openhound-github 0.3.6__tar.gz → 0.4.0__tar.gz

{openhound_github-0.3.6 → openhound_github-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openhound-github
-Version: 0.3.6
+Version: 0.4.0
 Summary: Github collector for OpenHound
 Author-email: "jdreijer@specterops.io" <jdreijer@specterops.io>, Jared Atkinson <jatkinson@specterops.io>
 License-File: LICENSE.md
@@ -45,6 +45,14 @@ The openhound-github extension collects resources from Github organizations and
 edges for
 BloodHound.
 
+### Enterprise SCIM and hybrid correlations
+
+When `SOURCES__GITHUB__COLLECT_ENTERPRISE_SCIM=true`, a token with enterprise SCIM access is used to collect both `/scim/v2/enterprises/{enterprise}/Users` and `/scim/v2/enterprises/{enterprise}/Groups`. The collector emits normalized `SCIM_Organization`, `SCIM_User`, and `SCIM_Group` nodes plus `SCIM_Contains`, `SCIM_MemberOf`, and `SCIM_Provisioned` relationships. Install the BloodHound SCIM extension alongside this extension to register the shared SCIM kinds.
+
+`SOURCES__GITHUB__EMIT_LEGACY_SCIM_CORRELATIONS=true` temporarily reproduces GitHound-style Okta-to-SCIM correlation relationships. It defaults to false because a dedicated hybrid correlator should own IdP-to-SCIM matching; GitHub remains authoritative for GitHub's SCIM resources and target-system provisioning relationships.
+
+Enterprise roles, including the built-in `members` role, are emitted through `GH_HasRole` and granular enterprise capability relationships. Only capability relationships with a confirmed privilege path are traversable; descriptive permissions such as `GH_WriteEnterpriseSso` remain non-traversable.
+
 [![Python Version](https://img.shields.io/badge/Python-3.13-brightgreen.svg)](#about)
 
 ## Getting Started

{openhound_github-0.3.6 → openhound_github-0.4.0}/README.md

@@ -34,6 +34,14 @@ The openhound-github extension collects resources from Github organizations and
 edges for
 BloodHound.
 
+### Enterprise SCIM and hybrid correlations
+
+When `SOURCES__GITHUB__COLLECT_ENTERPRISE_SCIM=true`, a token with enterprise SCIM access is used to collect both `/scim/v2/enterprises/{enterprise}/Users` and `/scim/v2/enterprises/{enterprise}/Groups`. The collector emits normalized `SCIM_Organization`, `SCIM_User`, and `SCIM_Group` nodes plus `SCIM_Contains`, `SCIM_MemberOf`, and `SCIM_Provisioned` relationships. Install the BloodHound SCIM extension alongside this extension to register the shared SCIM kinds.
+
+`SOURCES__GITHUB__EMIT_LEGACY_SCIM_CORRELATIONS=true` temporarily reproduces GitHound-style Okta-to-SCIM correlation relationships. It defaults to false because a dedicated hybrid correlator should own IdP-to-SCIM matching; GitHub remains authoritative for GitHub's SCIM resources and target-system provisioning relationships.
+
+Enterprise roles, including the built-in `members` role, are emitted through `GH_HasRole` and granular enterprise capability relationships. Only capability relationships with a confirmed privilege path are traversable; descriptive permissions such as `GH_WriteEnterpriseSso` remain non-traversable.
+
 [![Python Version](https://img.shields.io/badge/Python-3.13-brightgreen.svg)](#about)
 
 ## Getting Started

openhound_github-0.4.0/descriptions/edges/GH_AddMember.md

@@ -0,0 +1,3 @@
+## General Information
+
+The non-traversable GH_AddMember edge indicates that a team role with the Maintainer permission level can add new members to the team. Maintainers already inherit the team's repository permissions through GH_MemberOf, so this edge preserves the membership-management capability as context without creating a second access path to the same team.

openhound_github-0.4.0/descriptions/edges/GH_AdminTo.md

@@ -0,0 +1,3 @@
+## General Information
+
+The traversable GH_AdminTo edge represents a role's full administrative access to the repository. Admin is the highest built-in repository role and grants control over all repository settings, including dangerous operations like deleting the repository or modifying its visibility. Admin access bypasses most protections including branch protection rules, unless `enforce_admins` is explicitly enabled on the branch protection rule. This edge is a key permission in the computed branch access model and is a high-value target in attack path analysis.

