openhound-github 0.3.7__tar.gz → 0.5.0__tar.gz

{openhound_github-0.3.7 → openhound_github-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: openhound-github
-Version: 0.3.7
+Version: 0.5.0
 Summary: Github collector for OpenHound
 Author-email: "jdreijer@specterops.io" <jdreijer@specterops.io>, Jared Atkinson <jatkinson@specterops.io>
 License-File: LICENSE.md
@@ -45,6 +45,14 @@ The openhound-github extension collects resources from Github organizations and
 edges for
 BloodHound.
 
+### Enterprise SCIM and hybrid correlations
+
+When `SOURCES__GITHUB__COLLECT_ENTERPRISE_SCIM=true`, a token with enterprise SCIM access is used to collect both `/scim/v2/enterprises/{enterprise}/Users` and `/scim/v2/enterprises/{enterprise}/Groups`. The collector emits normalized `SCIM_Organization`, `SCIM_User`, and `SCIM_Group` nodes plus `SCIM_Contains`, `SCIM_MemberOf`, and `SCIM_Provisioned` relationships. Install the BloodHound SCIM extension alongside this extension to register the shared SCIM kinds.
+
+`SOURCES__GITHUB__EMIT_LEGACY_SCIM_CORRELATIONS=true` temporarily reproduces GitHound-style Okta-to-SCIM correlation relationships. It defaults to false because a dedicated hybrid correlator should own IdP-to-SCIM matching; GitHub remains authoritative for GitHub's SCIM resources and target-system provisioning relationships.
+
+Enterprise roles, including the built-in `members` role, are emitted through `GH_HasRole` and granular enterprise capability relationships. Only capability relationships with a confirmed privilege path are traversable; descriptive permissions such as `GH_WriteEnterpriseSso` remain non-traversable.
+
 [![Python Version](https://img.shields.io/badge/Python-3.13-brightgreen.svg)](#about)
 
 ## Getting Started

{openhound_github-0.3.7 → openhound_github-0.5.0}/README.md

@@ -34,6 +34,14 @@ The openhound-github extension collects resources from Github organizations and
 edges for
 BloodHound.
 
+### Enterprise SCIM and hybrid correlations
+
+When `SOURCES__GITHUB__COLLECT_ENTERPRISE_SCIM=true`, a token with enterprise SCIM access is used to collect both `/scim/v2/enterprises/{enterprise}/Users` and `/scim/v2/enterprises/{enterprise}/Groups`. The collector emits normalized `SCIM_Organization`, `SCIM_User`, and `SCIM_Group` nodes plus `SCIM_Contains`, `SCIM_MemberOf`, and `SCIM_Provisioned` relationships. Install the BloodHound SCIM extension alongside this extension to register the shared SCIM kinds.
+
+`SOURCES__GITHUB__EMIT_LEGACY_SCIM_CORRELATIONS=true` temporarily reproduces GitHound-style Okta-to-SCIM correlation relationships. It defaults to false because a dedicated hybrid correlator should own IdP-to-SCIM matching; GitHub remains authoritative for GitHub's SCIM resources and target-system provisioning relationships.
+
+Enterprise roles, including the built-in `members` role, are emitted through `GH_HasRole` and granular enterprise capability relationships. Only capability relationships with a confirmed privilege path are traversable; descriptive permissions such as `GH_WriteEnterpriseSso` remain non-traversable.
+
 [![Python Version](https://img.shields.io/badge/Python-3.13-brightgreen.svg)](#about)
 
 ## Getting Started

openhound_github-0.5.0/descriptions/edges/GH_AddMember.md

@@ -0,0 +1,3 @@
+## General Information
+
+The non-traversable GH_AddMember edge indicates that a team role with the Maintainer permission level can add new members to the team. Maintainers already inherit the team's repository permissions through GH_MemberOf, so this edge preserves the membership-management capability as context without creating a second access path to the same team.

