Feat (ci-rules) : Add AZ-CI-001..004 CI/CD workflow security rules (issue #259 PR 1/3)

compliance/frameworks/cis_azure_benchmark.json

@@ -1734,6 +1734,54 @@
       "owner": null,
       "review_status": "pending_review",
       "review_date": null
+    },
+    "AZ-CI-001": {
+      "control_id": "N/A-CI-001",
+      "control_name": "CI/CD Workflow Uses Long-Lived Azure Credentials",
+      "description": "CI/CD workflows should use workload identity federation (OIDC) instead of long-lived client secrets or storage keys stored as repository secrets.",
+      "mapping_type": "not_applicable",
+      "evidence_type": "not_applicable",
+      "primary_source": "CIS Microsoft Azure Foundations Benchmark v2.0.0, control N/A-FUNC-001",
+      "rationale": "CIS Microsoft Azure Foundations Benchmark v2.0.0 has no numbered control this rule maps to (N/A-FUNC-001: CI/CD Workflow Uses Long-Lived Azure Credentials) - this rule's evidence is not counted as a CIS pass/fail because there is no corresponding CIS requirement for it to be evidence of.",
+      "owner": null,
+      "review_status": "pending_review",
+      "review_date": null
+    },
+    "AZ-CI-002": {
+      "control_id": "N/A-CI-002",
+      "control_name": "CI/CD Workflow Has Unnecessarily Broad Token Permissions",
+      "description": "Workflow GITHUB_TOKEN permissions should follow least privilege with an explicit permissions block granting only required scopes.",
+      "mapping_type": "not_applicable",
+      "evidence_type": "not_applicable",
+      "primary_source": "CIS Microsoft Azure Foundations Benchmark v2.0.0, control N/A-FUNC-001",
+      "rationale": "CIS Microsoft Azure Foundations Benchmark v2.0.0 has no numbered control this rule maps to (N/A-FUNC-001: CI/CD Workflow Has Unnecessarily Broad Token Permissions) - this rule's evidence is not counted as a CIS pass/fail because there is no corresponding CIS requirement for it to be evidence of.",
+      "owner": null,
+      "review_status": "pending_review",
+      "review_date": null
+    },
+    "AZ-CI-003": {
+      "control_id": "N/A-CI-003",
+      "control_name": "Third-Party Workflow Action Not Pinned to Immutable Commit SHA",
+      "description": "Third-party GitHub Actions must be pinned to a full 40-character commit SHA to prevent supply-chain attacks via mutable tags.",
+      "mapping_type": "not_applicable",
+      "evidence_type": "not_applicable",
+      "primary_source": "CIS Microsoft Azure Foundations Benchmark v2.0.0, control N/A-FUNC-001",
+      "rationale": "CIS Microsoft Azure Foundations Benchmark v2.0.0 has no numbered control this rule maps to (N/A-FUNC-001: Third-Party Workflow Action Not Pinned to Immutable Commit SHA) - this rule's evidence is not counted as a CIS pass/fail because there is no corresponding CIS requirement for it to be evidence of.",
+      "owner": null,
+      "review_status": "pending_review",
+      "review_date": null
+    },
+    "AZ-CI-004": {
+      "control_id": "N/A-CI-004",
+      "control_name": "Untrusted Pull-Request Input Reaches Privileged Workflow Context",
+      "description": "Workflows triggered by pull_request_target or workflow_run must not check out or execute untrusted PR code in a context with secret access.",
+      "mapping_type": "not_applicable",
+      "evidence_type": "not_applicable",
+      "primary_source": "CIS Microsoft Azure Foundations Benchmark v2.0.0, control N/A-FUNC-001",
+      "rationale": "CIS Microsoft Azure Foundations Benchmark v2.0.0 has no numbered control this rule maps to (N/A-FUNC-001: Untrusted Pull-Request Input Reaches Privileged Workflow Context) - this rule's evidence is not counted as a CIS pass/fail because there is no corresponding CIS requirement for it to be evidence of.",
+      "owner": null,
+      "review_status": "pending_review",
+      "review_date": null
     }
   }
 }