openhound_github-0.4.0/descriptions/edges/GH_ApprovesDeploymentTo.md

@@ -0,0 +1,7 @@
+## General Information
+
+The non-traversable GH_ApprovesDeploymentTo edge represents that a user or team is configured as a required reviewer for a GitHub Environment.
+
+This edge is emitted from GH_User or GH_Team nodes to GH_Environment nodes when the environment includes a required reviewer protection rule. Required reviewers act as an approval gate before jobs referencing the environment can continue.
+
+The edge is non-traversable because it records reviewer configuration rather than direct deployment access. When self-review is allowed, the same reviewer may also receive a traversable GH_CanDeployToEnvironment edge because they can satisfy the approval gate themselves. When prevent_self_review is enabled, GH_ApprovesDeploymentTo remains context only because the split-principal approval flow is not currently modeled.

openhound_github-0.4.0/descriptions/edges/GH_CanCreateEnvironment.md

@@ -0,0 +1,5 @@
+## General Information
+
+The traversable GH_CanCreateEnvironment edge is a computed edge indicating that a repository role can cause a new GitHub environment to be created in the repository. This is derived from the ability to create and modify runnable branches/workflows: if a workflow references an environment name that does not already exist, GitHub will create that environment automatically.
+
+This edge is useful for modeling OIDC and deployment scenarios where trust is tied to an environment name. An attacker who can create a new environment through workflow changes may be able to instantiate a trusted environment on demand, even if it was not previously configured.

openhound_github-0.4.0/descriptions/edges/GH_CanDeployToEnvironment.md

@@ -0,0 +1,7 @@
+## General Information
+
+The traversable GH_CanDeployToEnvironment edge represents the ability for a repository, branch, repository role, or self-approving reviewer to satisfy the modeled deployment constraints for a GitHub Environment.
+
+This edge is computed from environment deployment branch policy, branch protection state, required reviewer behavior, and administrator bypass behavior. For environments without required reviewers, unrestricted environments emit repository and branch edges, protected-branch-only environments emit edges only for protected branches unless no branch protection rules exist, and custom branch policies emit edges only for matching branches.
+
+When required reviewers are configured and self-review is allowed, the configured GH_User or GH_Team reviewer receives GH_CanDeployToEnvironment because that reviewer can satisfy the approval gate themselves. When prevent_self_review is enabled, no direct deploy edge is emitted for the reviewer because the required split-principal flow is not currently modeled. GH_ApprovesDeploymentTo remains non-traversable reviewer context in both cases.

openhound_github-0.4.0/descriptions/edges/GH_CanEditEnvironment.md

@@ -0,0 +1,15 @@
+## General Information
+
+The traversable GH_CanEditEnvironment edge indicates that a repository role can modify the configuration of a GitHub environment. In the current model, this edge is emitted for the repository's built-in `admin` role to every environment contained in that repository.
+
+Editing an environment is security-relevant because environment configuration controls deployment protections such as required reviewers, self-review restrictions, wait timers, deployment branch policies, and the "allow administrators to bypass configured protection rules" setting. An attacker who can edit an environment may be able to weaken or remove those controls, making later deployment and secret access paths possible.
+
+This edge is distinct from GH_CanDeployToEnvironment:
+
+- **GH_CanEditEnvironment** means the role can manage the environment's settings.
+- **GH_CanDeployToEnvironment** means the source satisfies the modeled deployment policy, reviewer gate, or administrator bypass condition for the environment.
+
+```mermaid
+graph LR
+    role["GH_RepoRole admin"] ==>|GH_CanEditEnvironment| env["GH_Environment production"]
+```

openhound_github-0.4.0/descriptions/edges/GH_Contains.md

@@ -0,0 +1,3 @@
+## General Information
+
+The non-traversable GH_Contains edge represents structural containment within the GitHub resource hierarchy. The organization serves as the top-level container for users, teams, repositories, roles, secrets, app installations, and personal access tokens. Repositories contain branches, workflows, branch protection rules, environments, and repo-level secrets and variables. Environments contain environment branch policies, environment-scoped secrets, and environment-scoped variables. This edge is created by the collector to establish the resource hierarchy and is not traversable because containment alone does not imply privilege escalation.

