openhound-github 0.5.2__tar.gz → 0.6.0__tar.gz

{openhound_github-0.5.2 → openhound_github-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openhound-github
-Version: 0.5.2
+Version: 0.6.0
 Summary: Github collector for OpenHound
 Author-email: "jdreijer@specterops.io" <jdreijer@specterops.io>, Jared Atkinson <jatkinson@specterops.io>
 License-File: LICENSE.md

{openhound_github-0.5.2 → openhound_github-0.6.0}/descriptions/edges/GH_ApprovesDeploymentTo.md

@@ -4,4 +4,4 @@ The non-traversable GH_ApprovesDeploymentTo edge represents that a user or team
 
 This edge is emitted from GH_User or GH_Team nodes to GH_Environment nodes when the environment includes a required reviewer protection rule. Required reviewers act as an approval gate before jobs referencing the environment can continue.
 
-The edge is non-traversable because it records reviewer configuration rather than direct deployment access. When self-review is allowed, the same reviewer may also receive a traversable GH_CanDeployToEnvironment edge because they can satisfy the approval gate themselves. When prevent_self_review is enabled, GH_ApprovesDeploymentTo remains context only because the split-principal approval flow is not currently modeled.
+The edge is non-traversable because it records reviewer configuration rather than direct deployment access. When self-review is allowed, the same reviewer may also receive a traversable GH_CanDeployToEnvironment edge only if they can also supply deployable code through GH_CanCreateBranch or GH_CanWriteBranch under the environment's branch policy. When prevent_self_review is enabled, GH_ApprovesDeploymentTo remains context only because the split-principal approval flow is not currently modeled.

openhound_github-0.6.0/descriptions/edges/GH_AssignedTo.md

@@ -0,0 +1,5 @@
+## General Information
+
+The non-traversable GH_AssignedTo edge represents an enterprise-scoped team being assigned to an organization.
+
+This edge is not traversable because assignment alone does not directly grant a principal a privilege path.

openhound_github-0.6.0/descriptions/edges/GH_CanCreateRepositoryWithRunnerAccess.md

@@ -0,0 +1,9 @@
+## General Information
+
+The traversable GH_CanCreateRepositoryWithRunnerAccess edge is a computed edge indicating that a GH_OrgRole can create a repository that will immediately be able to dispatch workflows to a GH_OrgRunnerGroup.
+
+This edge is emitted only for runner groups with `visibility=all` or `visibility=private`. Groups with `visibility=selected` require explicit repository assignment, so creating a repository does not automatically grant access to the group. For `visibility=all`, public repository creation is included only when `allows_public_repositories=true`; otherwise the composition is limited to private and internal repository creation.
+
+The collector emits this edge only when new repositories in the organization have GitHub Actions enabled by default (`actions_enabled_repositories=all`), the organization-facing runner group has `restricted_to_workflows=false`, and inherited enterprise-backed access also has `restricted_to_workflows=false` on the source GH_EnterpriseRunnerGroup.
+
+The computation follows repository-creation capability edges from the org role to the organization and then GH_Contains to the runner group. Each edge includes a `query_composition` Cypher query showing the repository-creation path and the Actions and runner-group policy predicates that make the path immediately usable.

openhound_github-0.6.0/descriptions/edges/GH_CanDeployToEnvironment.md

@@ -0,0 +1,9 @@
+## General Information
+
+The traversable GH_CanDeployToEnvironment edge represents the ability for a repository, branch, repository role, or reviewer to satisfy the modeled deployment constraints for a GitHub Environment.
+
+This edge is computed from environment deployment branch policy, branch protection state, required reviewer behavior, and administrator bypass behavior. For environments without required reviewers, unrestricted environments emit repository and branch edges, protected-branch-only environments emit edges only for protected branches unless no branch protection rules exist, and custom branch policies emit edges only for matching branches.
+
+When required reviewers are configured and self-review is allowed, a configured GH_User or GH_Team reviewer receives GH_CanDeployToEnvironment only when the same actor can also supply deployable code. For unrestricted environments this means the actor can create a branch in the repository. For protected-branch-only or custom branch policy environments this means the actor can write to an eligible branch under the existing GH_CanWriteBranch rules.
+
+Self-review alone is not sufficient for this edge. GH_ApprovesDeploymentTo remains the non-traversable representation of reviewer authority, while GH_CanDeployToEnvironment represents the combined ability to satisfy both the approval gate and the code-supply path. When prevent_self_review is enabled, no direct deploy edge is emitted for the reviewer because the required split-principal flow is not currently modeled.