openhound_github-0.5.0/descriptions/edges/GH_AdminTo.md

@@ -0,0 +1,3 @@
+## General Information
+
+The traversable GH_AdminTo edge represents a role's full administrative access to the repository. Admin is the highest built-in repository role and grants control over all repository settings, including dangerous operations like deleting the repository or modifying its visibility. Admin access bypasses most protections including branch protection rules, unless `enforce_admins` is explicitly enabled on the branch protection rule. This edge is a key permission in the computed branch access model and is a high-value target in attack path analysis.

openhound_github-0.5.0/descriptions/edges/GH_ApprovesDeploymentTo.md

@@ -0,0 +1,7 @@
+## General Information
+
+The non-traversable GH_ApprovesDeploymentTo edge represents that a user or team is configured as a required reviewer for a GitHub Environment.
+
+This edge is emitted from GH_User or GH_Team nodes to GH_Environment nodes when the environment includes a required reviewer protection rule. Required reviewers act as an approval gate before jobs referencing the environment can continue.
+
+The edge is non-traversable because it records reviewer configuration rather than direct deployment access. When self-review is allowed, the same reviewer may also receive a traversable GH_CanDeployToEnvironment edge because they can satisfy the approval gate themselves. When prevent_self_review is enabled, GH_ApprovesDeploymentTo remains context only because the split-principal approval flow is not currently modeled.

openhound_github-0.5.0/descriptions/edges/GH_AssignedTo.md

@@ -0,0 +1,5 @@
+## General Information
+
+The non-traversable GH_AssignedTo edge represents an enterprise-scoped object being assigned to an organization. It is currently used for enterprise teams and enterprise runner groups. For runner groups, this edge indicates that an organization is allowed to inherit and use the enterprise-owned runner group.
+
+This edge is not traversable because assignment alone does not directly grant a principal a privilege path.

openhound_github-0.5.0/descriptions/edges/GH_CanCreateEnvironment.md

@@ -0,0 +1,5 @@
+## General Information
+
+The traversable GH_CanCreateEnvironment edge is a computed edge indicating that a repository role can cause a new GitHub environment to be created in the repository. This is derived from the ability to create and modify runnable branches/workflows: if a workflow references an environment name that does not already exist, GitHub will create that environment automatically.
+
+This edge is useful for modeling OIDC and deployment scenarios where trust is tied to an environment name. An attacker who can create a new environment through workflow changes may be able to instantiate a trusted environment on demand, even if it was not previously configured.

openhound_github-0.5.0/descriptions/edges/GH_CanCreateRepositoryWithRunnerAccess.md

@@ -0,0 +1,9 @@
+## General Information
+
+The non-traversable GH_CanCreateRepositoryWithRunnerAccess edge is a computed edge indicating that a GH_OrgRole can create a repository whose visibility automatically places it in scope for a GH_OrgRunnerGroup.
+
+This edge is emitted only for runner groups with `visibility=all` or `visibility=private`. Groups with `visibility=selected` require explicit repository assignment, so creating a repository does not automatically grant access to the group.
+
+The computation follows repository-creation capability edges from the org role to the organization and then GH_Contains to the runner group. For `visibility=all`, public repository creation is included only when `allows_public_repositories=true`; otherwise the composition is limited to private and internal repository creation. Each edge includes a `query_composition` Cypher query showing the underlying graph evidence.
+
+This edge represents latent repository eligibility subject to runner-group workflow policy. It is non-traversable because creating an eligible repository does not by itself prove that arbitrary jobs can dispatch to the group's runners.

