensions/github/edges/gh_caneditenvironment.mdx @@ -0,0 +1,26 @@ +--- +title: 'GH_CanEditEnvironment' +description: 'Repo admin role can edit the configuration of this GitHub environment' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable GH_CanEditEnvironment edge indicates that a repository role can modify the configuration of a GitHub environment. In the current model, this edge is emitted for the repository's built-in `admin` role to every environment contained in that repository. + +Editing an environment is security-relevant because environment configuration controls deployment protections such as required reviewers, self-review restrictions, wait timers, deployment branch policies, and the "allow administrators to bypass configured protection rules" setting. An attacker who can edit an environment may be able to weaken or remove those controls, making later deployment and secret access paths possible. + +This edge is distinct from [GH_CanDeployToEnvironment](/opengraph/extensions/github/edges/gh_candeploytoenvironment): + +- **GH_CanEditEnvironment** means the role can manage the environment's settings. +- **[GH_CanDeployToEnvironment](/opengraph/extensions/github/edges/gh_candeploytoenvironment)** means the source satisfies the modeled deployment policy, reviewer gate, or administrator bypass condition for the environment. + +```mermaid +graph LR + role["GH_RepoRole admin"] ==>|GH_CanEditEnvironment| env["GH_Environment production"] +``` diff --git a/docs/opengraph/extensions/github/edges/gh_caneditprotection.mdx b/docs/opengraph/extensions/github/edges/gh_caneditprotection.mdx index 28105056..5a218d45 100644 --- a/docs/opengraph/extensions/github/edges/gh_caneditprotection.mdx +++ b/docs/opengraph/extensions/github/edges/gh_caneditprotection.mdx @@ -1,44 +1,42 @@ ---- -title: 'GH_CanEditProtection' -description: '[Repository - Computed] Repo role can modify or remove branch protection rules for the repository/branch (computed from GH_EditRepoProtections + GH_ProtectedBy)' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_Branch](/opengraph/extensions/github/nodes/gh_branch) -- Traversable: ✅ - -## General Information - -The traversable GH_CanEditProtection edge is a computed edge indicating that a role can modify or remove branch protection rules in a repository. This edge is emitted when the role has [GH_EditRepoProtections](/opengraph/extensions/github/edges/gh_editrepoprotections) or [GH_AdminTo](/opengraph/extensions/github/edges/gh_adminto) permissions and the repository contains at least one protected branch. Repo-targeted edges model the repo-wide security impact for attack path traversal; branch-targeted edges are also emitted as supporting evidence for each protected branch governed by those rules. - -## Scenarios - -### `admin` — Admin can edit protections - -The admin role has [GH_AdminTo](/opengraph/extensions/github/edges/gh_adminto) which implicitly grants the ability to modify or remove any branch protection rule. - -```mermaid -graph LR - role("GH_RepoRole admin") -->|GH_AdminTo| repo("GH_Repository") - repo -->|GH_HasBranch| branch("GH_Branch main") - bpr("GH_BranchProtectionRule") -->|GH_ProtectedBy| branch - role ==>|GH_CanEditProtection| repo - role ==>|GH_CanEditProtection| branch -``` - -### `edit_repo_protections` — Explicit edit permission - -A custom or standard role with the [GH_EditRepoProtections](/opengraph/extensions/github/edges/gh_editrepoprotections) permission can modify or remove branch protection rules. - -```mermaid -graph LR - role("GH_RepoRole custom") -->|GH_EditRepoProtections| repo("GH_Repository") - repo -->|GH_HasBranch| branch("GH_Branch main") - bpr("GH_BranchProtectionRule") -->|GH_ProtectedBy| branch - role ==>|GH_CanEditProtection| repo - role ==>|GH_CanEditProtection| branch +--- +title: 'GH_CanEditProtection' +description: '[Repository - Computed] Repo role can modify or remove branch protection rules for the repository/branch (computed from GH_EditRepoProtections + GH_ProtectedBy)' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable GH_CanEditProtection edge is a computed edge indicating that a role can modify or remove branch protection rules in a repository. This edge is emitted when the role has [GH_EditRepoProtections](/opengraph/extensions/github/edges/gh_editrepoprotections) or [GH_AdminTo](/opengraph/extensions/github/edges/gh_adminto) permissions and the repository contains at least one protected branch. Repo-targeted edges model the repo-wide security impact for attack path traversal; branch-targeted edges are also emitted as supporting evidence for each protected branch governed by those rules. + +## Scenarios + +### `admin` — Admin can edit protections + +The admin role has [GH_AdminTo](/opengraph/extensions/github/edges/gh_adminto) which implicitly grants the ability to modify or remove any branch protection rule. + +```mermaid +graph LR + role("GH_RepoRole admin") -->|GH_AdminTo| repo("GH_Repository") + repo -->|GH_HasBranch| branch("GH_Branch main") + bpr("GH_BranchProtectionRule") -->|GH_ProtectedBy| branch + role ==>|GH_CanEditProtection| repo + role ==>|GH_CanEditProtection| branch +``` + +### `edit_repo_protections` — Explicit edit permission + +A custom or standard role with the [GH_EditRepoProtections](/opengraph/extensions/github/edges/gh_editrepoprotections) permission can modify or remove branch protection rules. + +```mermaid +graph LR + role("GH_RepoRole custom") -->|GH_EditRepoProtections| repo("GH_Repository") + repo -->|GH_HasBranch| branch("GH_Branch main") + bpr("GH_BranchProtectionRule") -->|GH_ProtectedBy| branch + role ==>|GH_CanEditProtection| repo + role ==>|GH_CanEditProtection| branch ``` diff --git a/docs/opengraph/extensions/github/edges/gh_canpwnrequest.mdx b/docs/opengraph/extensions/github/edges/gh_canpwnrequest.mdx index 1690180b..2f482308 100644 --- a/docs/opengraph/extensions/github/edges/gh_canpwnrequest.mdx +++ b/docs/opengraph/extensions/github/edges/gh_canpwnrequest.mdx @@ -1,65 +1,70 @@ ---- -title: 'GH_CanPwnRequest' -description: '[Computed] Repo role can exploit a pwn-requestable workflow to execute arbitrary code with the target''s secrets and permissions — GH_RepoRole → GH_Repository / GH_Branch' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_Branch](/opengraph/extensions/github/nodes/gh_branch) -- Traversable: ✅ - -## General Information - -The traversable GH_CanPwnRequest edge indicates that a repository role can exploit a pwn-requestable workflow to execute arbitrary code with the base branch's secrets, `GITHUB_TOKEN` permissions, and OIDC identity. This is a computed edge that combines workflow analysis with repository access and fork policy evaluation. - -### Pwn Request Conditions - -A workflow is considered pwn-requestable (`is_pwn_requestable = true`) when **all** of the following are true: - -1. **`pull_request_target` trigger**: The workflow is triggered by `pull_request_target`, which runs in the context of the base branch and has access to the base branch's secrets and permissions. -2. **Attacker-controlled checkout**: A step uses `actions/checkout` with a `ref` parameter pointing to the pull request head, meaning attacker-supplied code from the fork replaces the trusted repository contents. Detected ref patterns: - - `${{ github.event.pull_request.head.sha }}` - - `${{ github.event.pull_request.head.ref }}` - - `${{ github.head_ref }}` - -### Edge Drawing Conditions - -An edge is drawn from a [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) to the repository and its branches when: - -1. **Read access**: The role has a [GH_ReadRepoContents](/opengraph/extensions/github/edges/gh_readrepocontents) edge to the repository. -2. **Forkability**: The repository can be forked by the role holder. -3. **Pwn-requestable workflow**: The repository has at least one workflow with `is_pwn_requestable = true`. - -### Attack Impact - -An attacker who exploits a pwn request gains code execution in the workflow runner with access to: - -- **Repository secrets** scoped to the base branch -- **Organization secrets** accessible by the repository -- **`GITHUB_TOKEN`** with the workflow's declared permissions -- **OIDC tokens** if `id-token: write` is set, enabling cloud identity assumption via [GH_CanAssumeIdentity](/opengraph/extensions/github/edges/gh_canassumeidentity) -- **Environment secrets** if the workflow job targets a deployment environment - -### Caveats - -- **OIDC traversal requires `id-token: write`**: The attack chain from GH_CanPwnRequest through [GH_CanAssumeIdentity](/opengraph/extensions/github/edges/gh_canassumeidentity) to a cloud role is only valid if the pwn-requestable workflow or job explicitly declares `id-token: write`. -- **`GITHUB_TOKEN` permissions**: The `permissions:` block controls what the token can do, but does not limit secret access, OIDC token requests, or arbitrary code execution. - -```mermaid -graph LR - role("GH_RepoRole repo-read") - repo("GH_Repository private-app") - branch("GH_Branch main") - wf("GH_Workflow vulnerable-ci.yml") - secret("GH_RepoSecret DEPLOY_KEY") - cloud("AWSRole deploy-prod") - - role -- GH_CanPwnRequest --> repo - role -- GH_CanPwnRequest --> branch - repo -.- |GH_HasWorkflow| wf - repo -.- |GH_Contains| secret - branch -- GH_CanAssumeIdentity --> cloud +--- +title: 'GH_CanPwnRequest' +description: '[Computed] Repo role can exploit a pwn-requestable workflow to execute arbitrary code with the target''s secrets and permissions — GH_RepoRole → GH_Repository / GH_Branch' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable GH_CanPwnRequest edge indicates that a repository role can exploit a pwn-requestable workflow to execute arbitrary code with the base branch's secrets, GITHUB_TOKEN permissions, and OIDC identity. This is a computed edge that combines workflow analysis with repository access and fork policy evaluation. + +### Pwn Request Conditions + +A workflow is considered pwn-requestable (`is_pwn_requestable = true`) when **all** of the following are true: + +1. **`pull_request_target` trigger**: The workflow is triggered by `pull_request_target`, which runs in the context of the base branch (not the fork) and has access to the base branch's secrets and permissions. +2. **Attacker-controlled checkout**: A step uses `actions/checkout` with a `ref` parameter pointing to the pull request head, meaning attacker-supplied code from the fork replaces the trusted repository contents. Detected ref patterns: + - `${{ github.event.pull_request.head.sha }}` + - `${{ github.event.pull_request.head.ref }}` + - `${{ github.head_ref }}` + +### Edge Drawing Conditions + +An edge is drawn from a [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) to the repository (and its branches) when: + +1. **Read access**: The role has a [GH_ReadRepoContents](/opengraph/extensions/github/edges/gh_readrepocontents) edge to the repository (read access is the minimum required to fork). +2. **Forkability**: The repository can be forked by the role holder: + - **Public repos**: Always forkable by anyone on GitHub. + - **Private/internal repos**: Requires both the organization setting `members_can_fork_private_repositories = true` AND the repository setting `allow_forking = true`. +3. **Pwn-requestable workflow**: The repository has at least one workflow with `is_pwn_requestable = true`. + +### Branch Targeting + +- If the `pull_request_target` trigger has a `branches:` filter (e.g., `branches: [main]`), edges are drawn only to matching branches and the repository. +- If unconstrained, edges are drawn to the repository and all of its branches. + +### Attack Impact + +An attacker who exploits a pwn request gains code execution in the workflow runner with access to: + +- **Repository secrets** scoped to the base branch +- **Organization secrets** accessible by the repository +- **GITHUB_TOKEN** with the workflow's declared permissions (often `write`) +- **OIDC tokens** if `id-token: write` is set, enabling cloud identity assumption via [GH_CanAssumeIdentity](/opengraph/extensions/github/edges/gh_canassumeidentity) +- **Environment secrets** if the workflow job targets a deployment environment + +### Caveats + +- **OIDC traversal requires `id-token: write`**: The attack chain from GH_CanPwnRequest through [GH_CanAssumeIdentity](/opengraph/extensions/github/edges/gh_canassumeidentity) to a cloud role is only valid if the pwn-requestable workflow (or job) explicitly declares `id-token: write` in its `permissions:` block. The `id-token` permission defaults to `none` and is never implicitly granted — even when the workflow has no `permissions:` block at all. The `permissions` property on the [GH_WorkflowJob](/opengraph/extensions/github/nodes/gh_workflowjob) node can be inspected to verify this. +- **GITHUB_TOKEN permissions**: The `permissions:` block controls what the `GITHUB_TOKEN` can do (e.g., push commits, create releases), but has no effect on secret access, OIDC token requests (governed separately by `id-token`), or arbitrary code execution. A workflow with `contents: read` is still fully exploitable via pwn request for secret exfiltration and lateral movement — only write-back to the repository is limited. + +```mermaid +graph LR + role("GH_RepoRole repo-read") + repo("GH_Repository private-app") + branch("GH_Branch main") + wf("GH_Workflow vulnerable-ci.yml") + secret("GH_RepoSecret DEPLOY_KEY") + cloud("AWSRole deploy-prod") + + role -- GH_CanPwnRequest --> repo + role -- GH_CanPwnRequest --> branch + repo -.- |GH_HasWorkflow| wf + repo -.- |GH_Contains| secret + branch -- GH_CanAssumeIdentity --> cloud ``` diff --git a/docs/opengraph/extensions/github/edges/gh_canreadsecretscanningalert.mdx b/docs/opengraph/extensions/github/edges/gh_canreadsecretscanningalert.mdx index 84a59ceb..d92a2e91 100644 --- a/docs/opengraph/extensions/github/edges/gh_canreadsecretscanningalert.mdx +++ b/docs/opengraph/extensions/github/edges/gh_canreadsecretscanningalert.mdx @@ -1,43 +1,42 @@ ---- -title: 'GH_CanReadSecretScanningAlert' -description: '[Computed] Role can read secret scanning alerts (computed from GH_ViewSecretScanningAlerts permission + GH_Contains)' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole), [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_SecretScanningAlert](/opengraph/extensions/github/nodes/gh_secretscanningalert) -- Traversable: ✅ - -## General Information - -The traversable GH_CanReadSecretScanningAlert edge is a computed edge indicating that a role can read a specific secret scanning alert, including the leaked secret value. The computation cross-references [GH_ViewSecretScanningAlerts](/opengraph/extensions/github/edges/gh_viewsecretscanningalerts) permission edges with [GH_Contains](/opengraph/extensions/github/edges/gh_contains) structural edges (org-level and repo-level) to determine which alerts each role can access. This edge is traversable because reading an alert reveals the leaked secret — if the secret is a valid GitHub Personal Access Token, the [GH_ValidToken](/opengraph/extensions/github/edges/gh_validtoken) edge enables identity compromise of the token's owner. - -Each edge includes a `reason` property (`org_role_permission` or `repo_role_permission`) and a `query_composition` Cypher query showing the underlying graph evidence. -## Scenarios - -### `org_role_permission` — Org role views alerts via organization - -An org role with [GH_ViewSecretScanningAlerts](/opengraph/extensions/github/edges/gh_viewsecretscanningalerts) to the organization can read all secret scanning alerts across the entire org. The computation follows [GH_Contains](/opengraph/extensions/github/edges/gh_contains) edges from the organization to each alert. - -```mermaid -graph LR - role("GH_OrgRole security_manager") -->|GH_ViewSecretScanningAlerts| org("GH_Organization") - org -->|GH_Contains| alert("GH_SecretScanningAlert #42") - role ==>|GH_CanReadSecretScanningAlert| alert - alert -.->|GH_ValidToken| user("GH_User jdoe") -``` - -### `repo_role_permission` — Repo role views alerts via repository - -A repo role with [GH_ViewSecretScanningAlerts](/opengraph/extensions/github/edges/gh_viewsecretscanningalerts) to the repository can read secret scanning alerts in that specific repo. The computation follows [GH_Contains](/opengraph/extensions/github/edges/gh_contains) edges from the repository to each alert. - -```mermaid -graph LR - role("GH_RepoRole admin") -->|GH_ViewSecretScanningAlerts| repo("GH_Repository") - repo -->|GH_Contains| alert("GH_SecretScanningAlert #17") - role ==>|GH_CanReadSecretScanningAlert| alert - alert -.->|GH_ValidToken| user("GH_User jdoe") +--- +title: 'GH_CanReadSecretScanningAlert' +description: '[Computed] Role can read secret scanning alerts (computed from GH_ViewSecretScanningAlerts permission + GH_Contains)' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable GH_CanReadSecretScanningAlert edge is a computed edge indicating that a role can read a specific secret scanning alert, including the leaked secret value. The computation cross-references [GH_ViewSecretScanningAlerts](/opengraph/extensions/github/edges/gh_viewsecretscanningalerts) permission edges with [GH_Contains](/opengraph/extensions/github/edges/gh_contains) structural edges (org-level and repo-level) to determine which alerts each role can access. This edge is traversable because reading an alert reveals the leaked secret — if the secret is a valid GitHub Personal Access Token, the [GH_ValidToken](/opengraph/extensions/github/edges/gh_validtoken) edge enables identity compromise of the token's owner. + +Each edge includes a `reason` property (`org_role_permission` or `repo_role_permission`) and a `query_composition` Cypher query showing the underlying graph evidence. + +## Scenarios + +### `org_role_permission` — Org role views alerts via organization + +An org role with [GH_ViewSecretScanningAlerts](/opengraph/extensions/github/edges/gh_viewsecretscanningalerts) to the organization can read all secret scanning alerts across the entire org. The computation follows [GH_Contains](/opengraph/extensions/github/edges/gh_contains) edges from the organization to each alert. + +```mermaid +graph LR + role("GH_OrgRole security_manager") -->|GH_ViewSecretScanningAlerts| org("GH_Organization") + org -->|GH_Contains| alert("GH_SecretScanningAlert #42") + role ==>|GH_CanReadSecretScanningAlert| alert + alert -.->|GH_ValidToken| user("GH_User jdoe") +``` + +### `repo_role_permission` — Repo role views alerts via repository + +A repo role with [GH_ViewSecretScanningAlerts](/opengraph/extensions/github/edges/gh_viewsecretscanningalerts) to the repository can read secret scanning alerts in that specific repo. The computation follows [GH_Contains](/opengraph/extensions/github/edges/gh_contains) edges from the repository to each alert. + +```mermaid +graph LR + role("GH_RepoRole admin") -->|GH_ViewSecretScanningAlerts| repo("GH_Repository") + repo -->|GH_Contains| alert("GH_SecretScanningAlert #17") + role ==>|GH_CanReadSecretScanningAlert| alert + alert -.->|GH_ValidToken| user("GH_User jdoe") ``` diff --git a/docs/opengraph/extensions/github/edges/gh_canwritebranch.mdx b/docs/opengraph/extensions/github/edges/gh_canwritebranch.mdx index 6660a2f7..a2bef696 100644 --- a/docs/opengraph/extensions/github/edges/gh_canwritebranch.mdx +++ b/docs/opengraph/extensions/github/edges/gh_canwritebranch.mdx @@ -1,94 +1,93 @@ ---- -title: 'GH_CanWriteBranch' -description: '[Repository - Computed] Role can push to this branch after evaluating branch protection rules, push restrictions, and bypass allowances' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole), [GH_User](/opengraph/extensions/github/nodes/gh_user), [GH_Team](/opengraph/extensions/github/nodes/gh_team) -- Destination: [GH_Branch](/opengraph/extensions/github/nodes/gh_branch) -- Traversable: ✅ - -## General Information - -The traversable GH_CanWriteBranch edge is a computed edge indicating that a role or actor can push to a specific branch. The computation evaluates both the merge gate (PR review requirements) and push gate (push restrictions) of any branch protection rule protecting the branch. Role-level edges are the common case; per-actor edges from [GH_User](/opengraph/extensions/github/nodes/gh_user) or [GH_Team](/opengraph/extensions/github/nodes/gh_team) are only emitted when BPR allowances grant access beyond what the role provides. Each edge includes a `reason` property (`no_protection`, `admin`, `push_protected_branch`, `bypass_branch_protection`, `push_allowance`, `bypass_pr_allowance`) and a `query_composition` Cypher query showing the underlying graph evidence. -## Scenarios - -### `no_protection` — Unprotected branch - -Branch has no BPR. Any write-capable role can push directly. - -```mermaid -graph LR - role("GH_RepoRole write") -->|GH_WriteRepoContents| repo("GH_Repository") - repo -->|GH_HasBranch| branch("GH_Branch develop") - role ==>|GH_CanWriteBranch| branch -``` - -### `admin` — Admin bypasses both gates - -BPR blocks both the merge gate (PR reviews) and push gate (push_restrictions). The admin role bypasses both gates. Requires `enforce_admins=false`; when `enforce_admins=true`, admin cannot bypass the merge gate. - -```mermaid -graph LR - role("GH_RepoRole admin") -->|GH_AdminTo| repo("GH_Repository") - repo -->|GH_HasBranch| branch("GH_Branch main") - bpr("GH_BranchProtectionRule\nrequired_pull_request_reviews\npush_restrictions\nenforce_admins=false") -->|GH_ProtectedBy| branch - role ==>|GH_CanWriteBranch| branch -``` - -### `push_protected_branch` — Push gate bypass - -Push gate blocked by `push_restrictions` (no merge gate block). The [GH_PushProtectedBranch](/opengraph/extensions/github/edges/gh_pushprotectedbranch) permission bypasses the push gate regardless of `enforce_admins`. - -```mermaid -graph LR - role("GH_RepoRole maintain") -->|GH_WriteRepoContents| repo("GH_Repository") - role -->|GH_PushProtectedBranch| repo - repo -->|GH_HasBranch| branch("GH_Branch main") - bpr("GH_BranchProtectionRule\npush_restrictions") -->|GH_ProtectedBy| branch - role ==>|GH_CanWriteBranch| branch -``` - -### `bypass_branch_protection` — Merge gate bypass - -Merge gate blocked by PR reviews. The [GH_BypassBranchProtection](/opengraph/extensions/github/edges/gh_bypassbranchprotection) permission bypasses the merge gate. Requires `enforce_admins=false`; suppressed when `enforce_admins=true`. - -```mermaid -graph LR - role("GH_RepoRole custom") -->|GH_WriteRepoContents| repo("GH_Repository") - role -->|GH_BypassBranchProtection| repo - repo -->|GH_HasBranch| branch("GH_Branch main") - bpr("GH_BranchProtectionRule\nrequired_pull_request_reviews\nenforce_admins=false") -->|GH_ProtectedBy| branch - role ==>|GH_CanWriteBranch| branch -``` - -### `push_allowance` — Per-actor push restriction bypass - -User or Team listed in the BPR's `pushAllowances` bypasses the push gate. This is a per-actor delta edge — only emitted when the actor's role-level access doesn't already cover the branch. - -```mermaid -graph LR - user("GH_User alice") -->|GH_HasRole| role("GH_RepoRole write") - role -->|GH_WriteRepoContents| repo("GH_Repository") - repo -->|GH_HasBranch| branch("GH_Branch main") - bpr("GH_BranchProtectionRule\npush_restrictions") -->|GH_ProtectedBy| branch - user -->|GH_RestrictionsCanPush| bpr - user ==>|GH_CanWriteBranch| branch -``` - -### `bypass_pr_allowance` — Per-actor PR review bypass - -User or Team listed in the BPR's `bypassPullRequestAllowances` bypasses the merge gate (PR reviews only, not `lock_branch`). Requires `enforce_admins=false`. This is a per-actor delta edge — only emitted when the actor's role-level access doesn't already cover the branch. - -```mermaid -graph LR - user("GH_User alice") -->|GH_HasRole| role("GH_RepoRole write") - role -->|GH_WriteRepoContents| repo("GH_Repository") - repo -->|GH_HasBranch| branch("GH_Branch main") - bpr("GH_BranchProtectionRule\nrequired_pull_request_reviews\nenforce_admins=false") -->|GH_ProtectedBy| branch - user -->|GH_BypassPullRequestAllowances| bpr - user ==>|GH_CanWriteBranch| branch +--- +title: 'GH_CanWriteBranch' +description: '[Repository - Computed] Role can push to this branch after evaluating branch protection rules, push restrictions, and bypass allowances' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable GH_CanWriteBranch edge is a computed edge indicating that a role or actor can push to a specific branch. The computation evaluates both the merge gate (PR review requirements) and push gate (push restrictions) of any branch protection rule protecting the branch. Role-level edges are the common case; per-actor edges from [GH_User](/opengraph/extensions/github/nodes/gh_user) or [GH_Team](/opengraph/extensions/github/nodes/gh_team) are only emitted when BPR allowances grant access beyond what the role provides. Each edge includes a `reason` property (`no_protection`, `admin`, `push_protected_branch`, `bypass_branch_protection`, `push_allowance`, `bypass_pr_allowance`) and a `query_composition` Cypher query showing the underlying graph evidence. + +## Scenarios + +### `no_protection` — Unprotected branch + +Branch has no BPR. Any write-capable role can push directly. + +```mermaid +graph LR + role("GH_RepoRole write") -->|GH_WriteRepoContents| repo("GH_Repository") + repo -->|GH_HasBranch| branch("GH_Branch develop") + role ==>|GH_CanWriteBranch| branch +``` + +### `admin` — Admin bypasses both gates + +BPR blocks both the merge gate (PR reviews) and push gate (push_restrictions). The admin role bypasses both gates. Requires `enforce_admins=false`; when `enforce_admins=true`, admin cannot bypass the merge gate. + +```mermaid +graph LR + role("GH_RepoRole admin") -->|GH_AdminTo| repo("GH_Repository") + repo -->|GH_HasBranch| branch("GH_Branch main") + bpr("GH_BranchProtectionRule\nrequired_pull_request_reviews\npush_restrictions\nenforce_admins=false") -->|GH_ProtectedBy| branch + role ==>|GH_CanWriteBranch| branch +``` + +### `push_protected_branch` — Push gate bypass + +Push gate blocked by `push_restrictions` (no merge gate block). The [GH_PushProtectedBranch](/opengraph/extensions/github/edges/gh_pushprotectedbranch) permission bypasses the push gate regardless of `enforce_admins`. + +```mermaid +graph LR + role("GH_RepoRole maintain") -->|GH_WriteRepoContents| repo("GH_Repository") + role -->|GH_PushProtectedBranch| repo + repo -->|GH_HasBranch| branch("GH_Branch main") + bpr("GH_BranchProtectionRule\npush_restrictions") -->|GH_ProtectedBy| branch + role ==>|GH_CanWriteBranch| branch +``` + +### `bypass_branch_protection` — Merge gate bypass + +Merge gate blocked by PR reviews. The [GH_BypassBranchProtection](/opengraph/extensions/github/edges/gh_bypassbranchprotection) permission bypasses the merge gate. Requires `enforce_admins=false`; suppressed when `enforce_admins=true`. + +```mermaid +graph LR + role("GH_RepoRole custom") -->|GH_WriteRepoContents| repo("GH_Repository") + role -->|GH_BypassBranchProtection| repo + repo -->|GH_HasBranch| branch("GH_Branch main") + bpr("GH_BranchProtectionRule\nrequired_pull_request_reviews\nenforce_admins=false") -->|GH_ProtectedBy| branch + role ==>|GH_CanWriteBranch| branch +``` + +### `push_allowance` — Per-actor push restriction bypass + +User or Team listed in the BPR's `pushAllowances` bypasses the push gate. This is a per-actor delta edge — only emitted when the actor's role-level access doesn't already cover the branch. + +```mermaid +graph LR + user("GH_User alice") -->|GH_HasRole| role("GH_RepoRole write") + role -->|GH_WriteRepoContents| repo("GH_Repository") + repo -->|GH_HasBranch| branch("GH_Branch main") + bpr("GH_BranchProtectionRule\npush_restrictions") -->|GH_ProtectedBy| branch + user -->|GH_RestrictionsCanPush| bpr + user ==>|GH_CanWriteBranch| branch +``` + +### `bypass_pr_allowance` — Per-actor PR review bypass + +User or Team listed in the BPR's `bypassPullRequestAllowances` bypasses the merge gate (PR reviews only, not `lock_branch`). Requires `enforce_admins=false`. This is a per-actor delta edge — only emitted when the actor's role-level access doesn't already cover the branch. + +```mermaid +graph LR + user("GH_User alice") -->|GH_HasRole| role("GH_RepoRole write") + role -->|GH_WriteRepoContents| repo("GH_Repository") + repo -->|GH_HasBranch| branch("GH_Branch main") + bpr("GH_BranchProtectionRule\nrequired_pull_request_reviews\nenforce_admins=false") -->|GH_ProtectedBy| branch + user -->|GH_BypassPullRequestAllowances| bpr + user ==>|GH_CanWriteBranch| branch ``` diff --git a/docs/opengraph/extensions/github/edges/gh_closediscussion.mdx b/docs/opengraph/extensions/github/edges/gh_closediscussion.mdx index 5d5f28e7..2d19de3b 100644 --- a/docs/opengraph/extensions/github/edges/gh_closediscussion.mdx +++ b/docs/opengraph/extensions/github/edges/gh_closediscussion.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_CloseDiscussion' -description: '[Repository] Repo role can close discussions' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_CloseDiscussion' +description: '[Repository] Repo role can close discussions' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_CloseDiscussion edge represents a role's ability to close discussions, preventing further replies. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\triage") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_CloseDiscussion --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_closeissue.mdx b/docs/opengraph/extensions/github/edges/gh_closeissue.mdx index f36fb057..2d6f4d95 100644 --- a/docs/opengraph/extensions/github/edges/gh_closeissue.mdx +++ b/docs/opengraph/extensions/github/edges/gh_closeissue.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_CloseIssue' -description: '[Repository] Repo role can close issues' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_CloseIssue' +description: '[Repository] Repo role can close issues' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_CloseIssue edge represents a role's ability to close issues. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\triage") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_CloseIssue --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_closepullrequest.mdx b/docs/opengraph/extensions/github/edges/gh_closepullrequest.mdx index d0948bbd..7a41bb11 100644 --- a/docs/opengraph/extensions/github/edges/gh_closepullrequest.mdx +++ b/docs/opengraph/extensions/github/edges/gh_closepullrequest.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_ClosePullRequest' -description: '[Repository] Repo role can close pull requests' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ClosePullRequest' +description: '[Repository] Repo role can close pull requests' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ClosePullRequest edge represents a role's ability to close pull requests. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\triage") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_ClosePullRequest --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_contains.mdx b/docs/opengraph/extensions/github/edges/gh_contains.mdx index b46d7a20..15223795 100644 --- a/docs/opengraph/extensions/github/edges/gh_contains.mdx +++ b/docs/opengraph/extensions/github/edges/gh_contains.mdx @@ -1,30 +1,14 @@ ---- -title: 'GH_Contains' -description: 'Container relationship for organizational hierarchy (org contains secrets/variables, repo contains secrets/variables, environment contains secrets/variables)' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization), [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) -- Destination: [GH_User](/opengraph/extensions/github/nodes/gh_user), [GH_Team](/opengraph/extensions/github/nodes/gh_team), [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole), [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole), [GH_TeamRole](/opengraph/extensions/github/nodes/gh_teamrole), [GH_OrgSecret](/opengraph/extensions/github/nodes/gh_orgsecret), [GH_AppInstallation](/opengraph/extensions/github/nodes/gh_appinstallation), [GH_PersonalAccessToken](/opengraph/extensions/github/nodes/gh_personalaccesstoken), [GH_PersonalAccessTokenRequest](/opengraph/extensions/github/nodes/gh_personalaccesstokenrequest), [GH_RepoSecret](/opengraph/extensions/github/nodes/gh_reposecret), [GH_EnvironmentSecret](/opengraph/extensions/github/nodes/gh_environmentsecret), [GH_SecretScanningAlert](/opengraph/extensions/github/nodes/gh_secretscanningalert) -- Traversable: ❌ - -## General Information - -The non-traversable GH_Contains edge represents structural containment within the GitHub resource hierarchy. The organization serves as the top-level container for users, teams, repositories, roles, secrets, app installations, and personal access tokens. Repositories contain their own repo-level secrets, and environments contain environment-scoped secrets. This edge is created by the collector to establish the organizational hierarchy of GitHub resources and is not traversable because containment alone does not imply privilege escalation. - - -```mermaid -graph LR - node1("GH_Organization SpecterOps") - node2("GH_User alice") - node3("GH_Team engineering") - node4("GH_Repository GitHound") - node5("GH_RepoSecret DEPLOY_KEY") - node1 -- GH_Contains --> node2 - node1 -- GH_Contains --> node3 - node1 -- GH_Contains --> node4 - node4 -- GH_Contains --> node5 -``` \ No newline at end of file +--- +title: 'GH_Contains' +description: 'Container relationship for organizational hierarchy (org contains secrets/variables, repo contains secrets/variables, environment contains secrets/variables)' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +The non-traversable GH_Contains edge represents structural containment within the GitHub resource hierarchy. The organization serves as the top-level container for users, teams, repositories, roles, secrets, app installations, and personal access tokens. Repositories contain branches, workflows, branch protection rules, environments, and repo-level secrets and variables. Environments contain environment branch policies, environment-scoped secrets, and environment-scoped variables. This edge is created by the collector to establish the resource hierarchy and is not traversable because containment alone does not imply privilege escalation. diff --git a/docs/opengraph/extensions/github/edges/gh_convertissuestodiscussions.mdx b/docs/opengraph/extensions/github/edges/gh_convertissuestodiscussions.mdx index 7a10d59e..492bbde4 100644 --- a/docs/opengraph/extensions/github/edges/gh_convertissuestodiscussions.mdx +++ b/docs/opengraph/extensions/github/edges/gh_convertissuestodiscussions.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_ConvertIssuesToDiscussions' -description: '[Repository] Repo role can convert issues to discussions' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ConvertIssuesToDiscussions' +description: '[Repository] Repo role can convert issues to discussions' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ConvertIssuesToDiscussions edge represents a role's ability to convert issues to discussions, moving them from the issue tracker to the discussions forum. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\triage") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_ConvertIssuesToDiscussions --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_creatediscussioncategory.mdx b/docs/opengraph/extensions/github/edges/gh_creatediscussioncategory.mdx index 18500070..57d1f3db 100644 --- a/docs/opengraph/extensions/github/edges/gh_creatediscussioncategory.mdx +++ b/docs/opengraph/extensions/github/edges/gh_creatediscussioncategory.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_CreateDiscussionCategory' -description: '[Repository] Repo role can create discussion categories' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_CreateDiscussionCategory' +description: '[Repository] Repo role can create discussion categories' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_CreateDiscussionCategory edge represents a role's ability to create new discussion categories. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\triage") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_CreateDiscussionCategory --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_createrepository.mdx b/docs/opengraph/extensions/github/edges/gh_createrepository.mdx index efad6150..334a8dc5 100644 --- a/docs/opengraph/extensions/github/edges/gh_createrepository.mdx +++ b/docs/opengraph/extensions/github/edges/gh_createrepository.mdx @@ -1,24 +1,14 @@ ---- -title: 'GH_CreateRepository' -description: '[Organization] Org role can create repositories in the organization' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) -- Destination: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_CreateRepository' +description: '[Organization] Org role can create repositories in the organization' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_CreateRepository edge represents that a role has the ability to create new repositories within the organization. This permission is available to Owners and custom organization roles that have been granted the repository creation permission. Creating repositories can introduce new attack surface to an organization, as each new repository is a potential vector for code execution through GitHub Actions workflows, secret exposure, and supply chain attacks. - - -```mermaid -graph LR - node1("GH_OrgRole SpecterOps\\Owners") - node2("GH_Organization SpecterOps") - node1 -- GH_CreateRepository --> node2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_createsolomergequeueentry.mdx b/docs/opengraph/extensions/github/edges/gh_createsolomergequeueentry.mdx index 19fd255a..92c55e93 100644 --- a/docs/opengraph/extensions/github/edges/gh_createsolomergequeueentry.mdx +++ b/docs/opengraph/extensions/github/edges/gh_createsolomergequeueentry.mdx @@ -1,28 +1,14 @@ ---- -title: 'GH_CreateSoloMergeQueueEntry' -description: 'Repo role can create solo merge queue entries' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_CreateSoloMergeQueueEntry' +description: 'Repo role can create solo merge queue entries' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_CreateSoloMergeQueueEntry edge represents a role's ability to create solo merge queue entries, effectively bypassing the merge queue by merging independently of other queued changes. This permission is available to Admin roles and custom roles that have been granted this specific permission. Solo merge queue entries skip the batching and ordering guarantees of the merge queue, allowing changes to land without waiting for or being tested alongside other pending merges. This can circumvent the integration testing benefits that merge queues provide. - - -```mermaid -graph LR - user1("GH_User carol") - adminRole("GH_RepoRole GitHound\admin") - customRole("GH_RepoRole GitHound\release_manager") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> customRole - adminRole -- GH_CreateSoloMergeQueueEntry --> repo - customRole -- GH_CreateSoloMergeQueueEntry --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_createtag.mdx b/docs/opengraph/extensions/github/edges/gh_createtag.mdx index 1af336cb..dd5a2412 100644 --- a/docs/opengraph/extensions/github/edges/gh_createtag.mdx +++ b/docs/opengraph/extensions/github/edges/gh_createtag.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_CreateTag' -description: '[Repository] Repo role can create tags and releases' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_CreateTag' +description: '[Repository] Repo role can create tags and releases' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_CreateTag edge represents a role's ability to create tags and releases. This permission is available to Maintain and Admin roles and custom roles that have been granted this specific permission. Creating tags can trigger CI/CD workflows and publish release artifacts. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\maintain") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_CreateTag --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_createteam.mdx b/docs/opengraph/extensions/github/edges/gh_createteam.mdx index d5ca9bb8..2847d8ff 100644 --- a/docs/opengraph/extensions/github/edges/gh_createteam.mdx +++ b/docs/opengraph/extensions/github/edges/gh_createteam.mdx @@ -1,24 +1,14 @@ ---- -title: 'GH_CreateTeam' -description: '[Organization] Org role can create teams in the organization' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) -- Destination: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_CreateTeam' +description: '[Organization] Org role can create teams in the organization' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_CreateTeam edge represents that a role has the ability to create teams within the organization. Teams are the primary mechanism for granting groups of users access to repositories, so team creation is a stepping stone to broader access. This edge is created by the collector when enumerating organization role permissions, and its security significance lies in the fact that a newly created team can be granted repository access and then populated with controlled accounts. - - -```mermaid -graph LR - node1("GH_OrgRole SpecterOps\\Owners") - node2("GH_Organization SpecterOps") - node1 -- GH_CreateTeam --> node2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_deletealertscodescanning.mdx b/docs/opengraph/extensions/github/edges/gh_deletealertscodescanning.mdx index f75ff5f0..ec88a9be 100644 --- a/docs/opengraph/extensions/github/edges/gh_deletealertscodescanning.mdx +++ b/docs/opengraph/extensions/github/edges/gh_deletealertscodescanning.