compliance/frameworks/iso27001.json

@@ -1734,6 +1734,54 @@
       "owner": null,
       "review_status": "pending_review",
       "review_date": null
+    },
+    "AZ-CI-001": {
+      "control_id": "A.5.17",
+      "control_name": "Authentication information",
+      "description": "CI/CD workflows should use workload identity federation (OIDC) instead of long-lived client secrets or storage keys stored as repository secrets.",
+      "mapping_type": "supporting",
+      "evidence_type": "automated_configuration_scan",
+      "primary_source": "ISO/IEC 27001:2022, Annex A control A.5.17",
+      "rationale": "ISO/IEC 27001:2022 Annex A control A.5.17 ('Authentication information') describes a broader outcome than one technical setting. OpenShield rule AZ-CI-001 ('CI/CD Workflow Uses Long-Lived Azure Credentials') evaluates one GitHub Actions workflow setting that provides supporting automated evidence toward it; it does not by itself establish conformance.",
+      "owner": null,
+      "review_status": "pending_review",
+      "review_date": null
+    },
+    "AZ-CI-002": {
+      "control_id": "A.8.2",
+      "control_name": "Privileged access rights",
+      "description": "Workflow GITHUB_TOKEN permissions should follow least privilege with an explicit permissions block granting only required scopes.",
+      "mapping_type": "supporting",
+      "evidence_type": "automated_configuration_scan",
+      "primary_source": "ISO/IEC 27001:2022, Annex A control A.8.2",
+      "rationale": "ISO/IEC 27001:2022 Annex A control A.8.2 ('Privileged access rights') describes a broader outcome than one technical setting. OpenShield rule AZ-CI-002 ('CI/CD Workflow Has Unnecessarily Broad Token Permissions') evaluates one GitHub Actions workflow setting that provides supporting automated evidence toward it; it does not by itself establish conformance.",
+      "owner": null,
+      "review_status": "pending_review",
+      "review_date": null
+    },
+    "AZ-CI-003": {
+      "control_id": "A.5.21",
+      "control_name": "Managing information security in the ICT supply chain",
+      "description": "Third-party GitHub Actions must be pinned to a full 40-character commit SHA to prevent supply-chain attacks via mutable tags.",
+      "mapping_type": "supporting",
+      "evidence_type": "automated_configuration_scan",
+      "primary_source": "ISO/IEC 27001:2022, Annex A control A.5.21",
+      "rationale": "ISO/IEC 27001:2022 Annex A control A.5.21 ('Managing information security in the ICT supply chain') describes a broader outcome than one technical setting. OpenShield rule AZ-CI-003 ('Third-Party Workflow Action Not Pinned to Immutable Commit SHA') evaluates one GitHub Actions workflow setting that provides supporting automated evidence toward it; it does not by itself establish conformance.",
+      "owner": null,
+      "review_status": "pending_review",
+      "review_date": null
+    },
+    "AZ-CI-004": {
+      "control_id": "A.8.28",
+      "control_name": "Secure coding",
+      "description": "Workflows triggered by pull_request_target or workflow_run must not check out or execute untrusted PR code in a context with secret access.",
+      "mapping_type": "supporting",
+      "evidence_type": "automated_configuration_scan",
+      "primary_source": "ISO/IEC 27001:2022, Annex A control A.8.28",
+      "rationale": "ISO/IEC 27001:2022 Annex A control A.8.28 ('Secure coding') describes a broader outcome than one technical setting. OpenShield rule AZ-CI-004 ('Untrusted Pull-Request Input Reaches Privileged Workflow Context') evaluates one GitHub Actions workflow setting that provides supporting automated evidence toward it; it does not by itself establish conformance.",
+      "owner": null,
+      "review_status": "pending_review",
+      "review_date": null
     }
   }
 }