{openhound_github-0.3.6 → openhound_github-0.4.0}/descriptions/edges/GH_DeploysTo.md

@@ -1,3 +1,3 @@
 ## General Information
 
-The non-traversable GH_DeploysTo edge links a workflow job to the GitHub Environment it targets via the `environment:` key. This edge records which jobs deploy to which environments. Environments can gate deployments with protection rules (required reviewers, wait timers, deployment branch policies) and can expose environment-scoped secrets.
+The non-traversable GH_DeploysTo edge links a workflow job to the GitHub Environment it targets via the `environment:` key. This edge records which jobs deploy to which environments. Environments can gate deployments with protection rules (required reviewers, wait timers, deployment branch policies) and can expose environment-scoped secrets and variables.

openhound_github-0.4.0/descriptions/edges/GH_HasBranch.md

@@ -0,0 +1,3 @@
+## General Information
+
+The non-traversable GH_Contains edge represents the relationship between a repository and its branches. This edge links each collected branch to its parent repository. It is a structural edge that provides the foundation for understanding branch-level protections and access controls. While not traversable itself, it connects repositories to branches where traversable edges like GH_CanWriteBranch and GH_CanEditProtection model the effective access.

openhound_github-0.4.0/descriptions/edges/GH_HasEnvironment.md

@@ -0,0 +1,3 @@
+## General Information
+
+Environment containment is modeled with the non-traversable GH_Contains edge from a repository to each deployment environment it defines. Branch deployment eligibility is modeled separately with GH_CanDeployToEnvironment and GH_MatchesEnvironmentPolicy rather than a containment edge. Environments are security-relevant because they can gate access to secrets and cloud credentials, and their deployment branch policies control which branches can trigger deployments.

{openhound_github-0.3.6 → openhound_github-0.4.0}/descriptions/edges/GH_HasSecret.md

@@ -1,3 +1,3 @@
 ## General Information
 
-The traversable GH_HasSecret edge represents the relationship between a repository or environment and the secrets accessible within that context. This edge shows which secrets are available in which scopes. Repositories can have access to both organization-level secrets (scoped to selected repositories) and repository-level secrets, while environments contain their own environment-scoped secrets. This edge is traversable because any principal that can push code to a repository (via GH_CanWriteBranch or GH_CanCreateBranch) can write a workflow that exfiltrates the secret values at runtime, making this a meaningful link in attack path analysis.
+The traversable GH_HasSecret edge represents the relationship between a repository or environment and the secrets accessible within that context. This edge shows which secrets are available in which scopes. Repositories can have access to both organization-level secrets (scoped to selected repositories) and repository-level secrets, while environments expose their own environment-scoped secrets to jobs that target them. This edge is traversable because any principal that can execute a workflow in the relevant context may be able to exfiltrate secret values at runtime, making this a meaningful link in attack path analysis.

openhound_github-0.4.0/descriptions/edges/GH_HasVariable.md

@@ -0,0 +1,3 @@
+## General Information
+
+The traversable GH_HasVariable edge represents the relationship between a repository or environment and the variables accessible within that context. This edge shows which variables are available in which scopes. Repositories can have access to both organization-level variables (scoped by visibility to all, private, or selected repositories) and repository-level variables defined directly on the repo, while environments expose their own environment-scoped variables to jobs that target them. This edge is traversable because any principal that can execute a workflow in the relevant context may be able to read variable values at runtime, and variables may contain configuration data useful for lateral movement such as deployment URLs, service names, or environment identifiers.

openhound_github-0.4.0/descriptions/edges/GH_MatchesEnvironmentPolicy.md

@@ -0,0 +1,7 @@
+## General Information
+
+The non-traversable GH_MatchesEnvironmentPolicy edge links a branch to a GitHub Environment deployment branch policy that it satisfies.
+
+This edge is emitted when a branch name matches the pattern defined by a GH_EnvironmentBranchPolicy node, such as `main`, `release/*`, or `release/**/*`. The edge is structural rather than directly traversable because matching a policy alone does not guarantee deployment access; the environment may still require protected branches, reviewers, wait timers, or other controls.
+
+GH_MatchesEnvironmentPolicy is primarily used as supporting evidence for computed GH_CanDeployToEnvironment edges.