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_DeleteAlertsCodeScanning' -description: '[Repository] Repo role can delete code scanning alerts' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_DeleteAlertsCodeScanning' +description: '[Repository] Repo role can delete code scanning alerts' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_DeleteAlertsCodeScanning edge represents a role's ability to delete code scanning alerts from the repository. This permission is available to Admin roles and custom roles that have been granted this specific permission. Deleting code scanning alerts can obscure security vulnerabilities that have been detected in the codebase, which is significant from an audit and compliance perspective. An attacker with this permission could suppress evidence of vulnerabilities they have introduced. - - -```mermaid -graph LR - user1("GH_User alice") - adminRole("GH_RepoRole GitHound\admin") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> adminRole - adminRole -- GH_DeleteAlertsCodeScanning --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_deletediscussion.mdx b/docs/opengraph/extensions/github/edges/gh_deletediscussion.mdx index 1f96a6bc..e04a805f 100644 --- a/docs/opengraph/extensions/github/edges/gh_deletediscussion.mdx +++ b/docs/opengraph/extensions/github/edges/gh_deletediscussion.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_DeleteDiscussion' -description: '[Repository] Repo role can delete discussions' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_DeleteDiscussion' +description: '[Repository] Repo role can delete discussions' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_DeleteDiscussion edge represents a role's ability to delete discussions. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\triage") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_DeleteDiscussion --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_deletediscussioncomment.mdx b/docs/opengraph/extensions/github/edges/gh_deletediscussioncomment.mdx index 16e210d3..1798ec37 100644 --- a/docs/opengraph/extensions/github/edges/gh_deletediscussioncomment.mdx +++ b/docs/opengraph/extensions/github/edges/gh_deletediscussioncomment.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_DeleteDiscussionComment' -description: '[Repository] Repo role can delete discussion comments' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_DeleteDiscussionComment' +description: '[Repository] Repo role can delete discussion comments' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_DeleteDiscussionComment edge represents a role's ability to delete discussion comments authored by any user. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\triage") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_DeleteDiscussionComment --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_deleteissue.mdx b/docs/opengraph/extensions/github/edges/gh_deleteissue.mdx index 97819a85..8a80df50 100644 --- a/docs/opengraph/extensions/github/edges/gh_deleteissue.mdx +++ b/docs/opengraph/extensions/github/edges/gh_deleteissue.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_DeleteIssue' -description: '[Repository] Repo role can delete issues' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_DeleteIssue' +description: '[Repository] Repo role can delete issues' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_DeleteIssue edge represents a role's ability to delete issues permanently. Deleted issues cannot be recovered. This permission is available to Admin roles and custom roles that have been granted this specific permission. Deleting issues can destroy audit trails and remove evidence of security discussions or vulnerability reports. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\admin") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_DeleteIssue --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_deletetag.mdx b/docs/opengraph/extensions/github/edges/gh_deletetag.mdx index dbf2dd95..d2f8ed50 100644 --- a/docs/opengraph/extensions/github/edges/gh_deletetag.mdx +++ b/docs/opengraph/extensions/github/edges/gh_deletetag.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_DeleteTag' -description: '[Repository] Repo role can delete tags and releases' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_DeleteTag' +description: '[Repository] Repo role can delete tags and releases' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_DeleteTag edge represents a role's ability to delete tags and releases. This permission is available to Admin roles and custom roles that have been granted this specific permission. Deleting tags can break downstream dependency references and remove published artifacts. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\admin") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_DeleteTag --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_dependson.mdx b/docs/opengraph/extensions/github/edges/gh_dependson.mdx index 51f8797f..1629da3b 100644 --- a/docs/opengraph/extensions/github/edges/gh_dependson.mdx +++ b/docs/opengraph/extensions/github/edges/gh_dependson.mdx @@ -1,16 +1,14 @@ ---- -title: 'GH_DependsOn' -description: '[Workflow] Job must run after another job (needs: dependency) — ordering only, not an access path' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_WorkflowJob](/opengraph/extensions/github/nodes/gh_workflowjob) -- Destination: [GH_WorkflowJob](/opengraph/extensions/github/nodes/gh_workflowjob) -- Traversable: ❌ - -## General Information - -The non-traversable GH_DependsOn edge represents a `needs:` dependency between two jobs in the same workflow. This edge captures execution order constraints. The source job will not start until the destination job completes successfully. This edge is non-traversable because it represents sequencing only, not an access or privilege path. +--- +title: 'GH_DependsOn' +description: '[Workflow] Job must run after another job (needs: dependency) — ordering only, not an access path' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +The non-traversable GH_DependsOn edge represents a `needs:` dependency between two jobs in the same workflow. This edge captures execution order constraints — the source job will not start until the destination job completes successfully. This edge is non-traversable because it represents sequencing only, not an access or privilege path. diff --git a/docs/opengraph/extensions/github/edges/gh_deploysto.mdx b/docs/opengraph/extensions/github/edges/gh_deploysto.mdx index a76131ce..c30871dc 100644 --- a/docs/opengraph/extensions/github/edges/gh_deploysto.mdx +++ b/docs/opengraph/extensions/github/edges/gh_deploysto.mdx @@ -1,16 +1,14 @@ ---- -title: 'GH_DeploysTo' -description: '[Workflow] Job deploys to a GitHub Environment — GH_WorkflowJob → GH_Environment' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_WorkflowJob](/opengraph/extensions/github/nodes/gh_workflowjob) -- Destination: [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) -- Traversable: ❌ - -## General Information - -The non-traversable GH_DeploysTo edge links a workflow job to the GitHub Environment it targets via the `environment:` key. This edge records which jobs deploy to which environments. Environments can gate deployments with protection rules and can expose environment-scoped secrets. +--- +title: 'GH_DeploysTo' +description: '[Workflow] Job deploys to a GitHub Environment — GH_WorkflowJob → GH_Environment' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +The non-traversable GH_DeploysTo edge links a workflow job to the GitHub Environment it targets via the `environment:` key. This edge records which jobs deploy to which environments. Environments can gate deployments with protection rules (required reviewers, wait timers, deployment branch policies) and can expose environment-scoped secrets and variables. diff --git a/docs/opengraph/extensions/github/edges/gh_editcategoryondiscussion.mdx b/docs/opengraph/extensions/github/edges/gh_editcategoryondiscussion.mdx index 1a63c657..44a67e60 100644 --- a/docs/opengraph/extensions/github/edges/gh_editcategoryondiscussion.mdx +++ b/docs/opengraph/extensions/github/edges/gh_editcategoryondiscussion.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_EditCategoryOnDiscussion' -description: '[Repository] Repo role can change the category of a discussion' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_EditCategoryOnDiscussion' +description: '[Repository] Repo role can change the category of a discussion' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_EditCategoryOnDiscussion edge represents a role's ability to change the category of a discussion, moving it between categories. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\triage") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_EditCategoryOnDiscussion --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_editdiscussioncategory.mdx b/docs/opengraph/extensions/github/edges/gh_editdiscussioncategory.mdx index fb0062fb..6d237a73 100644 --- a/docs/opengraph/extensions/github/edges/gh_editdiscussioncategory.mdx +++ b/docs/opengraph/extensions/github/edges/gh_editdiscussioncategory.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_EditDiscussionCategory' -description: '[Repository] Repo role can edit discussion categories' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_EditDiscussionCategory' +description: '[Repository] Repo role can edit discussion categories' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_EditDiscussionCategory edge represents a role's ability to edit discussion categories to reorganize discussion classification. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\triage") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_EditDiscussionCategory --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_editdiscussioncomment.mdx b/docs/opengraph/extensions/github/edges/gh_editdiscussioncomment.mdx index f2b9705f..50c21790 100644 --- a/docs/opengraph/extensions/github/edges/gh_editdiscussioncomment.mdx +++ b/docs/opengraph/extensions/github/edges/gh_editdiscussioncomment.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_EditDiscussionComment' -description: '[Repository] Repo role can edit discussion comments' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_EditDiscussionComment' +description: '[Repository] Repo role can edit discussion comments' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_EditDiscussionComment edge represents a role's ability to edit discussion comments authored by any user. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\triage") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_EditDiscussionComment --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_editrepoannouncementbanners.mdx b/docs/opengraph/extensions/github/edges/gh_editrepoannouncementbanners.mdx index 97a773d8..2ddecd59 100644 --- a/docs/opengraph/extensions/github/edges/gh_editrepoannouncementbanners.mdx +++ b/docs/opengraph/extensions/github/edges/gh_editrepoannouncementbanners.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_EditRepoAnnouncementBanners' -description: '[Repository] Repo role can edit repository announcement banners' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_EditRepoAnnouncementBanners' +description: '[Repository] Repo role can edit repository announcement banners' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_EditRepoAnnouncementBanners edge represents a role's ability to edit repository announcement banners displayed to visitors. This permission is available to Maintain and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\maintain") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_EditRepoAnnouncementBanners --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_editrepocustompropertiesvalues.mdx b/docs/opengraph/extensions/github/edges/gh_editrepocustompropertiesvalues.mdx index ffd25e74..08282ad8 100644 --- a/docs/opengraph/extensions/github/edges/gh_editrepocustompropertiesvalues.mdx +++ b/docs/opengraph/extensions/github/edges/gh_editrepocustompropertiesvalues.mdx @@ -1,27 +1,14 @@ ---- -title: 'GH_EditRepoCustomPropertiesValues' -description: '[Repository] Repo role can edit custom property values on the repository' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_EditRepoCustomPropertiesValues' +description: '[Repository] Repo role can edit custom property values on the repository' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_EditRepoCustomPropertiesValues edge represents a role's ability to edit custom property values on the repository. This permission is available to Admin roles and custom roles that have been granted this specific permission. Custom properties are organization-defined metadata fields on repositories that can be used for classification, compliance tagging, or policy enforcement via rulesets. Modifying custom property values could alter which organization-level rulesets apply to the repository, potentially bypassing security controls that are scoped by property-based targeting. - - -```mermaid -graph LR - user1("GH_User alice") - adminRole("GH_RepoRole GitHound\admin") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> adminRole - adminRole -- GH_EditRepoCustomPropertiesValues --> repo - adminRole -- GH_AdminTo --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_editrepometadata.mdx b/docs/opengraph/extensions/github/edges/gh_editrepometadata.mdx index 42ee1922..357d32fd 100644 --- a/docs/opengraph/extensions/github/edges/gh_editrepometadata.mdx +++ b/docs/opengraph/extensions/github/edges/gh_editrepometadata.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_EditRepoMetadata' -description: '[Repository] Repo role can edit repository metadata' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_EditRepoMetadata' +description: '[Repository] Repo role can edit repository metadata' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_EditRepoMetadata edge represents a role's ability to edit repository metadata including description, homepage URL, and visibility settings. This permission is available to Maintain and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\maintain") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_EditRepoMetadata --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_editrepoprotections.mdx b/docs/opengraph/extensions/github/edges/gh_editrepoprotections.mdx index 7cab8ec2..abc1010f 100644 --- a/docs/opengraph/extensions/github/edges/gh_editrepoprotections.mdx +++ b/docs/opengraph/extensions/github/edges/gh_editrepoprotections.mdx @@ -1,27 +1,14 @@ ---- -title: 'GH_EditRepoProtections' -description: 'Repo role can edit branch protection rules' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_EditRepoProtections' +description: 'Repo role can edit branch protection rules' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_EditRepoProtections edge represents a role's ability to edit or remove branch protection rules on the repository. This permission is available to Admin roles and custom roles that have been granted this specific permission. Modifying a branch protection rule is an indirect bypass -- removing or weakening protections opens the branch to direct push or unreviewed merges, making this a high-severity permission from a security perspective. Attack paths that include this edge can escalate to full branch write access by first disabling protections. - - -```mermaid -graph LR - user1("GH_User bob") - adminRole("GH_RepoRole GitHound\admin") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> adminRole - adminRole -- GH_EditRepoProtections --> repo - adminRole -- GH_AdminTo --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_hasbaserole.mdx b/docs/opengraph/extensions/github/edges/gh_hasbaserole.mdx index ad04599f..811a22fc 100644 --- a/docs/opengraph/extensions/github/edges/gh_hasbaserole.mdx +++ b/docs/opengraph/extensions/github/edges/gh_hasbaserole.mdx @@ -1,30 +1,14 @@ ---- -title: 'GH_HasBaseRole' -description: 'Role inherits permissions from another role' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole), [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole), [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Traversable: ✅ - -## General Information - +--- +title: 'GH_HasBaseRole' +description: 'Role inherits permissions from another role' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + The traversable GH_HasBaseRole edge represents role inheritance within the GitHub permission hierarchy. Org roles inherit down to all-repo roles (e.g., Owners inherits to all_repo_admin), and custom roles inherit from their base roles (e.g., a custom_role inherits from write). This edge is traversable because it extends permissions through the role hierarchy, meaning a principal with a higher-level role implicitly holds all inherited lower-level roles. - - -```mermaid -graph LR - orgOwners("GH_OrgRole SpecterOps\\Owners") - orgMembers("GH_OrgRole SpecterOps\\Members") - allRepoAdmin("GH_RepoRole SpecterOps\\all_repo_admin") - allRepoRead("GH_RepoRole SpecterOps\\all_repo_read") - customRole("GH_RepoRole GitHound\\security_reviewer") - writeRole("GH_RepoRole GitHound\\write") - orgOwners -- GH_HasBaseRole --> allRepoAdmin - orgMembers -- GH_HasBaseRole --> allRepoRead - customRole -- GH_HasBaseRole --> writeRole -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_hasbranch.mdx b/docs/opengraph/extensions/github/edges/gh_hasbranch.mdx deleted file mode 100644 index b371293b..00000000 --- a/docs/opengraph/extensions/github/edges/gh_hasbranch.mdx +++ /dev/null @@ -1,28 +0,0 @@ ---- -title: 'GH_HasBranch' -description: 'Repository has this branch' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Destination: [GH_Branch](/opengraph/extensions/github/nodes/gh_branch) -- Traversable: ❌ - -## General Information - -The non-traversable GH_HasBranch edge represents the relationship between a repository and its branches. This edge links each collected branch to its parent repository. It is a structural edge that provides the foundation for understanding branch-level protections and access controls. While not traversable itself, it connects repositories to branches where traversable edges like [GH_CanWriteBranch](/opengraph/extensions/github/edges/gh_canwritebranch) and [GH_CanEditProtection](/opengraph/extensions/github/edges/gh_caneditprotection) model the effective access. - - -```mermaid -graph LR - node1("GH_Repository GitHound") - node2("GH_Branch main") - node3("GH_Branch develop") - node4("GH_Branch feature/auth") - node1 -- GH_HasBranch --> node2 - node1 -- GH_HasBranch --> node3 - node1 -- GH_HasBranch --> node4 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_hasenvironment.mdx b/docs/opengraph/extensions/github/edges/gh_hasenvironment.mdx deleted file mode 100644 index 5d8f7d5f..00000000 --- a/docs/opengraph/extensions/github/edges/gh_hasenvironment.mdx +++ /dev/null @@ -1,28 +0,0 @@ ---- -title: 'GH_HasEnvironment' -description: 'Repository or branch has/can deploy to this environment' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_Branch](/opengraph/extensions/github/nodes/gh_branch) -- Destination: [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) -- Traversable: ❌ - -## General Information - -The non-traversable GH_HasEnvironment edge represents the relationship between a repository or branch and its deployment environments. This edge links environments to the repositories that define them and to the branches that are allowed to deploy to them (via deployment branch policies). Environments are security-relevant because they can gate access to secrets and cloud credentials, and their deployment branch policies control which branches can trigger deployments. - - -```mermaid -graph LR - node1("GH_Repository GitHound") - node2("GH_Environment production") - node3("GH_Environment staging") - node4("GH_Branch main") - node1 -- GH_HasEnvironment --> node2 - node1 -- GH_HasEnvironment --> node3 - node4 -- GH_HasEnvironment --> node2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_hasexternalidentity.mdx b/docs/opengraph/extensions/github/edges/gh_hasexternalidentity.mdx index e91c32b6..f5ba4801 100644 --- a/docs/opengraph/extensions/github/edges/gh_hasexternalidentity.mdx +++ b/docs/opengraph/extensions/github/edges/gh_hasexternalidentity.mdx @@ -1,28 +1,14 @@ ---- -title: 'GH_HasExternalIdentity' -description: 'SAML identity provider has this external identity' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_SamlIdentityProvider](/opengraph/extensions/github/nodes/gh_samlidentityprovider) -- Destination: [GH_ExternalIdentity](/opengraph/extensions/github/nodes/gh_externalidentity) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_HasExternalIdentity' +description: 'SAML identity provider has this external identity' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_HasExternalIdentity edge represents the relationship between a SAML identity provider and the external identities (SSO users) it manages. This edge links each external identity to the SAML provider that authenticated it. External identities are a key component in cross-platform attack path analysis because they bridge the gap between corporate identity providers and GitHub user accounts via the [GH_MapsToUser](/opengraph/extensions/github/edges/gh_mapstouser) edge. Enumerating external identities reveals which corporate users have linked GitHub accounts and enables mapping from IdP compromise to GitHub access. - - -```mermaid -graph LR - node1("GH_SamlIdentityProvider entra-id-sso") - node2("GH_ExternalIdentity alice\@specterops.io") - node3("GH_ExternalIdentity bob\@specterops.io") - node4("GH_User alice") - node1 -- GH_HasExternalIdentity --> node2 - node1 -- GH_HasExternalIdentity --> node3 - node2 -- GH_MapsToUser --> node4 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_hasjob.mdx b/docs/opengraph/extensions/github/edges/gh_hasjob.mdx deleted file mode 100644 index 43e40f54..00000000 --- a/docs/opengraph/extensions/github/edges/gh_hasjob.mdx +++ /dev/null @@ -1,16 +0,0 @@ ---- -title: 'GH_HasJob' -description: '[Workflow] Workflow contains this job — GH_Workflow → GH_WorkflowJob' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_Workflow](/opengraph/extensions/github/nodes/gh_workflow) -- Destination: [GH_WorkflowJob](/opengraph/extensions/github/nodes/gh_workflowjob) -- Traversable: ❌ - -## General Information - -The traversable GH_HasJob edge links a workflow to each of its jobs. This edge is the primary structural link for walking from a workflow definition into its execution units. Because jobs can declare environments and permissions, traversing this edge enables analysts to reason about what a workflow can do and where it can deploy. diff --git a/docs/opengraph/extensions/github/edges/gh_hasmember.mdx b/docs/opengraph/extensions/github/edges/gh_hasmember.mdx index 531ff837..40a274c0 100644 --- a/docs/opengraph/extensions/github/edges/gh_hasmember.mdx +++ b/docs/opengraph/extensions/github/edges/gh_hasmember.mdx @@ -1,16 +1,14 @@ ---- -title: 'GH_HasMember' -description: 'Enterprise or organization has this user as a member' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) -- Destination: [GH_User](/opengraph/extensions/github/nodes/gh_user) -- Traversable: ❌ - -## General Information - -The non-traversable GH_HasMember edge represents the relationship between a GitHub organization and a user who is a member of that scope. This edge records membership as directory context rather than as an access path. Being listed as a member does not by itself describe what the user can do, only that the user belongs to the organization. Membership is still security-relevant because it defines the population from which roles, team assignments, and token approvals are drawn. +--- +title: 'GH_HasMember' +description: 'Enterprise or organization has this user as a member' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +The non-traversable GH_HasMember edge represents the relationship between a GitHub enterprise or organization and a user who is a member of that scope. This edge records membership as directory context rather than as an access path: being listed as a member does not by itself describe what the user can do, only that the user belongs to the enterprise or organization. Membership remains security-relevant because it defines the population from which roles, team assignments, and token approvals are drawn, and it helps analysts understand who is inside the trust boundary when reviewing GitHub exposure. diff --git a/docs/opengraph/extensions/github/edges/gh_haspersonalaccesstoken.mdx b/docs/opengraph/extensions/github/edges/gh_haspersonalaccesstoken.mdx index 1c096dc4..2328603e 100644 --- a/docs/opengraph/extensions/github/edges/gh_haspersonalaccesstoken.mdx +++ b/docs/opengraph/extensions/github/edges/gh_haspersonalaccesstoken.mdx @@ -1,29 +1,14 @@ ---- -title: 'GH_HasPersonalAccessToken' -description: 'User owns this personal access token that has been granted access to the organization' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_User](/opengraph/extensions/github/nodes/gh_user) -- Destination: [GH_PersonalAccessToken](/opengraph/extensions/github/nodes/gh_personalaccesstoken) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_HasPersonalAccessToken' +description: 'User owns this personal access token that has been granted access to the organization' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_HasPersonalAccessToken edge represents the relationship between a user and their fine-grained personal access tokens that have been granted access to the organization. This edge links each approved token back to the user who created it. Fine-grained personal access tokens are security-significant because they provide programmatic access to organization resources with specific scoped permissions. Tracking token ownership is essential for understanding which users have standing API access and for identifying tokens that may need revocation. - - -```mermaid -graph LR - node1("GH_User alice") - node2("GH_PersonalAccessToken ci-deploy-token") - node3("GH_PersonalAccessToken read-only-audit") - node4("GH_User bob") - node5("GH_PersonalAccessToken automation-token") - node1 -- GH_HasPersonalAccessToken --> node2 - node1 -- GH_HasPersonalAccessToken --> node3 - node4 -- GH_HasPersonalAccessToken --> node5 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_haspersonalaccesstokenrequest.mdx b/docs/opengraph/extensions/github/edges/gh_haspersonalaccesstokenrequest.mdx index c628676a..5d712d02 100644 --- a/docs/opengraph/extensions/github/edges/gh_haspersonalaccesstokenrequest.mdx +++ b/docs/opengraph/extensions/github/edges/gh_haspersonalaccesstokenrequest.mdx @@ -1,27 +1,14 @@ ---- -title: 'GH_HasPersonalAccessTokenRequest' -description: 'User has a pending personal access token request for the organization' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_User](/opengraph/extensions/github/nodes/gh_user) -- Destination: [GH_PersonalAccessTokenRequest](/opengraph/extensions/github/nodes/gh_personalaccesstokenrequest) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_HasPersonalAccessTokenRequest' +description: 'User has a pending personal access token request for the organization' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_HasPersonalAccessTokenRequest edge represents the relationship between a user and their pending personal access token requests awaiting organizational approval. This edge links each pending token request back to the user who submitted it. Pending token requests are security-relevant because they represent access that may soon be granted, and reviewing them helps administrators understand what permissions users are requesting before approval. Organizations that require approval for fine-grained PATs will have these requests queued until an administrator acts on them. - - -```mermaid -graph LR - node1("GH_User alice") - node2("GH_PersonalAccessTokenRequest deploy-request") - node3("GH_User bob") - node4("GH_PersonalAccessTokenRequest admin-access-request") - node1 -- GH_HasPersonalAccessTokenRequest --> node2 - node3 -- GH_HasPersonalAccessTokenRequest --> node4 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_hasrole.mdx b/docs/opengraph/extensions/github/edges/gh_hasrole.mdx index 2f8c5db0..27f16bb3 100644 --- a/docs/opengraph/extensions/github/edges/gh_hasrole.mdx +++ b/docs/opengraph/extensions/github/edges/gh_hasrole.mdx @@ -1,31 +1,14 @@ ---- -title: 'GH_HasRole' -description: 'User or team has a role assignment (org role, team role, or repo role)' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_User](/opengraph/extensions/github/nodes/gh_user), [GH_Team](/opengraph/extensions/github/nodes/gh_team) -- Destination: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole), [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole), [GH_TeamRole](/opengraph/extensions/github/nodes/gh_teamrole) -- Traversable: ✅ - -## General Information - +--- +title: 'GH_HasRole' +description: 'User or team has a role assignment (org role, team role, or repo role)' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + The traversable GH_HasRole edge represents the assignment of a user or team to a specific role within the organization, repository, or team. This is the primary edge for connecting identities to their permissions and serves as the foundation of all access paths in the GitHub permission model. Because role assignment is the starting point for determining what a principal can do, this edge is traversable and critical for attack path analysis. - - -```mermaid -graph LR - user1("GH_User alice") - user2("GH_User bob") - team1("GH_Team security-team") - orgRole("GH_OrgRole SpecterOps\\Owners") - repoRole("GH_RepoRole GitHound\\write") - teamRole("GH_TeamRole security-team\\maintainer") - user1 -- GH_HasRole --> orgRole - user2 -- GH_HasRole --> repoRole - team1 -- GH_HasRole --> repoRole - user1 -- GH_HasRole --> teamRole -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_hassamlidentityprovider.mdx b/docs/opengraph/extensions/github/edges/gh_hassamlidentityprovider.mdx index 59efb2c1..5396d13c 100644 --- a/docs/opengraph/extensions/github/edges/gh_hassamlidentityprovider.mdx +++ b/docs/opengraph/extensions/github/edges/gh_hassamlidentityprovider.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_HasSamlIdentityProvider' -description: 'Organization has this SAML identity provider configured' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) -- Destination: [GH_SamlIdentityProvider](/opengraph/extensions/github/nodes/gh_samlidentityprovider) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_HasSamlIdentityProvider' +description: 'Organization has this SAML identity provider configured' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_HasSamlIdentityProvider edge represents the relationship between an organization and its SAML identity provider configuration. This edge links an organization to the SAML SSO provider used for authentication and user provisioning. SAML identity providers are a critical security component because they establish the trust boundary between an external identity provider (such as Entra ID or Okta) and the GitHub organization. Understanding this relationship is essential for mapping cross-platform attack paths where compromise of the identity provider could lead to access within the GitHub organization. - - -```mermaid -graph LR - node1("GH_Organization SpecterOps") - node2("GH_SamlIdentityProvider entra-id-sso") - node3("GH_ExternalIdentity alice\@specterops.io") - node1 -- GH_HasSamlIdentityProvider --> node2 - node2 -- GH_HasExternalIdentity --> node3 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_hassecret.mdx b/docs/opengraph/extensions/github/edges/gh_hassecret.mdx index e521ef30..731fc414 100644 --- a/docs/opengraph/extensions/github/edges/gh_hassecret.mdx +++ b/docs/opengraph/extensions/github/edges/gh_hassecret.mdx @@ -1,29 +1,14 @@ ---- -title: 'GH_HasSecret' -description: 'Repository or environment has access to this secret' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) -- Destination: [GH_OrgSecret](/opengraph/extensions/github/nodes/gh_orgsecret), [GH_RepoSecret](/opengraph/extensions/github/nodes/gh_reposecret), [GH_EnvironmentSecret](/opengraph/extensions/github/nodes/gh_environmentsecret) -- Traversable: ✅ - -## General Information - -The traversable GH_HasSecret edge represents the relationship between a repository or environment and the secrets accessible within that context. This edge shows which secrets are available in which scopes. Repositories can have access to both organization-level secrets (scoped to selected repositories) and repository-level secrets, while environments contain their own environment-scoped secrets. This edge is traversable because any principal that can push code to a repository (via [GH_CanWriteBranch](/opengraph/extensions/github/edges/gh_canwritebranch) or [GH_CanCreateBranch](/opengraph/extensions/github/edges/gh_cancreatebranch)) can write a workflow that exfiltrates the secret values at runtime, making this a meaningful link in attack path analysis. - - -```mermaid -graph LR - node1("GH_Repository GitHound") - node2("GH_OrgSecret NPM_TOKEN") - node3("GH_RepoSecret DEPLOY_KEY") - node4("GH_Environment production") - node5("GH_EnvironmentSecret AWS_SECRET_KEY") - node1 -- GH_HasSecret --> node2 - node1 -- GH_HasSecret --> node3 - node4 -- GH_HasSecret --> node5 -``` \ No newline at end of file +--- +title: 'GH_HasSecret' +description: 'Repository or environment has access to this secret' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable GH_HasSecret edge represents the relationship between a repository or environment and the secrets accessible within that context. This edge shows which secrets are available in which scopes. Repositories can have access to both organization-level secrets (scoped to selected repositories) and repository-level secrets, while environments expose their own environment-scoped secrets to jobs that target them. This edge is traversable because any principal that can execute a workflow in the relevant context may be able to exfiltrate secret values at runtime, making this a meaningful link in attack path analysis. diff --git a/docs/opengraph/extensions/github/edges/gh_hasstep.mdx b/docs/opengraph/extensions/github/edges/gh_hasstep.mdx deleted file mode 100644 index 6cce6556..00000000 --- a/docs/opengraph/extensions/github/edges/gh_hasstep.mdx +++ /dev/null @@ -1,16 +0,0 @@ ---- -title: 'GH_HasStep' -description: '[Workflow] Job contains this step — GH_WorkflowJob → GH_WorkflowStep' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_WorkflowJob](/opengraph/extensions/github/nodes/gh_workflowjob) -- Destination: [GH_WorkflowStep](/opengraph/extensions/github/nodes/gh_workflowstep) -- Traversable: ❌ - -## General Information - -The traversable GH_HasStep edge links a job to each of its steps in execution order. This edge enables analysts to enumerate all actions and shell commands executed by a job, including which secrets and variables each step consumes. diff --git a/docs/opengraph/extensions/github/edges/gh_hasvariable.mdx b/docs/opengraph/extensions/github/edges/gh_hasvariable.mdx index 797cc23a..636f6a24 100644 --- a/docs/opengraph/extensions/github/edges/gh_hasvariable.mdx +++ b/docs/opengraph/extensions/github/edges/gh_hasvariable.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_HasVariable' -description: 'Repository has access to this variable (org-level or repo-level)' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Destination: [GH_OrgVariable](/opengraph/extensions/github/nodes/gh_orgvariable), [GH_RepoVariable](/opengraph/extensions/github/nodes/gh_repovariable) -- Traversable: ✅ - -## General Information - -The traversable GH_HasVariable edge represents the relationship between a repository and the variables accessible within that context. This edge shows which variables are available in which scopes. Repositories can have access to both organization-level variables (scoped by visibility to all, private, or selected repositories) and repository-level variables defined directly on the repo. This edge is traversable because any principal that can push code to a repository (via [GH_CanWriteBranch](/opengraph/extensions/github/edges/gh_canwritebranch) or [GH_CanCreateBranch](/opengraph/extensions/github/edges/gh_cancreatebranch)) can write a workflow that reads variable values at runtime, and variables may contain configuration data useful for lateral movement such as deployment URLs, service names, or environment identifiers. - - -```mermaid -graph LR - node1("GH_Repository GitHound") - node2("GH_OrgVariable ENVIRONMENT_URL") - node3("GH_RepoVariable NODE_VERSION") - node1 -- GH_HasVariable --> node2 - node1 -- GH_HasVariable --> node3 -``` \ No newline at end of file +--- +title: 'GH_HasVariable' +description: 'Repository or environment has access to this variable' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + +The traversable GH_HasVariable edge represents the relationship between a repository or environment and the variables accessible within that context. This edge shows which variables are available in which scopes. Repositories can have access to both organization-level variables (scoped by visibility to all, private, or selected repositories) and repository-level variables defined directly on the repo, while environments expose their own environment-scoped variables to jobs that target them. This edge is traversable because any principal that can execute a workflow in the relevant context may be able to read variable values at runtime, and variables may contain configuration data useful for lateral movement such as deployment URLs, service names, or environment identifiers. diff --git a/docs/opengraph/extensions/github/edges/gh_hasworkflow.mdx b/docs/opengraph/extensions/github/edges/gh_hasworkflow.mdx deleted file mode 100644 index 8f8b2a7a..00000000 --- a/docs/opengraph/extensions/github/edges/gh_hasworkflow.mdx +++ /dev/null @@ -1,29 +0,0 @@ ---- -title: 'GH_HasWorkflow' -description: 'Repository has this workflow' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Destination: [GH_Workflow](/opengraph/extensions/github/nodes/gh_workflow) -- Traversable: ❌ - -## General Information - -The non-traversable GH_HasWorkflow edge represents the relationship between a repository and its GitHub Actions workflows. This edge links each discovered workflow definition to its parent repository. Workflows are significant from a security perspective because they can execute arbitrary code with repository permissions, access secrets, and assume cloud identities. This structural edge enables analysts to enumerate which workflows exist in a given repository. - - -```mermaid -graph LR - node1("GH_Repository GitHound") - node2("GH_Workflow ci.yml") - node3("GH_Workflow deploy.yml") - node4("GH_Repository BloodHound") - node5("GH_Workflow release.yml") - node1 -- GH_HasWorkflow --> node2 - node1 -- GH_HasWorkflow --> node3 - node4 -- GH_HasWorkflow --> node5 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_installedas.mdx b/docs/opengraph/extensions/github/edges/gh_installedas.mdx index 5da3de1d..b104e881 100644 --- a/docs/opengraph/extensions/github/edges/gh_installedas.mdx +++ b/docs/opengraph/extensions/github/edges/gh_installedas.mdx @@ -1,28 +1,14 @@ ---- -title: 'GH_InstalledAs' -description: 'GitHub App is installed as this app installation on an organization' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_App](/opengraph/extensions/github/nodes/gh_app) -- Destination: [GH_AppInstallation](/opengraph/extensions/github/nodes/gh_appinstallation) -- Traversable: ✅ - -## General Information - +--- +title: 'GH_InstalledAs' +description: 'GitHub App is installed as this app installation on an organization' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + The traversable GH_InstalledAs edge links a GitHub App to its installation within the organization. This edge is traversable because it connects the app definition to its active installation, which determines the specific set of repositories and permissions the app has been granted. Understanding the relationship between an app and its installation is essential for tracing how app-level permissions translate into repository access. - - -```mermaid -graph LR - app("GH_App dependabot") - install("GH_AppInstallation dependabot#12345") - repo1("GH_Repository GitHound") - repo2("GH_Repository BloodHound") - app -- GH_InstalledAs --> install - install -- GH_CanAccess --> repo1 - install -- GH_CanAccess --> repo2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_invitemember.mdx b/docs/opengraph/extensions/github/edges/gh_invitemember.mdx index 124d97c7..c840753b 100644 --- a/docs/opengraph/extensions/github/edges/gh_invitemember.mdx +++ b/docs/opengraph/extensions/github/edges/gh_invitemember.mdx @@ -1,24 +1,14 @@ ---- -title: 'GH_InviteMember' -description: '[Organization] Org role can invite members to the organization' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) -- Destination: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_InviteMember' +description: '[Organization] Org role can invite members to the organization' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_InviteMember edge represents that a role has the ability to invite new members to the organization. This permission is typically restricted to Owners, as inviting members expands the organization's trust boundary by granting new users access to internal resources. An attacker with this permission could invite a controlled account to gain persistent access to the organization's repositories, teams, and secrets. - - -```mermaid -graph LR - node1("GH_OrgRole SpecterOps\\Owners") - node2("GH_Organization SpecterOps") - node1 -- GH_InviteMember --> node2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_jumpmergequeue.mdx b/docs/opengraph/extensions/github/edges/gh_jumpmergequeue.mdx index 07e459cd..b189aa5c 100644 --- a/docs/opengraph/extensions/github/edges/gh_jumpmergequeue.mdx +++ b/docs/opengraph/extensions/github/edges/gh_jumpmergequeue.mdx @@ -1,27 +1,14 @@ ---- -title: 'GH_JumpMergeQueue' -description: 'Repo role can jump the merge queue' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_JumpMergeQueue' +description: 'Repo role can jump the merge queue' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_JumpMergeQueue edge represents a role's ability to jump ahead of other entries in the merge queue. This permission is available to Admin roles and custom roles that have been granted this specific permission. Merge queues enforce an ordered sequence of CI checks and merges; jumping the queue allows a principal to prioritize their changes ahead of others. While less severe than bypassing protections entirely, this permission can be used to accelerate the landing of malicious changes before other queued entries are reviewed or tested. - - -```mermaid -graph LR - user1("GH_User bob") - adminRole("GH_RepoRole GitHound\admin") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> adminRole - adminRole -- GH_JumpMergeQueue --> repo - adminRole -- GH_AdminTo --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_managedeploykeys.mdx b/docs/opengraph/extensions/github/edges/gh_managedeploykeys.mdx index bf2bfc6d..846a35cb 100644 --- a/docs/opengraph/extensions/github/edges/gh_managedeploykeys.mdx +++ b/docs/opengraph/extensions/github/edges/gh_managedeploykeys.mdx @@ -1,27 +1,14 @@ ---- -title: 'GH_ManageDeployKeys' -description: '[Repository] Repo role can manage deploy keys' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ManageDeployKeys' +description: '[Repository] Repo role can manage deploy keys' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ManageDeployKeys edge represents a role's ability to create, modify, and delete deploy keys for the repository. This permission is available to Admin roles and custom roles that have been granted this specific permission. Deploy keys provide SSH-based access to the repository, and a deploy key with write access can push commits directly without going through the GitHub web interface or API authentication. Managing deploy keys is security-significant because it enables the creation of persistent, credential-based access that operates outside the normal user authentication flow. - - -```mermaid -graph LR - user1("GH_User alice") - adminRole("GH_RepoRole GitHound\admin") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> adminRole - adminRole -- GH_ManageDeployKeys --> repo - adminRole -- GH_AdminTo --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_managediscussionbadges.mdx b/docs/opengraph/extensions/github/edges/gh_managediscussionbadges.mdx index a5e1d577..8040d903 100644 --- a/docs/opengraph/extensions/github/edges/gh_managediscussionbadges.mdx +++ b/docs/opengraph/extensions/github/edges/gh_managediscussionbadges.