compliance/frameworks/nist_csf.json

@@ -1734,6 +1734,54 @@
       "owner": null,
       "review_status": "pending_review",
       "review_date": null
+    },
+    "AZ-CI-001": {
+      "control_id": "PR.AC-1",
+      "control_name": "Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes",
+      "description": "CI/CD workflows should use workload identity federation (OIDC) instead of long-lived client secrets or storage keys stored as repository secrets.",
+      "mapping_type": "supporting",
+      "evidence_type": "automated_configuration_scan",
+      "primary_source": "NIST Cybersecurity Framework 1.1, subcategory PR.AC-1",
+      "rationale": "NIST CSF 1.1 subcategory control PR.AC-1 ('Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes') describes a broader outcome than one technical setting. OpenShield rule AZ-CI-001 ('CI/CD Workflow Uses Long-Lived Azure Credentials') evaluates one GitHub Actions workflow setting that provides supporting automated evidence toward it; it does not by itself establish conformance.",
+      "owner": null,
+      "review_status": "pending_review",
+      "review_date": null
+    },
+    "AZ-CI-002": {
+      "control_id": "PR.AC-4",
+      "control_name": "Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",
+      "description": "Workflow GITHUB_TOKEN permissions should follow least privilege with an explicit permissions block granting only required scopes.",
+      "mapping_type": "supporting",
+      "evidence_type": "automated_configuration_scan",
+      "primary_source": "NIST Cybersecurity Framework 1.1, subcategory PR.AC-4",
+      "rationale": "NIST CSF 1.1 subcategory control PR.AC-4 ('Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties') describes a broader outcome than one technical setting. OpenShield rule AZ-CI-002 ('CI/CD Workflow Has Unnecessarily Broad Token Permissions') evaluates one GitHub Actions workflow setting that provides supporting automated evidence toward it; it does not by itself establish conformance.",
+      "owner": null,
+      "review_status": "pending_review",
+      "review_date": null
+    },
+    "AZ-CI-003": {
+      "control_id": "PR.IP-1",
+      "control_name": "A baseline configuration of information technology systems is created and maintained incorporating appropriate security principles",
+      "description": "Third-party GitHub Actions must be pinned to a full 40-character commit SHA to prevent supply-chain attacks via mutable tags.",
+      "mapping_type": "supporting",
+      "evidence_type": "automated_configuration_scan",
+      "primary_source": "NIST Cybersecurity Framework 1.1, subcategory PR.IP-1",
+      "rationale": "NIST CSF 1.1 subcategory control PR.IP-1 ('A baseline configuration of information technology systems is created and maintained incorporating appropriate security principles') describes a broader outcome than one technical setting. OpenShield rule AZ-CI-003 ('Third-Party Workflow Action Not Pinned to Immutable Commit SHA') evaluates one GitHub Actions workflow setting that provides supporting automated evidence toward it; it does not by itself establish conformance.",
+      "owner": null,
+      "review_status": "pending_review",
+      "review_date": null
+    },
+    "AZ-CI-004": {
+      "control_id": "PR.AC-4",
+      "control_name": "Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties",
+      "description": "Workflows triggered by pull_request_target or workflow_run must not check out or execute untrusted PR code in a context with secret access.",
+      "mapping_type": "supporting",
+      "evidence_type": "automated_configuration_scan",
+      "primary_source": "NIST Cybersecurity Framework 1.1, subcategory PR.AC-4",
+      "rationale": "NIST CSF 1.1 subcategory control PR.AC-4 ('Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties') describes a broader outcome than one technical setting. OpenShield rule AZ-CI-004 ('Untrusted Pull-Request Input Reaches Privileged Workflow Context') evaluates one GitHub Actions workflow setting that provides supporting automated evidence toward it; it does not by itself establish conformance.",
+      "owner": null,
+      "review_status": "pending_review",
+      "review_date": null
     }
   }
 }