openhound_github-0.6.0/descriptions/edges/GH_CanUseRunner.md

@@ -0,0 +1,7 @@
+## General Information
+
+For runner-group-backed access, the traversable GH_CanUseRunner edge is a computed edge representing that a repository or branch can dispatch workflows to a self-hosted runner execution surface under the modeled runner-group controls.
+
+The collector derives this edge from GH_IsEligibleFor rather than directly from repository visibility. It emits GH_CanUseRunner only when the repository is within the runner group's repository-access scope, GitHub Actions is enabled for the repository, and `restricted_to_workflows=false` on the organization-facing runner group. Inherited enterprise-backed access also requires `restricted_to_workflows=false` on the source GH_EnterpriseRunnerGroup. Every collected branch in a repository that satisfies those conditions receives the same edge so branch write paths can reach the execution surface.
+
+Organization and inherited enterprise-backed access terminate at the organization-facing GH_OrgRunnerGroup, then continue through GH_HasRunner for native organization runners or through GH_InheritedFrom and GH_HasRunner for inherited enterprise runners. Repository-scoped runners currently receive GH_CanUseRunner directly from their containing repository and are not part of this runner-group traversability change.

openhound_github-0.6.0/descriptions/edges/GH_HasRunner.md

@@ -0,0 +1,5 @@
+## General Information
+
+The traversable GH_HasRunner edge represents that a runner group exposes a directly assigned self-hosted runner to repositories or workflows that satisfy the runner group's access policy.
+
+This edge is distinct from GH_Contains. GH_Contains records structural membership only, while GH_HasRunner represents the runner-group-to-runner capability hop used for attack-path composition. This edge is emitted only for direct organization and enterprise runner group memberships; inherited organization runner group access to enterprise runners is modeled as GH_Repository or GH_Branch -[:GH_CanUseRunner]-> GH_OrgRunnerGroup -[:GH_InheritedFrom]-> GH_EnterpriseRunnerGroup -[:GH_HasRunner]-> GH_EnterpriseRunner.

openhound_github-0.6.0/descriptions/edges/GH_InheritedFrom.md

@@ -0,0 +1,5 @@
+## General Information
+
+The traversable GH_InheritedFrom edge links an inherited GH_OrgRunnerGroup to the GH_EnterpriseRunnerGroup that owns the underlying runner set. This preserves the organization-local view of a runner group while still identifying the enterprise source that provides the runners.
+
+This edge is traversable because an inherited organization runner group is the organization-facing policy boundary for the enterprise runner group. Repository access flows through the organization runner group, then through GH_InheritedFrom to the enterprise group, and finally through GH_HasRunner to directly assigned enterprise runners.

openhound_github-0.6.0/descriptions/edges/GH_IsEligibleFor.md

@@ -0,0 +1,5 @@
+## General Information
+
+The non-traversable GH_IsEligibleFor edge represents that a repository is within the repository-access scope of an organization runner group.
+
+For runner groups, this edge evaluates the group's `visibility`, selected repository assignments, and `allows_public_repositories` setting. It does not prove that workflows in the repository can dispatch to the group's runners, because GitHub Actions may be disabled for the repository or the runner group may be restricted to selected workflows.

openhound_github-0.6.0/descriptions/nodes/GH_EnterpriseRunner.md

@@ -0,0 +1,5 @@
+## Description
+
+Represents a self-hosted runner owned at the GitHub Enterprise level. Enterprise runners are contained by GH_EnterpriseRunnerGroup nodes and exposed through GH_HasRunner. Repositories become eligible for the organization-facing runner group through GH_IsEligibleFor. Repositories and branches that can dispatch workflows then reach the runner through GH_CanUseRunner to an inherited GH_OrgRunnerGroup, GH_InheritedFrom to the enterprise group, and finally GH_HasRunner to the runner.
+
+The node captures runner metadata such as operating system, status, busy state, labels, and whether the runner is ephemeral when GitHub returns that property.

openhound_github-0.6.0/descriptions/nodes/GH_EnterpriseRunnerGroup.md

@@ -0,0 +1,5 @@
+## Description
+
+Represents a self-hosted runner group owned by a GitHub Enterprise account. Enterprise runner groups control which organizations may use a shared set of enterprise runners. That organization-level visibility is reflected by which inherited GH_OrgRunnerGroup nodes point back to the enterprise group through GH_InheritedFrom.
+
+Enterprise runner groups contain GH_EnterpriseRunner nodes and emit GH_HasRunner for directly assigned runners to represent the traversable capability hop from the group to the runner. They may be projected into organizations as inherited GH_OrgRunnerGroup nodes. The GH_InheritedFrom edge links the organization view back to the enterprise-owned group.