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_ManageDiscussionBadges' -description: '[Repository] Repo role can manage discussion badges' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ManageDiscussionBadges' +description: '[Repository] Repo role can manage discussion badges' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ManageDiscussionBadges edge represents a role's ability to manage discussion badges used to highlight discussion participants. This permission is available to Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\write") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_ManageDiscussionBadges --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_manageorganizationwebhooks.mdx b/docs/opengraph/extensions/github/edges/gh_manageorganizationwebhooks.mdx index c4028eea..a7113db9 100644 --- a/docs/opengraph/extensions/github/edges/gh_manageorganizationwebhooks.mdx +++ b/docs/opengraph/extensions/github/edges/gh_manageorganizationwebhooks.mdx @@ -1,24 +1,14 @@ ---- -title: 'GH_ManageOrganizationWebhooks' -description: '[Organization] Org role can manage organization webhooks' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) -- Destination: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ManageOrganizationWebhooks' +description: '[Organization] Org role can manage organization webhooks' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ManageOrganizationWebhooks edge represents that a role has the ability to manage organization-level webhooks. This edge is dynamically generated from custom organization role permissions discovered by the collector. Webhooks can be configured to send event data to external endpoints, making this permission significant for security because an attacker could create or modify webhooks to exfiltrate repository data, commit contents, or issue details to an attacker-controlled server, or use them as a persistence mechanism. - - -```mermaid -graph LR - node1("GH_OrgRole SpecterOps\\Owners") - node2("GH_Organization SpecterOps") - node1 -- GH_ManageOrganizationWebhooks --> node2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_managereposecurityproducts.mdx b/docs/opengraph/extensions/github/edges/gh_managereposecurityproducts.mdx index 0a8f046f..648118c9 100644 --- a/docs/opengraph/extensions/github/edges/gh_managereposecurityproducts.mdx +++ b/docs/opengraph/extensions/github/edges/gh_managereposecurityproducts.mdx @@ -1,28 +1,14 @@ ---- -title: 'GH_ManageRepoSecurityProducts' -description: 'Repo role can manage repo-level security products' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ManageRepoSecurityProducts' +description: 'Repo role can manage repo-level security products' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ManageRepoSecurityProducts edge represents a role's ability to manage repository-specific security product settings. This permission is available to Admin roles and custom roles that have been granted this specific permission. Unlike the broader [GH_ManageSecurityProducts](/opengraph/extensions/github/edges/gh_managesecurityproducts) permission, this edge is scoped to repository-level security configuration such as repository-specific scanning settings and alert management. Disabling repository-level security products can create blind spots in vulnerability detection for the specific repository. - - -```mermaid -graph LR - user1("GH_User alice") - adminRole("GH_RepoRole GitHound\admin") - customRole("GH_RepoRole GitHound\security_admin") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> customRole - adminRole -- GH_ManageRepoSecurityProducts --> repo - customRole -- GH_ManageRepoSecurityProducts --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_managesecurityproducts.mdx b/docs/opengraph/extensions/github/edges/gh_managesecurityproducts.mdx index 994e449a..55b0a958 100644 --- a/docs/opengraph/extensions/github/edges/gh_managesecurityproducts.mdx +++ b/docs/opengraph/extensions/github/edges/gh_managesecurityproducts.mdx @@ -1,28 +1,14 @@ ---- -title: 'GH_ManageSecurityProducts' -description: 'Repo role can manage security products' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ManageSecurityProducts' +description: 'Repo role can manage security products' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ManageSecurityProducts edge represents a role's ability to manage security product settings on the repository. This permission is available to Admin roles and custom roles that have been granted this specific permission. Managing security products allows enabling or disabling features such as secret scanning, code scanning, and Dependabot alerts. An attacker with this permission could disable security features to prevent detection of vulnerabilities or leaked secrets, making this a high-severity permission for security posture management. - - -```mermaid -graph LR - user1("GH_User bob") - adminRole("GH_RepoRole GitHound\admin") - customRole("GH_RepoRole GitHound\security_admin") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> adminRole - adminRole -- GH_ManageSecurityProducts --> repo - customRole -- GH_ManageSecurityProducts --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_managesettingsmergetypes.mdx b/docs/opengraph/extensions/github/edges/gh_managesettingsmergetypes.mdx index bac154e5..98c7154a 100644 --- a/docs/opengraph/extensions/github/edges/gh_managesettingsmergetypes.mdx +++ b/docs/opengraph/extensions/github/edges/gh_managesettingsmergetypes.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_ManageSettingsMergeTypes' -description: '[Repository] Repo role can manage allowed merge types' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ManageSettingsMergeTypes' +description: '[Repository] Repo role can manage allowed merge types' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ManageSettingsMergeTypes edge represents a role's ability to configure allowed merge types (merge commit, squash, rebase) on the repository. This permission is available to Maintain and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\maintain") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_ManageSettingsMergeTypes --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_managesettingspages.mdx b/docs/opengraph/extensions/github/edges/gh_managesettingspages.mdx index bb27a3ab..77a92559 100644 --- a/docs/opengraph/extensions/github/edges/gh_managesettingspages.mdx +++ b/docs/opengraph/extensions/github/edges/gh_managesettingspages.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_ManageSettingsPages' -description: '[Repository] Repo role can manage GitHub Pages settings' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ManageSettingsPages' +description: '[Repository] Repo role can manage GitHub Pages settings' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ManageSettingsPages edge represents a role's ability to manage GitHub Pages settings including enabling, disabling, and configuring the source. This permission is available to Maintain and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\maintain") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_ManageSettingsPages --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_managesettingsprojects.mdx b/docs/opengraph/extensions/github/edges/gh_managesettingsprojects.mdx index 22d38720..086f2e0d 100644 --- a/docs/opengraph/extensions/github/edges/gh_managesettingsprojects.mdx +++ b/docs/opengraph/extensions/github/edges/gh_managesettingsprojects.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_ManageSettingsProjects' -description: '[Repository] Repo role can manage project settings' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ManageSettingsProjects' +description: '[Repository] Repo role can manage project settings' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ManageSettingsProjects edge represents a role's ability to manage project board settings on the repository. This permission is available to Maintain and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\maintain") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_ManageSettingsProjects --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_managesettingswiki.mdx b/docs/opengraph/extensions/github/edges/gh_managesettingswiki.mdx index 74fd9c2b..5d30114c 100644 --- a/docs/opengraph/extensions/github/edges/gh_managesettingswiki.mdx +++ b/docs/opengraph/extensions/github/edges/gh_managesettingswiki.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_ManageSettingsWiki' -description: '[Repository] Repo role can manage wiki settings' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ManageSettingsWiki' +description: '[Repository] Repo role can manage wiki settings' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ManageSettingsWiki edge represents a role's ability to enable or disable the repository wiki. This permission is available to Maintain and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\maintain") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_ManageSettingsWiki --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_managetopics.mdx b/docs/opengraph/extensions/github/edges/gh_managetopics.mdx index 76bd52e2..1e29a3ed 100644 --- a/docs/opengraph/extensions/github/edges/gh_managetopics.mdx +++ b/docs/opengraph/extensions/github/edges/gh_managetopics.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_ManageTopics' -description: '[Repository] Repo role can manage repository topics' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ManageTopics' +description: '[Repository] Repo role can manage repository topics' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ManageTopics edge represents a role's ability to manage repository topics used for discovery and classification. This permission is available to Maintain and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\maintain") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_ManageTopics --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_managewebhooks.mdx b/docs/opengraph/extensions/github/edges/gh_managewebhooks.mdx index 63938a11..70f7314f 100644 --- a/docs/opengraph/extensions/github/edges/gh_managewebhooks.mdx +++ b/docs/opengraph/extensions/github/edges/gh_managewebhooks.mdx @@ -1,28 +1,14 @@ ---- -title: 'GH_ManageWebhooks' -description: '[Repository] Repo role can manage repository webhooks' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ManageWebhooks' +description: '[Repository] Repo role can manage repository webhooks' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ManageWebhooks edge represents a role's ability to create, modify, and delete repository-level webhooks. This permission is available to Admin roles and custom roles that have been granted this specific permission. Webhooks can exfiltrate repository events and code changes to external endpoints, making this a security-sensitive permission. An attacker with this permission could configure a webhook to receive push event payloads containing commit diffs, effectively creating a covert channel for data exfiltration. - - -```mermaid -graph LR - user1("GH_User carol") - adminRole("GH_RepoRole GitHound\admin") - customRole("GH_RepoRole GitHound\integrations_manager") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> adminRole - adminRole -- GH_ManageWebhooks --> repo - customRole -- GH_ManageWebhooks --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_mapstouser.mdx b/docs/opengraph/extensions/github/edges/gh_mapstouser.mdx index f83d1bf6..f298fc5d 100644 --- a/docs/opengraph/extensions/github/edges/gh_mapstouser.mdx +++ b/docs/opengraph/extensions/github/edges/gh_mapstouser.mdx @@ -1,27 +1,14 @@ ---- -title: 'GH_MapsToUser' -description: 'External identity maps to a GitHub user or identity provider user' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_ExternalIdentity](/opengraph/extensions/github/nodes/gh_externalidentity) -- Destination: [GH_User](/opengraph/extensions/github/nodes/gh_user) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_MapsToUser' +description: 'External identity maps to a GitHub user or identity provider user' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_MapsToUser edge maps an external identity (provisioned via SAML or SCIM) to a GitHub user within the organization, or to an external IdP user (such as [AZUser](/resources/nodes/az-user), [Okta_User](/opengraph/extensions/okta/nodes/okta_user), or [PingOneUser](https://github.com/andyrobbins/PingOneHound?tab=readme-ov-file#schema)) in hybrid graph scenarios. This edge represents identity correlation rather than an attack path, connecting a user's external IdP account to their GitHub account for visibility into federated identity mappings. - - -```mermaid -graph LR - extId1("GH_ExternalIdentity alice\@specterops.io") - extId2("GH_ExternalIdentity bob\@specterops.io") - user1("GH_User alice") - user2("GH_User bob") - extId1 -- GH_MapsToUser --> user1 - extId2 -- GH_MapsToUser --> user2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_markasduplicate.mdx b/docs/opengraph/extensions/github/edges/gh_markasduplicate.mdx index a4f94839..2ca9e8ce 100644 --- a/docs/opengraph/extensions/github/edges/gh_markasduplicate.mdx +++ b/docs/opengraph/extensions/github/edges/gh_markasduplicate.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_MarkAsDuplicate' -description: '[Repository] Repo role can mark issues or pull requests as duplicates' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_MarkAsDuplicate' +description: '[Repository] Repo role can mark issues or pull requests as duplicates' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_MarkAsDuplicate edge represents a role's ability to mark issues or pull requests as duplicates. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\triage") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_MarkAsDuplicate --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_matchesenvironmentpolicy.mdx b/docs/opengraph/extensions/github/edges/gh_matchesenvironmentpolicy.mdx new file mode 100644 index 00000000..7913f76b --- /dev/null +++ b/docs/opengraph/extensions/github/edges/gh_matchesenvironmentpolicy.mdx @@ -0,0 +1,18 @@ +--- +title: 'GH_MatchesEnvironmentPolicy' +description: 'Branch matches this environment deployment branch policy' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +The non-traversable GH_MatchesEnvironmentPolicy edge links a branch to a GitHub Environment deployment branch policy that it satisfies. + +This edge is emitted when a branch name matches the pattern defined by a [GH_EnvironmentBranchPolicy](/opengraph/extensions/github/nodes/gh_environmentbranchpolicy) node, such as `main`, `release/*`, or `release/**/*`. The edge is structural rather than directly traversable because matching a policy alone does not guarantee deployment access; the environment may still require protected branches, reviewers, wait timers, or other controls. + +GH_MatchesEnvironmentPolicy is primarily used as supporting evidence for computed [GH_CanDeployToEnvironment](/opengraph/extensions/github/edges/gh_candeploytoenvironment) edges. diff --git a/docs/opengraph/extensions/github/edges/gh_memberof.mdx b/docs/opengraph/extensions/github/edges/gh_memberof.mdx index 11199f53..3251feec 100644 --- a/docs/opengraph/extensions/github/edges/gh_memberof.mdx +++ b/docs/opengraph/extensions/github/edges/gh_memberof.mdx @@ -1,28 +1,14 @@ ---- -title: 'GH_MemberOf' -description: 'Team role is a member of a team, or team is a nested member of a parent team' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_TeamRole](/opengraph/extensions/github/nodes/gh_teamrole), [GH_Team](/opengraph/extensions/github/nodes/gh_team) -- Destination: [GH_Team](/opengraph/extensions/github/nodes/gh_team) -- Traversable: ✅ - -## General Information - +--- +title: 'GH_MemberOf' +description: 'Team role is a member of a team, or team is a nested member of a parent team' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + The traversable GH_MemberOf edge represents team membership, linking a team role to its parent team or a child team to a parent team in nested team hierarchies. This edge is traversable because team membership extends access transitively -- a user who holds a role in a child team inherits the repository permissions of all ancestor teams in the nesting hierarchy, making it a key component of attack path analysis. - - -```mermaid -graph LR - teamRole1("GH_TeamRole security-team\\maintainer") - teamRole2("GH_TeamRole appsec-team\\member") - childTeam("GH_Team appsec-team") - parentTeam("GH_Team security-team") - teamRole1 -- GH_MemberOf --> parentTeam - teamRole2 -- GH_MemberOf --> childTeam - childTeam -- GH_MemberOf --> parentTeam -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_orgbypasscodescanningdismissalrequests.mdx b/docs/opengraph/extensions/github/edges/gh_orgbypasscodescanningdismissalrequests.mdx index 228470ec..6bb05884 100644 --- a/docs/opengraph/extensions/github/edges/gh_orgbypasscodescanningdismissalrequests.mdx +++ b/docs/opengraph/extensions/github/edges/gh_orgbypasscodescanningdismissalrequests.mdx @@ -1,24 +1,14 @@ ---- -title: 'GH_OrgBypassCodeScanningDismissalRequests' -description: '[Organization] Org role can bypass code scanning dismissal requests' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) -- Destination: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_OrgBypassCodeScanningDismissalRequests' +description: '[Organization] Org role can bypass code scanning dismissal requests' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_OrgBypassCodeScanningDismissalRequests edge represents that a role can bypass code scanning dismissal requests at the organization level. This edge is dynamically generated from custom organization role permissions discovered by the collector. This permission allows suppressing code scanning security findings without the standard review process, which is significant because an attacker could use it to hide vulnerabilities or malicious code patterns that would otherwise be flagged by automated scanning tools. - - -```mermaid -graph LR - node1("GH_OrgRole SpecterOps\\Owners") - node2("GH_Organization SpecterOps") - node1 -- GH_OrgBypassCodeScanningDismissalRequests --> node2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_orgbypasssecretscanningclosurerequests.mdx b/docs/opengraph/extensions/github/edges/gh_orgbypasssecretscanningclosurerequests.mdx index 4578da62..49c8f668 100644 --- a/docs/opengraph/extensions/github/edges/gh_orgbypasssecretscanningclosurerequests.mdx +++ b/docs/opengraph/extensions/github/edges/gh_orgbypasssecretscanningclosurerequests.mdx @@ -1,24 +1,14 @@ ---- -title: 'GH_OrgBypassSecretScanningClosureRequests' -description: '[Organization] Org role can bypass secret scanning closure requests' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) -- Destination: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_OrgBypassSecretScanningClosureRequests' +description: '[Organization] Org role can bypass secret scanning closure requests' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_OrgBypassSecretScanningClosureRequests edge represents that a role can bypass secret scanning closure requests at the organization level. This edge is dynamically generated from custom organization role permissions discovered by the collector. This permission allows closing secret scanning alerts without going through the standard review and approval process, which is significant because an attacker could use it to suppress alerts about leaked credentials and prevent incident response teams from being notified. - - -```mermaid -graph LR - node1("GH_OrgRole SpecterOps\\Owners") - node2("GH_Organization SpecterOps") - node1 -- GH_OrgBypassSecretScanningClosureRequests --> node2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_orgreviewandmanagesecretscanningbypassrequests.mdx b/docs/opengraph/extensions/github/edges/gh_orgreviewandmanagesecretscanningbypassrequests.mdx index 3dbecb84..3c48b8f2 100644 --- a/docs/opengraph/extensions/github/edges/gh_orgreviewandmanagesecretscanningbypassrequests.mdx +++ b/docs/opengraph/extensions/github/edges/gh_orgreviewandmanagesecretscanningbypassrequests.mdx @@ -1,24 +1,14 @@ ---- -title: 'GH_OrgReviewAndManageSecretScanningBypassRequests' -description: '[Organization] Org role can review and manage secret scanning bypass requests' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) -- Destination: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_OrgReviewAndManageSecretScanningBypassRequests' +description: '[Organization] Org role can review and manage secret scanning bypass requests' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_OrgReviewAndManageSecretScanningBypassRequests edge represents that a role can review and manage secret scanning push protection bypass requests at the organization level. This edge is dynamically generated from custom organization role permissions discovered by the collector. Push protection prevents secrets from being committed to repositories, and bypass requests allow developers to override this protection for specific commits. An attacker with this permission could approve their own or an accomplice's bypass requests, allowing secrets to be committed to repositories without triggering push protection blocks. - - -```mermaid -graph LR - node1("GH_OrgRole SpecterOps\\Owners") - node2("GH_Organization SpecterOps") - node1 -- GH_OrgReviewAndManageSecretScanningBypassRequests --> node2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_orgreviewandmanagesecretscanningclosurerequests.mdx b/docs/opengraph/extensions/github/edges/gh_orgreviewandmanagesecretscanningclosurerequests.mdx index 9b062f5c..e1e046f8 100644 --- a/docs/opengraph/extensions/github/edges/gh_orgreviewandmanagesecretscanningclosurerequests.mdx +++ b/docs/opengraph/extensions/github/edges/gh_orgreviewandmanagesecretscanningclosurerequests.mdx @@ -1,24 +1,14 @@ ---- -title: 'GH_OrgReviewAndManageSecretScanningClosureRequests' -description: '[Organization] Org role can review and manage secret scanning closure requests' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) -- Destination: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_OrgReviewAndManageSecretScanningClosureRequests' +description: '[Organization] Org role can review and manage secret scanning closure requests' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_OrgReviewAndManageSecretScanningClosureRequests edge represents that a role can review and manage secret scanning alert closure requests at the organization level. This edge is dynamically generated from custom organization role permissions discovered by the collector. Alert closure requests are part of the workflow for closing secret scanning alerts, and this permission controls who can approve or deny those requests. An attacker with this permission could approve closure requests to suppress alerts about actively leaked credentials, undermining the organization's secret scanning remediation process. - - -```mermaid -graph LR - node1("GH_OrgRole SpecterOps\\Owners") - node2("GH_Organization SpecterOps") - node1 -- GH_OrgReviewAndManageSecretScanningClosureRequests --> node2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_owns.mdx b/docs/opengraph/extensions/github/edges/gh_owns.mdx index 94ebfe33..2ee5263c 100644 --- a/docs/opengraph/extensions/github/edges/gh_owns.mdx +++ b/docs/opengraph/extensions/github/edges/gh_owns.mdx @@ -1,28 +1,14 @@ ---- -title: 'GH_Owns' -description: 'Organization owns a repository' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ✅ - -## General Information - +--- +title: 'GH_Owns' +description: 'Organization owns a repository' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + The traversable GH_Owns edge represents that an organization owns a repository. This edge establishes the foundation of the access control model by linking repositories to their owning organization. It is traversable because repository ownership is a critical relationship for understanding how organizational permissions cascade down to repository-level access, making it essential for attack path analysis. - - -```mermaid -graph LR - node1("GH_Organization SpecterOps") - node2("GH_Repository GitHound") - node3("GH_Repository BloodHound") - node4("GH_Repository Nemesis") - node1 -- GH_Owns --> node2 - node1 -- GH_Owns --> node3 - node1 -- GH_Owns --> node4 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_protectedby.mdx b/docs/opengraph/extensions/github/edges/gh_protectedby.mdx index 2a032e43..c7e9f407 100644 --- a/docs/opengraph/extensions/github/edges/gh_protectedby.mdx +++ b/docs/opengraph/extensions/github/edges/gh_protectedby.mdx @@ -1,30 +1,14 @@ ---- -title: 'GH_ProtectedBy' -description: 'Branch protection rule protects this branch' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_BranchProtectionRule](/opengraph/extensions/github/nodes/gh_branchprotectionrule) -- Destination: [GH_Branch](/opengraph/extensions/github/nodes/gh_branch) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ProtectedBy' +description: 'Branch protection rule protects this branch' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ProtectedBy edge represents that a branch protection rule applies to a specific branch. This edge links protection rules to the branches they govern. Understanding which protections apply to a branch is critical for determining the effective access model — protections such as required reviews, status checks, and push restrictions directly impact who can modify a branch. This edge is consumed by the computed branch-access edges to determine effective push access; the computed [GH_CanWriteBranch](/opengraph/extensions/github/edges/gh_canwritebranch) and [GH_CanEditProtection](/opengraph/extensions/github/edges/gh_caneditprotection) edges carry traversability instead. - - -```mermaid -graph LR - node1("GH_Repository GitHound") - node2("GH_Branch main") - node3("GH_BranchProtectionRule main-protection") - node4("GH_Branch develop") - node5("GH_BranchProtectionRule develop-protection") - node1 -- GH_HasBranch --> node2 - node1 -- GH_HasBranch --> node4 - node3 -- GH_ProtectedBy --> node2 - node5 -- GH_ProtectedBy --> node4 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_pushprotectedbranch.mdx b/docs/opengraph/extensions/github/edges/gh_pushprotectedbranch.mdx index 3d1c5044..f6a441e6 100644 --- a/docs/opengraph/extensions/github/edges/gh_pushprotectedbranch.mdx +++ b/docs/opengraph/extensions/github/edges/gh_pushprotectedbranch.mdx @@ -1,28 +1,14 @@ ---- -title: 'GH_PushProtectedBranch' -description: '[Repository] Repo role can push to branches with push restrictions. Not affected by enforce_admins.' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_PushProtectedBranch' +description: '[Repository] Repo role can push to branches with push restrictions. Not affected by enforce_admins.' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_PushProtectedBranch edge represents a role's ability to push directly to branches that are protected by push restrictions. This permission is available to Admin and Maintain roles. This edge bypasses the push gate of branch protection, allowing direct commits to protected branches without going through the pull request workflow. Unlike merge gate bypasses (such as [GH_BypassBranchProtection](/opengraph/extensions/github/edges/gh_bypassbranchprotection)), this push gate bypass is NOT suppressed by the `enforce_admins` setting on the branch protection rule, making it a particularly potent permission. - - -```mermaid -graph LR - user1("GH_User bob") - maintainRole("GH_RepoRole GitHound\maintain") - adminRole("GH_RepoRole GitHound\admin") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> maintainRole - maintainRole -- GH_PushProtectedBranch --> repo - adminRole -- GH_PushProtectedBranch --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_readcodescanning.mdx b/docs/opengraph/extensions/github/edges/gh_readcodescanning.mdx index 3beef118..0fb366a6 100644 --- a/docs/opengraph/extensions/github/edges/gh_readcodescanning.mdx +++ b/docs/opengraph/extensions/github/edges/gh_readcodescanning.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_ReadCodeScanning' -description: '[Repository] Repo role can read code scanning results' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ReadCodeScanning' +description: '[Repository] Repo role can read code scanning results' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ReadCodeScanning edge represents a role's ability to read code scanning analysis results and alerts. This permission is available to Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. Code scanning alerts may reveal exploitable vulnerabilities in the codebase. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\write") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_ReadCodeScanning --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_readorganizationactionsusagemetrics.mdx b/docs/opengraph/extensions/github/edges/gh_readorganizationactionsusagemetrics.mdx index 7f239fbe..2c5d5a64 100644 --- a/docs/opengraph/extensions/github/edges/gh_readorganizationactionsusagemetrics.mdx +++ b/docs/opengraph/extensions/github/edges/gh_readorganizationactionsusagemetrics.mdx @@ -1,24 +1,14 @@ ---- -title: 'GH_ReadOrganizationActionsUsageMetrics' -description: '[Organization] Org role can read Actions usage metrics' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) -- Destination: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ReadOrganizationActionsUsageMetrics' +description: '[Organization] Org role can read Actions usage metrics' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ReadOrganizationActionsUsageMetrics edge represents that a role can read GitHub Actions usage metrics for the organization. This edge is dynamically generated from custom organization role permissions discovered by the collector. Usage metrics provide visibility into workflow execution patterns, runner utilization, and billing data across the organization. While this is primarily an informational permission, it can reveal which repositories have active CI/CD pipelines and the scale of automation in use. - - -```mermaid -graph LR - node1("GH_OrgRole SpecterOps\\Owners") - node2("GH_Organization SpecterOps") - node1 -- GH_ReadOrganizationActionsUsageMetrics --> node2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_readorganizationcustomorgrole.mdx b/docs/opengraph/extensions/github/edges/gh_readorganizationcustomorgrole.mdx index 5ad3608a..3fd33b9e 100644 --- a/docs/opengraph/extensions/github/edges/gh_readorganizationcustomorgrole.mdx +++ b/docs/opengraph/extensions/github/edges/gh_readorganizationcustomorgrole.mdx @@ -1,24 +1,14 @@ ---- -title: 'GH_ReadOrganizationCustomOrgRole' -description: '[Organization] Org role can read custom org role definitions' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) -- Destination: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ReadOrganizationCustomOrgRole' +description: '[Organization] Org role can read custom org role definitions' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ReadOrganizationCustomOrgRole edge represents that a role can read custom organization role definitions. This edge is dynamically generated from custom organization role permissions discovered by the collector. Reading custom org role definitions allows a user to enumerate the permissions granted to each custom role, which provides reconnaissance value for understanding the organization's access control model and identifying roles with elevated privileges. - - -```mermaid -graph LR - node1("GH_OrgRole SpecterOps\\Owners") - node2("GH_Organization SpecterOps") - node1 -- GH_ReadOrganizationCustomOrgRole --> node2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_readorganizationcustomreporole.mdx b/docs/opengraph/extensions/github/edges/gh_readorganizationcustomreporole.mdx index 986e568f..afaceed0 100644 --- a/docs/opengraph/extensions/github/edges/gh_readorganizationcustomreporole.mdx +++ b/docs/opengraph/extensions/github/edges/gh_readorganizationcustomreporole.mdx @@ -1,24 +1,14 @@ ---- -title: 'GH_ReadOrganizationCustomRepoRole' -description: '[Organization] Org role can read custom repo role definitions' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) -- Destination: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ReadOrganizationCustomRepoRole' +description: '[Organization] Org role can read custom repo role definitions' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ReadOrganizationCustomRepoRole edge represents that a role can read custom repository role definitions. This edge is dynamically generated from custom organization role permissions discovered by the collector. Reading custom repo role definitions allows a user to enumerate the permissions granted to each custom repository role, which provides reconnaissance value for understanding repository-level access controls and identifying roles that grant elevated repository permissions. - - -```mermaid -graph LR - node1("GH_OrgRole SpecterOps\\Owners") - node2("GH_Organization SpecterOps") - node1 -- GH_ReadOrganizationCustomRepoRole --> node2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_readrepocontents.mdx b/docs/opengraph/extensions/github/edges/gh_readrepocontents.mdx index 7c6def92..62b3f52a 100644 --- a/docs/opengraph/extensions/github/edges/gh_readrepocontents.mdx +++ b/docs/opengraph/extensions/github/edges/gh_readrepocontents.mdx @@ -1,30 +1,14 @@ ---- -title: 'GH_ReadRepoContents' -description: '[Repository] Repo role can read repository contents' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ReadRepoContents' +description: '[Repository] Repo role can read repository contents' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ReadRepoContents edge represents a role's ability to read repository contents including source code, issues, and pull requests. This is the base level of repository access, available to all roles at the Read permission level and above (Read, Triage, Write, Maintain, Admin). - - -```mermaid -graph LR - user1("GH_User alice") - readRole("GH_RepoRole GitHound\read") - writeRole("GH_RepoRole GitHound\write") - adminRole("GH_RepoRole GitHound\admin") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> readRole - readRole -- GH_ReadRepoContents -.-> repo - writeRole -- GH_ReadRepoContents -.-> repo - adminRole -- GH_ReadRepoContents -.> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_removeassignee.mdx b/docs/opengraph/extensions/github/edges/gh_removeassignee.mdx index a46dbb3e..ea0dbec3 100644 --- a/docs/opengraph/extensions/github/edges/gh_removeassignee.mdx +++ b/docs/opengraph/extensions/github/edges/gh_removeassignee.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_RemoveAssignee' -description: '[Repository] Repo role can remove assignees from issues and pull requests' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_RemoveAssignee' +description: '[Repository] Repo role can remove assignees from issues and pull requests' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_RemoveAssignee edge represents a role's ability to remove assignees from issues and pull requests. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\triage") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_RemoveAssignee --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_removelabel.mdx b/docs/opengraph/extensions/github/edges/gh_removelabel.mdx index 75c37c44..4991b256 100644 --- a/docs/opengraph/extensions/github/edges/gh_removelabel.mdx +++ b/docs/opengraph/extensions/github/edges/gh_removelabel.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_RemoveLabel' -description: '[Repository] Repo role can remove labels from issues and pull requests' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_RemoveLabel' +description: '[Repository] Repo role can remove labels from issues and pull requests' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_RemoveLabel edge represents a role's ability to remove labels from issues and pull requests. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\triage") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_RemoveLabel --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_reopendiscussion.mdx b/docs/opengraph/extensions/github/edges/gh_reopendiscussion.mdx index d05f84fe..b4e706bd 100644 --- a/docs/opengraph/extensions/github/edges/gh_reopendiscussion.mdx +++ b/docs/opengraph/extensions/github/edges/gh_reopendiscussion.