compliance/frameworks/soc2.json

@@ -1734,6 +1734,54 @@
       "owner": null,
       "review_status": "pending_review",
       "review_date": null
+    },
+    "AZ-CI-001": {
+      "control_id": "CC6.1",
+      "control_name": "Logical and Physical Access Controls",
+      "description": "CI/CD workflows should use workload identity federation (OIDC) instead of long-lived client secrets or storage keys stored as repository secrets.",
+      "mapping_type": "supporting",
+      "evidence_type": "automated_configuration_scan",
+      "primary_source": "SOC 2 Type II (2017 Trust Services Criteria), criterion CC6.1",
+      "rationale": "SOC 2 (2017 Trust Services Criteria) criterion control CC6.1 ('Logical and Physical Access Controls') describes a broader outcome than one technical setting. OpenShield rule AZ-CI-001 ('CI/CD Workflow Uses Long-Lived Azure Credentials') evaluates one GitHub Actions workflow setting that provides supporting automated evidence toward it; it does not by itself establish conformance.",
+      "owner": null,
+      "review_status": "pending_review",
+      "review_date": null
+    },
+    "AZ-CI-002": {
+      "control_id": "CC6.3",
+      "control_name": "Access Authorization and Least Privilege",
+      "description": "Workflow GITHUB_TOKEN permissions should follow least privilege with an explicit permissions block granting only required scopes.",
+      "mapping_type": "supporting",
+      "evidence_type": "automated_configuration_scan",
+      "primary_source": "SOC 2 Type II (2017 Trust Services Criteria), criterion CC6.3",
+      "rationale": "SOC 2 (2017 Trust Services Criteria) criterion control CC6.3 ('Access Authorization and Least Privilege') describes a broader outcome than one technical setting. OpenShield rule AZ-CI-002 ('CI/CD Workflow Has Unnecessarily Broad Token Permissions') evaluates one GitHub Actions workflow setting that provides supporting automated evidence toward it; it does not by itself establish conformance.",
+      "owner": null,
+      "review_status": "pending_review",
+      "review_date": null
+    },
+    "AZ-CI-003": {
+      "control_id": "CC7.1",
+      "control_name": "Detection and Monitoring of Vulnerabilities",
+      "description": "Third-party GitHub Actions must be pinned to a full 40-character commit SHA to prevent supply-chain attacks via mutable tags.",
+      "mapping_type": "supporting",
+      "evidence_type": "automated_configuration_scan",
+      "primary_source": "SOC 2 Type II (2017 Trust Services Criteria), criterion CC7.1",
+      "rationale": "SOC 2 (2017 Trust Services Criteria) criterion control CC7.1 ('Detection and Monitoring of Vulnerabilities') describes a broader outcome than one technical setting. OpenShield rule AZ-CI-003 ('Third-Party Workflow Action Not Pinned to Immutable Commit SHA') evaluates one GitHub Actions workflow setting that provides supporting automated evidence toward it; it does not by itself establish conformance.",
+      "owner": null,
+      "review_status": "pending_review",
+      "review_date": null
+    },
+    "AZ-CI-004": {
+      "control_id": "CC8.1",
+      "control_name": "Change Management",
+      "description": "Workflows triggered by pull_request_target or workflow_run must not check out or execute untrusted PR code in a context with secret access.",
+      "mapping_type": "supporting",
+      "evidence_type": "automated_configuration_scan",
+      "primary_source": "SOC 2 Type II (2017 Trust Services Criteria), criterion CC8.1",
+      "rationale": "SOC 2 (2017 Trust Services Criteria) criterion control CC8.1 ('Change Management') describes a broader outcome than one technical setting. OpenShield rule AZ-CI-004 ('Untrusted Pull-Request Input Reaches Privileged Workflow Context') evaluates one GitHub Actions workflow setting that provides supporting automated evidence toward it; it does not by itself establish conformance.",
+      "owner": null,
+      "review_status": "pending_review",
+      "review_date": null
     }
   }
 }