openhound_github-0.4.0/descriptions/edges/GH_UsesSecret.md

@@ -0,0 +1,20 @@
+## General Information
+
+The non-traversable GH_UsesSecret edge links a workflow job or step to the secret it references via a `${{ secrets.NAME }}` expression. This edge reveals which secrets a workflow component can access at runtime, enabling analysts to trace the blast radius of a compromised workflow.
+
+### Matching strategy
+
+Edges use `match_by: property` with scope-specific matchers to disambiguate between secrets with the same name across repositories and environments:
+
+- **GH_RepoSecret** is matched by `name` + `repository_id` (the GitHub node_id of the repository).
+- **GH_OrgSecret** is matched by `name` + `environmentid` (the node_id of the organization, which acts as the org-level secret scope).
+- **GH_EnvironmentSecret** is matched by `name` + `deployment_environment_name` + `repository_id` when the parent job targets a concrete environment name.
+
+This means one `${{ secrets.MY_SECRET }}` expression in a workflow can produce edges to repo-level, org-level, and environment-level secrets that share the same name in the applicable scopes. The environment-level edge is only emitted when the workflow job references a literal environment name rather than a dynamic expression.
+
+### Context property
+
+The edge carries a `context` property indicating where the reference was found:
+- `with` — inside a `with:` input block of a `uses:` action step
+- `env` — inside the step's `env:` block
+- `run` — inline within a `run:` shell script

openhound_github-0.4.0/descriptions/edges/GH_UsesVariable.md

@@ -0,0 +1,20 @@
+## General Information
+
+The non-traversable GH_UsesVariable edge links a workflow job or step to the variable it references via a `${{ vars.NAME }}` expression. This edge maps variable consumption within workflows. Unlike secrets, variable values are readable via the API, making them lower sensitivity — but they can still influence workflow behavior (e.g., controlling target environments or feature flags).
+
+### Matching strategy
+
+Edges use `match_by: property` with scope-specific matchers to disambiguate between variables with the same name across repositories and environments:
+
+- **GH_RepoVariable** is matched by `name` + `repository_id` (the GitHub node_id of the repository).
+- **GH_OrgVariable** is matched by `name` + `environmentid` (the node_id of the organization, which acts as the org-level variable scope).
+- **GH_EnvironmentVariable** is matched by `name` + `deployment_environment_name` + `repository_id` when the parent job targets a concrete environment name.
+
+This means one `${{ vars.MY_VAR }}` expression can produce edges to repo-level, org-level, and environment-level variables that share the same name in the applicable scopes. The environment-level edge is only emitted when the workflow job references a literal environment name rather than a dynamic expression.
+
+### Context property
+
+The edge carries a `context` property indicating where the reference was found:
+- `with` — inside a `with:` input block of a `uses:` action step
+- `env` — inside the step's `env:` block
+- `run` — inline within a `run:` shell script

openhound_github-0.4.0/descriptions/nodes/GH_Environment.md

@@ -0,0 +1,5 @@
+## Description
+
+Represents a GitHub Actions deployment environment configured on a repository. Environments can have protection rules including required reviewers, wait timers, administrator bypass behavior, and deployment branch policies.
+
+Repositories always contain their environments. When custom branch policies are configured, the environment also contains one or more GH_EnvironmentBranchPolicy nodes that describe which branches are allowed to deploy. Environment-scoped secrets and variables are modeled as child nodes of the environment and become available to workflow jobs that reference it.

openhound_github-0.4.0/descriptions/nodes/GH_EnvironmentBranchPolicy.md

@@ -0,0 +1,5 @@
+## Description
+
+Represents a deployment branch policy attached to a GitHub Environment. These policies define which branches or branch patterns are allowed to deploy to the environment, such as `main`, `release/*`, or `release/**/*`.
+
+Environment branch policies are modeled as their own nodes so analysts can distinguish between the environment itself and the matching rules that govern deployment eligibility.

openhound_github-0.4.0/descriptions/nodes/GH_EnvironmentSecret.md

@@ -0,0 +1,5 @@
+## Description
+
+Represents an environment-level GitHub Actions secret. These secrets are scoped to a specific deployment environment and are only available to workflow jobs that reference that environment.
+
+The containing environment is linked to the secret with GH_Contains and GH_HasSecret edges. Workflow steps that reference the secret by name receive GH_UsesSecret edges when their job targets the same environment.