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_ReopenDiscussion' -description: '[Repository] Repo role can reopen discussions' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ReopenDiscussion' +description: '[Repository] Repo role can reopen discussions' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ReopenDiscussion edge represents a role's ability to reopen closed discussions to allow further replies. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\triage") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_ReopenDiscussion --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_reopenissue.mdx b/docs/opengraph/extensions/github/edges/gh_reopenissue.mdx index 5a0863bc..68d49633 100644 --- a/docs/opengraph/extensions/github/edges/gh_reopenissue.mdx +++ b/docs/opengraph/extensions/github/edges/gh_reopenissue.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_ReopenIssue' -description: '[Repository] Repo role can reopen closed issues' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ReopenIssue' +description: '[Repository] Repo role can reopen closed issues' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ReopenIssue edge represents a role's ability to reopen closed issues. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\triage") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_ReopenIssue --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_reopenpullrequest.mdx b/docs/opengraph/extensions/github/edges/gh_reopenpullrequest.mdx index 51897d7d..08622922 100644 --- a/docs/opengraph/extensions/github/edges/gh_reopenpullrequest.mdx +++ b/docs/opengraph/extensions/github/edges/gh_reopenpullrequest.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_ReopenPullRequest' -description: '[Repository] Repo role can reopen closed pull requests' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ReopenPullRequest' +description: '[Repository] Repo role can reopen closed pull requests' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ReopenPullRequest edge represents a role's ability to reopen closed pull requests. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\triage") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_ReopenPullRequest --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_requestprreview.mdx b/docs/opengraph/extensions/github/edges/gh_requestprreview.mdx index 3b8791ae..77dfe7cd 100644 --- a/docs/opengraph/extensions/github/edges/gh_requestprreview.mdx +++ b/docs/opengraph/extensions/github/edges/gh_requestprreview.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_RequestPrReview' -description: '[Repository] Repo role can request pull request reviews' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_RequestPrReview' +description: '[Repository] Repo role can request pull request reviews' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_RequestPrReview edge represents a role's ability to request pull request reviews from specific users or teams. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\triage") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_RequestPrReview --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_resolvedependabotalerts.mdx b/docs/opengraph/extensions/github/edges/gh_resolvedependabotalerts.mdx index 4464e81c..ea008a8e 100644 --- a/docs/opengraph/extensions/github/edges/gh_resolvedependabotalerts.mdx +++ b/docs/opengraph/extensions/github/edges/gh_resolvedependabotalerts.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_ResolveDependabotAlerts' -description: '[Repository] Repo role can resolve Dependabot alerts' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ResolveDependabotAlerts' +description: '[Repository] Repo role can resolve Dependabot alerts' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ResolveDependabotAlerts edge represents a role's ability to dismiss or resolve Dependabot alerts. This permission is available to Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. An attacker could dismiss valid alerts to suppress vulnerability warnings and prevent remediation. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\write") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_ResolveDependabotAlerts --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_resolvesecretscanningalerts.mdx b/docs/opengraph/extensions/github/edges/gh_resolvesecretscanningalerts.mdx index de63fbcf..8acbc3fb 100644 --- a/docs/opengraph/extensions/github/edges/gh_resolvesecretscanningalerts.mdx +++ b/docs/opengraph/extensions/github/edges/gh_resolvesecretscanningalerts.mdx @@ -1,24 +1,14 @@ ---- -title: 'GH_ResolveSecretScanningAlerts' -description: '[Organization] Org role can resolve secret scanning alerts' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) -- Destination: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ResolveSecretScanningAlerts' +description: '[Organization] Org role can resolve secret scanning alerts' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ResolveSecretScanningAlerts edge represents that a role can resolve (close) secret scanning alerts at the organization level. This edge is dynamically generated from custom organization role permissions discovered by the collector. Resolving a secret scanning alert marks a leaked secret as addressed, which removes it from active monitoring dashboards. An attacker with this permission could suppress alerts about leaked credentials to prevent incident response teams from detecting and rotating compromised secrets. - - -```mermaid -graph LR - node1("GH_OrgRole SpecterOps\\Owners") - node2("GH_Organization SpecterOps") - node1 -- GH_ResolveSecretScanningAlerts --> node2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_restrictionscanpush.mdx b/docs/opengraph/extensions/github/edges/gh_restrictionscanpush.mdx index 7a1e89bc..232acecd 100644 --- a/docs/opengraph/extensions/github/edges/gh_restrictionscanpush.mdx +++ b/docs/opengraph/extensions/github/edges/gh_restrictionscanpush.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_RestrictionsCanPush' -description: 'User or team is allowed to push to branches protected by this rule' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_User](/opengraph/extensions/github/nodes/gh_user), [GH_Team](/opengraph/extensions/github/nodes/gh_team) -- Destination: [GH_BranchProtectionRule](/opengraph/extensions/github/nodes/gh_branchprotectionrule) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_RestrictionsCanPush' +description: 'User or team is allowed to push to branches protected by this rule' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_RestrictionsCanPush edge represents a per-actor allowance that grants push access through push restrictions on a branch protection rule. This edge identifies specific users or teams that are permitted to push to the protected branch even when push restrictions are active. This is security-relevant because push restrictions limit who can directly push to a branch, and actors with this allowance bypass that control. Unlike [GH_BypassPullRequestAllowances](/opengraph/extensions/github/edges/gh_bypasspullrequestallowances), this allowance is NOT suppressed by `enforce_admins` — listed actors retain push access regardless of admin enforcement settings. - - -```mermaid -graph LR - user1("GH_User deploy-bot") - team1("GH_Team platform-eng") - bpr1("GH_BranchProtectionRule release/*") - user1 -- GH_RestrictionsCanPush --> bpr1 - team1 -- GH_RestrictionsCanPush --> bpr1 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_runorgmigration.mdx b/docs/opengraph/extensions/github/edges/gh_runorgmigration.mdx index 3e688895..110e1d1e 100644 --- a/docs/opengraph/extensions/github/edges/gh_runorgmigration.mdx +++ b/docs/opengraph/extensions/github/edges/gh_runorgmigration.mdx @@ -1,28 +1,14 @@ ---- -title: 'GH_RunOrgMigration' -description: '[Repository] Repo role can run organization migrations' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_RunOrgMigration' +description: '[Repository] Repo role can run organization migrations' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_RunOrgMigration edge represents a role's ability to run organization migrations on the repository. This permission is available to Admin roles and custom roles that have been granted this specific permission. Organization migrations export repository data including source code, issues, and pull requests, which can be used to transfer repository contents to another organization. This permission is security-relevant because it enables bulk data export from the repository. - - -```mermaid -graph LR - user1("GH_User carol") - adminRole("GH_RepoRole GitHound\admin") - customRole("GH_RepoRole GitHound\migration_operator") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> adminRole - adminRole -- GH_RunOrgMigration --> repo - customRole -- GH_RunOrgMigration --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_setinteractionlimits.mdx b/docs/opengraph/extensions/github/edges/gh_setinteractionlimits.mdx index c351ee7e..7e9c7952 100644 --- a/docs/opengraph/extensions/github/edges/gh_setinteractionlimits.mdx +++ b/docs/opengraph/extensions/github/edges/gh_setinteractionlimits.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_SetInteractionLimits' -description: '[Repository] Repo role can set interaction limits on the repository' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_SetInteractionLimits' +description: '[Repository] Repo role can set interaction limits on the repository' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_SetInteractionLimits edge represents a role's ability to set temporary interaction limits to restrict who can comment, open issues, or create pull requests. This permission is available to Maintain and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\maintain") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_SetInteractionLimits --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_setissuetype.mdx b/docs/opengraph/extensions/github/edges/gh_setissuetype.mdx index c8387903..fde251d6 100644 --- a/docs/opengraph/extensions/github/edges/gh_setissuetype.mdx +++ b/docs/opengraph/extensions/github/edges/gh_setissuetype.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_SetIssueType' -description: '[Repository] Repo role can set issue types' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_SetIssueType' +description: '[Repository] Repo role can set issue types' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_SetIssueType edge represents a role's ability to set issue types. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\triage") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_SetIssueType --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_setmilestone.mdx b/docs/opengraph/extensions/github/edges/gh_setmilestone.mdx index e92747f6..fa421bb1 100644 --- a/docs/opengraph/extensions/github/edges/gh_setmilestone.mdx +++ b/docs/opengraph/extensions/github/edges/gh_setmilestone.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_SetMilestone' -description: '[Repository] Repo role can set milestones on issues and pull requests' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_SetMilestone' +description: '[Repository] Repo role can set milestones on issues and pull requests' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_SetMilestone edge represents a role's ability to set milestones on issues and pull requests. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\triage") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_SetMilestone --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_setsocialpreview.mdx b/docs/opengraph/extensions/github/edges/gh_setsocialpreview.mdx index ad3200be..54eb6b3c 100644 --- a/docs/opengraph/extensions/github/edges/gh_setsocialpreview.mdx +++ b/docs/opengraph/extensions/github/edges/gh_setsocialpreview.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_SetSocialPreview' -description: '[Repository] Repo role can set the repository social preview image' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_SetSocialPreview' +description: '[Repository] Repo role can set the repository social preview image' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_SetSocialPreview edge represents a role's ability to set the repository social preview image shown in link previews. This permission is available to Maintain and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\maintain") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_SetSocialPreview --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_syncedto.mdx b/docs/opengraph/extensions/github/edges/gh_syncedto.mdx index 7f2c0f56..b1d37adf 100644 --- a/docs/opengraph/extensions/github/edges/gh_syncedto.mdx +++ b/docs/opengraph/extensions/github/edges/gh_syncedto.mdx @@ -1,27 +1,14 @@ ---- -title: 'GH_SyncedTo' -description: 'External identity (Azure, Okta, PingOne) is synced to this GitHub user via SSO/SCIM' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [AZUser](/resources/nodes/az-user), [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [PingOneUser](https://github.com/andyrobbins/PingOneHound?tab=readme-ov-file#schema) -- Destination: [GH_User](/opengraph/extensions/github/nodes/gh_user) -- Traversable: ✅ - -## General Information - +--- +title: 'GH_SyncedTo' +description: 'External identity (Azure, Okta, PingOne) is synced to this GitHub user via SSO/SCIM' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + The traversable GH_SyncedTo edge is a hybrid edge that maps an external IdP user to a GitHub user based on SCIM provisioning. This edge represents a confirmed identity linkage between an external identity provider and GitHub. It is traversable because compromising the IdP account provides a verified path to the corresponding GitHub account, making it a critical edge for cross-system attack path analysis. This edge enables analysts to trace access from enterprise identity providers like Azure AD, Okta, or PingOne into the GitHub environment. - - -```mermaid -graph LR - azUser("AZUser alice\@specterops.io") - oktaUser("Okta_User bob\@specterops.io") - ghUser1("GH_User alice") - ghUser2("GH_User bob") - azUser -- GH_SyncedTo --> ghUser1 - oktaUser -- GH_SyncedTo --> ghUser2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_togglediscussionanswer.mdx b/docs/opengraph/extensions/github/edges/gh_togglediscussionanswer.mdx index 9379e9d4..f6524cdb 100644 --- a/docs/opengraph/extensions/github/edges/gh_togglediscussionanswer.mdx +++ b/docs/opengraph/extensions/github/edges/gh_togglediscussionanswer.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_ToggleDiscussionAnswer' -description: '[Repository] Repo role can toggle discussion answers' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ToggleDiscussionAnswer' +description: '[Repository] Repo role can toggle discussion answers' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ToggleDiscussionAnswer edge represents a role's ability to mark or unmark a discussion comment as the accepted answer. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\triage") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_ToggleDiscussionAnswer --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_togglediscussioncommentminimize.mdx b/docs/opengraph/extensions/github/edges/gh_togglediscussioncommentminimize.mdx index ae44dc7f..c98b9d08 100644 --- a/docs/opengraph/extensions/github/edges/gh_togglediscussioncommentminimize.mdx +++ b/docs/opengraph/extensions/github/edges/gh_togglediscussioncommentminimize.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_ToggleDiscussionCommentMinimize' -description: '[Repository] Repo role can minimize discussion comments' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ToggleDiscussionCommentMinimize' +description: '[Repository] Repo role can minimize discussion comments' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ToggleDiscussionCommentMinimize edge represents a role's ability to minimize or restore discussion comments, hiding them from default view. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\triage") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_ToggleDiscussionCommentMinimize --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_transferrepository.mdx b/docs/opengraph/extensions/github/edges/gh_transferrepository.mdx index db20094c..838f292e 100644 --- a/docs/opengraph/extensions/github/edges/gh_transferrepository.mdx +++ b/docs/opengraph/extensions/github/edges/gh_transferrepository.mdx @@ -1,24 +1,14 @@ ---- -title: 'GH_TransferRepository' -description: '[Organization] Org role can transfer repositories' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) -- Destination: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_TransferRepository' +description: '[Organization] Org role can transfer repositories' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_TransferRepository edge represents that a role has the ability to transfer repositories to or from the organization. This permission is typically restricted to Owners, as transferring a repository can move it outside of the organization's security controls, branch protection rules, and audit logging. An attacker with this permission could transfer a repository to an organization they control, effectively exfiltrating the codebase and its associated secrets. - - -```mermaid -graph LR - node1("GH_OrgRole SpecterOps\\Owners") - node2("GH_Organization SpecterOps") - node1 -- GH_TransferRepository --> node2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_usessecret.mdx b/docs/opengraph/extensions/github/edges/gh_usessecret.mdx index f77969fb..7d8107b8 100644 --- a/docs/opengraph/extensions/github/edges/gh_usessecret.mdx +++ b/docs/opengraph/extensions/github/edges/gh_usessecret.mdx @@ -1,33 +1,31 @@ ---- -title: 'GH_UsesSecret' -description: '[Workflow] Step references a secret by name — GH_WorkflowStep → GH_RepoSecret / GH_OrgSecret (name match)' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_WorkflowStep](/opengraph/extensions/github/nodes/gh_workflowstep) -- Destination: [GH_RepoSecret](/opengraph/extensions/github/nodes/gh_reposecret), [GH_OrgSecret](/opengraph/extensions/github/nodes/gh_orgsecret) -- Traversable: ❌ - -## General Information - -The traversable GH_UsesSecret edge links a workflow step to the secret it references via a `${{ secrets.NAME }}` expression. This edge reveals which secrets a step can access at runtime, enabling analysts to trace the blast radius of a compromised workflow. - -### Matching strategy - -Edges use `match_by: property` with two matchers to disambiguate between secrets with the same name across repositories: - -- **[GH_RepoSecret](/opengraph/extensions/github/nodes/gh_reposecret)** is matched by `name` + `repository_id`. -- **[GH_OrgSecret](/opengraph/extensions/github/nodes/gh_orgsecret)** is matched by `name` + `environmentid`. - -This means one `${{ secrets.MY_SECRET }}` expression in a workflow can produce up to two GH_UsesSecret edges. - -### Context property - -The edge carries a `context` property indicating where the reference was found: - -- `with` — inside a `with:` input block of a `uses:` action step -- `env` — inside the step's `env:` block +--- +title: 'GH_UsesSecret' +description: '[Workflow] Job or step references a secret by name — GH_WorkflowJob / GH_WorkflowStep → GH_RepoSecret / GH_OrgSecret / GH_EnvironmentSecret (scope match)' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +The non-traversable GH_UsesSecret edge links a workflow job or step to the secret it references via a `${{ secrets.NAME }}` expression. This edge reveals which secrets a workflow component can access at runtime, enabling analysts to trace the blast radius of a compromised workflow. + +### Matching strategy + +Edges use `match_by: property` with scope-specific matchers to disambiguate between secrets with the same name across repositories and environments: + +- **[GH_RepoSecret](/opengraph/extensions/github/nodes/gh_reposecret)** is matched by `name` + `repository_id` (the GitHub node_id of the repository). +- **[GH_OrgSecret](/opengraph/extensions/github/nodes/gh_orgsecret)** is matched by `name` + `environmentid` (the node_id of the organization, which acts as the org-level secret scope). +- **[GH_EnvironmentSecret](/opengraph/extensions/github/nodes/gh_environmentsecret)** is matched by `name` + `deployment_environment_name` + `repository_id` when the parent job targets a concrete environment name. + +This means one `${{ secrets.MY_SECRET }}` expression in a workflow can produce edges to repo-level, org-level, and environment-level secrets that share the same name in the applicable scopes. The environment-level edge is only emitted when the workflow job references a literal environment name rather than a dynamic expression. + +### Context property + +The edge carries a `context` property indicating where the reference was found: +- `with` — inside a `with:` input block of a `uses:` action step +- `env` — inside the step's `env:` block - `run` — inline within a `run:` shell script diff --git a/docs/opengraph/extensions/github/edges/gh_usesvariable.mdx b/docs/opengraph/extensions/github/edges/gh_usesvariable.mdx index 30e278c7..907d72ed 100644 --- a/docs/opengraph/extensions/github/edges/gh_usesvariable.mdx +++ b/docs/opengraph/extensions/github/edges/gh_usesvariable.mdx @@ -1,33 +1,31 @@ ---- -title: 'GH_UsesVariable' -description: '[Workflow] Step references a variable by name — GH_WorkflowStep → GH_RepoVariable / GH_OrgVariable (name match)' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_WorkflowStep](/opengraph/extensions/github/nodes/gh_workflowstep) -- Destination: [GH_RepoVariable](/opengraph/extensions/github/nodes/gh_repovariable), [GH_OrgVariable](/opengraph/extensions/github/nodes/gh_orgvariable) -- Traversable: ❌ - -## General Information - -The non-traversable GH_UsesVariable edge links a workflow step to the variable it references via a `${{ vars.NAME }}` expression. This edge maps variable consumption within workflows. Unlike secrets, variable values are readable via the API, making them lower sensitivity, but they can still influence workflow behavior. - -### Matching strategy - -Edges use `match_by: property` with two matchers to disambiguate between variables with the same name across repositories: - -- **[GH_RepoVariable](/opengraph/extensions/github/nodes/gh_repovariable)** is matched by `name` + `repository_id`. -- **[GH_OrgVariable](/opengraph/extensions/github/nodes/gh_orgvariable)** is matched by `name` + `environmentid`. - -This means one `${{ vars.MY_VAR }}` expression can produce up to two GH_UsesVariable edges. - -### Context property - -The edge carries a `context` property indicating where the reference was found: - -- `with` — inside a `with:` input block of a `uses:` action step -- `env` — inside the step's `env:` block +--- +title: 'GH_UsesVariable' +description: '[Workflow] Job or step references a variable by name — GH_WorkflowJob / GH_WorkflowStep → GH_RepoVariable / GH_OrgVariable / GH_EnvironmentVariable (scope match)' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + +The non-traversable GH_UsesVariable edge links a workflow job or step to the variable it references via a `${{ vars.NAME }}` expression. This edge maps variable consumption within workflows. Unlike secrets, variable values are readable via the API, making them lower sensitivity — but they can still influence workflow behavior (e.g., controlling target environments or feature flags). + +### Matching strategy + +Edges use `match_by: property` with scope-specific matchers to disambiguate between variables with the same name across repositories and environments: + +- **[GH_RepoVariable](/opengraph/extensions/github/nodes/gh_repovariable)** is matched by `name` + `repository_id` (the GitHub node_id of the repository). +- **[GH_OrgVariable](/opengraph/extensions/github/nodes/gh_orgvariable)** is matched by `name` + `environmentid` (the node_id of the organization, which acts as the org-level variable scope). +- **[GH_EnvironmentVariable](/opengraph/extensions/github/nodes/gh_environmentvariable)** is matched by `name` + `deployment_environment_name` + `repository_id` when the parent job targets a concrete environment name. + +This means one `${{ vars.MY_VAR }}` expression can produce edges to repo-level, org-level, and environment-level variables that share the same name in the applicable scopes. The environment-level edge is only emitted when the workflow job references a literal environment name rather than a dynamic expression. + +### Context property + +The edge carries a `context` property indicating where the reference was found: +- `with` — inside a `with:` input block of a `uses:` action step +- `env` — inside the step's `env:` block - `run` — inline within a `run:` shell script diff --git a/docs/opengraph/extensions/github/edges/gh_validtoken.mdx b/docs/opengraph/extensions/github/edges/gh_validtoken.mdx index 839f822e..7d17360c 100644 --- a/docs/opengraph/extensions/github/edges/gh_validtoken.mdx +++ b/docs/opengraph/extensions/github/edges/gh_validtoken.mdx @@ -1,24 +1,14 @@ ---- -title: 'GH_ValidToken' -description: 'Secret scanning alert contains a valid, active token belonging to this user' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_SecretScanningAlert](/opengraph/extensions/github/nodes/gh_secretscanningalert) -- Destination: [GH_User](/opengraph/extensions/github/nodes/gh_user) -- Traversable: ✅ - -## General Information - +--- +title: 'GH_ValidToken' +description: 'Secret scanning alert contains a valid, active token belonging to this user' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + The traversable GH_ValidToken edge represents a secret scanning alert that contains a valid, active GitHub Personal Access Token belonging to a specific user. This edge is only emitted when the alert's state is `open`, the secret type is `github_personal_access_token`, and the token is confirmed valid by calling the GitHub API. This edge is traversable because possessing the leaked token grants the ability to act as the token's owner, effectively compromising that user's identity and all permissions granted to the token. - - -```mermaid -graph LR - node1("GH_SecretScanningAlert #42") - node2("GH_User jdoe") - node1 -- GH_ValidToken --> node2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_viewdependabotalerts.mdx b/docs/opengraph/extensions/github/edges/gh_viewdependabotalerts.mdx index 09090652..0c6b6c3b 100644 --- a/docs/opengraph/extensions/github/edges/gh_viewdependabotalerts.mdx +++ b/docs/opengraph/extensions/github/edges/gh_viewdependabotalerts.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_ViewDependabotAlerts' -description: '[Repository] Repo role can view Dependabot alerts' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ViewDependabotAlerts' +description: '[Repository] Repo role can view Dependabot alerts' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ViewDependabotAlerts edge represents a role's ability to view Dependabot security alerts, which reveal known vulnerabilities in the repository's dependencies. This permission is available to Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. This information could be used to identify and exploit unpatched vulnerabilities. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\write") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_ViewDependabotAlerts --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_viewsecretscanningalerts.mdx b/docs/opengraph/extensions/github/edges/gh_viewsecretscanningalerts.mdx index 78f1ca61..978cdcb9 100644 --- a/docs/opengraph/extensions/github/edges/gh_viewsecretscanningalerts.mdx +++ b/docs/opengraph/extensions/github/edges/gh_viewsecretscanningalerts.mdx @@ -1,27 +1,14 @@ ---- -title: 'GH_ViewSecretScanningAlerts' -description: '[Repository] Role can view secret scanning alerts' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole), [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization), [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_ViewSecretScanningAlerts' +description: '[Repository] Role can view secret scanning alerts' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_ViewSecretScanningAlerts edge represents that a role can view secret scanning alerts at the organization or repository level. This edge is dynamically generated from custom role permissions discovered by the collector. Secret scanning alerts may reveal details about leaked credentials, including partial or full secret values and the locations where they were detected. This makes the permission significant for security because an attacker with access to view these alerts could harvest exposed credentials for use in lateral movement or privilege escalation. - - -```mermaid -graph LR - node1("GH_OrgRole SpecterOps\\Owners") - node2("GH_Organization SpecterOps") - node3("GH_RepoRole GitHound\\write") - node4("GH_Repository GitHound") - node1 -- GH_ViewSecretScanningAlerts --> node2 - node3 -- GH_ViewSecretScanningAlerts --> node4 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_writecodescanning.mdx b/docs/opengraph/extensions/github/edges/gh_writecodescanning.mdx index 708bd3a5..fb661213 100644 --- a/docs/opengraph/extensions/github/edges/gh_writecodescanning.mdx +++ b/docs/opengraph/extensions/github/edges/gh_writecodescanning.mdx @@ -1,26 +1,14 @@ ---- -title: 'GH_WriteCodeScanning' -description: '[Repository] Repo role can upload code scanning results' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_WriteCodeScanning' +description: '[Repository] Repo role can upload code scanning results' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_WriteCodeScanning edge represents a role's ability to upload code scanning analysis results. This permission is available to Write, Maintain, and Admin roles and custom roles that have been granted this specific permission. An attacker could upload falsified SARIF results to suppress real alerts or inject misleading findings. - - -```mermaid -graph LR - user1("GH_User alice") - role("GH_RepoRole GitHound\\write") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> role - role -- GH_WriteCodeScanning --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_writeorganizationactionssecrets.mdx b/docs/opengraph/extensions/github/edges/gh_writeorganizationactionssecrets.mdx index 19f4176a..b0d13649 100644 --- a/docs/opengraph/extensions/github/edges/gh_writeorganizationactionssecrets.mdx +++ b/docs/opengraph/extensions/github/edges/gh_writeorganizationactionssecrets.mdx @@ -1,24 +1,14 @@ ---- -title: 'GH_WriteOrganizationActionsSecrets' -description: '[Organization] Org role can write Actions secrets' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) -- Destination: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_WriteOrganizationActionsSecrets' +description: '[Organization] Org role can write Actions secrets' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_WriteOrganizationActionsSecrets edge represents that a role can write organization-level GitHub Actions secrets. This edge is dynamically generated from custom organization role permissions discovered by the collector. Organization-level secrets are available to workflows across multiple repositories and often contain credentials for external systems such as cloud providers, package registries, and deployment targets. An attacker with this permission could overwrite existing secrets to inject malicious credentials or create new secrets to facilitate lateral movement. - - -```mermaid -graph LR - node1("GH_OrgRole SpecterOps\\Owners") - node2("GH_Organization SpecterOps") - node1 -- GH_WriteOrganizationActionsSecrets --> node2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_writeorganizationactionssettings.mdx b/docs/opengraph/extensions/github/edges/gh_writeorganizationactionssettings.mdx index 590154ba..3908cede 100644 --- a/docs/opengraph/extensions/github/edges/gh_writeorganizationactionssettings.mdx +++ b/docs/opengraph/extensions/github/edges/gh_writeorganizationactionssettings.mdx @@ -1,24 +1,14 @@ ---- -title: 'GH_WriteOrganizationActionsSettings' -description: '[Organization] Org role can write Actions settings' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) -- Destination: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_WriteOrganizationActionsSettings' +description: '[Organization] Org role can write Actions settings' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_WriteOrganizationActionsSettings edge represents that a role can modify organization-level GitHub Actions settings. This edge is dynamically generated from custom organization role permissions discovered by the collector. These settings control which actions are allowed to run within the organization and the default permissions granted to the `GITHUB_TOKEN` in workflows. An attacker with this permission could weaken restrictions to allow untrusted third-party actions or elevate default token permissions to enable write access across repositories. - - -```mermaid -graph LR - node1("GH_OrgRole SpecterOps\\Owners") - node2("GH_Organization SpecterOps") - node1 -- GH_WriteOrganizationActionsSettings --> node2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_writeorganizationactionsvariables.mdx b/docs/opengraph/extensions/github/edges/gh_writeorganizationactionsvariables.mdx index 85c013ea..8c9ce9bf 100644 --- a/docs/opengraph/extensions/github/edges/gh_writeorganizationactionsvariables.mdx +++ b/docs/opengraph/extensions/github/edges/gh_writeorganizationactionsvariables.mdx @@ -1,24 +1,14 @@ ---- -title: 'GH_WriteOrganizationActionsVariables' -description: '[Organization] Org role can write Actions variables' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) -- Destination: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_WriteOrganizationActionsVariables' +description: '[Organization] Org role can write Actions variables' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_WriteOrganizationActionsVariables edge represents that a role can write organization-level GitHub Actions variables. This edge is dynamically generated from custom organization role permissions discovered by the collector. Organization-level variables are available to workflows across multiple repositories and often contain configuration values such as environment URLs, feature flags, and service endpoints. An attacker with this permission could overwrite existing variables to redirect workflows to malicious endpoints or alter application behavior. - - -```mermaid -graph LR - node1("GH_OrgRole SpecterOps\\Owners") - node2("GH_Organization SpecterOps") - node1 -- GH_WriteOrganizationActionsVariables --> node2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_writeorganizationcustomorgrole.mdx b/docs/opengraph/extensions/github/edges/gh_writeorganizationcustomorgrole.mdx index 3ffcba8d..e001d84d 100644 --- a/docs/opengraph/extensions/github/edges/gh_writeorganizationcustomorgrole.mdx +++ b/docs/opengraph/extensions/github/edges/gh_writeorganizationcustomorgrole.mdx @@ -1,24 +1,14 @@ ---- -title: 'GH_WriteOrganizationCustomOrgRole' -description: '[Organization] Org role can write custom org role definitions' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) -- Destination: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) -- Traversable: ✅ - -## General Information - +--- +title: 'GH_WriteOrganizationCustomOrgRole' +description: '[Organization] Org role can write custom org role definitions' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: true + +## General Information + The traversable GH_WriteOrganizationCustomOrgRole edge represents that a role can create or modify custom organization role definitions. This edge is dynamically generated from custom organization role permissions discovered by the collector. Modifying organization role definitions can escalate privileges because an attacker could add permissions to an existing custom role that is already assigned to their account, including setting the base_role to inherit all_repo_admin. Since this permission can only belong to custom organization roles, the user necessarily holds the role they can modify — guaranteeing a self-escalation path. This makes it a Tier Zero privilege escalation vector. - - -```mermaid -graph LR - node1("GH_OrgRole SpecterOps\\Owners") - node2("GH_Organization SpecterOps") - node1 -- GH_WriteOrganizationCustomOrgRole --> node2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_writeorganizationcustomreporole.mdx b/docs/opengraph/extensions/github/edges/gh_writeorganizationcustomreporole.mdx index 8f53d93a..ad4acb44 100644 --- a/docs/opengraph/extensions/github/edges/gh_writeorganizationcustomreporole.mdx +++ b/docs/opengraph/extensions/github/edges/gh_writeorganizationcustomreporole.mdx @@ -1,24 +1,14 @@ ---- -title: 'GH_WriteOrganizationCustomRepoRole' -description: '[Organization] Org role can write custom repo role definitions' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) -- Destination: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_WriteOrganizationCustomRepoRole' +description: '[Organization] Org role can write custom repo role definitions' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_WriteOrganizationCustomRepoRole edge represents that a role can create or modify custom repository role definitions. This edge is dynamically generated from custom organization role permissions discovered by the collector. Modifying repository role definitions can escalate privileges because an attacker could add permissions such as admin access, bypass branch protections, or secret management to a custom repo role that is already assigned to their account. This makes it a high-impact permission for gaining elevated access to repositories across the organization. - - -```mermaid -graph LR - node1("GH_OrgRole SpecterOps\\Owners") - node2("GH_Organization SpecterOps") - node1 -- GH_WriteOrganizationCustomRepoRole --> node2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_writeorganizationnetworkconfigurations.mdx b/docs/opengraph/extensions/github/edges/gh_writeorganizationnetworkconfigurations.mdx index 1e08ddc5..434d3d97 100644 --- a/docs/opengraph/extensions/github/edges/gh_writeorganizationnetworkconfigurations.mdx +++ b/docs/opengraph/extensions/github/edges/gh_writeorganizationnetworkconfigurations.mdx @@ -1,24 +1,14 @@ ---- -title: 'GH_WriteOrganizationNetworkConfigurations' -description: '[Organization] Org role can write network configurations' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) -- Destination: [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_WriteOrganizationNetworkConfigurations' +description: '[Organization] Org role can write network configurations' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_WriteOrganizationNetworkConfigurations edge represents that a role can modify organization network configurations. This edge is dynamically generated from custom organization role permissions discovered by the collector. Network configurations control how GitHub-hosted runners connect to private resources such as internal APIs, databases, and cloud services. An attacker with this permission could modify network settings to route runner traffic through attacker-controlled infrastructure or grant runners access to previously isolated network segments. - - -```mermaid -graph LR - node1("GH_OrgRole SpecterOps\\Owners") - node2("GH_Organization SpecterOps") - node1 -- GH_WriteOrganizationNetworkConfigurations --> node2 -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_writerepocontents.mdx b/docs/opengraph/extensions/github/edges/gh_writerepocontents.mdx index a7437a95..7d8d28c5 100644 --- a/docs/opengraph/extensions/github/edges/gh_writerepocontents.mdx +++ b/docs/opengraph/extensions/github/edges/gh_writerepocontents.mdx @@ -1,30 +1,14 @@ ---- -title: 'GH_WriteRepoContents' -description: '[Repository] Repo role can write repository contents' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_WriteRepoContents' +description: '[Repository] Repo role can write repository contents' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_WriteRepoContents edge represents a role's ability to push commits to the repository. This permission is available to Write, Maintain, and Admin roles. Pushing code can modify application behavior and introduce vulnerabilities, making this a security-significant edge. However, this edge represents only the raw permission; actual branch push capability is determined by the computed [GH_CanWriteBranch](/opengraph/extensions/github/edges/gh_canwritebranch) edge, which factors in branch protection rules and push restrictions. - - -```mermaid -graph LR - user1("GH_User bob") - writeRole("GH_RepoRole GitHound\write") - maintainRole("GH_RepoRole GitHound\maintain") - adminRole("GH_RepoRole GitHound\admin") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> writeRole - writeRole -- GH_WriteRepoContents --> repo - maintainRole -- GH_WriteRepoContents --> repo - adminRole -- GH_WriteRepoContents --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/edges/gh_writerepopullrequests.mdx b/docs/opengraph/extensions/github/edges/gh_writerepopullrequests.mdx index 2c53c6a8..334297ef 100644 --- a/docs/opengraph/extensions/github/edges/gh_writerepopullrequests.mdx +++ b/docs/opengraph/extensions/github/edges/gh_writerepopullrequests.mdx @@ -1,28 +1,14 @@ ---- -title: 'GH_WriteRepoPullRequests' -description: '[Repository] Repo role can create and merge pull requests' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) -- Destination: [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) -- Traversable: ❌ - -## General Information - +--- +title: 'GH_WriteRepoPullRequests' +description: '[Repository] Repo role can create and merge pull requests' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +Traversable: false + +## General Information + The non-traversable GH_WriteRepoPullRequests edge represents a role's ability to create and merge pull requests in the repository. This permission is available to Write, Maintain, and Admin roles. Pull request merge access is security-significant because merging code into protected branches is a common vector for introducing unauthorized changes; however, actual merge capability on protected branches is further governed by branch protection rules and required reviews. - - -```mermaid -graph LR - user1("GH_User carol") - writeRole("GH_RepoRole GitHound\write") - adminRole("GH_RepoRole GitHound\admin") - repo("GH_Repository GitHound") - user1 -- GH_HasRole --> writeRole - writeRole -- GH_WriteRepoPullRequests --> repo - adminRole -- GH_WriteRepoPullRequests --> repo -``` \ No newline at end of file diff --git a/docs/opengraph/extensions/github/nodes/gh_app.mdx b/docs/opengraph/extensions/github/nodes/gh_app.mdx index 0fb8e662..784c6f43 100644 --- a/docs/opengraph/extensions/github/nodes/gh_app.