playbooks/cli/fix_az_ci_001.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Fix AZ-CI-001: Replace long-lived Azure credentials with workload identity federation
+# Usage: bash fix_az_ci_001.sh <AZURE_APP_ID> <TENANT_ID> <SUBSCRIPTION_ID> <REPO>
+set -euo pipefail
+APP_ID="${1:?Usage: $0 <app-id> <tenant-id> <subscription-id> <repo>}"
+TENANT_ID="${2:?}"
+SUBSCRIPTION_ID="${3:?}"
+REPO="${4:?}"
+
+echo "[1/4] Creating federated identity credential for GitHub Actions..."
+az ad app federated-credential create \
+  --id "$APP_ID" \
+  --parameters "{
+    \"name\": \"github-oidc\",
+    \"issuer\": \"https://token.actions.githubusercontent.com\",
+    \"subject\": \"repo:${REPO}:ref:refs/heads/main\",
+    \"audiences\": [\"api://AzureADTokenExchange\"]
+  }"
+
+echo "[2/4] Update workflow: add id-token: write permission"
+echo "      Replace azure/login with:"
+echo "      - uses: azure/login@v2"
+echo "        with:"
+echo "          client-id: \${{ secrets.AZURE_CLIENT_ID }}"
+echo "          tenant-id: \${{ secrets.AZURE_TENANT_ID }}"
+echo "          subscription-id: \${{ secrets.AZURE_SUBSCRIPTION_ID }}"
+
+echo "[3/4] Remove AZURE_CLIENT_SECRET from repository secrets"
+gh secret delete AZURE_CLIENT_SECRET --repo "$REPO" 2>/dev/null || true
+gh secret delete ARM_CLIENT_SECRET --repo "$REPO" 2>/dev/null || true
+
+echo "[4/4] Done. Validate with: az login --federated-token"

playbooks/cli/fix_az_ci_002.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Fix AZ-CI-002: Add least-privilege permissions block to workflow
+# Usage: bash fix_az_ci_002.sh <workflow-file>
+set -euo pipefail
+WORKFLOW="${1:?Usage: $0 <path-to-workflow.yml>}"
+
+echo "[INFO] Add the following to the top level of $WORKFLOW:"
+echo ""
+echo "permissions:"
+echo "  contents: read"
+echo ""
+echo "[INFO] Override per-job only where broader access is needed."
+echo "[INFO] Never use permissions: write-all in production workflows."
+echo "[INFO] See: https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs"

playbooks/cli/fix_az_ci_003.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Fix AZ-CI-003: Pin third-party actions to immutable commit SHAs
+# Usage: bash fix_az_ci_003.sh <workflow-file>
+set -euo pipefail
+WORKFLOW="${1:?Usage: $0 <path-to-workflow.yml>}"
+
+echo "[INFO] For each unpinned action in $WORKFLOW, replace the tag with a full SHA:"
+echo "  Before: uses: actions/checkout@v4"
+echo "  After:  uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2"
+echo ""
+echo "[INFO] Use pin-github-action to automate:"
+echo "  pip install pin-github-action"
+echo "  pin-github-action $WORKFLOW"
+echo ""
+echo "[INFO] Enable Dependabot to keep pinned SHAs updated:"
+echo "  Add to .github/dependabot.yml:"
+echo "  - package-ecosystem: github-actions"
+echo "    directory: /"
+echo "    schedule:"
+echo "      interval: weekly"

playbooks/cli/fix_az_ci_004.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Fix AZ-CI-004: Prevent untrusted PR code from reaching privileged context
+# Usage: bash fix_az_ci_004.sh
+set -euo pipefail
+
+echo "[INFO] For pull_request_target workflows that check out PR code:"
+echo ""
+echo "[1/3] Never use actions/checkout with PR head ref in pull_request_target:"
+echo "  Remove: ref: \${{ github.event.pull_request.head.sha }}"
+echo ""
+echo "[2/3] Split privileged and unprivileged steps:"
+echo "  - Untrusted build: triggered by pull_request (no secrets)"
+echo "  - Privileged deploy: triggered by workflow_run on completed build"
+echo ""
+echo "[3/3] If checkout of PR code is required, remove all secret access:"
+echo "  permissions:"
+echo "    contents: read"
+echo "  env: {} # no secrets"
+echo ""
+echo "[INFO] See: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/"