{openhound_github-0.3.6 → openhound_github-0.4.0}/descriptions/nodes/GH_EnvironmentVariable.md

@@ -1,3 +1,5 @@
 ## Description
 
 Represents an environment-level GitHub Actions variable. These variables are scoped to a specific deployment environment and are only available to workflow jobs that reference that environment. Unlike secrets, variable values are readable via the API.
+
+The containing environment is linked to the variable with GH_Contains and GH_HasVariable edges. Workflow steps that reference the variable by name receive GH_UsesVariable edges when their job targets the same environment.

{openhound_github-0.3.6 → openhound_github-0.4.0}/extension/saved_searches/environments-admin-bypass.json

@@ -1,5 +1,5 @@
 {
   "name": "GitHub: Environments Where Admins Can Bypass Protections",
-  "query": "MATCH p=(:GH_Repository)-[:GH_HasEnvironment]->(env:GH_Environment {can_admins_bypass: true})\nRETURN p\nLIMIT 1000",
+  "query": "MATCH p=(:GH_Repository)-[:GH_Contains]->(env:GH_Environment {can_admins_bypass: true})\nRETURN p\nLIMIT 1000",
   "description": "Finds deployment environments where administrators can bypass protection rules such as required reviewers and wait timers. Admins can deploy to these environments without any approval."
 }

{openhound_github-0.3.6 → openhound_github-0.4.0}/extension/saved_searches/repository-workflows.json

@@ -1,5 +1,5 @@
 {
   "name": "GitHub: Repository Workflows",
-  "query": "MATCH p=(:GH_Repository)-[:GH_HasWorkflow]->(:GH_Workflow)\nRETURN p\nLIMIT 1000",
+  "query": "MATCH p=(:GH_Repository)-[:GH_Contains]->(:GH_Workflow)\nRETURN p\nLIMIT 1000",
   "description": "Returns all repository workflows"
 }

{openhound_github-0.3.6 → openhound_github-0.4.0}/extension/saved_searches/unprotected-branches.json

@@ -1,5 +1,5 @@
 {
   "name": "GitHub: Unprotected Branches",
-  "query": "MATCH p=(repo:GH_Repository)-[:GH_HasBranch]-(:GH_Branch {protected: false})\nRETURN p\nLIMIT 1000",
+  "query": "MATCH p=(repo:GH_Repository)-[:GH_Contains]-(:GH_Branch {protected: false})\nRETURN p\nLIMIT 1000",
   "description": "Returns all unprotected branches in repositories."
 }

{openhound_github-0.3.6 → openhound_github-0.4.0}/extension/saved_searches/unprotected-default-branch-with-workflow.json

@@ -1,5 +1,5 @@
 {
   "name": "GitHub: Repositories with Workflows and Unprotected Default Branch",
-  "query": "MATCH p=(repo:GH_Repository)-[:GH_HasWorkflow]->(:GH_Workflow)\nMATCH p1=(repo)-[:GH_HasBranch]->(branch:GH_Branch)\nWHERE repo.default_branch = branch.short_name\nAND branch.protected = false\nRETURN p1\nLIMIT 1000",
+  "query": "MATCH p=(repo:GH_Repository)-[:GH_Contains]->(:GH_Workflow)\nMATCH p1=(repo)-[:GH_Contains]->(branch:GH_Branch)\nWHERE repo.default_branch = branch.short_name\nAND branch.protected = false\nRETURN p1\nLIMIT 1000",
   "description": "Returns all repositories that have GitHub Actions workflows and an unprotected default branch. This means that users with GH_WriteRepoContents to the Repository can overwrite or change the workflow."
 }

openhound_github-0.4.0/extension/saved_searches/unprotected-default-branches.json

@@ -0,0 +1,5 @@
+{
+  "name": "GitHub: Unprotected Default Branches",
+  "query": "MATCH p=(repo:GH_Repository)-[:GH_Contains]-(branch:GH_Branch {protected: false})\nWHERE repo.default_branch = branch.short_name\nRETURN p\nLIMIT 1000",
+  "description": "Returns all default branches in repositories that are not protected."
+}