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_app.mdx @@ -1,64 +1,13 @@ ---- -title: 'GH_App' -description: 'A GitHub App definition representing the registered application. The app owner controls the private key used to generate installation tokens.' -icon: '/images/extensions/github/gh_app.png' ---- - -Applies to BloodHound Enterprise and CE - -Represents a GitHub App definition — the registered application entity. The app owner holds the private key that can generate installation access tokens for **every** [GH_AppInstallation](/opengraph/extensions/github/nodes/gh_appinstallation) of this app. If the private key is compromised, all installations across all organizations are affected. - +--- +title: 'GH_App' +description: 'A GitHub App definition representing the registered application. The app owner controls the private key used to generate installation tokens.' +icon: '/images/extensions/github/gh_app.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + +Represents a GitHub App definition — the registered application entity. The app owner holds the private key that can generate installation access tokens for **every** [GH_AppInstallation](/opengraph/extensions/github/nodes/gh_appinstallation) of this app. If the private key is compromised, all installations across all organizations are affected. + App definitions are retrieved via the public `GET /apps/{app_slug}` endpoint (no authentication required) after discovering unique app slugs from the organization's app installations. - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -No inbound edges are defined by the GitHub extension for this node. - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [GH_InstalledAs](/opengraph/extensions/github/edges/gh_installedas) | [GH_AppInstallation](/opengraph/extensions/github/nodes/gh_appinstallation) | ✅ | - -## Properties - -| Property Name | Data Type | Description | -| ------------------- | --------- | ----------------------------------------------------------------------- | -| objectid | string | Composite identifier: `A_kwHOABLL_s4ABJ8V`. | -| id | integer | The GitHub App's numeric ID. | -| name | string | The display name of the app. | -| slug | string | The app's URL-friendly slug identifier. | -| client_id | string | The app's OAuth client ID. | -| node_id | string | The app's GraphQL node ID. | -| description | string | The app's description. | -| external_url | string | The app's external homepage URL. | -| html_url | string | URL to the app's GitHub page. | -| owner_login | string | The login of the user or organization that owns the app. | -| owner_node_id | string | The node_id of the user or organization that owns the app. | -| owner_type | string | The type of the owner (e.g., `User`, `Organization`). | -| created_at | datetime | When the app was created. | -| updated_at | datetime | When the app was last updated. | -| permissions | string | JSON string of the default permissions the app requests. | -| events | string | JSON string of the default webhook events the app subscribes to. | -| installations_count | integer | The total number of installations of this app across all organizations. | - -## Diagram - -```mermaid -flowchart TD - GH_App[fa:fa-cube GH_App] - GH_AppInstallation[fa:fa-plug GH_AppInstallation] - GH_Repository[fa:fa-box-archive GH_Repository] - GH_Organization[fa:fa-building GH_Organization] - - GH_App -->|GH_InstalledAs| GH_AppInstallation - GH_Organization -.->|GH_Contains| GH_AppInstallation - GH_AppInstallation -.->|GH_CanAccess| GH_Repository - -``` diff --git a/docs/opengraph/extensions/github/nodes/gh_appinstallation.mdx b/docs/opengraph/extensions/github/nodes/gh_appinstallation.mdx index 3266355c..965a6881 100644 --- a/docs/opengraph/extensions/github/nodes/gh_appinstallation.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_appinstallation.mdx @@ -1,68 +1,13 @@ ---- -title: 'GH_AppInstallation' -description: 'A GitHub App installed on the organization with specific permissions and repository access' -icon: '/images/extensions/github/gh_appinstallation.png' ---- - -Applies to BloodHound Enterprise and CE - -Represents a GitHub App installed on an organization. App installations have specific permissions and can be scoped to all repositories or a selection of repositories. The permissions granted to the app are captured as a JSON string in the properties. - +--- +title: 'GH_AppInstallation' +description: 'A GitHub App installed on the organization with specific permissions and repository access' +icon: '/images/extensions/github/gh_appinstallation.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + +Represents a GitHub App installed on an organization. App installations have specific permissions and can be scoped to all repositories or a selection of repositories. The permissions granted to the app are captured as a JSON string in the properties. + Each installation is linked to its parent [GH_App](/opengraph/extensions/github/nodes/gh_app) via a [GH_InstalledAs](/opengraph/extensions/github/edges/gh_installedas) edge. For installations with `repository_selection` set to `all`, [GH_CanAccess](/opengraph/extensions/github/edges/gh_canaccess) edges are created to every repository in the organization. For installations with `repository_selection` set to `selected`, repository-level edges cannot be enumerated with a PAT (requires app installation token authentication). - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [GH_Contains](/opengraph/extensions/github/edges/gh_contains) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization), [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) | ❌ | -| [GH_InstalledAs](/opengraph/extensions/github/edges/gh_installedas) | [GH_App](/opengraph/extensions/github/nodes/gh_app) | ✅ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [GH_CanAccess](/opengraph/extensions/github/edges/gh_canaccess) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | - -## Properties - -| Property Name | Data Type | Description | -| -------------------- | --------- | ----------------------------------------------------------------------------------------------------- | -| objectid | string | Composite identifier: `Iv23liPgjiu18oXLM2q7`. | -| id | integer | The GitHub installation ID. | -| name | string | The app's slug identifier. | -| environment_name | string | The name of the environment (GitHub organization) where the app is installed. | -| environmentid | string | The node_id of the environment (GitHub organization). | -| repositories_url | string | API URL to list repositories accessible to this installation. | -| app_id | integer | The GitHub App's numeric ID (shared across all installations of the same app). | -| app_slug | string | The app's URL-friendly slug identifier. | -| repository_selection | string | Whether the app has access to `all` repositories or `selected` repositories. | -| access_tokens_url | string | API URL to create installation access tokens. | -| target_type | string | The target type of the installation (e.g., `Organization`). | -| description | string | The app's description. | -| html_url | string | URL to the app's GitHub page. | -| created_at | datetime | When the app was installed. | -| updated_at | datetime | When the installation was last updated. | -| suspended_at | datetime | When the installation was suspended, if applicable. | -| permissions | string | JSON string of the permissions granted to the app (e.g., `{"contents": "read", "metadata": "read"}`). | -| events | string | JSON string of the webhook events the app subscribes to. | - -## Diagram - -```mermaid -flowchart TD - GH_App[fa:fa-cube GH_App] - GH_Organization[fa:fa-building GH_Organization] - GH_AppInstallation[fa:fa-plug GH_AppInstallation] - GH_Repository[fa:fa-box-archive GH_Repository] - - GH_App -->|GH_InstalledAs| GH_AppInstallation - GH_Organization -.->|GH_Contains| GH_AppInstallation - GH_AppInstallation -.->|GH_CanAccess| GH_Repository - -``` diff --git a/docs/opengraph/extensions/github/nodes/gh_branch.mdx b/docs/opengraph/extensions/github/nodes/gh_branch.mdx index b1d829a4..6f31223c 100644 --- a/docs/opengraph/extensions/github/nodes/gh_branch.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_branch.mdx @@ -1,67 +1,11 @@ ---- -title: 'GH_Branch' -description: 'A named reference in a repository representing a line of development' -icon: '/images/extensions/github/gh_branch.png' ---- - -Applies to BloodHound Enterprise and CE - +--- +title: 'GH_Branch' +description: 'A named reference in a repository representing a line of development' +icon: '/images/extensions/github/gh_branch.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + Represents a Git branch within a repository. Branch nodes capture basic branch information and whether the branch is protected. Protection rule details are stored in separate [GH_BranchProtectionRule](/opengraph/extensions/github/nodes/gh_branchprotectionrule) nodes, linked via [GH_ProtectedBy](/opengraph/extensions/github/edges/gh_protectedby) edges. - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [GH_CanEditProtection](/opengraph/extensions/github/edges/gh_caneditprotection) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ✅ | -| [GH_CanWriteBranch](/opengraph/extensions/github/edges/gh_canwritebranch) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole), [GH_User](/opengraph/extensions/github/nodes/gh_user), [GH_Team](/opengraph/extensions/github/nodes/gh_team) | ✅ | -| [GH_HasBranch](/opengraph/extensions/github/edges/gh_hasbranch) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_ProtectedBy](/opengraph/extensions/github/edges/gh_protectedby) | [GH_BranchProtectionRule](/opengraph/extensions/github/nodes/gh_branchprotectionrule) | ❌ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [GH_CanAssumeIdentity](/opengraph/extensions/github/edges/gh_canassumeidentity) | [AZFederatedIdentityCredential](/resources/nodes/az-federated-identity-credential), `AWSRole` | ✅ | -| [GH_HasEnvironment](/opengraph/extensions/github/edges/gh_hasenvironment) | [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) | ❌ | - -## Properties - -| Property Name | Data Type | Description | -| ---------------- | --------- | ------------------------------------------------------------------------------ | -| objectid | string | A unique identifier for the branch: `REF_kwDOMuFnXLNyZWZzL2hlYWRzL0NhblB1c2gz` | -| name | string | The fully qualified branch name (e.g., `repo\main`). | -| short_name | string | The branch reference name (e.g., `main`). | -| node_id | string | Same as objectid. | -| environment_name | string | The name of the environment (GitHub organization). | -| environmentid | string | The node_id of the environment (GitHub organization). | -| protected | boolean | Whether the branch has a protection rule. | - -## Diagram - -```mermaid -flowchart TD - GH_Branch[fa:fa-code-branch GH_Branch] - GH_Repository[fa:fa-box-archive GH_Repository] - GH_RepoRole[fa:fa-user-tie GH_RepoRole] - GH_BranchProtectionRule[fa:fa-shield GH_BranchProtectionRule] - GH_Environment[fa:fa-leaf GH_Environment] - GH_User[fa:fa-user GH_User] - GH_Team[fa:fa-user-group GH_Team] - AZFederatedIdentityCredential[fa:fa-id-card AZFederatedIdentityCredential] - - - GH_Repository -.->|GH_HasBranch| GH_Branch - GH_BranchProtectionRule -.->|GH_ProtectedBy| GH_Branch - GH_Branch -.->|GH_HasEnvironment| GH_Environment - GH_Branch -->|GH_CanAssumeIdentity| AZFederatedIdentityCredential - GH_RepoRole -->|GH_CanWriteBranch| GH_Branch - GH_RepoRole -->|GH_CanEditProtection| GH_Branch - GH_User -->|GH_CanWriteBranch| GH_Branch - GH_Team -->|GH_CanWriteBranch| GH_Branch -``` diff --git a/docs/opengraph/extensions/github/nodes/gh_branchprotectionrule.mdx b/docs/opengraph/extensions/github/nodes/gh_branchprotectionrule.mdx index 499dd5bf..06955cc9 100644 --- a/docs/opengraph/extensions/github/nodes/gh_branchprotectionrule.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_branchprotectionrule.mdx @@ -1,100 +1,42 @@ ---- -title: 'GH_BranchProtectionRule' -description: 'A branch protection rule that applies to one or more branches via pattern matching' -icon: '/images/extensions/github/gh_branchprotectionrule.png' ---- - -Applies to BloodHound Enterprise and CE - -Represents a branch protection rule configured on a GitHub repository. Protection rules define requirements that must be met before changes can be merged to matching branches, such as required reviews, status checks, and restrictions on who can push. - -A single protection rule can apply to multiple branches via pattern matching (e.g., `main`, `release/*`). - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [GH_BypassPullRequestAllowances](/opengraph/extensions/github/edges/gh_bypasspullrequestallowances) | [GH_User](/opengraph/extensions/github/nodes/gh_user), [GH_Team](/opengraph/extensions/github/nodes/gh_team) | ❌ | -| [GH_RestrictionsCanPush](/opengraph/extensions/github/edges/gh_restrictionscanpush) | [GH_User](/opengraph/extensions/github/nodes/gh_user), [GH_Team](/opengraph/extensions/github/nodes/gh_team) | ❌ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [GH_ProtectedBy](/opengraph/extensions/github/edges/gh_protectedby) | [GH_Branch](/opengraph/extensions/github/nodes/gh_branch) | ❌ | - -## Properties - -| Property Name | Data Type | Description | -| ------------------------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| objectid | string | The GitHub node ID of the branch protection rule: `BPR_kwDOMuFnXM4DPZQt` | -| name | string | Display name (e.g., `repo\main`). | -| id | string | Same as objectid. | -| environment_name | string | The GitHub organization login name. | -| environmentid | string | The GitHub organization node ID. | -| pattern | string | The branch name pattern this rule applies to (e.g., `main`, `release/*`). | -| enforce_admins | boolean | Whether branch protection rules are enforced for administrators. | -| lock_branch | boolean | Whether the branch is locked (read-only). | -| blocks_creations | boolean | Whether creating branches matching this pattern is restricted. Only effective when `push_restrictions` is also `true`; silently reverts to `false` otherwise. | -| required_pull_request_reviews | boolean | Whether pull request reviews are required before merging. | -| required_approving_review_count | integer | The number of approving reviews required. | -| require_code_owner_reviews | boolean | Whether reviews from code owners are required. | -| require_last_push_approval | boolean | Whether the last push must be approved by someone other than the pusher. | -| push_restrictions | boolean | Whether push access is restricted to specific users/teams. | -| requires_status_checks | boolean | Whether status checks must pass before merging. | -| requires_strict_status_checks | boolean | Whether branches must be up to date with the base branch before merging. | -| dismisses_stale_reviews | boolean | Whether new commits dismiss previously approved reviews. | -| allows_force_pushes | boolean | Whether force pushes are allowed to matching branches. | -| allows_deletions | boolean | Whether matching branches can be deleted. | - -## Diagram - -```mermaid -flowchart TD - GH_BranchProtectionRule[fa:fa-shield GH_BranchProtectionRule] - GH_Branch[fa:fa-code-branch GH_Branch] - GH_User[fa:fa-user GH_User] - GH_Team[fa:fa-user-group GH_Team] - - - GH_User -.->|GH_BypassPullRequestAllowances| GH_BranchProtectionRule - GH_Team -.->|GH_BypassPullRequestAllowances| GH_BranchProtectionRule - GH_User -.->|GH_RestrictionsCanPush| GH_BranchProtectionRule - GH_Team -.->|GH_RestrictionsCanPush| GH_BranchProtectionRule - GH_BranchProtectionRule -.->|GH_ProtectedBy| GH_Branch -``` - -## Security Considerations - -Branch protection rules are critical security controls. Key settings to review: - -- **enforce_admins**: Enforces merge-gate controls (PR reviews, lock branch) for admins and users with `bypass_branch_protection`. Does **not** enforce push-gate controls (`push_restrictions`) for admins or users with `push_protected_branch`. -- **required_pull_request_reviews**: Blocks direct pushes to existing protected branches. Bypassed by [GH_BypassBranchProtection](/opengraph/extensions/github/edges/gh_bypassbranchprotection) and [GH_BypassPullRequestAllowances](/opengraph/extensions/github/edges/gh_bypasspullrequestallowances) (both suppressed by `enforce_admins`). -- **push_restrictions**: Restricts who can push. Bypassed by [GH_PushProtectedBranch](/opengraph/extensions/github/edges/gh_pushprotectedbranch), [GH_AdminTo](/opengraph/extensions/github/edges/gh_adminto), and [GH_RestrictionsCanPush](/opengraph/extensions/github/edges/gh_restrictionscanpush) (none suppressed by `enforce_admins`). -- **blocks_creations**: Restricts new branch creation when `push_restrictions` is also `true`. Same bypass vectors as `push_restrictions`. Silently reverts to `false` if `push_restrictions` is disabled. -- **lock_branch**: Makes branch read-only. Bypassed by [GH_BypassBranchProtection](/opengraph/extensions/github/edges/gh_bypassbranchprotection) (suppressed by `enforce_admins`). -- **require_code_owner_reviews**: If `false`, changes to critical paths may not require owner approval. -- **allows_force_pushes**: Controls whether history rewrites are allowed. Does **not** grant push access — it is not a bypass mechanism. -- **allows_deletions**: If `true`, branches can be deleted (potentially losing code). - -### Secret Exfiltration Mitigation - -The only branch protection configuration that blocks the write-access → workflow → secrets exfiltration attack path is `push_restrictions` + `blocks_creations` on a `*` pattern rule. However, users with [GH_PushProtectedBranch](/opengraph/extensions/github/edges/gh_pushprotectedbranch), [GH_AdminTo](/opengraph/extensions/github/edges/gh_adminto), [GH_RestrictionsCanPush](/opengraph/extensions/github/edges/gh_restrictionscanpush), or [GH_EditRepoProtections](/opengraph/extensions/github/edges/gh_editrepoprotections) can bypass this control. - -For complete analysis, see [Mitigating Controls](/opengraph/extensions/github/mitigating-controls). - -### Identifying Bypass Actors - -Use these edges to identify users and teams with elevated branch permissions: - -- [GH_BypassPullRequestAllowances](/opengraph/extensions/github/edges/gh_bypasspullrequestallowances) — can bypass PR requirements on a specific rule (PR reviews only) -- [GH_RestrictionsCanPush](/opengraph/extensions/github/edges/gh_restrictionscanpush) — can push despite push restrictions on a specific rule -- [GH_BypassBranchProtection](/opengraph/extensions/github/edges/gh_bypassbranchprotection) — repo-wide bypass of merge-gate controls (PR reviews + lock branch) -- [GH_PushProtectedBranch](/opengraph/extensions/github/edges/gh_pushprotectedbranch) — repo-wide bypass of push-gate controls (push restrictions + blocks creations) +--- +title: 'GH_BranchProtectionRule' +description: 'A branch protection rule that applies to one or more branches via pattern matching' +icon: '/images/extensions/github/gh_branchprotectionrule.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + +Represents a branch protection rule configured on a GitHub repository. Protection rules define requirements that must be met before changes can be merged to matching branches, such as required reviews, status checks, and restrictions on who can push. + +A single protection rule can apply to multiple branches via pattern matching (e.g., `main`, `release/*`). + +## Security Considerations + +Branch protection rules are critical security controls. Key settings to review: + +- **enforce_admins**: Enforces merge-gate controls (PR reviews, lock branch) for admins and users with `bypass_branch_protection`. Does **not** enforce push-gate controls (`push_restrictions`) for admins or users with `push_protected_branch`. +- **required_pull_request_reviews**: Blocks direct pushes to existing protected branches. Bypassed by [GH_BypassBranchProtection](/opengraph/extensions/github/edges/gh_bypassbranchprotection) and [GH_BypassPullRequestAllowances](/opengraph/extensions/github/edges/gh_bypasspullrequestallowances) (both suppressed by `enforce_admins`). +- **push_restrictions**: Restricts who can push. Bypassed by [GH_PushProtectedBranch](/opengraph/extensions/github/edges/gh_pushprotectedbranch), [GH_AdminTo](/opengraph/extensions/github/edges/gh_adminto), and [GH_RestrictionsCanPush](/opengraph/extensions/github/edges/gh_restrictionscanpush) (none suppressed by `enforce_admins`). +- **blocks_creations**: Restricts new branch creation when `push_restrictions` is also `true`. Same bypass vectors as `push_restrictions`. Silently reverts to `false` if `push_restrictions` is disabled. +- **lock_branch**: Makes branch read-only. Bypassed by [GH_BypassBranchProtection](/opengraph/extensions/github/edges/gh_bypassbranchprotection) (suppressed by `enforce_admins`). +- **require_code_owner_reviews**: If `false`, changes to critical paths may not require owner approval. +- **allows_force_pushes**: Controls whether history rewrites are allowed. Does **not** grant push access — it is not a bypass mechanism. +- **allows_deletions**: If `true`, branches can be deleted (potentially losing code). + +### Secret Exfiltration Mitigation + +The only branch protection configuration that blocks the write-access → workflow → secrets exfiltration attack path is `push_restrictions` + `blocks_creations` on a `*` pattern rule. However, users with [GH_PushProtectedBranch](/opengraph/extensions/github/edges/gh_pushprotectedbranch), [GH_AdminTo](/opengraph/extensions/github/edges/gh_adminto), [GH_RestrictionsCanPush](/opengraph/extensions/github/edges/gh_restrictionscanpush), or [GH_EditRepoProtections](/opengraph/extensions/github/edges/gh_editrepoprotections) can bypass this control. + +For complete analysis, see [BloodHound Docs: GitHub - Mitigating Controls](/opengraph/extensions/github/mitigating-controls). + +### Identifying Bypass Actors + +Use these edges to identify users and teams with elevated branch permissions: + +- [GH_BypassPullRequestAllowances](/opengraph/extensions/github/edges/gh_bypasspullrequestallowances) — can bypass PR requirements on a specific rule (PR reviews only) +- [GH_RestrictionsCanPush](/opengraph/extensions/github/edges/gh_restrictionscanpush) — can push despite push restrictions on a specific rule +- [GH_BypassBranchProtection](/opengraph/extensions/github/edges/gh_bypassbranchprotection) — repo-wide bypass of merge-gate controls (PR reviews + lock branch) +- [GH_PushProtectedBranch](/opengraph/extensions/github/edges/gh_pushprotectedbranch) — repo-wide bypass of push-gate controls (push restrictions + blocks creations) - [GH_EditRepoProtections](/opengraph/extensions/github/edges/gh_editrepoprotections) — can remove/modify protection rules entirely diff --git a/docs/opengraph/extensions/github/nodes/gh_environment.mdx b/docs/opengraph/extensions/github/nodes/gh_environment.mdx index 53c1c0c5..610ce93d 100644 --- a/docs/opengraph/extensions/github/nodes/gh_environment.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_environment.mdx @@ -1,64 +1,13 @@ ---- -title: 'GH_Environment' -description: 'A GitHub Actions deployment environment with protection rules and deployment branch policies' -icon: '/images/extensions/github/gh_environment.png' ---- - -Applies to BloodHound Enterprise and CE - -Represents a GitHub Actions deployment environment configured on a repository. Environments can have protection rules including required reviewers, wait timers, and deployment branch policies. When custom branch policies are configured, the environment is connected to specific branches; otherwise, it is connected directly to the repository. - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [GH_HasEnvironment](/opengraph/extensions/github/edges/gh_hasenvironment) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_Branch](/opengraph/extensions/github/nodes/gh_branch) | ❌ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [GH_CanAssumeIdentity](/opengraph/extensions/github/edges/gh_canassumeidentity) | [AZFederatedIdentityCredential](/resources/nodes/az-federated-identity-credential), `AWSRole` | ✅ | -| [GH_Contains](/opengraph/extensions/github/edges/gh_contains) | [GH_User](/opengraph/extensions/github/nodes/gh_user), [GH_Team](/opengraph/extensions/github/nodes/gh_team), [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole), [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole), [GH_TeamRole](/opengraph/extensions/github/nodes/gh_teamrole), [GH_OrgSecret](/opengraph/extensions/github/nodes/gh_orgsecret), [GH_AppInstallation](/opengraph/extensions/github/nodes/gh_appinstallation), [GH_PersonalAccessToken](/opengraph/extensions/github/nodes/gh_personalaccesstoken), [GH_PersonalAccessTokenRequest](/opengraph/extensions/github/nodes/gh_personalaccesstokenrequest), [GH_RepoSecret](/opengraph/extensions/github/nodes/gh_reposecret), [GH_EnvironmentSecret](/opengraph/extensions/github/nodes/gh_environmentsecret), [GH_SecretScanningAlert](/opengraph/extensions/github/nodes/gh_secretscanningalert) | ❌ | -| [GH_HasSecret](/opengraph/extensions/github/edges/gh_hassecret) | [GH_OrgSecret](/opengraph/extensions/github/nodes/gh_orgsecret), [GH_RepoSecret](/opengraph/extensions/github/nodes/gh_reposecret), [GH_EnvironmentSecret](/opengraph/extensions/github/nodes/gh_environmentsecret) | ✅ | - -## Properties - -| Property Name | Data Type | Description | -| ----------------- | --------- | ----------------------------------------------------------------------------- | -| objectid | string | The GitHub `node_id` of the environment, used as the unique graph identifier. | -| id | integer | The numeric GitHub ID of the environment. | -| node_id | string | The GitHub node ID. Redundant with objectid. | -| name | string | The fully qualified environment name (e.g., `repoName\production`). | -| short_name | string | The environment's display name (e.g., `production`, `staging`). | -| can_admins_bypass | boolean | Whether repository administrators can bypass environment protection rules. | -| environment_name | string | The name of the environment (GitHub organization) | -| environmentid | string | The node_id of the environment (GitHub organization) | -| repository_name | string | The full name of the containing repository. | -| repository_id | string | The ID of the containing repository. | - -## Diagram - -```mermaid -flowchart TD - GH_Environment[fa:fa-leaf GH_Environment] - GH_Repository[fa:fa-box-archive GH_Repository] - GH_Branch[fa:fa-code-branch GH_Branch] - GH_EnvironmentSecret[fa:fa-lock GH_EnvironmentSecret] - GH_EnvironmentVariable[fa:fa-lock-open GH_EnvironmentVariable] - AZFederatedIdentityCredential[fa:fa-id-card AZFederatedIdentityCredential] - - - GH_Repository -.->|GH_HasEnvironment| GH_Environment - GH_Branch -.->|GH_HasEnvironment| GH_Environment - GH_Environment -.->|GH_Contains| GH_EnvironmentSecret - GH_Environment -.->|GH_Contains| GH_EnvironmentVariable - GH_Environment -->|GH_HasSecret| GH_EnvironmentSecret - GH_Environment -->|GH_CanAssumeIdentity| AZFederatedIdentityCredential -``` +--- +title: 'GH_Environment' +description: 'A GitHub Actions deployment environment with protection rules and deployment branch policies' +icon: '/images/extensions/github/gh_environment.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + +Represents a GitHub Actions deployment environment configured on a repository. Environments can have protection rules including required reviewers, wait timers, administrator bypass behavior, and deployment branch policies. + +Repositories always contain their environments. When custom branch policies are configured, the environment also contains one or more [GH_EnvironmentBranchPolicy](/opengraph/extensions/github/nodes/gh_environmentbranchpolicy) nodes that describe which branches are allowed to deploy. Environment-scoped secrets and variables are modeled as child nodes of the environment and become available to workflow jobs that reference it. diff --git a/docs/opengraph/extensions/github/nodes/gh_environmentbranchpolicy.mdx b/docs/opengraph/extensions/github/nodes/gh_environmentbranchpolicy.mdx new file mode 100644 index 00000000..18f3aad5 --- /dev/null +++ b/docs/opengraph/extensions/github/nodes/gh_environmentbranchpolicy.mdx @@ -0,0 +1,13 @@ +--- +title: 'GH_EnvironmentBranchPolicy' +description: 'A deployment branch policy attached to a GitHub environment, such as an exact branch name or wildcard pattern like release/*' +icon: '/images/extensions/github/gh_environmentbranchpolicy.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + +Represents a deployment branch policy attached to a GitHub Environment. These policies define which branches or branch patterns are allowed to deploy to the environment, such as `main`, `release/*`, or `release/**/*`. + +Environment branch policies are modeled as their own nodes so analysts can distinguish between the environment itself and the matching rules that govern deployment eligibility. diff --git a/docs/opengraph/extensions/github/nodes/gh_environmentsecret.mdx b/docs/opengraph/extensions/github/nodes/gh_environmentsecret.mdx index 5cc3799c..e8a8d79f 100644 --- a/docs/opengraph/extensions/github/nodes/gh_environmentsecret.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_environmentsecret.mdx @@ -1,51 +1,13 @@ ---- -title: 'GH_EnvironmentSecret' -description: 'An environment-level GitHub Actions secret scoped to a specific deployment environment' -icon: '/images/extensions/github/gh_environmentsecret.png' ---- - -Applies to BloodHound Enterprise and CE - -Represents an environment-level GitHub Actions secret. These secrets are scoped to a specific deployment environment and are only available to workflow jobs that reference that environment. - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [GH_Contains](/opengraph/extensions/github/edges/gh_contains) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization), [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) | ❌ | -| [GH_HasSecret](/opengraph/extensions/github/edges/gh_hassecret) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) | ✅ | - -### Outbound Edges - -No outbound edges are defined by the GitHub extension for this node. - -## Properties - -| Property Name | Data Type | Description | -| --------------------------- | --------- | --------------------------------------------------------------------------------- | -| objectid | string | A deterministic ID in the format `GH_EnvironmentSecret_{envNodeId}_{secretName}`. | -| id | string | Same as objectid. | -| name | string | The name of the secret. | -| environment_name | string | The name of the environment (GitHub organization) | -| environmentid | string | The node_id of the environment (GitHub organization) | -| deployment_environment_name | string | The name of the containing deployment environment. | -| deployment_environmentid | string | The node_id of the containing deployment environment. | -| created_at | datetime | When the secret was created. | -| updated_at | datetime | When the secret was last updated. | - -## Diagram - -```mermaid -flowchart TD - GH_Environment[fa:fa-leaf GH_Environment] - GH_EnvironmentSecret[fa:fa-lock GH_EnvironmentSecret] - - - GH_Environment -.->|GH_Contains| GH_EnvironmentSecret -``` +--- +title: 'GH_EnvironmentSecret' +description: 'An environment-level GitHub Actions secret scoped to a specific deployment environment' +icon: '/images/extensions/github/gh_environmentsecret.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + +Represents an environment-level GitHub Actions secret. These secrets are scoped to a specific deployment environment and are only available to workflow jobs that reference that environment. + +The containing environment is linked to the secret with [GH_Contains](/opengraph/extensions/github/edges/gh_contains) and [GH_HasSecret](/opengraph/extensions/github/edges/gh_hassecret) edges. Workflow steps that reference the secret by name receive [GH_UsesSecret](/opengraph/extensions/github/edges/gh_usessecret) edges when their job targets the same environment. diff --git a/docs/opengraph/extensions/github/nodes/gh_environmentvariable.mdx b/docs/opengraph/extensions/github/nodes/gh_environmentvariable.mdx index 0ff5bb60..78b2281a 100644 --- a/docs/opengraph/extensions/github/nodes/gh_environmentvariable.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_environmentvariable.mdx @@ -1,51 +1,13 @@ ---- -title: 'GH_EnvironmentVariable' -description: 'An environment-level GitHub Actions variable scoped to a specific deployment environment. Unlike secrets, variable values are readable.' -icon: '/images/extensions/github/gh_environmentvariable.png' ---- - -Applies to BloodHound Enterprise and CE - -Represents an environment-level GitHub Actions variable. These variables are scoped to a specific deployment environment and are only available to workflow jobs that reference that environment. Unlike secrets, variable values are readable via the API. - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -No inbound edges are defined by the GitHub extension for this node. - -### Outbound Edges - -No outbound edges are defined by the GitHub extension for this node. - -## Properties - -| Property Name | Data Type | Description | -| --------------------------- | --------- | ------------------------------------------------------------------------------------- | -| objectid | string | A deterministic ID in the format `GH_EnvironmentVariable_{envNodeId}_{variableName}`. | -| id | string | Same as objectid. | -| name | string | The name of the variable. | -| environment_name | string | The name of the environment (GitHub organization). | -| environmentid | string | The node_id of the environment (GitHub organization). | -| repository_name | string | The name of the containing repository. | -| repository_id | string | The node_id of the containing repository. | -| deployment_environment_name | string | The name of the containing deployment environment. | -| deployment_environmentid | string | The node_id of the containing deployment environment. | -| value | string | The plaintext value of the variable. | -| created_at | datetime | When the variable was created. | -| updated_at | datetime | When the variable was last updated. | - -## Diagram - -```mermaid -flowchart TD - GH_Environment[fa:fa-leaf GH_Environment] - GH_EnvironmentVariable[fa:fa-lock-open GH_EnvironmentVariable] - - - GH_Environment -.->|GH_Contains| GH_EnvironmentVariable -``` +--- +title: 'GH_EnvironmentVariable' +description: 'An environment-level GitHub Actions variable scoped to a specific deployment environment. Unlike secrets, variable values are readable.' +icon: '/images/extensions/github/gh_environmentvariable.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + +Represents an environment-level GitHub Actions variable. These variables are scoped to a specific deployment environment and are only available to workflow jobs that reference that environment. Unlike secrets, variable values are readable via the API. + +The containing environment is linked to the variable with [GH_Contains](/opengraph/extensions/github/edges/gh_contains) and [GH_HasVariable](/opengraph/extensions/github/edges/gh_hasvariable) edges. Workflow steps that reference the variable by name receive [GH_UsesVariable](/opengraph/extensions/github/edges/gh_usesvariable) edges when their job targets the same environment. diff --git a/docs/opengraph/extensions/github/nodes/gh_externalidentity.mdx b/docs/opengraph/extensions/github/nodes/gh_externalidentity.mdx index d513f834..1409778a 100644 --- a/docs/opengraph/extensions/github/nodes/gh_externalidentity.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_externalidentity.mdx @@ -1,66 +1,11 @@ ---- -title: 'GH_ExternalIdentity' -description: 'An external identity from a SAML/SCIM provider linked to a GitHub user for SSO authentication' -icon: '/images/extensions/github/gh_externalidentity.png' ---- - -Applies to BloodHound Enterprise and CE - +--- +title: 'GH_ExternalIdentity' +description: 'An external identity from a SAML/SCIM provider linked to a GitHub user for SSO authentication' +icon: '/images/extensions/github/gh_externalidentity.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + Represents an external identity from a SAML or SCIM identity provider that is linked to a GitHub user. External identities map corporate user accounts (from providers like Okta, Azure AD, etc.) to GitHub user accounts, enabling single sign-on authentication. Each external identity can have both SAML and SCIM identity attributes. - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [GH_HasExternalIdentity](/opengraph/extensions/github/edges/gh_hasexternalidentity) | [GH_SamlIdentityProvider](/opengraph/extensions/github/nodes/gh_samlidentityprovider) | ❌ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [GH_MapsToUser](/opengraph/extensions/github/edges/gh_mapstouser) | [GH_User](/opengraph/extensions/github/nodes/gh_user) | ❌ | - -## Properties - -| Property Name | Data Type | Description | -| ------------------------- | --------- | -------------------------------------------------------- | -| objectid | string | The GraphQL ID of the external identity. | -| node_id | string | The GraphQL ID of the external identity. | -| name | string | Same as objectid. | -| guid | string | The GUID of the external identity. | -| environmentid | string | The GraphQL ID of the environment (GitHub organization). | -| environment_name | string | The name of the environment (GitHub organization). | -| saml_identity_family_name | string | The family name from the SAML identity. | -| saml_identity_given_name | string | The given name from the SAML identity. | -| saml_identity_name_id | string | The SAML NameID attribute. | -| saml_identity_username | string | The username from the SAML identity. | -| scim_identity_family_name | string | The family name from the SCIM identity. | -| scim_identity_given_name | string | The given name from the SCIM identity. | -| scim_identity_username | string | The username from the SCIM identity. | -| github_username | string | The GitHub login of the linked user. | -| github_user_id | string | The GraphQL ID of the linked GitHub user. | - -## Diagram - -```mermaid -flowchart TD - GH_SamlIdentityProvider[fa:fa-id-badge GH_SamlIdentityProvider] - GH_ExternalIdentity[fa:fa-arrows-left-right GH_ExternalIdentity] - GH_User[fa:fa-user GH_User] - AZUser[fa:fa-user AZUser] - Okta_User[fa:fa-user Okta_User] - PingOneUser[fa:fa-user PingOneUser] - - - GH_SamlIdentityProvider -.->|GH_HasExternalIdentity| GH_ExternalIdentity - GH_ExternalIdentity -.->|GH_MapsToUser| GH_User - GH_ExternalIdentity -.->|GH_MapsToUser| AZUser - GH_ExternalIdentity -.->|GH_MapsToUser| Okta_User - GH_ExternalIdentity -.