|
2 | 2 | // SPDX-License-Identifier: Apache-2.0 |
3 | 3 |
|
4 | 4 | syntax = "proto3"; |
5 | | -package ampel.v1; |
| 5 | +package in_toto_attestation.predicates.source_provenance.v1; |
6 | 6 |
|
7 | 7 | import "google/protobuf/timestamp.proto"; |
8 | 8 |
|
| 9 | +// buf:lint:ignore PACKAGE_SAME_GO_PACKAGE |
9 | 10 | option go_package = "github.com/slsa-framework/slsa-source-poc/pkg/policy"; |
10 | 11 |
|
11 | 12 | // The repository policy definition |
12 | 13 | message RepoPolicy { |
13 | | - string canonical_repo = 1 [json_name="canonical_repo"]; |
14 | | - repeated ProtectedBranch protected_branches = 2 [json_name="protected_branches"]; |
15 | | - optional ProtectedTag protected_tag = 3; |
| 14 | + string canonical_repo = 1 [json_name = "canonical_repo"]; |
| 15 | + repeated ProtectedBranch protected_branches = 2 [json_name = "protected_branches"]; |
| 16 | + optional ProtectedTag protected_tag = 3; |
16 | 17 | } |
17 | 18 |
|
18 | 19 | // When a branch requires multiple controls, they must all be enabled |
19 | 20 | // at or before 'since'. |
20 | 21 | message ProtectedBranch { |
21 | | - string name = 1; |
22 | | - google.protobuf.Timestamp since = 2; |
23 | | - // We override this string with slsa.SlsaSourceLevel |
24 | | - string target_slsa_source_level = 3; |
25 | | - bool require_review = 4; |
26 | | - repeated OrgStatusCheckControl org_status_check_controls = 5 [json_name="org_status_check_controls"]; |
| 22 | + string name = 1; |
| 23 | + google.protobuf.Timestamp since = 2; |
| 24 | + // We override this string with slsa.SlsaSourceLevel |
| 25 | + string target_slsa_source_level = 3; |
| 26 | + bool require_review = 4; |
| 27 | + repeated OrgStatusCheckControl org_status_check_controls = 5 [json_name = "org_status_check_controls"]; |
27 | 28 | } |
28 | 29 |
|
29 | 30 | // The controls required for protected tags. |
30 | 31 | message ProtectedTag { |
31 | | - google.protobuf.Timestamp since = 1; |
32 | | - bool tag_hygiene = 2; |
| 32 | + google.protobuf.Timestamp since = 1; |
| 33 | + bool tag_hygiene = 2; |
33 | 34 | } |
34 | 35 |
|
35 | 36 | // Used by orgs to require that specific 'checks' are run on protected |
36 | 37 | // branches and to associate those checks with a control name to include |
37 | 38 | // in provenance and VSAs. |
38 | 39 | // https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets#require-status-checks-to-pass-before-merging |
39 | | -message OrgStatusCheckControl { |
40 | | - // The property to record in the VSA if the conditions are met. |
41 | | - // MUST start with `ORG_SOURCE_`. |
42 | | - // We'll overide this with slsa.ControlName |
43 | | - string property_name = 1; |
44 | | - |
45 | | - // These controls have their own start time to enable orgs to enable |
46 | | - // new ones without violating continuity on other controls. |
47 | | - google.protobuf.Timestamp since = 2; |
48 | | - |
49 | | - // The name of the 'Status Check' as reported in the GitHub UI & API. |
50 | | - string check_name = 3; |
| 40 | +message OrgStatusCheckControl { |
| 41 | + // The property to record in the VSA if the conditions are met. |
| 42 | + // MUST start with `ORG_SOURCE_`. |
| 43 | + // We'll overide this with slsa.ControlName |
| 44 | + string property_name = 1; |
| 45 | + |
| 46 | + // These controls have their own start time to enable orgs to enable |
| 47 | + // new ones without violating continuity on other controls. |
| 48 | + google.protobuf.Timestamp since = 2; |
| 49 | + |
| 50 | + // The name of the 'Status Check' as reported in the GitHub UI & API. |
| 51 | + string check_name = 3; |
51 | 52 | } |
0 commit comments