{openhound_github-0.3.6 → openhound_github-0.4.0}/extension/schema.json

@@ -2,7 +2,7 @@
   "schema": {
     "name": "SOGitHub",
     "display_name": "GitHub Extension (by SpecterOps)",
-    "version": "v1.2.3",
+    "version": "v1.3.0",
     "namespace": "GH"
   },
   "node_kinds": [
@@ -142,6 +142,14 @@
       "icon": "leaf",
       "color": "#D5F2C2"
     },
+    {
+      "name": "GH_EnvironmentBranchPolicy",
+      "display_name": "GitHub Environment Branch Policy",
+      "description": "A deployment branch policy attached to a GitHub environment, such as an exact branch name or wildcard pattern like release/*",
+      "is_display_kind": true,
+      "icon": "code-branch",
+      "color": "#B7E3A1"
+    },
     {
       "name": "GH_OrgSecret",
       "display_name": "GitHub Org Secret",
@@ -277,6 +285,126 @@
       "description": "Container relationship for organizational hierarchy (org contains secrets/variables, repo contains secrets/variables, environment contains secrets/variables)",
       "is_traversable": false
     },
+    {
+      "name": "GH_CreateEnterpriseOrganizations",
+      "description": "[Enterprise] Enterprise role can create organizations",
+      "is_traversable": false
+    },
+    {
+      "name": "GH_EditEnterpriseCustomPropertiesForOrganizations",
+      "description": "[Enterprise] Enterprise role can edit custom properties for organizations",
+      "is_traversable": false
+    },
+    {
+      "name": "GH_ManageEnterpriseAdmins",
+      "description": "[Enterprise] Enterprise role can manage enterprise administrators",
+      "is_traversable": true
+    },
+    {
+      "name": "GH_ManageEnterpriseIdentityProvider",
+      "description": "[Enterprise] Enterprise role can manage the enterprise identity provider",
+      "is_traversable": false
+    },
+    {
+      "name": "GH_ManageEnterpriseMembers",
+      "description": "[Enterprise] Enterprise role can manage enterprise members",
+      "is_traversable": true
+    },
+    {
+      "name": "GH_ManageEnterpriseOrganizationAdmins",
+      "description": "[Enterprise] Enterprise role can manage organization administrators",
+      "is_traversable": true
+    },
+    {
+      "name": "GH_ManageEnterpriseOrganizations",
+      "description": "[Enterprise] Enterprise role can manage organizations",
+      "is_traversable": false
+    },
+    {
+      "name": "GH_ManageEnterpriseReferrals",
+      "description": "[Enterprise] Enterprise role can manage referrals",
+      "is_traversable": false
+    },
+    {
+      "name": "GH_ManageEnterpriseTeams",
+      "description": "[Enterprise] Enterprise role can manage enterprise teams",
+      "is_traversable": false
+    },
+    {
+      "name": "GH_ReadEnterpriseAuditLog",
+      "description": "[Enterprise] Enterprise role can read the audit log",
+      "is_traversable": false
+    },
+    {
+      "name": "GH_ReadEnterpriseDomainVerification",
+      "description": "[Enterprise] Enterprise role can read domain verification data",
+      "is_traversable": false
+    },
+    {
+      "name": "GH_ReadEnterpriseMembers",
+      "description": "[Enterprise] Enterprise role can read enterprise members",
+      "is_traversable": false
+    },
+    {
+      "name": "GH_ReadEnterpriseOrgProjects",
+      "description": "[Enterprise] Enterprise role can read organization projects",
+      "is_traversable": false
+    },
+    {
+      "name": "GH_ReadEnterpriseOrganizationAdmin",
+      "description": "[Enterprise] Enterprise role can read organization administration data",
+      "is_traversable": false
+    },
+    {
+      "name": "GH_SetEnterpriseInteractionLimits",
+      "description": "[Enterprise] Enterprise role can set interaction limits",
+      "is_traversable": false
+    },
+    {
+      "name": "GH_ViewEnterpriseActionsUsageMetrics",
+      "description": "[Enterprise] Enterprise role can view Actions usage metrics",
+      "is_traversable": false
+    },
+    {
+      "name": "GH_ViewEnterpriseBilling",
+      "description": "[Enterprise] Enterprise role can view billing data",
+      "is_traversable": false
+    },
+    {
+      "name": "GH_ViewEnterpriseSecretScanningAlerts",
+      "description": "[Enterprise] Enterprise role can view secret-scanning alerts",