->|GH_MapsToUser| PingOneUser -``` diff --git a/docs/opengraph/extensions/github/nodes/gh_organization.mdx b/docs/opengraph/extensions/github/nodes/gh_organization.mdx index 28d05acb..56b036b0 100644 --- a/docs/opengraph/extensions/github/nodes/gh_organization.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_organization.mdx @@ -1,143 +1,11 @@ ---- -title: 'GH_Organization' -description: 'A GitHub Organization—top-level container for repositories, teams, and settings' -icon: '/images/extensions/github/gh_organization.png' ---- - -Applies to BloodHound Enterprise and CE - +--- +title: 'GH_Organization' +description: 'A GitHub Organization—top-level container for repositories, teams, and settings' +icon: '/images/extensions/github/gh_organization.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + Represents a GitHub organization. This is the root node of the graph and serves as the primary container for all other nodes. Organization-level settings such as default repository permissions, Actions configuration, and security features are captured as properties on this node. - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [GH_AddCollaborator](/opengraph/extensions/github/edges/gh_addcollaborator) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) | ❌ | -| [GH_CreateRepository](/opengraph/extensions/github/edges/gh_createrepository) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) | ❌ | -| [GH_CreateTeam](/opengraph/extensions/github/edges/gh_createteam) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) | ❌ | -| [GH_InviteMember](/opengraph/extensions/github/edges/gh_invitemember) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) | ❌ | -| [GH_ManageOrganizationWebhooks](/opengraph/extensions/github/edges/gh_manageorganizationwebhooks) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) | ❌ | -| [GH_OrgBypassCodeScanningDismissalRequests](/opengraph/extensions/github/edges/gh_orgbypasscodescanningdismissalrequests) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) | ❌ | -| [GH_OrgBypassSecretScanningClosureRequests](/opengraph/extensions/github/edges/gh_orgbypasssecretscanningclosurerequests) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) | ❌ | -| [GH_OrgReviewAndManageSecretScanningBypassRequests](/opengraph/extensions/github/edges/gh_orgreviewandmanagesecretscanningbypassrequests) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) | ❌ | -| [GH_OrgReviewAndManageSecretScanningClosureRequests](/opengraph/extensions/github/edges/gh_orgreviewandmanagesecretscanningclosurerequests) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) | ❌ | -| [GH_ReadOrganizationActionsUsageMetrics](/opengraph/extensions/github/edges/gh_readorganizationactionsusagemetrics) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) | ❌ | -| [GH_ReadOrganizationCustomOrgRole](/opengraph/extensions/github/edges/gh_readorganizationcustomorgrole) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) | ❌ | -| [GH_ReadOrganizationCustomRepoRole](/opengraph/extensions/github/edges/gh_readorganizationcustomreporole) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) | ❌ | -| [GH_ResolveSecretScanningAlerts](/opengraph/extensions/github/edges/gh_resolvesecretscanningalerts) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) | ❌ | -| [GH_TransferRepository](/opengraph/extensions/github/edges/gh_transferrepository) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) | ❌ | -| [GH_ViewSecretScanningAlerts](/opengraph/extensions/github/edges/gh_viewsecretscanningalerts) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole), [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_WriteOrganizationActionsSecrets](/opengraph/extensions/github/edges/gh_writeorganizationactionssecrets) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) | ❌ | -| [GH_WriteOrganizationActionsSettings](/opengraph/extensions/github/edges/gh_writeorganizationactionssettings) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) | ❌ | -| [GH_WriteOrganizationActionsVariables](/opengraph/extensions/github/edges/gh_writeorganizationactionsvariables) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) | ❌ | -| [GH_WriteOrganizationCustomOrgRole](/opengraph/extensions/github/edges/gh_writeorganizationcustomorgrole) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) | ✅ | -| [GH_WriteOrganizationCustomRepoRole](/opengraph/extensions/github/edges/gh_writeorganizationcustomreporole) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) | ❌ | -| [GH_WriteOrganizationNetworkConfigurations](/opengraph/extensions/github/edges/gh_writeorganizationnetworkconfigurations) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) | ❌ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [GH_Contains](/opengraph/extensions/github/edges/gh_contains) | [GH_User](/opengraph/extensions/github/nodes/gh_user), [GH_Team](/opengraph/extensions/github/nodes/gh_team), [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole), [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole), [GH_TeamRole](/opengraph/extensions/github/nodes/gh_teamrole), [GH_OrgSecret](/opengraph/extensions/github/nodes/gh_orgsecret), [GH_AppInstallation](/opengraph/extensions/github/nodes/gh_appinstallation), [GH_PersonalAccessToken](/opengraph/extensions/github/nodes/gh_personalaccesstoken), [GH_PersonalAccessTokenRequest](/opengraph/extensions/github/nodes/gh_personalaccesstokenrequest), [GH_RepoSecret](/opengraph/extensions/github/nodes/gh_reposecret), [GH_EnvironmentSecret](/opengraph/extensions/github/nodes/gh_environmentsecret), [GH_SecretScanningAlert](/opengraph/extensions/github/nodes/gh_secretscanningalert) | ❌ | -| [GH_HasSamlIdentityProvider](/opengraph/extensions/github/edges/gh_hassamlidentityprovider) | [GH_SamlIdentityProvider](/opengraph/extensions/github/nodes/gh_samlidentityprovider) | ❌ | -| [GH_Owns](/opengraph/extensions/github/edges/gh_owns) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ✅ | - -## Properties - -| Property Name | Data Type | Description | -| ------------------------------------------------------------ | --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| objectid | string | The GitHub `node_id` of the organization, used as the unique graph identifier. | -| id | integer | The numeric GitHub ID of the organization. | -| name | string | The organization's login handle, used as the display name. | -| login | string | The organization's login handle (URL slug). | -| node_id | string | The GitHub GraphQL node ID. Redundant with objectid. | -| description | string | The organization's description. | -| org_name | string | The organization's display name (from the `name` field in the GitHub API). | -| company | string | The company associated with the organization. | -| blog | string | The organization's blog URL. | -| location | string | The organization's location. | -| email | string | The organization's public email address. | -| is_verified | boolean | Whether the organization's domain is verified by GitHub. | -| has_organization_projects | boolean | Whether the organization has projects enabled. | -| has_repository_projects | boolean | Whether repository projects are enabled. | -| public_repos | integer | Number of public repositories in the organization. | -| public_gists | integer | Number of public gists. | -| followers | integer | Number of followers the organization has. | -| following | integer | Number of accounts the organization is following. | -| html_url | string | URL to the organization's GitHub profile page. | -| created_at | datetime | When the organization was created. | -| updated_at | datetime | When the organization was last updated. | -| type | string | The account type (e.g., `Organization`). | -| total_private_repos | integer | Total number of private repositories. | -| owned_private_repos | integer | Number of private repositories owned directly by the organization. | -| private_gists | integer | Number of private gists. | -| collaborators | integer | Number of outside collaborators across the organization. | -| default_repository_permission | string | Default permission level granted to members on all repositories (e.g., `read`, `write`, `admin`, `none`). Used to associate the Members org role with the appropriate `all_repo_*` role node. | -| members_can_create_repositories | boolean | Whether members can create repositories. | -| two_factor_requirement_enabled | boolean | Whether two-factor authentication is required for all members. | -| members_can_create_public_repositories | boolean | Whether members can create public repositories. | -| members_can_create_private_repositories | boolean | Whether members can create private repositories. | -| members_can_create_internal_repositories | boolean | Whether members can create internal repositories. | -| members_can_create_pages | boolean | Whether members can create GitHub Pages sites. | -| members_can_fork_private_repositories | boolean | Whether members can fork private repositories. | -| web_commit_signoff_required | boolean | Whether web-based commits require sign-off. | -| deploy_keys_enabled_for_repositories | string | Which repositories allow deploy keys. | -| members_can_delete_repositories | boolean | Whether members can delete repositories. | -| members_can_change_repo_visibility | boolean | Whether members can change repository visibility. | -| members_can_invite_outside_collaborators | boolean | Whether members can invite outside collaborators. | -| members_can_delete_issues | boolean | Whether members can delete issues. | -| display_commenter_full_name_setting_enabled | boolean | Whether commenter full names are displayed. | -| readers_can_create_discussions | boolean | Whether readers can create discussions. | -| members_can_create_teams | boolean | Whether members can create teams. | -| members_can_view_dependency_insights | boolean | Whether members can view dependency insights. | -| default_repository_branch | string | The default branch name for new repositories. | -| members_can_create_public_pages | boolean | Whether members can create public GitHub Pages sites. | -| members_can_create_private_pages | boolean | Whether members can create private GitHub Pages sites. | -| advanced_security_enabled_for_new_repositories | boolean | Whether GitHub Advanced Security is automatically enabled for new repositories. | -| dependabot_alerts_enabled_for_new_repositories | boolean | Whether Dependabot alerts are enabled for new repositories. | -| dependabot_security_updates_enabled_for_new_repositories | boolean | Whether Dependabot security updates are enabled for new repositories. | -| dependency_graph_enabled_for_new_repositories | boolean | Whether the dependency graph is enabled for new repositories. | -| secret_scanning_enabled_for_new_repositories | boolean | Whether secret scanning is enabled for new repositories. | -| secret_scanning_push_protection_enabled_for_new_repositories | boolean | Whether secret scanning push protection is enabled for new repositories. | -| secret_scanning_push_protection_custom_link_enabled | boolean | Whether a custom link is enabled for secret scanning push protection. | -| secret_scanning_push_protection_custom_link | boolean | The custom link for secret scanning push protection. | -| secret_scanning_validity_checks_enabled | boolean | Whether secret scanning validity checks are enabled. | -| actions_enabled_repositories | string | Which repositories have GitHub Actions enabled: `all`, `selected`, or `none`. | -| actions_allowed_actions | string | Which Actions are allowed to run: `all`, `local_only`, or `selected`. | -| actions_sha_pinning_required | boolean | Whether SHA pinning is required for GitHub Actions. | - -## Diagram - -```mermaid -flowchart TD - GH_Organization[fa:fa-building GH_Organization] - GH_Repository[fa:fa-box-archive GH_Repository] - GH_OrgSecret[fa:fa-lock GH_OrgSecret] - GH_SamlIdentityProvider[fa:fa-id-badge GH_SamlIdentityProvider] - GH_OrgRole[fa:fa-user-tie GH_OrgRole] - - - GH_Organization -.->|GH_Owns| GH_Repository - GH_PersonalAccessToken[fa:fa-key GH_PersonalAccessToken] - GH_PersonalAccessTokenRequest[fa:fa-key GH_PersonalAccessTokenRequest] - - - GH_Organization -.->|GH_Contains| GH_OrgSecret - GH_Organization -.->|GH_HasSamlIdentityProvider| GH_SamlIdentityProvider - GH_Organization -.->|GH_Contains| GH_PersonalAccessToken - GH_Organization -.->|GH_Contains| GH_PersonalAccessTokenRequest - GH_OrgRole -.->|GH_ManageOrganizationWebhooks| GH_Organization - GH_OrgRole -.->|GH_OrgBypassCodeScanningDismissalRequests| GH_Organization - GH_OrgRole -.->|GH_OrgBypassSecretScanningClosureRequests| GH_Organization - GH_OrgRole -.->|GH_CreateRepository| GH_Organization - GH_OrgRole -.->|GH_InviteMember| GH_Organization - GH_OrgRole -.->|GH_AddCollaborator| GH_Organization - GH_OrgRole -.->|GH_CreateTeam| GH_Organization - GH_OrgRole -.->|GH_TransferRepository| GH_Organization -``` diff --git a/docs/opengraph/extensions/github/nodes/gh_orgrole.mdx b/docs/opengraph/extensions/github/nodes/gh_orgrole.mdx index beb664e3..ccdbedfe 100644 --- a/docs/opengraph/extensions/github/nodes/gh_orgrole.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_orgrole.mdx @@ -1,90 +1,11 @@ ---- -title: 'GH_OrgRole' -description: 'The role a user has at the organization level (e.g., admin, member)' -icon: '/images/extensions/github/gh_orgrole.png' ---- - -Applies to BloodHound Enterprise and CE - +--- +title: 'GH_OrgRole' +description: 'The role a user has at the organization level (e.g., admin, member)' +icon: '/images/extensions/github/gh_orgrole.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + Represents an organization-level role such as Owner, Member, or a custom organization role. Org roles define what permissions a user or team has at the organization level. The Owner and Member roles are default (built-in), while custom roles inherit from a base role and can have additional permissions. - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [GH_Contains](/opengraph/extensions/github/edges/gh_contains) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization), [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) | ❌ | -| [GH_HasBaseRole](/opengraph/extensions/github/edges/gh_hasbaserole) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole), [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ✅ | -| [GH_HasRole](/opengraph/extensions/github/edges/gh_hasrole) | [GH_User](/opengraph/extensions/github/nodes/gh_user), [GH_Team](/opengraph/extensions/github/nodes/gh_team) | ✅ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [GH_AddCollaborator](/opengraph/extensions/github/edges/gh_addcollaborator) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) | ❌ | -| [GH_CanReadSecretScanningAlert](/opengraph/extensions/github/edges/gh_canreadsecretscanningalert) | [GH_SecretScanningAlert](/opengraph/extensions/github/nodes/gh_secretscanningalert) | ✅ | -| [GH_CreateRepository](/opengraph/extensions/github/edges/gh_createrepository) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) | ❌ | -| [GH_CreateTeam](/opengraph/extensions/github/edges/gh_createteam) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) | ❌ | -| [GH_HasBaseRole](/opengraph/extensions/github/edges/gh_hasbaserole) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole), [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ✅ | -| [GH_InviteMember](/opengraph/extensions/github/edges/gh_invitemember) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) | ❌ | -| [GH_ManageOrganizationWebhooks](/opengraph/extensions/github/edges/gh_manageorganizationwebhooks) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) | ❌ | -| [GH_OrgBypassCodeScanningDismissalRequests](/opengraph/extensions/github/edges/gh_orgbypasscodescanningdismissalrequests) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) | ❌ | -| [GH_OrgBypassSecretScanningClosureRequests](/opengraph/extensions/github/edges/gh_orgbypasssecretscanningclosurerequests) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) | ❌ | -| [GH_OrgReviewAndManageSecretScanningBypassRequests](/opengraph/extensions/github/edges/gh_orgreviewandmanagesecretscanningbypassrequests) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) | ❌ | -| [GH_OrgReviewAndManageSecretScanningClosureRequests](/opengraph/extensions/github/edges/gh_orgreviewandmanagesecretscanningclosurerequests) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) | ❌ | -| [GH_ReadOrganizationActionsUsageMetrics](/opengraph/extensions/github/edges/gh_readorganizationactionsusagemetrics) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) | ❌ | -| [GH_ReadOrganizationCustomOrgRole](/opengraph/extensions/github/edges/gh_readorganizationcustomorgrole) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) | ❌ | -| [GH_ReadOrganizationCustomRepoRole](/opengraph/extensions/github/edges/gh_readorganizationcustomreporole) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) | ❌ | -| [GH_ResolveSecretScanningAlerts](/opengraph/extensions/github/edges/gh_resolvesecretscanningalerts) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) | ❌ | -| [GH_TransferRepository](/opengraph/extensions/github/edges/gh_transferrepository) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) | ❌ | -| [GH_ViewSecretScanningAlerts](/opengraph/extensions/github/edges/gh_viewsecretscanningalerts) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization), [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_WriteOrganizationActionsSecrets](/opengraph/extensions/github/edges/gh_writeorganizationactionssecrets) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) | ❌ | -| [GH_WriteOrganizationActionsSettings](/opengraph/extensions/github/edges/gh_writeorganizationactionssettings) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) | ❌ | -| [GH_WriteOrganizationActionsVariables](/opengraph/extensions/github/edges/gh_writeorganizationactionsvariables) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) | ❌ | -| [GH_WriteOrganizationCustomOrgRole](/opengraph/extensions/github/edges/gh_writeorganizationcustomorgrole) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) | ✅ | -| [GH_WriteOrganizationCustomRepoRole](/opengraph/extensions/github/edges/gh_writeorganizationcustomreporole) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) | ❌ | -| [GH_WriteOrganizationNetworkConfigurations](/opengraph/extensions/github/edges/gh_writeorganizationnetworkconfigurations) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) | ❌ | - -## Properties - -| Property Name | Data Type | Description | -| ---------------- | --------- | ---------------------------------------------------------------------------------------- | -| objectid | string | A deterministic ID derived from the organization ID and role name. | -| name | string | The fully qualified role name (e.g., `OrgName\Owners`). | -| id | string | Same as objectid. | -| short_name | string | The short display name of the role (e.g., `Owners`, `Members`, or the custom role name). | -| type | string | `default` for built-in roles (Owner, Member) or `custom` for custom organization roles. | -| environment_name | string | The name of the environment (GitHub organization). | -| environmentid | string | The node_id of the environment (GitHub organization). | - -## Diagram - -```mermaid -flowchart TD - GH_OrgRole[fa:fa-user-tie GH_OrgRole] - GH_User[fa:fa-user GH_User] - GH_Team[fa:fa-user-group GH_Team] - GH_Organization[fa:fa-building GH_Organization] - GH_RepoRole[fa:fa-user-tie GH_RepoRole] - GH_SecretScanningAlert[fa:fa-key GH_SecretScanningAlert] - - - GH_User -->|GH_HasRole| GH_OrgRole - GH_Team -->|GH_HasRole| GH_OrgRole - GH_OrgRole -->|GH_HasBaseRole| GH_OrgRole - GH_OrgRole -.->|GH_ManageOrganizationWebhooks| GH_Organization - GH_OrgRole -.->|GH_OrgBypassCodeScanningDismissalRequests| GH_Organization - GH_OrgRole -.->|GH_OrgBypassSecretScanningClosureRequests| GH_Organization - GH_OrgRole -.->|GH_CreateRepository| GH_Organization - GH_OrgRole -.->|GH_InviteMember| GH_Organization - GH_OrgRole -.->|GH_AddCollaborator| GH_Organization - GH_OrgRole -.->|GH_CreateTeam| GH_Organization - GH_OrgRole -.->|GH_TransferRepository| GH_Organization - GH_OrgRole -->|GH_HasBaseRole| GH_RepoRole - GH_OrgRole -->|GH_CanReadSecretScanningAlert| GH_SecretScanningAlert -``` diff --git a/docs/opengraph/extensions/github/nodes/gh_orgsecret.mdx b/docs/opengraph/extensions/github/nodes/gh_orgsecret.mdx index bcc417f9..c979f583 100644 --- a/docs/opengraph/extensions/github/nodes/gh_orgsecret.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_orgsecret.mdx @@ -1,52 +1,11 @@ ---- -title: 'GH_OrgSecret' -description: 'An organization-level GitHub Actions secret that can be scoped to all, private, or selected repositories' -icon: '/images/extensions/github/gh_orgsecret.png' ---- - -Applies to BloodHound Enterprise and CE - +--- +title: 'GH_OrgSecret' +description: 'An organization-level GitHub Actions secret that can be scoped to all, private, or selected repositories' +icon: '/images/extensions/github/gh_orgsecret.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + Represents an organization-level GitHub Actions secret. Organization secrets can be scoped to all repositories, only private/internal repositories, or a specific set of selected repositories. The visibility property determines how [GH_HasSecret](/opengraph/extensions/github/edges/gh_hassecret) edges are resolved to repository nodes. - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [GH_Contains](/opengraph/extensions/github/edges/gh_contains) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization), [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) | ❌ | -| [GH_HasSecret](/opengraph/extensions/github/edges/gh_hassecret) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) | ✅ | - -### Outbound Edges - -No outbound edges are defined by the GitHub extension for this node. - -## Properties - -| Property Name | Data Type | Description | -| ---------------- | --------- | ------------------------------------------------------------------------------------------------------------------------- | -| objectid | string | A deterministic ID in the format `GH_OrgSecret_{orgNodeId}_{secretName}`. | -| id | string | Same as objectid. | -| name | string | The name of the secret. | -| environment_name | string | The name of the environment (GitHub organization). | -| environmentid | string | The node_id of the environment (GitHub organization). | -| created_at | datetime | When the secret was created. | -| updated_at | datetime | When the secret was last updated. | -| visibility | string | The secret's visibility scope: `all` (all repos), `private` (private and internal repos), or `selected` (specific repos). | - -## Diagram - -```mermaid -flowchart TD - GH_OrgSecret[fa:fa-lock GH_OrgSecret] - GH_Organization[fa:fa-building GH_Organization] - GH_Repository[fa:fa-box-archive GH_Repository] - - - GH_Organization -.->|GH_Contains| GH_OrgSecret - GH_Repository -->|GH_HasSecret| GH_OrgSecret -``` diff --git a/docs/opengraph/extensions/github/nodes/gh_orgvariable.mdx b/docs/opengraph/extensions/github/nodes/gh_orgvariable.mdx index f036733d..73b10844 100644 --- a/docs/opengraph/extensions/github/nodes/gh_orgvariable.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_orgvariable.mdx @@ -1,52 +1,11 @@ ---- -title: 'GH_OrgVariable' -description: 'An organization-level GitHub Actions variable that can be scoped to all, private, or selected repositories. Unlike secrets, variable values are readable.' -icon: '/images/extensions/github/gh_orgvariable.png' ---- - -Applies to BloodHound Enterprise and CE - +--- +title: 'GH_OrgVariable' +description: 'An organization-level GitHub Actions variable that can be scoped to all, private, or selected repositories. Unlike secrets, variable values are readable.' +icon: '/images/extensions/github/gh_orgvariable.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + Represents an organization-level GitHub Actions variable. Organization variables can be scoped to all repositories, only private/internal repositories, or a specific set of selected repositories. The visibility property determines how [GH_HasVariable](/opengraph/extensions/github/edges/gh_hasvariable) edges are resolved to repository nodes. Unlike secrets, variable values are readable via the API. - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [GH_HasVariable](/opengraph/extensions/github/edges/gh_hasvariable) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ✅ | - -### Outbound Edges - -No outbound edges are defined by the GitHub extension for this node. - -## Properties - -| Property Name | Data Type | Description | -| ---------------- | --------- | --------------------------------------------------------------------------------------------------------------------------- | -| objectid | string | A deterministic ID in the format `GH_OrgVariable_{orgNodeId}_{variableName}`. | -| id | string | Same as objectid. | -| name | string | The name of the variable. | -| environment_name | string | The name of the environment (GitHub organization). | -| environmentid | string | The node_id of the environment (GitHub organization). | -| value | string | The plaintext value of the variable. | -| created_at | datetime | When the variable was created. | -| updated_at | datetime | When the variable was last updated. | -| visibility | string | The variable's visibility scope: `all` (all repos), `private` (private and internal repos), or `selected` (specific repos). | - -## Diagram - -```mermaid -flowchart TD - GH_OrgVariable[fa:fa-lock-open GH_OrgVariable] - GH_Organization[fa:fa-building GH_Organization] - GH_Repository[fa:fa-box-archive GH_Repository] - - - GH_Organization -.->|GH_Contains| GH_OrgVariable - GH_Repository -->|GH_HasVariable| GH_OrgVariable -``` diff --git a/docs/opengraph/extensions/github/nodes/gh_personalaccesstoken.mdx b/docs/opengraph/extensions/github/nodes/gh_personalaccesstoken.mdx index 634a5850..eba69b37 100644 --- a/docs/opengraph/extensions/github/nodes/gh_personalaccesstoken.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_personalaccesstoken.mdx @@ -1,64 +1,11 @@ ---- -title: 'GH_PersonalAccessToken' -description: 'A fine-grained personal access token granted access to organization resources' -icon: '/images/extensions/github/gh_personalaccesstoken.png' ---- - -Applies to BloodHound Enterprise and CE - +--- +title: 'GH_PersonalAccessToken' +description: 'A fine-grained personal access token granted access to organization resources' +icon: '/images/extensions/github/gh_personalaccesstoken.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + Represents a fine-grained personal access token that has been granted access to organization resources. PATs are linked to their owning user, the organization, and the repositories they can access. The permissions granted to the token are captured as a JSON string in the properties. - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [GH_Contains](/opengraph/extensions/github/edges/gh_contains) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization), [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) | ❌ | -| [GH_HasPersonalAccessToken](/opengraph/extensions/github/edges/gh_haspersonalaccesstoken) | [GH_User](/opengraph/extensions/github/nodes/gh_user) | ❌ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [GH_CanAccess](/opengraph/extensions/github/edges/gh_canaccess) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | - -## Properties - -| Property Name | Data Type | Description | -| -------------------- | --------- | -------------------------------------------------------------------------------------------------- | -| objectid | string | Deterministic Base64-encoded identifier, used as the unique graph identifier. | -| id | string | The deterministic identifier (same as objectid). | -| name | string | The user-assigned display name of the token. | -| environment_name | string | The name of the environment (GitHub organization) where the token has access. | -| environmentid | string | The node_id of the environment (GitHub organization). | -| owner_login | string | The login handle of the user who owns the token. | -| owner_id | integer | The numeric GitHub ID of the token owner. | -| owner_node_id | string | The GraphQL node ID of the token owner. | -| token_id | integer | Unique identifier of the user's token, found in audit logs and organization settings. | -| token_name | string | The user-assigned display name of the token. | -| token_expired | boolean | Whether the token has expired. | -| token_expires_at | string | ISO 8601 timestamp of when the token expires. | -| token_last_used_at | string | ISO 8601 timestamp of when the token was last used. | -| repository_selection | string | Whether the token has access to `all`, `subset`, or `none` of the organization's repositories. | -| access_granted_at | string | ISO 8601 timestamp of when access was granted to the organization. | -| permissions | string | JSON string of the permissions granted to the token (e.g., `{"organization":{},"repository":{}}`). | - -## Diagram - -```mermaid -flowchart TD - GH_PersonalAccessToken[fa:fa-key GH_PersonalAccessToken] - GH_User[fa:fa-user GH_User] - GH_Organization[fa:fa-building GH_Organization] - GH_Repository[fa:fa-box-archive GH_Repository] - - - GH_User -.->|GH_HasPersonalAccessToken| GH_PersonalAccessToken - GH_Organization -.->|GH_Contains| GH_PersonalAccessToken - GH_PersonalAccessToken -.->|GH_CanAccess| GH_Repository -``` diff --git a/docs/opengraph/extensions/github/nodes/gh_personalaccesstokenrequest.mdx b/docs/opengraph/extensions/github/nodes/gh_personalaccesstokenrequest.mdx index 9b465a72..a2a76155 100644 --- a/docs/opengraph/extensions/github/nodes/gh_personalaccesstokenrequest.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_personalaccesstokenrequest.mdx @@ -1,61 +1,11 @@ ---- -title: 'GH_PersonalAccessTokenRequest' -description: 'A pending request from an organization member to access organization resources with a fine-grained personal access token' -icon: '/images/extensions/github/gh_personalaccesstokenrequest.png' ---- - -Applies to BloodHound Enterprise and CE - +--- +title: 'GH_PersonalAccessTokenRequest' +description: 'A pending request from an organization member to access organization resources with a fine-grained personal access token' +icon: '/images/extensions/github/gh_personalaccesstokenrequest.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + Represents a pending request from an organization member to access organization resources with a fine-grained personal access token. PAT requests are linked to their owning user and the organization. The requested permissions are captured as a JSON string in the properties. - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [GH_Contains](/opengraph/extensions/github/edges/gh_contains) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization), [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) | ❌ | -| [GH_HasPersonalAccessTokenRequest](/opengraph/extensions/github/edges/gh_haspersonalaccesstokenrequest) | [GH_User](/opengraph/extensions/github/nodes/gh_user) | ❌ | - -### Outbound Edges - -No outbound edges are defined by the GitHub extension for this node. - -## Properties - -| Property Name | Data Type | Description | -| -------------------- | --------- | --------------------------------------------------------------------------------------------- | -| objectid | string | Deterministic Base64-encoded identifier, used as the unique graph identifier. | -| id | string | The deterministic identifier (same as objectid). | -| name | string | The user-assigned display name of the token. | -| environment_name | string | The name of the environment (GitHub organization) where access is being requested. | -| environmentid | string | The node_id of the environment (GitHub organization). | -| owner_login | string | The login handle of the user who submitted the request. | -| owner_id | integer | The numeric GitHub ID of the requester. | -| owner_node_id | string | The GraphQL node ID of the requester. | -| token_id | integer | Unique identifier of the user's token, found in audit logs. | -| token_name | string | The user-assigned display name of the token. | -| token_expired | boolean | Whether the token has expired. | -| token_expires_at | string | ISO 8601 timestamp of when the token expires. | -| token_last_used_at | string | ISO 8601 timestamp of when the token was last used. | -| repository_selection | string | Whether the request targets `all`, `subset`, or `none` of the organization's repositories. | -| reason | string | The rationale provided by the requester for the access request. | -| created_at | string | ISO 8601 timestamp of when the request was submitted. | -| permissions | string | JSON string of the permissions being requested (e.g., `{"organization":{},"repository":{}}`). | - -## Diagram - -```mermaid -flowchart TD - GH_PersonalAccessTokenRequest[fa:fa-key GH_PersonalAccessTokenRequest] - GH_User[fa:fa-user GH_User] - GH_Organization[fa:fa-building GH_Organization] - - - GH_User -.->|GH_HasPersonalAccessTokenRequest| GH_PersonalAccessTokenRequest - GH_Organization -.->|GH_Contains| GH_PersonalAccessTokenRequest -``` diff --git a/docs/opengraph/extensions/github/nodes/gh_reporole.mdx b/docs/opengraph/extensions/github/nodes/gh_reporole.mdx index dd9a8022..99bbbf5e 100644 --- a/docs/opengraph/extensions/github/nodes/gh_reporole.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_reporole.mdx @@ -1,143 +1,11 @@ ---- -title: 'GH_RepoRole' -description: 'The permission granted to a user or team on a repository (e.g., admin, write, read)' -icon: '/images/extensions/github/gh_reporole.png' ---- - -Applies to BloodHound Enterprise and CE - +--- +title: 'GH_RepoRole' +description: 'The permission granted to a user or team on a repository (e.g., admin, write, read)' +icon: '/images/extensions/github/gh_reporole.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + Represents a repository-level permission role. Each repository has five default roles (Read, Write, Admin, Triage, Maintain) plus any custom repository roles defined at the organization level. Repo roles define what actions a user or team can perform on a specific repository. Default roles form an inheritance hierarchy (Triage -> Read, Maintain -> Write, Admin includes all), and custom roles inherit from one of the base roles. - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [GH_Contains](/opengraph/extensions/github/edges/gh_contains) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization), [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) | ❌ | -| [GH_HasBaseRole](/opengraph/extensions/github/edges/gh_hasbaserole) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole), [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ✅ | -| [GH_HasRole](/opengraph/extensions/github/edges/gh_hasrole) | [GH_User](/opengraph/extensions/github/nodes/gh_user), [GH_Team](/opengraph/extensions/github/nodes/gh_team) | ✅ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [GH_AddAssignee](/opengraph/extensions/github/edges/gh_addassignee) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_AddLabel](/opengraph/extensions/github/edges/gh_addlabel) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_AdminTo](/opengraph/extensions/github/edges/gh_adminto) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_BypassBranchProtection](/opengraph/extensions/github/edges/gh_bypassbranchprotection) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_CanCreateBranch](/opengraph/extensions/github/edges/gh_cancreatebranch) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ✅ | -| [GH_CanEditProtection](/opengraph/extensions/github/edges/gh_caneditprotection) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_Branch](/opengraph/extensions/github/nodes/gh_branch) | ✅ | -| [GH_CanReadSecretScanningAlert](/opengraph/extensions/github/edges/gh_canreadsecretscanningalert) | [GH_SecretScanningAlert](/opengraph/extensions/github/nodes/gh_secretscanningalert) | ✅ | -| [GH_CanWriteBranch](/opengraph/extensions/github/edges/gh_canwritebranch) | [GH_Branch](/opengraph/extensions/github/nodes/gh_branch) | ✅ | -| [GH_CloseDiscussion](/opengraph/extensions/github/edges/gh_closediscussion) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_CloseIssue](/opengraph/extensions/github/edges/gh_closeissue) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_ClosePullRequest](/opengraph/extensions/github/edges/gh_closepullrequest) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_ConvertIssuesToDiscussions](/opengraph/extensions/github/edges/gh_convertissuestodiscussions) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_CreateDiscussionCategory](/opengraph/extensions/github/edges/gh_creatediscussioncategory) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_CreateSoloMergeQueueEntry](/opengraph/extensions/github/edges/gh_createsolomergequeueentry) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_CreateTag](/opengraph/extensions/github/edges/gh_createtag) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_DeleteAlertsCodeScanning](/opengraph/extensions/github/edges/gh_deletealertscodescanning) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_DeleteDiscussion](/opengraph/extensions/github/edges/gh_deletediscussion) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_DeleteDiscussionComment](/opengraph/extensions/github/edges/gh_deletediscussioncomment) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_DeleteIssue](/opengraph/extensions/github/edges/gh_deleteissue) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_DeleteTag](/opengraph/extensions/github/edges/gh_deletetag) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_EditCategoryOnDiscussion](/opengraph/extensions/github/edges/gh_editcategoryondiscussion) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_EditDiscussionCategory](/opengraph/extensions/github/edges/gh_editdiscussioncategory) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_EditDiscussionComment](/opengraph/extensions/github/edges/gh_editdiscussioncomment) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_EditRepoAnnouncementBanners](/opengraph/extensions/github/edges/gh_editrepoannouncementbanners) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_EditRepoCustomPropertiesValues](/opengraph/extensions/github/edges/gh_editrepocustompropertiesvalues) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_EditRepoMetadata](/opengraph/extensions/github/edges/gh_editrepometadata) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_EditRepoProtections](/opengraph/extensions/github/edges/gh_editrepoprotections) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_HasBaseRole](/opengraph/extensions/github/edges/gh_hasbaserole) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole), [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ✅ | -| [GH_JumpMergeQueue](/opengraph/extensions/github/edges/gh_jumpmergequeue) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_ManageDeployKeys](/opengraph/extensions/github/edges/gh_managedeploykeys) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_ManageDiscussionBadges](/opengraph/extensions/github/edges/gh_managediscussionbadges) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_ManageRepoSecurityProducts](/opengraph/extensions/github/edges/gh_managereposecurityproducts) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_ManageSecurityProducts](/opengraph/extensions/github/edges/gh_managesecurityproducts) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_ManageSettingsMergeTypes](/opengraph/extensions/github/edges/gh_managesettingsmergetypes) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_ManageSettingsPages](/opengraph/extensions/github/edges/gh_managesettingspages) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_ManageSettingsProjects](/opengraph/extensions/github/edges/gh_managesettingsprojects) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_ManageSettingsWiki](/opengraph/extensions/github/edges/gh_managesettingswiki) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_ManageTopics](/opengraph/extensions/github/edges/gh_managetopics) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_ManageWebhooks](/opengraph/extensions/github/edges/gh_managewebhooks) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_MarkAsDuplicate](/opengraph/extensions/github/edges/gh_markasduplicate) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_PushProtectedBranch](/opengraph/extensions/github/edges/gh_pushprotectedbranch) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_ReadCodeScanning](/opengraph/extensions/github/edges/gh_readcodescanning) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_ReadRepoContents](/opengraph/extensions/github/edges/gh_readrepocontents) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_RemoveAssignee](/opengraph/extensions/github/edges/gh_removeassignee) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_RemoveLabel](/opengraph/extensions/github/edges/gh_removelabel) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_ReopenDiscussion](/opengraph/extensions/github/edges/gh_reopendiscussion) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_ReopenIssue](/opengraph/extensions/github/edges/gh_reopenissue) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_ReopenPullRequest](/opengraph/extensions/github/edges/gh_reopenpullrequest) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_RequestPrReview](/opengraph/extensions/github/edges/gh_requestprreview) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_ResolveDependabotAlerts](/opengraph/extensions/github/edges/gh_resolvedependabotalerts) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_RunOrgMigration](/opengraph/extensions/github/edges/gh_runorgmigration) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_SetInteractionLimits](/opengraph/extensions/github/edges/gh_setinteractionlimits) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_SetIssueType](/opengraph/extensions/github/edges/gh_setissuetype) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_SetMilestone](/opengraph/extensions/github/edges/gh_setmilestone) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_SetSocialPreview](/opengraph/extensions/github/edges/gh_setsocialpreview) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_ToggleDiscussionAnswer](/opengraph/extensions/github/edges/gh_togglediscussionanswer) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_ToggleDiscussionCommentMinimize](/opengraph/extensions/github/edges/gh_togglediscussioncommentminimize) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_ViewDependabotAlerts](/opengraph/extensions/github/edges/gh_viewdependabotalerts) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_ViewSecretScanningAlerts](/opengraph/extensions/github/edges/gh_viewsecretscanningalerts) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization), [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_WriteCodeScanning](/opengraph/extensions/github/edges/gh_writecodescanning) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_WriteRepoContents](/opengraph/extensions/github/edges/gh_writerepocontents) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | -| [GH_WriteRepoPullRequests](/opengraph/extensions/github/edges/gh_writerepopullrequests) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | - -## Properties - -| Property Name | Data Type | Description | -| ---------------- | --------- | ------------------------------------------------------------------------------------------------ | -| objectid | string | A deterministic ID derived from the repo node_id and role name. | -| name | string | The fully qualified role name (e.g., `repoName\read`). | -| id | string | Same as objectid. | -| short_name | string | The short role name (e.g., `read`, `write`, `admin`, `triage`, `maintain`, or custom role name). | -| type | string | `default` for built-in roles or `custom` for custom repository roles. | -| environment_name | string | The name of the environment (GitHub organization). | -| environmentid | string | The node_id of the environment (GitHub organization). | -| repository_name | string | The name of the repository this role belongs to. | -| repository_id | string | The node_id of the repository this role belongs to. | - -## Diagram - -```mermaid -flowchart TD - GH_RepoRole[fa:fa-user-tie GH_RepoRole] - GH_Repository[fa:fa-box-archive GH_Repository] - GH_Branch[fa:fa-code-branch GH_Branch] - GH_BranchProtectionRule[fa:fa-shield GH_BranchProtectionRule] - GH_User[fa:fa-user GH_User] - GH_Team[fa:fa-user-group GH_Team] - GH_OrgRole[fa:fa-user-tie GH_OrgRole] - GH_SecretScanningAlert[fa:fa-key GH_SecretScanningAlert] - - - GH_RepoRole -.