{openhound_github-0.5.2 → openhound_github-0.6.0}/descriptions/nodes/GH_OrgRunner.md

@@ -1,5 +1,5 @@
 ## Description
 
-Represents a self-hosted runner owned by a GitHub organization. Organization runners are contained by native GH_OrgRunnerGroup nodes and become usable by repositories through the runner group's repository access policy.
+Represents a self-hosted runner owned by a GitHub organization. Organization runners are contained by native GH_OrgRunnerGroup nodes and exposed through GH_HasRunner. Repositories become eligible for those groups through GH_IsEligibleFor, while repositories and branches that can dispatch workflows to them are linked through GH_CanUseRunner.
 
 The node captures runner metadata such as operating system, status, busy state, labels, and whether the runner is ephemeral when GitHub returns that property.

openhound_github-0.6.0/descriptions/nodes/GH_OrgRunnerGroup.md

@@ -0,0 +1,5 @@
+## Description
+
+Represents a self-hosted runner group visible within a GitHub organization. Organization runner groups may either be native to the organization or inherited from an enterprise runner group.
+
+Native organization runner groups contain GH_OrgRunner nodes directly. Direct memberships also emit GH_HasRunner to represent the traversable capability hop from the group to its runners. Inherited organization runner groups do not directly contain organization runners; instead, they link to the source GH_EnterpriseRunnerGroup through GH_InheritedFrom and gain access to the enterprise runners contained there. GH_IsEligibleFor edges from repositories describe repository access policy scope, while GH_CanUseRunner edges identify repositories and branches that can dispatch workflows to the group under the collected Actions and workflow-restriction settings.

{openhound_github-0.5.2 → openhound_github-0.6.0}/extension/schema.json

@@ -442,18 +442,18 @@
     },
     {
       "name": "GH_AssignedTo",
-      "description": "Enterprise-scoped team or runner group is assigned to an organization",
+      "description": "Enterprise-scoped team is assigned to an organization",
       "is_traversable": false
     },
     {
       "name": "GH_InheritedFrom",
       "description": "Organization runner group is inherited from an enterprise runner group",
-      "is_traversable": false
+      "is_traversable": true
     },
     {
-      "name": "GH_GrantsAccessTo",
-      "description": "Organization runner group grants a repository access to its available runners",
-      "is_traversable": false
+      "name": "GH_HasRunner",
+      "description": "Runner group exposes a directly assigned self-hosted runner to authorized repositories or workflows",
+      "is_traversable": true
     },
     {
       "name": "GH_Owns",
@@ -967,13 +967,18 @@
     },
     {
       "name": "GH_CanUseRunner",
-      "description": "Repository can dispatch jobs to this self-hosted runner",
+      "description": "Repository or branch can dispatch workflows to this self-hosted runner execution surface",
+      "is_traversable": true
+    },
+    {
+      "name": "GH_IsEligibleFor",
+      "description": "Repository is within the repository-access scope of this runner group",
       "is_traversable": false
     },
     {
       "name": "GH_CanCreateRepositoryWithRunnerAccess",
-      "description": "Org role can create a repository that inherits access to this runner group",
-      "is_traversable": false
+      "description": "Org role can create a repository that can dispatch workflows to this runner group",
+      "is_traversable": true
     },
     {
       "name": "GH_CanWriteBranch",
@@ -1042,7 +1047,7 @@
     },
     {
       "name": "GH_CanDeployToEnvironment",
-      "description": "[Computed] Repository, branch, repo role, or self-approving reviewer can deploy to this GitHub environment after evaluating deployment branch policy, reviewer gates, and admin bypass behavior",
+      "description": "[Computed] Repository, branch, repo role, or reviewer can deploy to this GitHub environment after evaluating deployment branch policy, reviewer gates, and admin bypass behavior; reviewer edges require both self-approval and a deployable code path",
       "is_traversable": true
     },
     {

{openhound_github-0.5.2 → openhound_github-0.6.0}/src/openhound_github/kinds/edges.py

@@ -2,7 +2,6 @@
 CONTAINS = "GH_Contains"
 ASSIGNED_TO = "GH_AssignedTo"
 INHERITED_FROM = "GH_InheritedFrom"
-GRANTS_ACCESS_TO = "GH_GrantsAccessTo"
 