+      "is_traversable": false
+    },
+    {
+      "name": "GH_WriteEnterpriseActionsPolicies",
+      "description": "[Enterprise] Enterprise role can write Actions policies",
+      "is_traversable": false
+    },
+    {
+      "name": "GH_WriteEnterpriseBilling",
+      "description": "[Enterprise] Enterprise role can write billing settings",
+      "is_traversable": false
+    },
+    {
+      "name": "GH_WriteEnterprisePersonalAccessTokenPolicies",
+      "description": "[Enterprise] Enterprise role can write personal access token policies",
+      "is_traversable": false
+    },
+    {
+      "name": "GH_WriteEnterpriseSso",
+      "description": "[Enterprise] Enterprise role can write SSO settings",
+      "is_traversable": false
+    },
+    {
+      "name": "GH_WriteEnterpriseTeamMembers",
+      "description": "[Enterprise] Enterprise role can write enterprise team membership",
+      "is_traversable": false
+    },
+    {
+      "name": "GH_AssignedTo",
+      "description": "Enterprise team is assigned to an organization",
+      "is_traversable": false
+    },
     {
       "name": "GH_Owns",
       "description": "Organization owns a repository",
@@ -295,13 +423,33 @@
     {
       "name": "GH_AddMember",
       "description": "Team role can add members to the team (maintainer privilege)",
-      "is_traversable": true
+      "is_traversable": false
     },
     {
       "name": "GH_HasBaseRole",
       "description": "Role inherits permissions from another role",
       "is_traversable": true
     },
+    {
+      "name": "GH_CanCreateRepositories",
+      "description": "Role can create repositories in the organization",
+      "is_traversable": false
+    },
+    {
+      "name": "GH_CanCreatePublicRepositories",
+      "description": "Role can create public repositories in the organization",
+      "is_traversable": false
+    },
+    {
+      "name": "GH_CanCreateInternalRepositories",
+      "description": "Role can create internal repositories in the organization",
+      "is_traversable": false
+    },
+    {
+      "name": "GH_CanCreatePrivateRepositories",
+      "description": "Role can create private repositories in the organization",
+      "is_traversable": false
+    },
     {
       "name": "GH_ReadRepoContents",
       "description": "[Repository] Repo role can read repository contents",
@@ -320,7 +468,7 @@
     {
       "name": "GH_AdminTo",
       "description": "[Repository] Repo role has admin access to the repository.",
-      "is_traversable": false
+      "is_traversable": true
     },
     {
       "name": "GH_BypassBranchProtection",
@@ -697,16 +845,16 @@
       "description": "User or team is allowed to push to branches protected by this rule",
       "is_traversable": false
     },
-    {
-      "name": "GH_HasBranch",
-      "description": "Repository has this branch",
-      "is_traversable": false
-    },
     {
       "name": "GH_CanEditProtection",
       "description": "[Repository - Computed] Repo role can modify or remove branch protection rules for the repository/branch (computed from GH_EditRepoProtections + GH_ProtectedBy)",
       "is_traversable": true
     },
+    {
+      "name": "GH_CanReadSecret",
+      "description": "Org role can read an organization secret by creating a repository in scope",
+      "is_traversable": true
+    },
     {
       "name": "GH_CanReadSecretScanningAlert",
       "description": "[Computed] Role can read secret scanning alerts (computed from GH_ViewSecretScanningAlerts permission + GH_Contains)",
@@ -717,16 +865,6 @@
       "description": "Branch protection rule protects this branch",
       "is_traversable": false
     },
-    {
-      "name": "GH_HasWorkflow",
-      "description": "Repository has this workflow",
-      "is_traversable": false
-    },
-    {
-      "name": "GH_HasEnvironment",
-      "description": "Repository or branch has/can deploy to this environment",
-      "is_traversable": false
-    },
     {
       "name": "GH_HasSecret",
       "description": "Repository or environment has access to this secret",
@@ -734,7 +872,7 @@
     },
     {
       "name": "GH_HasVariable",