openhound_github-0.5.0/descriptions/edges/GH_CanDeployToEnvironment.md

@@ -0,0 +1,7 @@
+## General Information
+
+The traversable GH_CanDeployToEnvironment edge represents the ability for a repository, branch, repository role, or self-approving reviewer to satisfy the modeled deployment constraints for a GitHub Environment.
+
+This edge is computed from environment deployment branch policy, branch protection state, required reviewer behavior, and administrator bypass behavior. For environments without required reviewers, unrestricted environments emit repository and branch edges, protected-branch-only environments emit edges only for protected branches unless no branch protection rules exist, and custom branch policies emit edges only for matching branches.
+
+When required reviewers are configured and self-review is allowed, the configured GH_User or GH_Team reviewer receives GH_CanDeployToEnvironment because that reviewer can satisfy the approval gate themselves. When prevent_self_review is enabled, no direct deploy edge is emitted for the reviewer because the required split-principal flow is not currently modeled. GH_ApprovesDeploymentTo remains non-traversable reviewer context in both cases.

openhound_github-0.5.0/descriptions/edges/GH_CanEditEnvironment.md

@@ -0,0 +1,15 @@
+## General Information
+
+The traversable GH_CanEditEnvironment edge indicates that a repository role can modify the configuration of a GitHub environment. In the current model, this edge is emitted for the repository's built-in `admin` role to every environment contained in that repository.
+
+Editing an environment is security-relevant because environment configuration controls deployment protections such as required reviewers, self-review restrictions, wait timers, deployment branch policies, and the "allow administrators to bypass configured protection rules" setting. An attacker who can edit an environment may be able to weaken or remove those controls, making later deployment and secret access paths possible.
+
+This edge is distinct from GH_CanDeployToEnvironment:
+
+- **GH_CanEditEnvironment** means the role can manage the environment's settings.
+- **GH_CanDeployToEnvironment** means the source satisfies the modeled deployment policy, reviewer gate, or administrator bypass condition for the environment.
+
+```mermaid
+graph LR
+    role["GH_RepoRole admin"] ==>|GH_CanEditEnvironment| env["GH_Environment production"]
+```

openhound_github-0.5.0/descriptions/edges/GH_CanUseRunner.md

@@ -0,0 +1,5 @@
+## General Information
+
+The non-traversable GH_CanUseRunner edge represents that a repository can dispatch GitHub Actions jobs to a self-hosted runner. Repository-scoped runners receive this edge directly from their containing repository. Organization and enterprise runners receive composed GH_CanUseRunner edges derived from runner group containment and repository access policy.
+
+For native organization runner groups, the composition path is `GH_Repository <- GH_GrantsAccessTo - GH_OrgRunnerGroup - GH_Contains -> GH_OrgRunner`. For inherited groups, the path continues through `GH_InheritedFrom` to the enterprise runner group and its contained GH_EnterpriseRunner nodes.

openhound_github-0.5.0/descriptions/edges/GH_Contains.md

@@ -0,0 +1,3 @@
+## General Information
+
+The non-traversable GH_Contains edge represents structural containment within the GitHub resource hierarchy. The enterprise contains enterprise teams, roles, managed users, runner groups, and enterprise runners through their groups. The organization serves as a top-level container for users, teams, repositories, roles, secrets, app installations, personal access tokens, and organization runner groups. Native organization runner groups contain organization runners. Repositories contain branches, workflows, branch protection rules, environments, repo-level secrets and variables, and repository-scoped runners. Environments contain environment branch policies, environment-scoped secrets, and environment-scoped variables. This edge is created by the collector to establish the resource hierarchy and is not traversable because containment alone does not imply privilege escalation.

{openhound_github-0.3.7 → openhound_github-0.5.0}/descriptions/edges/GH_DeploysTo.md

@@ -1,3 +1,3 @@
 ## General Information
 
-The non-traversable GH_DeploysTo edge links a workflow job to the GitHub Environment it targets via the `environment:` key. This edge records which jobs deploy to which environments. Environments can gate deployments with protection rules (required reviewers, wait timers, deployment branch policies) and can expose environment-scoped secrets.
+The non-traversable GH_DeploysTo edge links a workflow job to the GitHub Environment it targets via the `environment:` key. This edge records which jobs deploy to which environments. Environments can gate deployments with protection rules (required reviewers, wait timers, deployment branch policies) and can expose environment-scoped secrets and variables.