 # Administrative edges
 ADMIN_TO = "GH_AdminTo"
@@ -12,12 +11,14 @@ OWNS = "GH_Owns"
 HAS_MEMBER = "GH_HasMember"
 HAS_ROLE = "GH_HasRole"
 HAS_BASE_ROLE = "GH_HasBaseRole"
+HAS_RUNNER = "GH_HasRunner"
 ADD_MEMBER = "GH_AddMember"
 MEMBER_OF = "GH_MemberOf"
 
 # Access and capability edges
 CAN_ACCESS = "GH_CanAccess"
 CAN_USE_RUNNER = "GH_CanUseRunner"
+IS_ELIGIBLE_FOR = "GH_IsEligibleFor"
 CAN_CREATE_REPOSITORY_WITH_RUNNER_ACCESS = "GH_CanCreateRepositoryWithRunnerAccess"
 CAN_CREATE_BRANCH = "GH_CanCreateBranch"
 CAN_CREATE_ENVIRONMENT = "GH_CanCreateEnvironment"

{openhound_github-0.5.2 → openhound_github-0.6.0}/src/openhound_github/lookup.py

@@ -1,3 +1,4 @@
+import json
 from functools import lru_cache
 
 import duckdb
@@ -109,6 +110,30 @@ class GithubLookup(LookupManager):
         enterprise_node_id, runner_group_id = identity
         return runner_group_node_id(enterprise_node_id, runner_group_id)
 
+    @lru_cache
+    def enterprise_runner_group_restricted_to_workflows_for_inherited_org_group(
+        self, org_node_id: str, group_name: str
+    ) -> bool | None:
+        identity = self._enterprise_runner_group_identity_for_inherited_org_group(
+            org_node_id, group_name
+        )
+        if not identity:
+            return None
+
+        enterprise_node_id, runner_group_id = identity
+        row = self._find_single_row(
+            f"""
+            SELECT restricted_to_workflows
+            FROM {self.schema}.enterprise_runner_groups
+            WHERE enterprise_node_id = ?
+              AND id = ?
+            """,
+            [enterprise_node_id, runner_group_id],
+        )
+        if row is None or row[0] is None:
+            return None
+        return bool(row[0])
+
     @lru_cache
     def enterprise_runner_node_ids_for_inherited_org_group(
         self, org_node_id: str, group_name: str
@@ -195,6 +220,33 @@ class GithubLookup(LookupManager):
             [org_login],
         )
 
+    @lru_cache
+    def actions_enabled_repository_node_ids_for_org(self, org_login: str):
+        return self._find_all_objects(
+            f"""SELECT node_id FROM {self.schema}.repositories WHERE org_login = ? AND actions_enabled = true""",
+            [org_login],
+        )
+
+    @lru_cache
+    def actions_enabled_repositories_for_org(self, org_login: str) -> str | None:
+        return self._find_single_object(
+            f"""SELECT actions_enabled_repositories FROM {self.schema}.organizations WHERE login = ?""",
+            [org_login],
+        )
+
+    @lru_cache
+    def branch_node_ids_for_org(self, org_login: str):
+        return self._find_all_objects(
+            f"""
+            SELECT b.repository_node_id, b.id
+            FROM {self.schema}.branches b
+            JOIN {self.schema}.repositories r
+              ON r.node_id = b.repository_node_id
+            WHERE r.org_login = ?
+            """,
+            [org_login],
+        )
+
     @lru_cache
     def repository_branch_ruleset_count(self, repository_node_id: str) -> int | None:
         row = self._find_single_row(
@@ -584,6 +636,265 @@ class GithubLookup(LookupManager):
             [repository_node_id],
         )
 