->|GH_ReadRepoContents| GH_Repository - GH_RepoRole -.->|GH_WriteRepoContents| GH_Repository - GH_RepoRole -.->|GH_AdminTo| GH_Repository - GH_RepoRole -.->|GH_ViewSecretScanningAlerts| GH_Repository - GH_RepoRole -.->|GH_BypassBranchProtection| GH_Repository - GH_RepoRole -.->|GH_EditRepoProtections| GH_Repository - %% Note: Additional non-traversable permission edges (issue triage, discussions, settings) omitted for readability. - GH_RepoRole -.->|GH_ReadCodeScanning| GH_Repository - GH_RepoRole -.->|GH_WriteCodeScanning| GH_Repository - GH_RepoRole -.->|GH_ViewDependabotAlerts| GH_Repository - GH_RepoRole -.->|GH_ResolveDependabotAlerts| GH_Repository - GH_RepoRole -.->|GH_DeleteIssue| GH_Repository - GH_RepoRole -.->|GH_CreateTag| GH_Repository - GH_RepoRole -.->|GH_DeleteTag| GH_Repository - GH_RepoRole -->|GH_HasBaseRole| GH_RepoRole - GH_RepoRole -->|GH_CanEditProtection| GH_Repository - GH_RepoRole -->|GH_CanEditProtection| GH_Branch - GH_RepoRole -->|GH_CanWriteBranch| GH_Branch - GH_RepoRole -->|GH_CanCreateBranch| GH_Repository - GH_RepoRole -->|GH_CanReadSecretScanningAlert| GH_SecretScanningAlert - GH_User -->|GH_HasRole| GH_RepoRole - GH_Team -->|GH_HasRole| GH_RepoRole - GH_OrgRole -->|GH_HasBaseRole| GH_RepoRole -``` diff --git a/docs/opengraph/extensions/github/nodes/gh_reposecret.mdx b/docs/opengraph/extensions/github/nodes/gh_reposecret.mdx index 6314384f..270117d8 100644 --- a/docs/opengraph/extensions/github/nodes/gh_reposecret.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_reposecret.mdx @@ -1,53 +1,11 @@ ---- -title: 'GH_RepoSecret' -description: 'A repository-level GitHub Actions secret accessible only to workflows in that repository' -icon: '/images/extensions/github/gh_reposecret.png' ---- - -Applies to BloodHound Enterprise and CE - +--- +title: 'GH_RepoSecret' +description: 'A repository-level GitHub Actions secret accessible only to workflows in that repository' +icon: '/images/extensions/github/gh_reposecret.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + Represents a repository-level GitHub Actions secret. These are secrets defined directly on a specific repository and are only accessible to workflows running in that repository. - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [GH_Contains](/opengraph/extensions/github/edges/gh_contains) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization), [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) | ❌ | -| [GH_HasSecret](/opengraph/extensions/github/edges/gh_hassecret) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) | ✅ | - -### Outbound Edges - -No outbound edges are defined by the GitHub extension for this node. - -## Properties - -| Property Name | Data Type | Description | -| ---------------- | --------- | ---------------------------------------------------------------------- | -| objectid | string | A deterministic ID in the format `GHSecret_{repoNodeId}_{secretName}`. | -| id | string | Same as objectid. | -| name | string | The name of the secret. | -| environment_name | string | The name of the environment (GitHub organization). | -| environmentid | string | The node_id of the environment (GitHub organization). | -| repository_name | string | The name of the containing repository. | -| repository_id | string | The node_id of the containing repository. | -| created_at | datetime | When the secret was created. | -| updated_at | datetime | When the secret was last updated. | -| visibility | string | The secret's visibility scope. | - -## Diagram - -```mermaid -flowchart TD - GH_RepoSecret[fa:fa-lock GH_RepoSecret] - GH_Repository[fa:fa-box-archive GH_Repository] - - - GH_Repository -.->|GH_Contains| GH_RepoSecret - GH_Repository -->|GH_HasSecret| GH_RepoSecret -``` diff --git a/docs/opengraph/extensions/github/nodes/gh_repository.mdx b/docs/opengraph/extensions/github/nodes/gh_repository.mdx index 70d69e8d..333e14e1 100644 --- a/docs/opengraph/extensions/github/nodes/gh_repository.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_repository.mdx @@ -1,178 +1,11 @@ ---- -title: 'GH_Repository' -description: 'A code repository in an organization, containing files, issues, and other resources' -icon: '/images/extensions/github/gh_repository.png' ---- - -Applies to BloodHound Enterprise and CE - +--- +title: 'GH_Repository' +description: 'A code repository in an organization, containing files, issues, and other resources' +icon: '/images/extensions/github/gh_repository.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + Represents a GitHub repository within the organization. Repository nodes capture metadata about the repo including visibility, Actions enablement status, and security configuration. Repository role nodes ([GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole)) are created alongside each repository to represent the permission levels available. - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [GH_AddAssignee](/opengraph/extensions/github/edges/gh_addassignee) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_AddLabel](/opengraph/extensions/github/edges/gh_addlabel) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_AdminTo](/opengraph/extensions/github/edges/gh_adminto) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_BypassBranchProtection](/opengraph/extensions/github/edges/gh_bypassbranchprotection) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_CanAccess](/opengraph/extensions/github/edges/gh_canaccess) | [GH_PersonalAccessToken](/opengraph/extensions/github/nodes/gh_personalaccesstoken), [GH_AppInstallation](/opengraph/extensions/github/nodes/gh_appinstallation) | ❌ | -| [GH_CanCreateBranch](/opengraph/extensions/github/edges/gh_cancreatebranch) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole), [GH_User](/opengraph/extensions/github/nodes/gh_user), [GH_Team](/opengraph/extensions/github/nodes/gh_team) | ✅ | -| [GH_CanEditProtection](/opengraph/extensions/github/edges/gh_caneditprotection) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ✅ | -| [GH_CloseDiscussion](/opengraph/extensions/github/edges/gh_closediscussion) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_CloseIssue](/opengraph/extensions/github/edges/gh_closeissue) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_ClosePullRequest](/opengraph/extensions/github/edges/gh_closepullrequest) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_Contains](/opengraph/extensions/github/edges/gh_contains) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization), [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) | ❌ | -| [GH_ConvertIssuesToDiscussions](/opengraph/extensions/github/edges/gh_convertissuestodiscussions) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_CreateDiscussionCategory](/opengraph/extensions/github/edges/gh_creatediscussioncategory) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_CreateSoloMergeQueueEntry](/opengraph/extensions/github/edges/gh_createsolomergequeueentry) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_CreateTag](/opengraph/extensions/github/edges/gh_createtag) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_DeleteAlertsCodeScanning](/opengraph/extensions/github/edges/gh_deletealertscodescanning) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_DeleteDiscussion](/opengraph/extensions/github/edges/gh_deletediscussion) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_DeleteDiscussionComment](/opengraph/extensions/github/edges/gh_deletediscussioncomment) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_DeleteIssue](/opengraph/extensions/github/edges/gh_deleteissue) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_DeleteTag](/opengraph/extensions/github/edges/gh_deletetag) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_EditCategoryOnDiscussion](/opengraph/extensions/github/edges/gh_editcategoryondiscussion) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_EditDiscussionCategory](/opengraph/extensions/github/edges/gh_editdiscussioncategory) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_EditDiscussionComment](/opengraph/extensions/github/edges/gh_editdiscussioncomment) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_EditRepoAnnouncementBanners](/opengraph/extensions/github/edges/gh_editrepoannouncementbanners) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_EditRepoCustomPropertiesValues](/opengraph/extensions/github/edges/gh_editrepocustompropertiesvalues) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_EditRepoMetadata](/opengraph/extensions/github/edges/gh_editrepometadata) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_EditRepoProtections](/opengraph/extensions/github/edges/gh_editrepoprotections) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_JumpMergeQueue](/opengraph/extensions/github/edges/gh_jumpmergequeue) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_ManageDeployKeys](/opengraph/extensions/github/edges/gh_managedeploykeys) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_ManageDiscussionBadges](/opengraph/extensions/github/edges/gh_managediscussionbadges) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_ManageRepoSecurityProducts](/opengraph/extensions/github/edges/gh_managereposecurityproducts) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_ManageSecurityProducts](/opengraph/extensions/github/edges/gh_managesecurityproducts) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_ManageSettingsMergeTypes](/opengraph/extensions/github/edges/gh_managesettingsmergetypes) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_ManageSettingsPages](/opengraph/extensions/github/edges/gh_managesettingspages) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_ManageSettingsProjects](/opengraph/extensions/github/edges/gh_managesettingsprojects) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_ManageSettingsWiki](/opengraph/extensions/github/edges/gh_managesettingswiki) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_ManageTopics](/opengraph/extensions/github/edges/gh_managetopics) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_ManageWebhooks](/opengraph/extensions/github/edges/gh_managewebhooks) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_MarkAsDuplicate](/opengraph/extensions/github/edges/gh_markasduplicate) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_Owns](/opengraph/extensions/github/edges/gh_owns) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) | ✅ | -| [GH_PushProtectedBranch](/opengraph/extensions/github/edges/gh_pushprotectedbranch) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_ReadCodeScanning](/opengraph/extensions/github/edges/gh_readcodescanning) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_ReadRepoContents](/opengraph/extensions/github/edges/gh_readrepocontents) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_RemoveAssignee](/opengraph/extensions/github/edges/gh_removeassignee) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_RemoveLabel](/opengraph/extensions/github/edges/gh_removelabel) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_ReopenDiscussion](/opengraph/extensions/github/edges/gh_reopendiscussion) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_ReopenIssue](/opengraph/extensions/github/edges/gh_reopenissue) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_ReopenPullRequest](/opengraph/extensions/github/edges/gh_reopenpullrequest) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_RequestPrReview](/opengraph/extensions/github/edges/gh_requestprreview) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_ResolveDependabotAlerts](/opengraph/extensions/github/edges/gh_resolvedependabotalerts) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_RunOrgMigration](/opengraph/extensions/github/edges/gh_runorgmigration) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_SetInteractionLimits](/opengraph/extensions/github/edges/gh_setinteractionlimits) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_SetIssueType](/opengraph/extensions/github/edges/gh_setissuetype) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_SetMilestone](/opengraph/extensions/github/edges/gh_setmilestone) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_SetSocialPreview](/opengraph/extensions/github/edges/gh_setsocialpreview) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_ToggleDiscussionAnswer](/opengraph/extensions/github/edges/gh_togglediscussionanswer) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_ToggleDiscussionCommentMinimize](/opengraph/extensions/github/edges/gh_togglediscussioncommentminimize) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_ViewDependabotAlerts](/opengraph/extensions/github/edges/gh_viewdependabotalerts) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_ViewSecretScanningAlerts](/opengraph/extensions/github/edges/gh_viewsecretscanningalerts) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole), [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_WriteCodeScanning](/opengraph/extensions/github/edges/gh_writecodescanning) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_WriteRepoContents](/opengraph/extensions/github/edges/gh_writerepocontents) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | -| [GH_WriteRepoPullRequests](/opengraph/extensions/github/edges/gh_writerepopullrequests) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ❌ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [GH_CanAssumeIdentity](/opengraph/extensions/github/edges/gh_canassumeidentity) | [AZFederatedIdentityCredential](/resources/nodes/az-federated-identity-credential), `AWSRole` | ✅ | -| [GH_Contains](/opengraph/extensions/github/edges/gh_contains) | [GH_User](/opengraph/extensions/github/nodes/gh_user), [GH_Team](/opengraph/extensions/github/nodes/gh_team), [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole), [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole), [GH_TeamRole](/opengraph/extensions/github/nodes/gh_teamrole), [GH_OrgSecret](/opengraph/extensions/github/nodes/gh_orgsecret), [GH_AppInstallation](/opengraph/extensions/github/nodes/gh_appinstallation), [GH_PersonalAccessToken](/opengraph/extensions/github/nodes/gh_personalaccesstoken), [GH_PersonalAccessTokenRequest](/opengraph/extensions/github/nodes/gh_personalaccesstokenrequest), [GH_RepoSecret](/opengraph/extensions/github/nodes/gh_reposecret), [GH_EnvironmentSecret](/opengraph/extensions/github/nodes/gh_environmentsecret), [GH_SecretScanningAlert](/opengraph/extensions/github/nodes/gh_secretscanningalert) | ❌ | -| [GH_HasBranch](/opengraph/extensions/github/edges/gh_hasbranch) | [GH_Branch](/opengraph/extensions/github/nodes/gh_branch) | ❌ | -| [GH_HasEnvironment](/opengraph/extensions/github/edges/gh_hasenvironment) | [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) | ❌ | -| [GH_HasSecret](/opengraph/extensions/github/edges/gh_hassecret) | [GH_OrgSecret](/opengraph/extensions/github/nodes/gh_orgsecret), [GH_RepoSecret](/opengraph/extensions/github/nodes/gh_reposecret), [GH_EnvironmentSecret](/opengraph/extensions/github/nodes/gh_environmentsecret) | ✅ | -| [GH_HasVariable](/opengraph/extensions/github/edges/gh_hasvariable) | [GH_OrgVariable](/opengraph/extensions/github/nodes/gh_orgvariable), [GH_RepoVariable](/opengraph/extensions/github/nodes/gh_repovariable) | ✅ | -| [GH_HasWorkflow](/opengraph/extensions/github/edges/gh_hasworkflow) | [GH_Workflow](/opengraph/extensions/github/nodes/gh_workflow) | ❌ | - -## Properties - -| Property Name | Data Type | Description | -| --------------------------- | --------- | ---------------------------------------------------------------------------- | -| objectid | string | The GitHub `node_id` of the repository, used as the unique graph identifier. | -| id | integer | The numeric GitHub ID of the repository. | -| node_id | string | The GitHub GraphQL node ID. Redundant with objectid. | -| name | string | The repository name. | -| full_name | string | The fully qualified name (e.g., `org/repo`). | -| environment_name | string | The name of the environment (GitHub organization). | -| environmentid | string | The node_id of the environment (GitHub organization). | -| owner_id | integer | The numeric ID of the repository owner. | -| owner_node_id | string | The node_id of the repository owner. | -| owner_name | string | The login of the repository owner. | -| private | boolean | Whether the repository is private. | -| visibility | string | The visibility level: `public`, `private`, or `internal`. | -| html_url | string | URL to the repository on GitHub. | -| description | string | The repository description. | -| created_at | datetime | When the repository was created. | -| updated_at | datetime | When the repository was last updated. | -| pushed_at | datetime | When the repository last had a push. | -| archived | boolean | Whether the repository is archived. | -| disabled | boolean | Whether the repository is disabled. | -| open_issues_count | integer | Number of open issues. | -| allow_forking | boolean | Whether forking is allowed. | -| web_commit_signoff_required | boolean | Whether web-based commits require sign-off. | -| forks | integer | Number of forks. | -| open_issues | integer | Number of open issues (includes pull requests). | -| watchers | integer | Number of watchers. | -| default_branch | string | The name of the default branch (e.g., `main`). | -| actions_enabled | boolean | Whether GitHub Actions is enabled for this repository. | -| secret_scanning | string | Status of secret scanning (e.g., `enabled`, `disabled`). | - -## Diagram - -```mermaid -flowchart TD - GH_Repository[fa:fa-box-archive GH_Repository] - GH_Organization[fa:fa-building GH_Organization] - GH_Branch[fa:fa-code-branch GH_Branch] - GH_Workflow[fa:fa-cogs GH_Workflow] - GH_Environment[fa:fa-leaf GH_Environment] - GH_OrgSecret[fa:fa-lock GH_OrgSecret] - GH_RepoSecret[fa:fa-lock GH_RepoSecret] - GH_OrgVariable[fa:fa-lock-open GH_OrgVariable] - GH_RepoVariable[fa:fa-lock-open GH_RepoVariable] - GH_SecretScanningAlert[fa:fa-key GH_SecretScanningAlert] - GH_RepoRole[fa:fa-user-tie GH_RepoRole] - AZFederatedIdentityCredential[fa:fa-id-card AZFederatedIdentityCredential] - - - GH_PersonalAccessToken[fa:fa-key GH_PersonalAccessToken] - - - GH_Organization -->|GH_Owns| GH_Repository - GH_Repository -.->|GH_HasBranch| GH_Branch - GH_Repository -.->|GH_HasWorkflow| GH_Workflow - GH_Repository -.->|GH_HasEnvironment| GH_Environment - GH_Repository -->|GH_HasSecret| GH_OrgSecret - GH_Repository -->|GH_HasSecret| GH_RepoSecret - GH_Repository -->|GH_HasVariable| GH_OrgVariable - GH_Repository -->|GH_HasVariable| GH_RepoVariable - GH_Repository -.->|GH_Contains| GH_RepoSecret - GH_Repository -.->|GH_Contains| GH_RepoVariable - GH_Repository -.->|GH_Contains| GH_SecretScanningAlert - GH_RepoRole -.->|GH_ReadRepoContents| GH_Repository - GH_RepoRole -.->|GH_WriteRepoContents| GH_Repository - GH_RepoRole -.->|GH_AdminTo| GH_Repository - GH_RepoRole -.->|GH_BypassBranchProtection| GH_Repository - GH_RepoRole -.->|GH_EditRepoProtections| GH_Repository - GH_RepoRole -.->|GH_ViewSecretScanningAlerts| GH_Repository - %% Note: Additional non-traversable permission edges (issue triage, discussions, settings) omitted for readability. - GH_RepoRole -.->|GH_ReadCodeScanning| GH_Repository - GH_RepoRole -.->|GH_WriteCodeScanning| GH_Repository - GH_RepoRole -.->|GH_ViewDependabotAlerts| GH_Repository - GH_RepoRole -.->|GH_ResolveDependabotAlerts| GH_Repository - GH_RepoRole -.->|GH_DeleteIssue| GH_Repository - GH_RepoRole -.->|GH_CreateTag| GH_Repository - GH_RepoRole -.->|GH_DeleteTag| GH_Repository - GH_RepoRole -->|GH_CanCreateBranch| GH_Repository - GH_RepoRole -->|GH_CanEditProtection| GH_Repository - GH_Repository -->|GH_CanAssumeIdentity| AZFederatedIdentityCredential -``` diff --git a/docs/opengraph/extensions/github/nodes/gh_repovariable.mdx b/docs/opengraph/extensions/github/nodes/gh_repovariable.mdx index 876f15a5..5b14661f 100644 --- a/docs/opengraph/extensions/github/nodes/gh_repovariable.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_repovariable.mdx @@ -1,52 +1,11 @@ ---- -title: 'GH_RepoVariable' -description: 'A repository-level GitHub Actions variable accessible only to workflows in that repository. Unlike secrets, variable values are readable.' -icon: '/images/extensions/github/gh_repovariable.png' ---- - -Applies to BloodHound Enterprise and CE - +--- +title: 'GH_RepoVariable' +description: 'A repository-level GitHub Actions variable accessible only to workflows in that repository. Unlike secrets, variable values are readable.' +icon: '/images/extensions/github/gh_repovariable.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + Represents a repository-level GitHub Actions variable. These are variables defined directly on a specific repository and are only accessible to workflows running in that repository. Unlike secrets, variable values are readable via the API. - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [GH_HasVariable](/opengraph/extensions/github/edges/gh_hasvariable) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ✅ | - -### Outbound Edges - -No outbound edges are defined by the GitHub extension for this node. - -## Properties - -| Property Name | Data Type | Description | -| ---------------- | --------- | --------------------------------------------------------------------------- | -| objectid | string | A deterministic ID in the format `GH_Variable_{repoNodeId}_{variableName}`. | -| id | string | Same as objectid. | -| name | string | The name of the variable. | -| environment_name | string | The name of the environment (GitHub organization). | -| environmentid | string | The node_id of the environment (GitHub organization). | -| repository_name | string | The name of the containing repository. | -| repository_id | string | The node_id of the containing repository. | -| value | string | The plaintext value of the variable. | -| created_at | datetime | When the variable was created. | -| updated_at | datetime | When the variable was last updated. | - -## Diagram - -```mermaid -flowchart TD - GH_RepoVariable[fa:fa-lock-open GH_RepoVariable] - GH_Repository[fa:fa-box-archive GH_Repository] - - - GH_Repository -.->|GH_Contains| GH_RepoVariable - GH_Repository -->|GH_HasVariable| GH_RepoVariable -``` diff --git a/docs/opengraph/extensions/github/nodes/gh_samlidentityprovider.mdx b/docs/opengraph/extensions/github/nodes/gh_samlidentityprovider.mdx index eb780b2a..8c0d8e26 100644 --- a/docs/opengraph/extensions/github/nodes/gh_samlidentityprovider.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_samlidentityprovider.mdx @@ -1,56 +1,11 @@ ---- -title: 'GH_SamlIdentityProvider' -description: 'A SAML identity provider configured for the organization, enabling SSO' -icon: '/images/extensions/github/gh_samlidentityprovider.png' ---- - -Applies to BloodHound Enterprise and CE - +--- +title: 'GH_SamlIdentityProvider' +description: 'A SAML identity provider configured for the organization, enabling SSO' +icon: '/images/extensions/github/gh_samlidentityprovider.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + Represents a SAML identity provider configured for the organization. This node captures the SAML SSO configuration details and serves as the parent container for external identity mappings. Through external identities, it enables linking GitHub users to their corporate identities in the identity provider. - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [GH_HasSamlIdentityProvider](/opengraph/extensions/github/edges/gh_hassamlidentityprovider) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) | ❌ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [GH_HasExternalIdentity](/opengraph/extensions/github/edges/gh_hasexternalidentity) | [GH_ExternalIdentity](/opengraph/extensions/github/nodes/gh_externalidentity) | ❌ | - -## Properties - -| Property Name | Data Type | Description | -| --------------------- | --------- | ---------------------------------------------------------- | -| objectid | string | The GraphQL ID of the SAML identity provider. | -| name | string | Same as objectid. | -| node_id | string | Same as objectid. | -| environment_name | string | The name of the environment (GitHub organization). | -| environmentid | string | The GraphQL ID of the environment (GitHub organization). | -| foreign_environmentid | string | The ID of the foreign environment linked to this provider. | -| digest_method | string | The digest method used by the SAML provider. | -| idp_certificate | string | The identity provider's X.509 certificate. | -| issuer | string | The SAML issuer URL. | -| signature_method | string | The signature method used by the SAML provider. | -| sso_url | string | The SAML single sign-on URL. | - -## Diagram - -```mermaid -flowchart TD - GH_Organization[fa:fa-building GH_Organization] - GH_SamlIdentityProvider[fa:fa-id-badge GH_SamlIdentityProvider] - GH_ExternalIdentity[fa:fa-arrows-left-right GH_ExternalIdentity] - - - GH_Organization -.->|GH_HasSamlIdentityProvider| GH_SamlIdentityProvider - GH_SamlIdentityProvider -.->|GH_HasExternalIdentity| GH_ExternalIdentity -``` diff --git a/docs/opengraph/extensions/github/nodes/gh_secretscanningalert.mdx b/docs/opengraph/extensions/github/nodes/gh_secretscanningalert.mdx index e4544e8d..b3084eeb 100644 --- a/docs/opengraph/extensions/github/nodes/gh_secretscanningalert.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_secretscanningalert.mdx @@ -1,63 +1,11 @@ ---- -title: 'GH_SecretScanningAlert' -description: 'A GitHub Advanced Security alert indicating a secret was accidentally committed to a repository' -icon: '/images/extensions/github/gh_secretscanningalert.png' ---- - -Applies to BloodHound Enterprise and CE - +--- +title: 'GH_SecretScanningAlert' +description: 'A GitHub Advanced Security alert indicating a secret was accidentally committed to a repository' +icon: '/images/extensions/github/gh_secretscanningalert.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + Represents a GitHub secret scanning alert detected in a repository. Secret scanning alerts are raised when GitHub detects a known secret pattern (such as an API key, token, or credential) committed to a repository. The alert captures the secret type, validity status, and current resolution state. - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [GH_CanReadSecretScanningAlert](/opengraph/extensions/github/edges/gh_canreadsecretscanningalert) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole), [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | ✅ | -| [GH_Contains](/opengraph/extensions/github/edges/gh_contains) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization), [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) | ❌ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [GH_ValidToken](/opengraph/extensions/github/edges/gh_validtoken) | [GH_User](/opengraph/extensions/github/nodes/gh_user) | ✅ | - -## Properties - -| Property Name | Data Type | Description | -| ------------------------ | --------- | ---------------------------------------------------------------------------------------------- | -| objectid | string | A deterministic Base64-encoded ID derived from the organization, repository, and alert number. | -| id | string | Same as objectid. | -| name | string | The alert number. | -| repository_name | string | The name of the repository where the secret was detected. | -| repository_id | string | The node_id of the repository. | -| repository_url | string | The HTML URL of the repository. | -| secret_type | string | The type of secret detected (e.g., `github_personal_access_token`, `aws_access_key_id`). | -| secret_type_display_name | string | A human-readable name for the secret type. | -| validity | string | The validity status of the detected secret (e.g., `active`, `inactive`, `unknown`). | -| state | string | The alert state (e.g., `open`, `resolved`). | -| created_at | datetime | When the alert was created. | -| updated_at | datetime | When the alert was last updated. | -| url | string | The HTML URL to view the alert on GitHub. | - -## Diagram - -```mermaid -flowchart TD - GH_Repository[fa:fa-box-archive GH_Repository] - GH_SecretScanningAlert[fa:fa-key GH_SecretScanningAlert] - GH_User[fa:fa-user GH_User] - GH_OrgRole[fa:fa-user-tie GH_OrgRole] - GH_RepoRole[fa:fa-user-tie GH_RepoRole] - - - GH_Repository -.->|GH_Contains| GH_SecretScanningAlert - GH_SecretScanningAlert -->|GH_ValidToken| GH_User - GH_OrgRole -->|GH_CanReadSecretScanningAlert| GH_SecretScanningAlert - GH_RepoRole -->|GH_CanReadSecretScanningAlert| GH_SecretScanningAlert -``` diff --git a/docs/opengraph/extensions/github/nodes/gh_team.mdx b/docs/opengraph/extensions/github/nodes/gh_team.mdx index 4ab89114..161f27a5 100644 --- a/docs/opengraph/extensions/github/nodes/gh_team.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_team.mdx @@ -1,73 +1,11 @@ ---- -title: 'GH_Team' -description: 'A team within an organization, grouping users for shared access and collaboration' -icon: '/images/extensions/github/gh_team.png' ---- - -Applies to BloodHound Enterprise and CE - +--- +title: 'GH_Team' +description: 'A team within an organization, grouping users for shared access and collaboration' +icon: '/images/extensions/github/gh_team.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + Represents a GitHub team within the organization. Teams can have parent-child relationships, contain members with different roles (Member, Maintainer), and be assigned to repository roles. - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [GH_AddMember](/opengraph/extensions/github/edges/gh_addmember) | [GH_TeamRole](/opengraph/extensions/github/nodes/gh_teamrole) | ✅ | -| [GH_Contains](/opengraph/extensions/github/edges/gh_contains) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization), [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) | ❌ | -| [GH_MemberOf](/opengraph/extensions/github/edges/gh_memberof) | [GH_TeamRole](/opengraph/extensions/github/nodes/gh_teamrole), [GH_Team](/opengraph/extensions/github/nodes/gh_team) | ✅ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [GH_BypassPullRequestAllowances](/opengraph/extensions/github/edges/gh_bypasspullrequestallowances) | [GH_BranchProtectionRule](/opengraph/extensions/github/nodes/gh_branchprotectionrule) | ❌ | -| [GH_CanCreateBranch](/opengraph/extensions/github/edges/gh_cancreatebranch) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ✅ | -| [GH_CanWriteBranch](/opengraph/extensions/github/edges/gh_canwritebranch) | [GH_Branch](/opengraph/extensions/github/nodes/gh_branch) | ✅ | -| [GH_HasRole](/opengraph/extensions/github/edges/gh_hasrole) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole), [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole), [GH_TeamRole](/opengraph/extensions/github/nodes/gh_teamrole) | ✅ | -| [GH_MemberOf](/opengraph/extensions/github/edges/gh_memberof) | [GH_Team](/opengraph/extensions/github/nodes/gh_team) | ✅ | -| [GH_RestrictionsCanPush](/opengraph/extensions/github/edges/gh_restrictionscanpush) | [GH_BranchProtectionRule](/opengraph/extensions/github/nodes/gh_branchprotectionrule) | ❌ | - -## Properties - -| Property Name | Data Type | Description | -| ---------------- | --------- | ------------------------------------------------------------------------- | -| objectid | string | The GitHub GraphQL `id` of the team, used as the unique graph identifier. | -| name | string | The team's display name, derived from the slug property. | -| id | string | The GraphQL ID of the team. | -| node_id | string | The GitHub node ID. Redundant with objectid. | -| slug | string | The team's URL-safe slug identifier. | -| description | string | The team's description. | -| privacy | string | The team's privacy level (e.g., `visible`, `secret`). | -| permission | string | The team's default permission on repositories. | -| environment_name | string | The name of the environment (GitHub organization). | -| environmentid | string | The node_id of the environment (GitHub organization). | - -## Diagram - -```mermaid -flowchart TD - GH_Team[fa:fa-user-group GH_Team] - GH_OrgRole[fa:fa-user-tie GH_OrgRole] - GH_RepoRole[fa:fa-user-tie GH_RepoRole] - GH_TeamRole[fa:fa-user-tie GH_TeamRole] - GH_Branch[fa:fa-code-branch GH_Branch] - GH_BranchProtectionRule[fa:fa-shield GH_BranchProtectionRule] - GH_Repository[fa:fa-box-archive GH_Repository] - - - GH_Team -->|GH_MemberOf| GH_Team - GH_Team -->|GH_HasRole| GH_OrgRole - GH_Team -->|GH_HasRole| GH_RepoRole - GH_Team -.->|GH_BypassPullRequestAllowances| GH_BranchProtectionRule - GH_Team -.->|GH_RestrictionsCanPush| GH_BranchProtectionRule - GH_Team -->|GH_CanWriteBranch| GH_Branch - GH_Team -->|GH_CanCreateBranch| GH_Repository - GH_TeamRole -->|GH_MemberOf| GH_Team - GH_TeamRole -->|GH_AddMember| GH_Team -``` diff --git a/docs/opengraph/extensions/github/nodes/gh_teamrole.mdx b/docs/opengraph/extensions/github/nodes/gh_teamrole.mdx index 33aed4e5..74e1fbd4 100644 --- a/docs/opengraph/extensions/github/nodes/gh_teamrole.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_teamrole.mdx @@ -1,55 +1,11 @@ ---- -title: 'GH_TeamRole' -description: 'The role a user has within a team (e.g., maintainer, member)' -icon: '/images/extensions/github/gh_teamrole.png' ---- - -Applies to BloodHound Enterprise and CE - +--- +title: 'GH_TeamRole' +description: 'The role a user has within a team (e.g., maintainer, member)' +icon: '/images/extensions/github/gh_teamrole.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + Represents a role within a GitHub team. Each team has two built-in roles: Member and Maintainer. Maintainers can add and remove team members. Team roles connect users to teams and transitively to any repository roles assigned to the team. - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [GH_Contains](/opengraph/extensions/github/edges/gh_contains) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization), [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) | ❌ | -| [GH_HasRole](/opengraph/extensions/github/edges/gh_hasrole) | [GH_User](/opengraph/extensions/github/nodes/gh_user), [GH_Team](/opengraph/extensions/github/nodes/gh_team) | ✅ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [GH_AddMember](/opengraph/extensions/github/edges/gh_addmember) | [GH_Team](/opengraph/extensions/github/nodes/gh_team) | ✅ | -| [GH_MemberOf](/opengraph/extensions/github/edges/gh_memberof) | [GH_Team](/opengraph/extensions/github/nodes/gh_team) | ✅ | - -## Properties - -| Property Name | Data Type | Description | -| ---------------- | --------- | ------------------------------------------------------------------------------------ | -| objectid | string | A deterministic ID derived from the team ID and role name (e.g., `{teamId}_member`). | -| name | string | The fully qualified role name (e.g., `TeamSlug\member`). | -| id | string | Same as objectid. | -| short_name | string | The short role name: `member` or `maintainer`. | -| type | string | Always `default` for team roles. | -| environment_name | string | The name of the environment (GitHub organization). | -| environmentid | string | The node_id of the environment (GitHub organization). | - -## Diagram - -```mermaid -flowchart TD - GH_TeamRole[fa:fa-user-tie GH_TeamRole] - GH_User[fa:fa-user GH_User] - GH_Team[fa:fa-user-group GH_Team] - - - GH_User -->|GH_HasRole| GH_TeamRole - GH_TeamRole -->|GH_MemberOf| GH_Team - GH_TeamRole -->|GH_AddMember| GH_Team -``` diff --git a/docs/opengraph/extensions/github/nodes/gh_user.mdx b/docs/opengraph/extensions/github/nodes/gh_user.mdx index 48cb813c..9281e639 100644 --- a/docs/opengraph/extensions/github/nodes/gh_user.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_user.mdx @@ -1,87 +1,11 @@ ---- -title: 'GH_User' -description: 'An individual GitHub user account' -icon: '/images/extensions/github/gh_user.png' ---- - -Applies to BloodHound Enterprise and CE - +--- +title: 'GH_User' +description: 'An individual GitHub user account' +icon: '/images/extensions/github/gh_user.