openhound_github-0.5.0/descriptions/edges/GH_GrantsAccessTo.md

@@ -0,0 +1,5 @@
+## General Information
+
+The non-traversable GH_GrantsAccessTo edge represents that a GH_OrgRunnerGroup allows a repository to use the runners exposed by that group. For native groups, those runners are GH_OrgRunner nodes contained by the group. For inherited groups, those runners are GH_EnterpriseRunner nodes reached through GH_InheritedFrom.
+
+This edge is used as part of the composition path for GH_CanUseRunner and is not traversable on its own because repository eligibility alone is not a privilege escalation path.

openhound_github-0.5.0/descriptions/edges/GH_HasBranch.md

@@ -0,0 +1,3 @@
+## General Information
+
+The non-traversable GH_Contains edge represents the relationship between a repository and its branches. This edge links each collected branch to its parent repository. It is a structural edge that provides the foundation for understanding branch-level protections and access controls. While not traversable itself, it connects repositories to branches where traversable edges like GH_CanWriteBranch and GH_CanEditProtection model the effective access.

openhound_github-0.5.0/descriptions/edges/GH_HasEnvironment.md

@@ -0,0 +1,3 @@
+## General Information
+
+Environment containment is modeled with the non-traversable GH_Contains edge from a repository to each deployment environment it defines. Branch deployment eligibility is modeled separately with GH_CanDeployToEnvironment and GH_MatchesEnvironmentPolicy rather than a containment edge. Environments are security-relevant because they can gate access to secrets and cloud credentials, and their deployment branch policies control which branches can trigger deployments.

{openhound_github-0.3.7 → openhound_github-0.5.0}/descriptions/edges/GH_HasSecret.md

@@ -1,3 +1,3 @@
 ## General Information
 
-The traversable GH_HasSecret edge represents the relationship between a repository or environment and the secrets accessible within that context. This edge shows which secrets are available in which scopes. Repositories can have access to both organization-level secrets (scoped to selected repositories) and repository-level secrets, while environments contain their own environment-scoped secrets. This edge is traversable because any principal that can push code to a repository (via GH_CanWriteBranch or GH_CanCreateBranch) can write a workflow that exfiltrates the secret values at runtime, making this a meaningful link in attack path analysis.
+The traversable GH_HasSecret edge represents the relationship between a repository or environment and the secrets accessible within that context. This edge shows which secrets are available in which scopes. Repositories can have access to both organization-level secrets (scoped to selected repositories) and repository-level secrets, while environments expose their own environment-scoped secrets to jobs that target them. This edge is traversable because any principal that can execute a workflow in the relevant context may be able to exfiltrate secret values at runtime, making this a meaningful link in attack path analysis.

openhound_github-0.5.0/descriptions/edges/GH_HasVariable.md

@@ -0,0 +1,3 @@
+## General Information
+
+The traversable GH_HasVariable edge represents the relationship between a repository or environment and the variables accessible within that context. This edge shows which variables are available in which scopes. Repositories can have access to both organization-level variables (scoped by visibility to all, private, or selected repositories) and repository-level variables defined directly on the repo, while environments expose their own environment-scoped variables to jobs that target them. This edge is traversable because any principal that can execute a workflow in the relevant context may be able to read variable values at runtime, and variables may contain configuration data useful for lateral movement such as deployment URLs, service names, or environment identifiers.

openhound_github-0.5.0/descriptions/edges/GH_InheritedFrom.md

@@ -0,0 +1,5 @@
+## General Information
+
+The non-traversable GH_InheritedFrom edge links an inherited GH_OrgRunnerGroup to the GH_EnterpriseRunnerGroup that owns the underlying runner set. This preserves the organization-local view of a runner group while still identifying the enterprise source that provides the runners.
+
+This edge is not traversable because inheritance describes resource provenance rather than a direct privilege path.