+    @lru_cache
+    def environment_branch_policy_names(self, environment_node_id: str):
+        return self._find_all_objects(
+            f"""
+            SELECT name
+            FROM {self.schema}.environment_branch_policies
+            WHERE environment_node_id = ?
+            """,
+            [environment_node_id],
+        )
+
+    @lru_cache
+    def reviewer_repo_role_assignments(
+        self, reviewer_node_id: str, reviewer_kind: str, repository_node_id: str
+    ):
+        reviewer_kind = reviewer_kind.lower()
+        return self._find_all_objects(
+            f"""
+            WITH RECURSIVE
+            repository_org(org_login) AS (
+                SELECT org_login
+                FROM {self.schema}.repositories
+                WHERE node_id = ?
+            ),
+            seed_teams(team_id) AS (
+                SELECT ? WHERE ? = 'team'
+
+                UNION
+
+                SELECT tm.team_id
+                FROM {self.schema}.team_members tm
+                WHERE ? = 'user'
+                  AND tm.id = ?
+            ),
+            actor_teams(team_id) AS (
+                SELECT team_id
+                FROM seed_teams
+
+                UNION
+
+                SELECT json_extract_string(t.parent_team, '$.id')
+                FROM {self.schema}.teams t
+                JOIN actor_teams actor_team ON t.id = actor_team.team_id
+                WHERE t.parent_team IS NOT NULL
+                  AND json_extract_string(t.parent_team, '$.id') IS NOT NULL
+            ),
+            direct_repo_roles(
+                assignment_actor_id,
+                role_id,
+                role_name,
+                base_role,
+                role_permissions
+            ) AS (
+                SELECT DISTINCT
+                    rra.node_id,
+                    rr.id,
+                    rra.role_name,
+                    coalesce(rra.base_role, rr.base_role),
+                    rra.role_permissions
+                FROM {self.schema}.repo_role_assignments rra
+                LEFT JOIN {self.schema}.repo_roles rr
+                  ON rr.repository_node_id = rra.repo_node_id
+                 AND rr.name = rra.role_name
+                WHERE rra.repo_node_id = ?
+                  AND (
+                      (lower(rra.assignee_type) = ? AND rra.node_id = ?)
+                      OR (
+                          lower(rra.assignee_type) = 'team'
+                          AND rra.node_id IN (SELECT team_id FROM actor_teams)
+                      )
+                  )
+            ),
+            actor_org_roles(assignment_actor_id, org_role_name, base_role) AS (
+                SELECT
+                    u.id,
+                    CASE WHEN u.role = 'ADMIN' THEN 'owners' ELSE 'members' END,
+                    org_role.base_role
+                FROM {self.schema}.users u
+                JOIN repository_org repo_org ON repo_org.org_login = u.org_login
+                JOIN {self.schema}.org_roles org_role
+                  ON org_role.org_login = u.org_login
+                 AND org_role.name = CASE
+                     WHEN u.role = 'ADMIN' THEN 'owners'
+                     ELSE 'members'
+                 END
+                WHERE ? = 'user'
+                  AND u.id = ?
+
+                UNION
+
+                SELECT
+                    orm.node_id,
+                    orm.org_role_name,
+                    org_role.base_role
+                FROM {self.schema}.org_role_members orm
+                JOIN repository_org repo_org ON repo_org.org_login = orm.org_login
+                JOIN {self.schema}.org_roles org_role
+                  ON org_role.org_login = orm.org_login
+                 AND org_role.name = orm.org_role_name
+                WHERE ? = 'user'
+                  AND orm.node_id = ?
+
+                UNION
+
+                SELECT
+                    ort.node_id,
+                    ort.org_role_name,
+                    org_role.base_role
+                FROM {self.schema}.org_role_teams ort
+                JOIN repository_org repo_org ON repo_org.org_login = ort.org_login
+                JOIN {self.schema}.org_roles org_role
+                  ON org_role.org_login = ort.org_login
+                 AND org_role.name = ort.org_role_name
+                WHERE ort.node_id IN (SELECT team_id FROM actor_teams)
+            ),
+            org_repo_roles(
+                assignment_actor_id,
+                role_id,
+                role_name,
+                base_role,
+                role_permissions
+            ) AS (
+                SELECT DISTINCT
+                    actor_org_role.assignment_actor_id,
+                    rr.id,
+                    rr.name,
+                    rr.base_role,
+                    rr.permissions
+                FROM actor_org_roles actor_org_role
+                JOIN {self.schema}.repo_roles rr
+                  ON rr.repository_node_id = ?
+                 AND rr.name = actor_org_role.base_role
+            )
+            SELECT * FROM direct_repo_roles
+            UNION
+            SELECT * FROM org_repo_roles
+            """,
+            [
+                repository_node_id,
+                reviewer_node_id,
+                reviewer_kind,
+                reviewer_kind,
+                reviewer_node_id,
+                repository_node_id,
+                reviewer_kind,
+                reviewer_node_id,