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + Represents a GitHub user who is a member of the organization. Users are associated with organization roles (Owner or Member) and can be assigned to repository roles and team roles. - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [GH_Contains](/opengraph/extensions/github/edges/gh_contains) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization), [GH_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) | ❌ | -| [GH_MapsToUser](/opengraph/extensions/github/edges/gh_mapstouser) | [GH_ExternalIdentity](/opengraph/extensions/github/nodes/gh_externalidentity) | ❌ | -| [GH_SyncedTo](/opengraph/extensions/github/edges/gh_syncedto) | [AZUser](/resources/nodes/az-user), [Okta_User](/opengraph/extensions/okta/nodes/okta_user), [PingOneUser](https://github.com/andyrobbins/PingOneHound?tab=readme-ov-file#schema) | ✅ | -| [GH_ValidToken](/opengraph/extensions/github/edges/gh_validtoken) | [GH_SecretScanningAlert](/opengraph/extensions/github/nodes/gh_secretscanningalert) | ✅ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [GH_BypassPullRequestAllowances](/opengraph/extensions/github/edges/gh_bypasspullrequestallowances) | [GH_BranchProtectionRule](/opengraph/extensions/github/nodes/gh_branchprotectionrule) | ❌ | -| [GH_CanCreateBranch](/opengraph/extensions/github/edges/gh_cancreatebranch) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ✅ | -| [GH_CanWriteBranch](/opengraph/extensions/github/edges/gh_canwritebranch) | [GH_Branch](/opengraph/extensions/github/nodes/gh_branch) | ✅ | -| [GH_HasPersonalAccessToken](/opengraph/extensions/github/edges/gh_haspersonalaccesstoken) | [GH_PersonalAccessToken](/opengraph/extensions/github/nodes/gh_personalaccesstoken) | ❌ | -| [GH_HasPersonalAccessTokenRequest](/opengraph/extensions/github/edges/gh_haspersonalaccesstokenrequest) | [GH_PersonalAccessTokenRequest](/opengraph/extensions/github/nodes/gh_personalaccesstokenrequest) | ❌ | -| [GH_HasRole](/opengraph/extensions/github/edges/gh_hasrole) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole), [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole), [GH_TeamRole](/opengraph/extensions/github/nodes/gh_teamrole) | ✅ | -| [GH_RestrictionsCanPush](/opengraph/extensions/github/edges/gh_restrictionscanpush) | [GH_BranchProtectionRule](/opengraph/extensions/github/nodes/gh_branchprotectionrule) | ❌ | - -## Properties - -| Property Name | Data Type | Description | -| ---------------- | --------- | ---------------------------------------------------------------------- | -| objectid | string | The GitHub `node_id` of the user, used as the unique graph identifier. | -| name | string | The user's display name, derived from the login property. | -| login | string | The user's GitHub login handle. | -| company | string | The company listed on the user's profile. | -| email | string | The user's public email address. | -| full_name | string | The user's full name from their profile. | -| id | integer | The numeric GitHub ID of the user. | -| node_id | string | The GitHub GraphQL node ID. Redundant with objectid. | -| environment_name | string | The name of the environment (GitHub organization) the user belongs to. | -| environmentid | string | The node_id of the environment (GitHub organization). | - -## Diagram - -```mermaid -flowchart TD - GH_User[fa:fa-user GH_User] - GH_OrgRole[fa:fa-user-tie GH_OrgRole] - GH_RepoRole[fa:fa-user-tie GH_RepoRole] - GH_TeamRole[fa:fa-user-tie GH_TeamRole] - GH_Branch[fa:fa-code-branch GH_Branch] - GH_ExternalIdentity[fa:fa-arrows-left-right GH_ExternalIdentity] - AZUser[fa:fa-user AZUser] - Okta_User[fa:fa-user Okta_User] - PingOneUser[fa:fa-user PingOneUser] - - - GH_PersonalAccessToken[fa:fa-key GH_PersonalAccessToken] - GH_PersonalAccessTokenRequest[fa:fa-key GH_PersonalAccessTokenRequest] - - - GH_BranchProtectionRule[fa:fa-shield GH_BranchProtectionRule] - GH_Repository[fa:fa-box-archive GH_Repository] - - - GH_User -->|GH_HasRole| GH_OrgRole - GH_User -->|GH_HasRole| GH_TeamRole - GH_User -->|GH_HasRole| GH_RepoRole - GH_User -.->|GH_BypassPullRequestAllowances| GH_BranchProtectionRule - GH_User -.->|GH_RestrictionsCanPush| GH_BranchProtectionRule - GH_User -->|GH_CanWriteBranch| GH_Branch - GH_User -->|GH_CanCreateBranch| GH_Repository - GH_ExternalIdentity -.->|GH_MapsToUser| GH_User - AZUser -->|GH_SyncedTo| GH_User - Okta_User -->|GH_SyncedTo| GH_User - PingOneUser -->|GH_SyncedTo| GH_User -``` diff --git a/docs/opengraph/extensions/github/nodes/gh_workflow.mdx b/docs/opengraph/extensions/github/nodes/gh_workflow.mdx index c4242d8d..1a9b1cfe 100644 --- a/docs/opengraph/extensions/github/nodes/gh_workflow.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_workflow.mdx @@ -1,55 +1,11 @@ ---- -title: 'GH_Workflow' -description: 'A GitHub Actions workflow defined in a repository' -icon: '/images/extensions/github/gh_workflow.png' ---- - -Applies to BloodHound Enterprise and CE - +--- +title: 'GH_Workflow' +description: 'A GitHub Actions workflow defined in a repository' +icon: '/images/extensions/github/gh_workflow.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + Represents a GitHub Actions workflow defined in a repository. Workflow nodes capture the workflow definition metadata including its file path, state, containing repository, and the full YAML contents of the workflow file. Only repositories with GitHub Actions enabled are queried for workflows. - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [GH_HasWorkflow](/opengraph/extensions/github/edges/gh_hasworkflow) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | ❌ | - -### Outbound Edges - -No outbound edges are defined by the GitHub extension for this node. - -## Properties - -| Property Name | Data Type | Description | -| ---------------- | --------- | ---------------------------------------------------------------------------- | -| objectid | string | The GitHub `node_id` of the workflow, used as the unique graph identifier. | -| name | string | The fully qualified workflow name (e.g., `repoName\CI Build`). | -| short_name | string | The workflow's display name. | -| node_id | string | The GitHub GraphQL node ID. Redundant with objectid. | -| environment_name | string | The name of the environment (GitHub organization). | -| environmentid | string | The node_id of the environment (GitHub organization). | -| repository_name | string | The full name of the containing repository. | -| repository_id | string | The node_id of the containing repository. | -| path | string | The file path of the workflow definition (e.g., `.github/workflows/ci.yml`). | -| state | string | The workflow state (e.g., `active`, `disabled_manually`). | -| url | string | The API URL for the workflow. | -| html_url | string | The GitHub web URL for the workflow file. | -| branch | string | The branch where the workflow file was found. | -| contents | string | The full YAML contents of the workflow file, downloaded from the repository. | - -## Diagram - -```mermaid -flowchart TD - GH_Workflow[fa:fa-cogs GH_Workflow] - GH_Repository[fa:fa-box-archive GH_Repository] - - - GH_Repository -.->|GH_HasWorkflow| GH_Workflow -``` diff --git a/docs/opengraph/extensions/github/nodes/gh_workflowjob.mdx b/docs/opengraph/extensions/github/nodes/gh_workflowjob.mdx index d4139b9c..d545bb19 100644 --- a/docs/opengraph/extensions/github/nodes/gh_workflowjob.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_workflowjob.mdx @@ -1,47 +1,11 @@ ---- -title: 'GH_WorkflowJob' -description: 'A job within a GitHub Actions workflow, with a runner, permissions, and an ordered list of steps' -icon: '/images/extensions/github/gh_workflowjob.png' ---- - -Applies to BloodHound Enterprise and CE - -Represents a single job within a GitHub Actions workflow. Jobs are the top-level execution units of a workflow. They run on a runner, hold a set of steps, and can declare permissions, environments, and dependencies on other jobs. - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [GH_DependsOn](/opengraph/extensions/github/edges/gh_dependson) | [GH_WorkflowJob](/opengraph/extensions/github/nodes/gh_workflowjob) | ❌ | -| [GH_HasJob](/opengraph/extensions/github/edges/gh_hasjob) | [GH_Workflow](/opengraph/extensions/github/nodes/gh_workflow) | ❌ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [GH_CallsWorkflow](/opengraph/extensions/github/edges/gh_callsworkflow) | [GH_Workflow](/opengraph/extensions/github/nodes/gh_workflow) | ❌ | -| [GH_DependsOn](/opengraph/extensions/github/edges/gh_dependson) | [GH_WorkflowJob](/opengraph/extensions/github/nodes/gh_workflowjob) | ❌ | -| [GH_DeploysTo](/opengraph/extensions/github/edges/gh_deploysto) | [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) | ❌ | -| [GH_HasStep](/opengraph/extensions/github/edges/gh_hasstep) | [GH_WorkflowStep](/opengraph/extensions/github/nodes/gh_workflowstep) | ❌ | - -## Diagram - -```mermaid -flowchart TD - GH_Workflow[fa:fa-cogs GH_Workflow] - GH_WorkflowJob1[fa:fa-gear GH_WorkflowJob] - GH_WorkflowJob2[fa:fa-gear GH_WorkflowJob] - GH_WorkflowStep[fa:fa-shoe-prints GH_WorkflowStep] - GH_Environment[fa:fa-leaf GH_Environment] - - GH_Workflow -.->|GH_HasJob| GH_WorkflowJob1 - GH_WorkflowJob1 -.->|GH_DependsOn| GH_WorkflowJob2 - GH_WorkflowJob1 -.->|GH_HasStep| GH_WorkflowStep - GH_WorkflowJob1 -.->|GH_DeploysTo| GH_Environment -``` +--- +title: 'GH_WorkflowJob' +description: 'A job within a GitHub Actions workflow, with a runner, permissions, and an ordered list of steps' +icon: '/images/extensions/github/gh_workflowjob.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + +Represents a single job within a GitHub Actions workflow. Jobs are the top-level execution units of a workflow — they run on a runner, hold a set of steps, and can declare permissions, environments, and dependencies on other jobs. diff --git a/docs/opengraph/extensions/github/nodes/gh_workflowstep.mdx b/docs/opengraph/extensions/github/nodes/gh_workflowstep.mdx index c0d39b55..a1da8006 100644 --- a/docs/opengraph/extensions/github/nodes/gh_workflowstep.mdx +++ b/docs/opengraph/extensions/github/nodes/gh_workflowstep.mdx @@ -1,42 +1,11 @@ ---- -title: 'GH_WorkflowStep' -description: 'A single step within a GitHub Actions job — either a uses: action reference or a run: shell command' -icon: '/images/extensions/github/gh_workflowstep.png' ---- - -Applies to BloodHound Enterprise and CE - +--- +title: 'GH_WorkflowStep' +description: 'A single step within a GitHub Actions job — either a uses: action reference or a run: shell command' +icon: '/images/extensions/github/gh_workflowstep.png' +--- + +Applies to BloodHound Enterprise and CE + +## Description + Represents a single step within a GitHub Actions job. A step is either a `uses:` action reference or a `run:` shell command. Steps are the leaf nodes of the workflow execution tree and are the primary location where secrets and variables are consumed. - -## Edges - - -The tables below list edges defined by the GitHub extension only. Additional edges to or from this node may be created by other extensions. - - -### Inbound Edges - -| Edge Type | Source Node Types | Traversable | -| --------- | ----------------- | ----------- | -| [GH_HasStep](/opengraph/extensions/github/edges/gh_hasstep) | [GH_WorkflowJob](/opengraph/extensions/github/nodes/gh_workflowjob) | ❌ | - -### Outbound Edges - -| Edge Type | Destination Node Types | Traversable | -| --------- | ---------------------- | ----------- | -| [GH_UsesSecret](/opengraph/extensions/github/edges/gh_usessecret) | [GH_RepoSecret](/opengraph/extensions/github/nodes/gh_reposecret), [GH_OrgSecret](/opengraph/extensions/github/nodes/gh_orgsecret) | ❌ | -| [GH_UsesVariable](/opengraph/extensions/github/edges/gh_usesvariable) | [GH_RepoVariable](/opengraph/extensions/github/nodes/gh_repovariable), [GH_OrgVariable](/opengraph/extensions/github/nodes/gh_orgvariable) | ❌ | - -## Diagram - -```mermaid -flowchart TD - GH_WorkflowJob[fa:fa-gear GH_WorkflowJob] - GH_WorkflowStep[fa:fa-shoe-prints GH_WorkflowStep] - GH_RepoSecret[fa:fa-lock GH_RepoSecret] - GH_OrgVariable[fa:fa-sliders GH_OrgVariable] - - GH_WorkflowJob -.->|GH_HasStep| GH_WorkflowStep - GH_WorkflowStep -.->|GH_UsesSecret| GH_RepoSecret - GH_WorkflowStep -.->|GH_UsesVariable| GH_OrgVariable -``` diff --git a/docs/opengraph/extensions/github/queries.mdx b/docs/opengraph/extensions/github/queries.mdx index a9dc114f..4a89c221 100644 --- a/docs/opengraph/extensions/github/queries.mdx +++ b/docs/opengraph/extensions/github/queries.mdx @@ -258,7 +258,7 @@ This query can be imported into BloodHound from the [dependency-graph-disabled-n Finds deployment environments where administrators can bypass protection rules such as required reviewers and wait timers. Admins can deploy to these environments without any approval. ```cypher -MATCH p=(:GH_Repository)-[:GH_HasEnvironment]->(env:GH_Environment {can_admins_bypass: true}) +MATCH p=(:GH_Repository)-[:GH_Contains]->(env:GH_Environment {can_admins_bypass: true}) RETURN p LIMIT 1000 ``` @@ -557,7 +557,7 @@ This query can be imported into BloodHound from the [repos-vulnerable-to-workflo Returns all repository workflows ```cypher -MATCH p=(:GH_Repository)-[:GH_HasWorkflow]->(:GH_Workflow) +MATCH p=(:GH_Repository)-[:GH_Contains]->(:GH_Workflow) RETURN p LIMIT 1000 ``` @@ -646,7 +646,7 @@ This query can be imported into BloodHound from the [team-structure.json](https: Returns all unprotected branches in repositories. ```cypher -MATCH p=(repo:GH_Repository)-[:GH_HasBranch]-(:GH_Branch {protected: false}) +MATCH p=(repo:GH_Repository)-[:GH_Contains]-(:GH_Branch {protected: false}) RETURN p LIMIT 1000 ``` @@ -658,8 +658,8 @@ This query can be imported into BloodHound from the [unprotected-branches.json]( Returns all repositories that have GitHub Actions workflows and an unprotected default branch. This means that users with GH_WriteRepoContents to the Repository can overwrite or change the workflow. ```cypher -MATCH p=(repo:GH_Repository)-[:GH_HasWorkflow]->(:GH_Workflow) -MATCH p1=(repo)-[:GH_HasBranch]->(branch:GH_Branch) +MATCH p=(repo:GH_Repository)-[:GH_Contains]->(:GH_Workflow) +MATCH p1=(repo)-[:GH_Contains]->(branch:GH_Branch) WHERE repo.default_branch = branch.short_name AND branch.protected = false RETURN p1 @@ -673,7 +673,7 @@ This query can be imported into BloodHound from the [unprotected-default-branch- Returns all default branches in repositories that are not protected. ```cypher -MATCH p=(repo:GH_Repository)-[:GH_HasBranch]-(branch:GH_Branch {protected: false}) +MATCH p=(repo:GH_Repository)-[:GH_Contains]-(branch:GH_Branch {protected: false}) WHERE repo.default_branch = branch.short_name RETURN p LIMIT 1000 diff --git a/docs/opengraph/extensions/github/schema.mdx b/docs/opengraph/extensions/github/schema.mdx index 7d58d625..fcfe3289 100644 --- a/docs/opengraph/extensions/github/schema.mdx +++ b/docs/opengraph/extensions/github/schema.mdx @@ -1,6 +1,6 @@ --- title: Schema -description: GitHub extension definition schema +description: GitHub extension schema definition icon: circle-nodes --- @@ -9,13 +9,13 @@ icon: circle-nodes **Name:** SOGitHub
**Display Name:** GitHub Extension (by SpecterOps)
-**Version:** v1.2.3
+**Version:** v1.3.0
**Namespace:** GH
**Environment Kind:** GH_Organization
**Source Kind:** GitHub -This file is automatically generated from the [extension definition schema file](https://github.com/SpecterOps/openhound-github/blob/main/extension/schema.json). +This file is automatically generated from the [extension schema definition file](https://github.com/SpecterOps/openhound-github/blob/main/extension/schema.json). ## Nodes @@ -26,20 +26,28 @@ This file is automatically generated from the [extension definition schema file] | ![GH_AppInstallation](/images/extensions/github/gh_appinstallation.png) | [GH_AppInstallation](/opengraph/extensions/github/nodes/gh_appinstallation) | GitHub App Installation | | ![GH_Branch](/images/extensions/github/gh_branch.png) | [GH_Branch](/opengraph/extensions/github/nodes/gh_branch) | GitHub Branch | | ![GH_BranchProtectionRule](/images/extensions/github/gh_branchprotectionrule.png) | [GH_BranchProtectionRule](/opengraph/extensions/github/nodes/gh_branchprotectionrule) | GitHub Branch Protection Rule | +| ![GH_Enterprise](/images/extensions/github/gh_enterprise.png) | [GH_Enterprise](/opengraph/extensions/github/nodes/gh_enterprise) | GitHub Enterprise | +| ![GH_EnterpriseManagedUser](/images/extensions/github/gh_enterprisemanageduser.png) | [GH_EnterpriseManagedUser](/opengraph/extensions/github/nodes/gh_enterprisemanageduser) | GitHub Enterprise Managed User | +| ![GH_EnterpriseRole](/images/extensions/github/gh_enterpriserole.png) | [GH_EnterpriseRole](/opengraph/extensions/github/nodes/gh_enterpriserole) | GitHub Enterprise Role | +| ![GH_EnterpriseTeam](/images/extensions/github/gh_enterpriseteam.png) | [GH_EnterpriseTeam](/opengraph/extensions/github/nodes/gh_enterpriseteam) | GitHub Enterprise Team | | ![GH_Environment](/images/extensions/github/gh_environment.png) | [GH_Environment](/opengraph/extensions/github/nodes/gh_environment) | GitHub Environment | +| ![GH_EnvironmentBranchPolicy](/images/extensions/github/gh_environmentbranchpolicy.png) | [GH_EnvironmentBranchPolicy](/opengraph/extensions/github/nodes/gh_environmentbranchpolicy) | GitHub Environment Branch Policy | | ![GH_EnvironmentSecret](/images/extensions/github/gh_environmentsecret.png) | [GH_EnvironmentSecret](/opengraph/extensions/github/nodes/gh_environmentsecret) | GitHub Environment Secret | | ![GH_EnvironmentVariable](/images/extensions/github/gh_environmentvariable.png) | [GH_EnvironmentVariable](/opengraph/extensions/github/nodes/gh_environmentvariable) | GitHub Environment Variable | | ![GH_ExternalIdentity](/images/extensions/github/gh_externalidentity.png) | [GH_ExternalIdentity](/opengraph/extensions/github/nodes/gh_externalidentity) | GitHub External Identity | | ![GH_Organization](/images/extensions/github/gh_organization.png) | [GH_Organization](/opengraph/extensions/github/nodes/gh_organization) | GitHub Organization | | ![GH_OrgRole](/images/extensions/github/gh_orgrole.png) | [GH_OrgRole](/opengraph/extensions/github/nodes/gh_orgrole) | GitHub Org Role | +| ![GH_OrgRunner](/images/extensions/github/gh_orgrunner.png) | [GH_OrgRunner](/opengraph/extensions/github/nodes/gh_orgrunner) | GitHub Org Runner | | ![GH_OrgSecret](/images/extensions/github/gh_orgsecret.png) | [GH_OrgSecret](/opengraph/extensions/github/nodes/gh_orgsecret) | GitHub Org Secret | | ![GH_OrgVariable](/images/extensions/github/gh_orgvariable.png) | [GH_OrgVariable](/opengraph/extensions/github/nodes/gh_orgvariable) | GitHub Org Variable | | ![GH_PersonalAccessToken](/images/extensions/github/gh_personalaccesstoken.png) | [GH_PersonalAccessToken](/opengraph/extensions/github/nodes/gh_personalaccesstoken) | GitHub Personal Access Token | | ![GH_PersonalAccessTokenRequest](/images/extensions/github/gh_personalaccesstokenrequest.png) | [GH_PersonalAccessTokenRequest](/opengraph/extensions/github/nodes/gh_personalaccesstokenrequest) | GitHub Personal Access Token Request | | ![GH_RepoRole](/images/extensions/github/gh_reporole.png) | [GH_RepoRole](/opengraph/extensions/github/nodes/gh_reporole) | GitHub Repo Role | +| ![GH_RepoRunner](/images/extensions/github/gh_reporunner.png) | [GH_RepoRunner](/opengraph/extensions/github/nodes/gh_reporunner) | GitHub Repo Runner | | ![GH_RepoSecret](/images/extensions/github/gh_reposecret.png) | [GH_RepoSecret](/opengraph/extensions/github/nodes/gh_reposecret) | GitHub Repo Secret | | ![GH_Repository](/images/extensions/github/gh_repository.png) | [GH_Repository](/opengraph/extensions/github/nodes/gh_repository) | GitHub Repository | | ![GH_RepoVariable](/images/extensions/github/gh_repovariable.png) | [GH_RepoVariable](/opengraph/extensions/github/nodes/gh_repovariable) | GitHub Repo Variable | +| ![GH_RunnerGroup](/images/extensions/github/gh_runnergroup.png) | [GH_RunnerGroup](/opengraph/extensions/github/nodes/gh_runnergroup) | GitHub Runner Group | | ![GH_SamlIdentityProvider](/images/extensions/github/gh_samlidentityprovider.png) | [GH_SamlIdentityProvider](/opengraph/extensions/github/nodes/gh_samlidentityprovider) | GitHub SAML Identity Provider | | ![GH_SecretScanningAlert](/images/extensions/github/gh_secretscanningalert.png) | [GH_SecretScanningAlert](/opengraph/extensions/github/nodes/gh_secretscanningalert) | GitHub Secret Scanning Alert | | ![GH_Team](/images/extensions/github/gh_team.png) | [GH_Team](/opengraph/extensions/github/nodes/gh_team) | GitHub Team | @@ -56,17 +64,28 @@ This file is automatically generated from the [extension definition schema file] | [GH_AddAssignee](/opengraph/extensions/github/edges/gh_addassignee) | ❌ | [Repository] Repo role can assign users to issues and pull requests | | [GH_AddCollaborator](/opengraph/extensions/github/edges/gh_addcollaborator) | ❌ | [Organization] Org role can add outside collaborators | | [GH_AddLabel](/opengraph/extensions/github/edges/gh_addlabel) | ❌ | [Repository] Repo role can add labels to issues and pull requests | -| [GH_AddMember](/opengraph/extensions/github/edges/gh_addmember) | ✅ | Team role can add members to the team (maintainer privilege) | -| [GH_AdminTo](/opengraph/extensions/github/edges/gh_adminto) | ❌ | [Repository] Repo role has admin access to the repository. | +| [GH_AddMember](/opengraph/extensions/github/edges/gh_addmember) | ❌ | Team role can add members to the team (maintainer privilege) | +| [GH_AdminTo](/opengraph/extensions/github/edges/gh_adminto) | ✅ | [Repository] Repo role has admin access to the repository. | +| [GH_ApprovesDeploymentTo](/opengraph/extensions/github/edges/gh_approvesdeploymentto) | ❌ | User or team is configured as a required reviewer for this environment | +| [GH_AssignedTo](/opengraph/extensions/github/edges/gh_assignedto) | ❌ | Enterprise team is assigned to an organization | | [GH_BypassBranchProtection](/opengraph/extensions/github/edges/gh_bypassbranchprotection) | ❌ | [Repository] Repo role can bypass merge-gate branch protections (PR reviews, lock branch). Suppressed by enforce_admins. | | [GH_BypassPullRequestAllowances](/opengraph/extensions/github/edges/gh_bypasspullrequestallowances) | ❌ | User or team can bypass pull request requirements on a branch protection rule | | [GH_CallsWorkflow](/opengraph/extensions/github/edges/gh_callsworkflow) | ❌ | [Workflow] Job calls a reusable workflow — GH_WorkflowJob → GH_Workflow | | [GH_CanAccess](/opengraph/extensions/github/edges/gh_canaccess) | ❌ | Personal access token or app installation can access this repository or organization | | [GH_CanAssumeIdentity](/opengraph/extensions/github/edges/gh_canassumeidentity) | ✅ | Repository can assume this cloud identity via OIDC federation (Azure workload identity or AWS IAM role) | | [GH_CanCreateBranch](/opengraph/extensions/github/edges/gh_cancreatebranch) | ✅ | [Repository - Computed] Role can create new branches in this repository (unprotected branches that bypass the merge gate) | +| [GH_CanCreateEnvironment](/opengraph/extensions/github/edges/gh_cancreateenvironment) | ✅ | Repo role can create new GitHub environments in this repository by editing a workflow that references a nonexistent environment name | +| [GH_CanCreateInternalRepositories](/opengraph/extensions/github/edges/gh_cancreateinternalrepositories) | ❌ | Role can create internal repositories in the organization | +| [GH_CanCreatePrivateRepositories](/opengraph/extensions/github/edges/gh_cancreateprivaterepositories) | ❌ | Role can create private repositories in the organization | +| [GH_CanCreatePublicRepositories](/opengraph/extensions/github/edges/gh_cancreatepublicrepositories) | ❌ | Role can create public repositories in the organization | +| [GH_CanCreateRepositories](/opengraph/extensions/github/edges/gh_cancreaterepositories) | ❌ | Role can create repositories in the organization | +| [GH_CanDeployToEnvironment](/opengraph/extensions/github/edges/gh_candeploytoenvironment) | ✅ | [Computed] Repository, branch, repo role, or self-approving reviewer can deploy to this GitHub environment after evaluating deployment branch policy, reviewer gates, and admin bypass behavior | +| [GH_CanEditEnvironment](/opengraph/extensions/github/edges/gh_caneditenvironment) | ✅ | Repo admin role can edit the configuration of this GitHub environment | | [GH_CanEditProtection](/opengraph/extensions/github/edges/gh_caneditprotection) | ✅ | [Repository - Computed] Repo role can modify or remove branch protection rules for the repository/branch (computed from GH_EditRepoProtections + GH_ProtectedBy) | | [GH_CanPwnRequest](/opengraph/extensions/github/edges/gh_canpwnrequest) | ✅ | [Computed] Repo role can exploit a pwn-requestable workflow to execute arbitrary code with the target's secrets and permissions — GH_RepoRole → GH_Repository / GH_Branch | +| [GH_CanReadSecret](/opengraph/extensions/github/edges/gh_canreadsecret) | ✅ | Org role can read an organization secret by creating a repository in scope | | [GH_CanReadSecretScanningAlert](/opengraph/extensions/github/edges/gh_canreadsecretscanningalert) | ✅ | [Computed] Role can read secret scanning alerts (computed from GH_ViewSecretScanningAlerts permission + GH_Contains) | +| [GH_CanUseRunner](/opengraph/extensions/github/edges/gh_canuserunner) | ❌ | Repository can dispatch jobs to this runner | | [GH_CanWriteBranch](/opengraph/extensions/github/edges/gh_canwritebranch) | ✅ | [Repository - Computed] Role can push to this branch after evaluating branch protection rules, push restrictions, and bypass allowances | | [GH_CloseDiscussion](/opengraph/extensions/github/edges/gh_closediscussion) | ❌ | [Repository] Repo role can close discussions | | [GH_CloseIssue](/opengraph/extensions/github/edges/gh_closeissue) | ❌ | [Repository] Repo role can close issues | @@ -74,6 +93,7 @@ This file is automatically generated from the [extension definition schema file] | [GH_Contains](/opengraph/extensions/github/edges/gh_contains) | ❌ | Container relationship for organizational hierarchy (org contains secrets/variables, repo contains secrets/variables, environment contains secrets/variables) | | [GH_ConvertIssuesToDiscussions](/opengraph/extensions/github/edges/gh_convertissuestodiscussions) | ❌ | [Repository] Repo role can convert issues to discussions | | [GH_CreateDiscussionCategory](/opengraph/extensions/github/edges/gh_creatediscussioncategory) | ❌ | [Repository] Repo role can create discussion categories | +| [GH_CreateEnterpriseOrganizations](/opengraph/extensions/github/edges/gh_createenterpriseorganizations) | ❌ | [Enterprise] Enterprise role can create organizations | | [GH_CreateRepository](/opengraph/extensions/github/edges/gh_createrepository) | ❌ | [Organization] Org role can create repositories in the organization | | [GH_CreateSoloMergeQueueEntry](/opengraph/extensions/github/edges/gh_createsolomergequeueentry) | ❌ | Repo role can create solo merge queue entries | | [GH_CreateTag](/opengraph/extensions/github/edges/gh_createtag) | ❌ | [Repository] Repo role can create tags and releases | @@ -88,29 +108,32 @@ This file is automatically generated from the [extension definition schema file] | [GH_EditCategoryOnDiscussion](/opengraph/extensions/github/edges/gh_editcategoryondiscussion) | ❌ | [Repository] Repo role can change the category of a discussion | | [GH_EditDiscussionCategory](/opengraph/extensions/github/edges/gh_editdiscussioncategory) | ❌ | [Repository] Repo role can edit discussion categories | | [GH_EditDiscussionComment](/opengraph/extensions/github/edges/gh_editdiscussioncomment) | ❌ | [Repository] Repo role can edit discussion comments | +| [GH_EditEnterpriseCustomPropertiesForOrganizations](/opengraph/extensions/github/edges/gh_editenterprisecustompropertiesfororganizations) | ❌ | [Enterprise] Enterprise role can edit custom properties for organizations | | [GH_EditRepoAnnouncementBanners](/opengraph/extensions/github/edges/gh_editrepoannouncementbanners) | ❌ | [Repository] Repo role can edit repository announcement banners | | [GH_EditRepoCustomPropertiesValues](/opengraph/extensions/github/edges/gh_editrepocustompropertiesvalues) | ❌ | [Repository] Repo role can edit custom property values on the repository | | [GH_EditRepoMetadata](/opengraph/extensions/github/edges/gh_editrepometadata) | ❌ | [Repository] Repo role can edit repository metadata | | [GH_EditRepoProtections](/opengraph/extensions/github/edges/gh_editrepoprotections) | ❌ | Repo role can edit branch protection rules | | [GH_HasBaseRole](/opengraph/extensions/github/edges/gh_hasbaserole) | ✅ | Role inherits permissions from another role | -| [GH_HasBranch](/opengraph/extensions/github/edges/gh_hasbranch) | ❌ | Repository has this branch | -| [GH_HasEnvironment](/opengraph/extensions/github/edges/gh_hasenvironment) | ❌ | Repository or branch has/can deploy to this environment | | [GH_HasExternalIdentity](/opengraph/extensions/github/edges/gh_hasexternalidentity) | ❌ | SAML identity provider has this external identity | -| [GH_HasJob](/opengraph/extensions/github/edges/gh_hasjob) | ❌ | [Workflow] Workflow contains this job — GH_Workflow → GH_WorkflowJob | | [GH_HasMember](/opengraph/extensions/github/edges/gh_hasmember) | ❌ | Enterprise or organization has this user as a member | | [GH_HasPersonalAccessToken](/opengraph/extensions/github/edges/gh_haspersonalaccesstoken) | ❌ | User owns this personal access token that has been granted access to the organization | | [GH_HasPersonalAccessTokenRequest](/opengraph/extensions/github/edges/gh_haspersonalaccesstokenrequest) | ❌ | User has a pending personal access token request for the organization | | [GH_HasRole](/opengraph/extensions/github/edges/gh_hasrole) | ✅ | User or team has a role assignment (org role, team role, or repo role) | | [GH_HasSamlIdentityProvider](/opengraph/extensions/github/edges/gh_hassamlidentityprovider) | ❌ | Organization has this SAML identity provider configured | | [GH_HasSecret](/opengraph/extensions/github/edges/gh_hassecret) | ✅ | Repository or environment has access to this secret | -| [GH_HasStep](/opengraph/extensions/github/edges/gh_hasstep) | ❌ | [Workflow] Job contains this step — GH_WorkflowJob → GH_WorkflowStep | -| [GH_HasVariable](/opengraph/extensions/github/edges/gh_hasvariable) | ✅ | Repository has access to this variable (org-level or repo-level) | -| [GH_HasWorkflow](/opengraph/extensions/github/edges/gh_hasworkflow) | ❌ | Repository has this workflow | +| [GH_HasVariable](/opengraph/extensions/github/edges/gh_hasvariable) | ✅ | Repository or environment has access to this variable | | [GH_InstalledAs](/opengraph/extensions/github/edges/gh_installedas) | ✅ | GitHub App is installed as this app installation on an organization | | [GH_InviteMember](/opengraph/extensions/github/edges/gh_invitemember) | ❌ | [Organization] Org role can invite members to the organization | | [GH_JumpMergeQueue](/opengraph/extensions/github/edges/gh_jumpmergequeue) | ❌ | Repo role can jump the merge queue | | [GH_ManageDeployKeys](/opengraph/extensions/github/edges/gh_managedeploykeys) | ❌ | [Repository] Repo role can manage deploy keys | | [GH_ManageDiscussionBadges](/opengraph/extensions/github/edges/gh_managediscussionbadges) | ❌ | [Repository] Repo role can manage discussion badges | +| [GH_ManageEnterpriseAdmins](/opengraph/extensions/github/edges/gh_manageenterpriseadmins) | ✅ | [Enterprise] Enterprise role can manage enterprise administrators | +| [GH_ManageEnterpriseIdentityProvider](/opengraph/extensions/github/edges/gh_manageenterpriseidentityprovider) | ❌ | [Enterprise] Enterprise role can manage the enterprise identity provider | +| [GH_ManageEnterpriseMembers](/opengraph/extensions/github/edges/gh_manageenterprisemembers) | ✅ | [Enterprise] Enterprise role can manage enterprise members | +| [GH_ManageEnterpriseOrganizationAdmins](/opengraph/extensions/github/edges/gh_manageenterpriseorganizationadmins) | ✅ | [Enterprise] Enterprise role can manage organization administrators | +| [GH_ManageEnterpriseOrganizations](/opengraph/extensions/github/edges/gh_manageenterpriseorganizations) | ❌ | [Enterprise] Enterprise role can manage organizations | +| [GH_ManageEnterpriseReferrals](/opengraph/extensions/github/edges/gh_manageenterprisereferrals) | ❌ | [Enterprise] Enterprise role can manage referrals | +| [GH_ManageEnterpriseTeams](/opengraph/extensions/github/edges/gh_manageenterpriseteams) | ❌ | [Enterprise] Enterprise role can manage enterprise teams | | [GH_ManageOrganizationWebhooks](/opengraph/extensions/github/edges/gh_manageorganizationwebhooks) | ❌ | [Organization] Org role can manage organization webhooks | | [GH_ManageRepoSecurityProducts](/opengraph/extensions/github/edges/gh_managereposecurityproducts) | ❌ | Repo role can manage repo-level security products | | [GH_ManageSecurityProducts](/opengraph/extensions/github/edges/gh_managesecurityproducts) | ❌ | Repo role can manage security products | @@ -122,6 +145,7 @@ This file is automatically generated from the [extension definition schema file] | [GH_ManageWebhooks](/opengraph/extensions/github/edges/gh_managewebhooks) | ❌ | [Repository] Repo role can manage repository webhooks | | [GH_MapsToUser](/opengraph/extensions/github/edges/gh_mapstouser) | ❌ | External identity maps to a GitHub user or identity provider user | | [GH_MarkAsDuplicate](/opengraph/extensions/github/edges/gh_markasduplicate) | ❌ | [Repository] Repo role can mark issues or pull requests as duplicates | +| [GH_MatchesEnvironmentPolicy](/opengraph/extensions/github/edges/gh_matchesenvironmentpolicy) | ❌ | Branch matches this environment deployment branch policy | | [GH_MemberOf](/opengraph/extensions/github/edges/gh_memberof) | ✅ | Team role is a member of a team, or team is a nested member of a parent team | | [GH_OrgBypassCodeScanningDismissalRequests](/opengraph/extensions/github/edges/gh_orgbypasscodescanningdismissalrequests) | ❌ | [Organization] Org role can bypass code scanning dismissal requests | | [GH_OrgBypassSecretScanningClosureRequests](/opengraph/extensions/github/edges/gh_orgbypasssecretscanningclosurerequests) | ❌ | [Organization] Org role can bypass secret scanning closure requests | @@ -131,6 +155,11 @@ This file is automatically generated from the [extension definition schema file] | [GH_ProtectedBy](/opengraph/extensions/github/edges/gh_protectedby) | ❌ | Branch protection rule protects this branch | | [GH_PushProtectedBranch](/opengraph/extensions/github/edges/gh_pushprotectedbranch) | ❌ | [Repository] Repo role can push to branches with push restrictions. Not affected by enforce_admins. | | [GH_ReadCodeScanning](/opengraph/extensions/github/edges/gh_readcodescanning) | ❌ | [Repository] Repo role can read code scanning results | +| [GH_ReadEnterpriseAuditLog](/opengraph/extensions/github/edges/gh_readenterpriseauditlog) | ❌ | [Enterprise] Enterprise role can read the audit log | +| [GH_ReadEnterpriseDomainVerification](/opengraph/extensions/github/edges/gh_readenterprisedomainverification) | ❌ | [Enterprise] Enterprise role can read domain verification data | +| [GH_ReadEnterpriseMembers](/opengraph/extensions/github/edges/gh_readenterprisemembers) | ❌ | [Enterprise] Enterprise role can read enterprise members | +| [GH_ReadEnterpriseOrganizationAdmin](/opengraph/extensions/github/edges/gh_readenterpriseorganizationadmin) | ❌ | [Enterprise] Enterprise role can read organization administration data | +| [GH_ReadEnterpriseOrgProjects](/opengraph/extensions/github/edges/gh_readenterpriseorgprojects) | ❌ | [Enterprise] Enterprise role can read organization projects | | [GH_ReadOrganizationActionsUsageMetrics](/opengraph/extensions/github/edges/gh_readorganizationactionsusagemetrics) | ❌ | [Organization] Org role can read Actions usage metrics | | [GH_ReadOrganizationCustomOrgRole](/opengraph/extensions/github/edges/gh_readorganizationcustomorgrole) | ❌ | [Organization] Org role can read custom org role definitions | | [GH_ReadOrganizationCustomRepoRole](/opengraph/extensions/github/edges/gh_readorganizationcustomreporole) | ❌ | [Organization] Org role can read custom repo role definitions | @@ -145,6 +174,7 @@ This file is automatically generated from the [extension definition schema file] | [GH_ResolveSecretScanningAlerts](/opengraph/extensions/github/edges/gh_resolvesecretscanningalerts) | ❌ | [Organization] Org role can resolve secret scanning alerts | | [GH_RestrictionsCanPush](/opengraph/extensions/github/edges/gh_restrictionscanpush) | ❌ | User or team is allowed to push to branches protected by this rule | | [GH_RunOrgMigration](/opengraph/extensions/github/edges/gh_runorgmigration) | ❌ | [Repository] Repo role can run organization migrations | +| [GH_SetEnterpriseInteractionLimits](/opengraph/extensions/github/edges/gh_setenterpriseinteractionlimits) | ❌ | [Enterprise] Enterprise role can set interaction limits | | [GH_SetInteractionLimits](/opengraph/extensions/github/edges/gh_setinteractionlimits) | ❌ | [Repository] Repo role can set interaction limits on the repository | | [GH_SetIssueType](/opengraph/extensions/github/edges/gh_setissuetype) | ❌ | [Repository] Repo role can set issue types | | [GH_SetMilestone](/opengraph/extensions/github/edges/gh_setmilestone) | ❌ | [Repository] Repo role can set milestones on issues and pull requests | @@ -153,12 +183,20 @@ This file is automatically generated from the [extension definition schema file] | [GH_ToggleDiscussionAnswer](/opengraph/extensions/github/edges/gh_togglediscussionanswer) | ❌ | [Repository] Repo role can toggle discussion answers | | [GH_ToggleDiscussionCommentMinimize](/opengraph/extensions/github/edges/gh_togglediscussioncommentminimize) | ❌ | [Repository] Repo role can minimize discussion comments | | [GH_TransferRepository](/opengraph/extensions/github/edges/gh_transferrepository) | ❌ | [Organization] Org role can transfer repositories | -| [GH_UsesSecret](/opengraph/extensions/github/edges/gh_usessecret) | ❌ | [Workflow] Step references a secret by name — GH_WorkflowStep → GH_RepoSecret / GH_OrgSecret (name match) | -| [GH_UsesVariable](/opengraph/extensions/github/edges/gh_usesvariable) | ❌ | [Workflow] Step references a variable by name — GH_WorkflowStep → GH_RepoVariable / GH_OrgVariable (name match) | +| [GH_UsesSecret](/opengraph/extensions/github/edges/gh_usessecret) | ❌ | [Workflow] Job or step references a secret by name — GH_WorkflowJob / GH_WorkflowStep → GH_RepoSecret / GH_OrgSecret / GH_EnvironmentSecret (scope match) | +| [GH_UsesVariable](/opengraph/extensions/github/edges/gh_usesvariable) | ❌ | [Workflow] Job or step references a variable by name — GH_WorkflowJob / GH_WorkflowStep → GH_RepoVariable / GH_OrgVariable / GH_EnvironmentVariable (scope match) | | [GH_ValidToken](/opengraph/extensions/github/edges/gh_validtoken) | ✅ | Secret scanning alert contains a valid, active token belonging to this user | | [GH_ViewDependabotAlerts](/opengraph/extensions/github/edges/gh_viewdependabotalerts) | ❌ | [Repository] Repo role can view Dependabot alerts | +| [GH_ViewEnterpriseActionsUsageMetrics](/opengraph/extensions/github/edges/gh_viewenterpriseactionsusagemetrics) | ❌ | [Enterprise] Enterprise role can view Actions usage metrics | +| [GH_ViewEnterpriseBilling](/opengraph/extensions/github/edges/gh_viewenterprisebilling) | ❌ | [Enterprise] Enterprise role can view billing data | +| [GH_ViewEnterpriseSecretScanningAlerts](/opengraph/extensions/github/edges/gh_viewenterprisesecretscanningalerts) | ❌ | [Enterprise] Enterprise role can view secret-scanning alerts | | [GH_ViewSecretScanningAlerts](/opengraph/extensions/github/edges/gh_viewsecretscanningalerts) | ❌ | [Repository] Role can view secret scanning alerts | | [GH_WriteCodeScanning](/opengraph/extensions/github/edges/gh_writecodescanning) | ❌ | [Repository] Repo role can upload code scanning results | +| [GH_WriteEnterpriseActionsPolicies](/opengraph/extensions/github/edges/gh_writeenterpriseactionspolicies) | ❌ | [Enterprise] Enterprise role can write Actions policies | +| [GH_WriteEnterpriseBilling](/opengraph/extensions/github/edges/gh_writeenterprisebilling) | ❌ | [Enterprise] Enterprise role can write billing settings | +| [GH_WriteEnterprisePersonalAccessTokenPolicies](/opengraph/extensions/github/edges/gh_writeenterprisepersonalaccesstokenpolicies) | ❌ | [Enterprise] Enterprise role can write personal access token policies | +| [GH_WriteEnterpriseSso](/opengraph/extensions/github/edges/gh_writeenterprisesso) | ❌ | [Enterprise] Enterprise role can write SSO settings | +| [GH_WriteEnterpriseTeamMembers](/opengraph/extensions/github/edges/gh_writeenterpriseteammembers) | ❌ | [Enterprise] Enterprise role can write enterprise team membership | | [GH_WriteOrganizationActionsSecrets](/opengraph/extensions/github/edges/gh_writeorganizationactionssecrets) | ❌ | [Organization] Org role can write Actions secrets | | [GH_WriteOrganizationActionsSettings](/opengraph/extensions/github/edges/gh_writeorganizationactionssettings) | ❌ | [Organization] Org role can write Actions settings | | [GH_WriteOrganizationActionsVariables](/opengraph/extensions/github/edges/gh_writeorganizationactionsvariables) | ❌ | [Organization] Org role can write Actions variables | @@ -166,4 +204,4 @@ This file is automatically generated from the [extension definition schema file] | [GH_WriteOrganizationCustomRepoRole](/opengraph/extensions/github/edges/gh_writeorganizationcustomreporole) | ❌ | [Organization] Org role can write custom repo role definitions | | [GH_WriteOrganizationNetworkConfigurations](/opengraph/extensions/github/edges/gh_writeorganizationnetworkconfigurations) | ❌ | [Organization] Org role can write network configurations | | [GH_WriteRepoContents](/opengraph/extensions/github/edges/gh_writerepocontents) | ❌ | [Repository] Repo role can write repository contents | -| [GH_WriteRepoPullRequests](/opengraph/extensions/github/edges/gh_writerepopullrequests) | ❌ | [Repository] Repo role can create and merge pull requests | +| [GH_WriteRepoPullRequests](/opengraph/extensions/github/edges/gh_writerepopullrequests) | ❌ | [Repository] Repo role can create and merge pull requests |