openhound_github-0.5.0/descriptions/edges/GH_MatchesEnvironmentPolicy.md

@@ -0,0 +1,7 @@
+## General Information
+
+The non-traversable GH_MatchesEnvironmentPolicy edge links a branch to a GitHub Environment deployment branch policy that it satisfies.
+
+This edge is emitted when a branch name matches the pattern defined by a GH_EnvironmentBranchPolicy node, such as `main`, `release/*`, or `release/**/*`. The edge is structural rather than directly traversable because matching a policy alone does not guarantee deployment access; the environment may still require protected branches, reviewers, wait timers, or other controls.
+
+GH_MatchesEnvironmentPolicy is primarily used as supporting evidence for computed GH_CanDeployToEnvironment edges.

openhound_github-0.5.0/descriptions/edges/GH_UsesSecret.md

@@ -0,0 +1,20 @@
+## General Information
+
+The non-traversable GH_UsesSecret edge links a workflow job or step to the secret it references via a `${{ secrets.NAME }}` expression. This edge reveals which secrets a workflow component can access at runtime, enabling analysts to trace the blast radius of a compromised workflow.
+
+### Matching strategy
+
+Edges use `match_by: property` with scope-specific matchers to disambiguate between secrets with the same name across repositories and environments:
+
+- **GH_RepoSecret** is matched by `name` + `repository_id` (the GitHub node_id of the repository).
+- **GH_OrgSecret** is matched by `name` + `environmentid` (the node_id of the organization, which acts as the org-level secret scope).
+- **GH_EnvironmentSecret** is matched by `name` + `deployment_environment_name` + `repository_id` when the parent job targets a concrete environment name.
+
+This means one `${{ secrets.MY_SECRET }}` expression in a workflow can produce edges to repo-level, org-level, and environment-level secrets that share the same name in the applicable scopes. The environment-level edge is only emitted when the workflow job references a literal environment name rather than a dynamic expression.
+
+### Context property
+
+The edge carries a `context` property indicating where the reference was found:
+- `with` — inside a `with:` input block of a `uses:` action step
+- `env` — inside the step's `env:` block
+- `run` — inline within a `run:` shell script

openhound_github-0.5.0/descriptions/edges/GH_UsesVariable.md

@@ -0,0 +1,20 @@
+## General Information
+
+The non-traversable GH_UsesVariable edge links a workflow job or step to the variable it references via a `${{ vars.NAME }}` expression. This edge maps variable consumption within workflows. Unlike secrets, variable values are readable via the API, making them lower sensitivity — but they can still influence workflow behavior (e.g., controlling target environments or feature flags).
+
+### Matching strategy
+
+Edges use `match_by: property` with scope-specific matchers to disambiguate between variables with the same name across repositories and environments:
+
+- **GH_RepoVariable** is matched by `name` + `repository_id` (the GitHub node_id of the repository).
+- **GH_OrgVariable** is matched by `name` + `environmentid` (the node_id of the organization, which acts as the org-level variable scope).
+- **GH_EnvironmentVariable** is matched by `name` + `deployment_environment_name` + `repository_id` when the parent job targets a concrete environment name.
+
+This means one `${{ vars.MY_VAR }}` expression can produce edges to repo-level, org-level, and environment-level variables that share the same name in the applicable scopes. The environment-level edge is only emitted when the workflow job references a literal environment name rather than a dynamic expression.
+
+### Context property
+
+The edge carries a `context` property indicating where the reference was found:
+- `with` — inside a `with:` input block of a `uses:` action step
+- `env` — inside the step's `env:` block
+- `run` — inline within a `run:` shell script

openhound_github-0.5.0/descriptions/nodes/GH_EnterpriseRunner.md

@@ -0,0 +1,5 @@
+## Description
+
+Represents a self-hosted runner owned at the GitHub Enterprise level. Enterprise runners are contained by GH_EnterpriseRunnerGroup nodes and become usable by repositories when an inherited organization runner group grants access to those repositories.
+
+The node captures runner metadata such as operating system, status, busy state, labels, and whether the runner is ephemeral when GitHub returns that property.

