Add tag protection to policy (#279)

* Update branch protection control description

Signed-off-by: Adolfo Garcia Veytia (puerco) <[email protected]>

* Add tag protection to generated policy

This commit adds the tag protection entry to the generated policy
when it is reported in the active controls.

Signed-off-by: Adolfo Garcia Veytia (puerco) <[email protected]>

---------

Signed-off-by: Adolfo Garcia Veytia (puerco) <[email protected]>

Author: puerco

pkg/policy/policy.go

@@ -276,6 +276,16 @@ func (pe *PolicyEvaluator) CreateLocalPolicy(ctx context.Context, repo *models.R
 			},
 		},
 	}
+
+	// If the controls returned
+	controls := slsa.Controls(provPred.GetControls())
+	tagHygiene := controls.GetControl(slsa.TagHygiene)
+	if tagHygiene != nil {
+		p.ProtectedTag = &ProtectedTag{
+			Since:      tagHygiene.GetSince(),
+			TagHygiene: true,
+		}
+	}
 	data, err := json.MarshalIndent(&p, "", "  ")
 	if err != nil {
 		return "", err

pkg/slsa/slsa_types.go

@@ -189,6 +189,9 @@ type ControlRecommendedAction struct {
 // which are active in the set.
 func (cs *ControlSetStatus) GetActiveControls() *Controls {
 	ret := Controls{}
+	if cs == nil {
+		return &ret
+	}
 	for _, c := range cs.Controls {
 		if c.State == StateActive {
 			ret.AddControl(&provenance.Control{

pkg/sourcetool/backends/vcs/github/github.go

@@ -201,7 +201,7 @@ func (b *Backend) ControlConfigurationDescr(branch *models.Branch, config models
 		)
 	case models.CONFIG_TAG_RULES:
 		return fmt.Sprintf(
-			"Enable push/update/delete protection for all tags in %s",
+			"Enable force push/update/delete protection for all tags in %s",
 			repo.Path,
 		)
 	default:

pkg/sourcetool/tool.go

@@ -220,6 +220,15 @@ func (t *Tool) createPolicy(r *models.Repository, branch *models.Branch, control
 			},
 		},
 	}
+
+	// If the controls returned
+	tagHygiene := controls.GetActiveControls().GetControl(slsa.TagHygiene)
+	if tagHygiene != nil {
+		p.ProtectedTag = &policy.ProtectedTag{
+			Since:      tagHygiene.GetSince(),
+			TagHygiene: true,
+		}
+	}
 	return p, nil
 }