+                reviewer_kind,
+                reviewer_node_id,
+                reviewer_kind,
+                reviewer_node_id,
+                repository_node_id,
+            ],
+        )
+
+    @staticmethod
+    def _role_permissions(raw_permissions) -> set[str]:
+        if raw_permissions is None:
+            return set()
+        if isinstance(raw_permissions, str):
+            try:
+                raw_permissions = json.loads(raw_permissions)
+            except json.JSONDecodeError:
+                return set()
+        if not isinstance(raw_permissions, list):
+            return set()
+        return {str(permission) for permission in raw_permissions}
+
+    @lru_cache
+    def reviewer_deployment_path(
+        self,
+        reviewer_node_id: str,
+        reviewer_kind: str,
+        repository_node_id: str,
+        eligible_branch_ids: tuple[str, ...],
+        allow_create_branch: bool,
+    ) -> tuple[str, str | None] | None:
+        if not self.repository_default_branch_collected(repository_node_id):
+            return None
+
+        eligible_branches = set(eligible_branch_ids)
+        write_roles = {"write", "maintain", "admin"}
+        bypass_roles = {"maintain"}
+
+        for (
+            assignment_actor_id,
+            role_id,
+            role_name,
+            base_role,
+            raw_permissions,
+        ) in self.reviewer_repo_role_assignments(
+            reviewer_node_id, reviewer_kind, repository_node_id
+        ):
+            permissions = self._role_permissions(raw_permissions)
+            has_write_access = role_name in write_roles or base_role in write_roles
+            if not has_write_access:
+                continue
+
+            if (
+                allow_create_branch
+                and role_id is not None
+                and self.role_can_create_branch(role_id, repository_node_id)
+            ):
+                return ("create_branch", None)
+
+            writable_branches = {
+                branch_id
+                for (branch_id,) in self.unprotected_branches(repository_node_id)
+            }
+
+            has_push_protected_branch = (
+                ("push_protected_branch" in permissions and base_role in write_roles)
+                or role_name in bypass_roles
+                or base_role in bypass_roles
+            )
+            has_bypass_branch_protection = (
+                "bypass_branch_protection" in permissions and base_role in write_roles
+            )
+
+            if role_name == "admin" or base_role == "admin":
+                writable_branches.update(
+                    branch_id
+                    for (branch_id,) in self._write_admin_bypass(repository_node_id)
+                )
+            if has_push_protected_branch:
+                writable_branches.update(
+                    branch_id
+                    for (branch_id,) in self._write_push_restricted_branch_bypass(
+                        repository_node_id
+                    )
+                )
+            if has_bypass_branch_protection:
+                writable_branches.update(
+                    branch_id
+                    for (branch_id,) in self._write_branch_protection_bypass(
+                        repository_node_id
+                    )
+                )
+            if has_push_protected_branch and has_bypass_branch_protection:
+                writable_branches.update(
+                    branch_id
+                    for (branch_id,) in self._write_combined_bypass(repository_node_id)
+                )
+
+            writable_branches.update(
+                branch_id
+                for (branch_id,) in self.actor_gate_bypass(
+                    assignment_actor_id,
+                    repository_node_id,
+                    has_bypass_branch_protection,
+                    has_push_protected_branch,
+                )
+            )
+
+            for branch_id in eligible_branch_ids:
+                if branch_id in writable_branches and branch_id in eligible_branches:
+                    return ("write_branch", branch_id)
+
+        return None
+
     @lru_cache
     def members_can_fork_private_repositories(self, org_login: str):
         return self._find_all_objects(

{openhound_github-0.5.2 → openhound_github-0.6.0}/src/openhound_github/main.py

@@ -59,6 +59,9 @@ def preproc(ctx: PreProcContext):
         "repo_role_assignments": "repo_role_assignments",
         "branches": "branches",
         "repo_roles": "repo_roles",
+        "users": "users",
+        "teams": "teams",
+        "team_members": "team_members",
         "saml_provider": "saml_provider",
         "applications": "applications",
         "enterprise": "enterprise",
@@ -67,8 +70,11 @@ def preproc(ctx: PreProcContext):
         "enterprise_runner_group_organizations": "enterprise_runner_group_organizations",
         "enterprise_runner_group_memberships": "enterprise_runner_group_memberships",
         "org_roles": "org_roles",
+        "org_role_members": "org_role_members",
+        "org_role_teams": "org_role_teams",
         "projected_enterprise_teams": "projected_enterprise_teams",
         "environments": "environments",
+        "environment_branch_policies": "environment_branch_policies",
         "environment_secrets": "environment_secrets",
         "environment_variables": "environment_variables",
         "organization_secrets": "organization_secrets",