openhound_github-0.5.0/descriptions/nodes/GH_EnterpriseRunnerGroup.md

@@ -0,0 +1,5 @@
+## Description
+
+Represents a self-hosted runner group owned by a GitHub Enterprise account. Enterprise runner groups control which organizations may use a shared set of enterprise runners. Groups with `visibility=all` are assigned to every organization in the enterprise, while groups with `visibility=selected` are assigned only to explicitly selected organizations.
+
+Enterprise runner groups contain GH_EnterpriseRunner nodes and may be projected into organizations as inherited GH_OrgRunnerGroup nodes. The GH_InheritedFrom edge links the organization view back to the enterprise-owned group.

openhound_github-0.5.0/descriptions/nodes/GH_Environment.md

@@ -0,0 +1,5 @@
+## Description
+
+Represents a GitHub Actions deployment environment configured on a repository. Environments can have protection rules including required reviewers, wait timers, administrator bypass behavior, and deployment branch policies.
+
+Repositories always contain their environments. When custom branch policies are configured, the environment also contains one or more GH_EnvironmentBranchPolicy nodes that describe which branches are allowed to deploy. Environment-scoped secrets and variables are modeled as child nodes of the environment and become available to workflow jobs that reference it.

openhound_github-0.5.0/descriptions/nodes/GH_EnvironmentBranchPolicy.md

@@ -0,0 +1,5 @@
+## Description
+
+Represents a deployment branch policy attached to a GitHub Environment. These policies define which branches or branch patterns are allowed to deploy to the environment, such as `main`, `release/*`, or `release/**/*`.
+
+Environment branch policies are modeled as their own nodes so analysts can distinguish between the environment itself and the matching rules that govern deployment eligibility.

openhound_github-0.5.0/descriptions/nodes/GH_EnvironmentSecret.md

@@ -0,0 +1,5 @@
+## Description
+
+Represents an environment-level GitHub Actions secret. These secrets are scoped to a specific deployment environment and are only available to workflow jobs that reference that environment.
+
+The containing environment is linked to the secret with GH_Contains and GH_HasSecret edges. Workflow steps that reference the secret by name receive GH_UsesSecret edges when their job targets the same environment.

{openhound_github-0.3.7 → openhound_github-0.5.0}/descriptions/nodes/GH_EnvironmentVariable.md

@@ -1,3 +1,5 @@
 ## Description
 
 Represents an environment-level GitHub Actions variable. These variables are scoped to a specific deployment environment and are only available to workflow jobs that reference that environment. Unlike secrets, variable values are readable via the API.
+
+The containing environment is linked to the variable with GH_Contains and GH_HasVariable edges. Workflow steps that reference the variable by name receive GH_UsesVariable edges when their job targets the same environment.

openhound_github-0.5.0/descriptions/nodes/GH_OrgRunner.md

@@ -0,0 +1,5 @@
+## Description
+
+Represents a self-hosted runner owned by a GitHub organization. Organization runners are contained by native GH_OrgRunnerGroup nodes and become usable by repositories through the runner group's repository access policy.
+
+The node captures runner metadata such as operating system, status, busy state, labels, and whether the runner is ephemeral when GitHub returns that property.

openhound_github-0.5.0/descriptions/nodes/GH_OrgRunnerGroup.md

@@ -0,0 +1,5 @@
+## Description
+
+Represents a self-hosted runner group visible within a GitHub organization. Organization runner groups may either be native to the organization or inherited from an enterprise runner group.
+
+Native organization runner groups contain GH_OrgRunner nodes directly. Inherited organization runner groups do not directly contain organization runners; instead, they link to the source GH_EnterpriseRunnerGroup through GH_InheritedFrom and gain access to the enterprise runners contained there. GH_GrantsAccessTo edges describe which repositories may use the runners exposed by the group.

openhound_github-0.5.0/descriptions/nodes/GH_RepoRunner.md

@@ -0,0 +1,5 @@
+## Description
+
+Represents a self-hosted runner registered directly to a single GitHub repository. Repository runners are contained by that repository and may only be used by workflows in that repository.
+
+The node captures runner metadata such as operating system, status, busy state, labels, and whether the runner is ephemeral when GitHub returns that property.