-      "description": "Repository has access to this variable (org-level or repo-level)",
+      "description": "Repository or environment has access to this variable",
       "is_traversable": true
     },
     {
@@ -777,6 +915,11 @@
       "description": "Personal access token or app installation can access this repository or organization",
       "is_traversable": false
     },
+    {
+      "name": "GH_CanUseRunner",
+      "description": "Repository can dispatch jobs to this runner",
+      "is_traversable": false
+    },
     {
       "name": "GH_CanWriteBranch",
       "description": "[Repository - Computed] Role can push to this branch after evaluating branch protection rules, push restrictions, and bypass allowances",
@@ -787,6 +930,16 @@
       "description": "[Repository - Computed] Role can create new branches in this repository (unprotected branches that bypass the merge gate)",
       "is_traversable": true
     },
+    {
+      "name": "GH_CanCreateEnvironment",
+      "description": "Repo role can create new GitHub environments in this repository by editing a workflow that references a nonexistent environment name",
+      "is_traversable": true
+    },
+    {
+      "name": "GH_CanEditEnvironment",
+      "description": "Repo admin role can edit the configuration of this GitHub environment",
+      "is_traversable": true
+    },
     {
       "name": "GH_CanAssumeIdentity",
       "description": "Repository can assume this cloud identity via OIDC federation (Azure workload identity or AWS IAM role)",
@@ -818,28 +971,33 @@
       "is_traversable": false
     },
     {
-      "name": "GH_HasJob",
-      "description": "[Workflow] Workflow contains this job — GH_Workflow → GH_WorkflowJob",
+      "name": "GH_HasMember",
+      "description": "Enterprise or organization has this user as a member",
       "is_traversable": false
     },
     {
-      "name": "GH_HasMember",
-      "description": "Enterprise or organization has this user as a member",
+      "name": "GH_UsesSecret",
+      "description": "[Workflow] Job or step references a secret by name — GH_WorkflowJob / GH_WorkflowStep → GH_RepoSecret / GH_OrgSecret / GH_EnvironmentSecret (scope match)",
       "is_traversable": false
     },
     {
-      "name": "GH_HasStep",
-      "description": "[Workflow] Job contains this step — GH_WorkflowJob → GH_WorkflowStep",
+      "name": "GH_UsesVariable",
+      "description": "[Workflow] Job or step references a variable by name — GH_WorkflowJob / GH_WorkflowStep → GH_RepoVariable / GH_OrgVariable / GH_EnvironmentVariable (scope match)",
       "is_traversable": false
     },
     {
-      "name": "GH_UsesSecret",
-      "description": "[Workflow] Step references a secret by name — GH_WorkflowStep → GH_RepoSecret / GH_OrgSecret (name match)",
+      "name": "GH_CanDeployToEnvironment",
+      "description": "[Computed] Repository, branch, repo role, or self-approving reviewer can deploy to this GitHub environment after evaluating deployment branch policy, reviewer gates, and admin bypass behavior",
+      "is_traversable": true
+    },
+    {
+      "name": "GH_MatchesEnvironmentPolicy",
+      "description": "Branch matches this environment deployment branch policy",
       "is_traversable": false
     },
     {
-      "name": "GH_UsesVariable",
-      "description": "[Workflow] Step references a variable by name — GH_WorkflowStep → GH_RepoVariable / GH_OrgVariable (name match)",
+      "name": "GH_ApprovesDeploymentTo",
+      "description": "User or team is configured as a required reviewer for this environment",
       "is_traversable": false
     }
   ],
@@ -848,11 +1006,7 @@
       "environment_kind": "GH_Organization",
       "source_kind": "GitHub",
       "principal_kinds": [
-        "GH_User",
-        "GH_Team",
-        "GH_Repository",
-        "GH_Branch",
-        "GH_Environment"
+        "GH_User"
       ]
     }
   ],

{openhound_github-0.3.6 → openhound_github-0.4.0}/pyproject.toml

@@ -24,7 +24,7 @@ source = "vcs"
 local_scheme = "no-local-version"
 
 [tool.hatch.build.targets.wheel.force-include]
-"extension.yaml" = "openhound_github/extension.yaml"
+"src/openhound_github/extension.yaml" = "openhound_github/extension.yaml"
 
 [dependency-groups]
 dev = [