{openhound_github-0.3.7 → openhound_github-0.5.0}/extension/saved_searches/environments-admin-bypass.json

@@ -1,5 +1,5 @@
 {
   "name": "GitHub: Environments Where Admins Can Bypass Protections",
-  "query": "MATCH p=(:GH_Repository)-[:GH_HasEnvironment]->(env:GH_Environment {can_admins_bypass: true})\nRETURN p\nLIMIT 1000",
+  "query": "MATCH p=(:GH_Repository)-[:GH_Contains]->(env:GH_Environment {can_admins_bypass: true})\nRETURN p\nLIMIT 1000",
   "description": "Finds deployment environments where administrators can bypass protection rules such as required reviewers and wait timers. Admins can deploy to these environments without any approval."
 }

{openhound_github-0.3.7 → openhound_github-0.5.0}/extension/saved_searches/repository-workflows.json

@@ -1,5 +1,5 @@
 {
   "name": "GitHub: Repository Workflows",
-  "query": "MATCH p=(:GH_Repository)-[:GH_HasWorkflow]->(:GH_Workflow)\nRETURN p\nLIMIT 1000",
+  "query": "MATCH p=(:GH_Repository)-[:GH_Contains]->(:GH_Workflow)\nRETURN p\nLIMIT 1000",
   "description": "Returns all repository workflows"
 }

{openhound_github-0.3.7 → openhound_github-0.5.0}/extension/saved_searches/unprotected-branches.json

@@ -1,5 +1,5 @@
 {
   "name": "GitHub: Unprotected Branches",
-  "query": "MATCH p=(repo:GH_Repository)-[:GH_HasBranch]-(:GH_Branch {protected: false})\nRETURN p\nLIMIT 1000",
+  "query": "MATCH p=(repo:GH_Repository)-[:GH_Contains]-(:GH_Branch {protected: false})\nRETURN p\nLIMIT 1000",
   "description": "Returns all unprotected branches in repositories."
 }

{openhound_github-0.3.7 → openhound_github-0.5.0}/extension/saved_searches/unprotected-default-branch-with-workflow.json

@@ -1,5 +1,5 @@
 {
   "name": "GitHub: Repositories with Workflows and Unprotected Default Branch",
-  "query": "MATCH p=(repo:GH_Repository)-[:GH_HasWorkflow]->(:GH_Workflow)\nMATCH p1=(repo)-[:GH_HasBranch]->(branch:GH_Branch)\nWHERE repo.default_branch = branch.short_name\nAND branch.protected = false\nRETURN p1\nLIMIT 1000",
+  "query": "MATCH p=(repo:GH_Repository)-[:GH_Contains]->(:GH_Workflow)\nMATCH p1=(repo)-[:GH_Contains]->(branch:GH_Branch)\nWHERE repo.default_branch = branch.short_name\nAND branch.protected = false\nRETURN p1\nLIMIT 1000",
   "description": "Returns all repositories that have GitHub Actions workflows and an unprotected default branch. This means that users with GH_WriteRepoContents to the Repository can overwrite or change the workflow."
 }

openhound_github-0.5.0/extension/saved_searches/unprotected-default-branches.json

@@ -0,0 +1,5 @@
+{
+  "name": "GitHub: Unprotected Default Branches",
+  "query": "MATCH p=(repo:GH_Repository)-[:GH_Contains]-(branch:GH_Branch {protected: false})\nWHERE repo.default_branch = branch.short_name\nRETURN p\nLIMIT 1000",
+  "description": "Returns all default branches in repositories that are not protected."
+}