openhound-github 0.7.2__tar.gz → 0.8.0__tar.gz

{openhound_github-0.7.2 → openhound_github-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openhound-github
-Version: 0.7.2
+Version: 0.8.0
 Summary: Github collector for OpenHound
 Author-email: "jdreijer@specterops.io" <jdreijer@specterops.io>, Jared Atkinson <jatkinson@specterops.io>
 License-File: LICENSE.md

{openhound_github-0.7.2 → openhound_github-0.8.0}/descriptions/edges/GH_AddAssignee.md

@@ -1,3 +1,20 @@
+# GH_AddAssignee
+
 ## General Information
 
 The non-traversable GH_AddAssignee edge represents a role's ability to assign users to issues and pull requests. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_RepoRole` | `GH_Repository` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_RepoRole"]
+    n1["GH_Repository"]
+    n0 -.->|GH_AddAssignee| n1
+```

{openhound_github-0.7.2 → openhound_github-0.8.0}/descriptions/edges/GH_AddCollaborator.md

@@ -1,3 +1,20 @@
+# GH_AddCollaborator
+
 ## General Information
 
 The non-traversable GH_AddCollaborator edge represents that a role has the ability to add outside collaborators to organization repositories. This permission is typically restricted to Owners, as it grants repository access to external users who are not members of the organization. Outside collaborators bypass organizational membership controls, making this permission significant for security because it can be used to grant access to untrusted external identities without the visibility that full membership provides.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_OrgRole` | `GH_Organization` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_OrgRole"]
+    n1["GH_Organization"]
+    n0 -.->|GH_AddCollaborator| n1
+```

{openhound_github-0.7.2 → openhound_github-0.8.0}/descriptions/edges/GH_AddLabel.md

@@ -1,3 +1,20 @@
+# GH_AddLabel
+
 ## General Information
 
 The non-traversable GH_AddLabel edge represents a role's ability to add labels to issues and pull requests. This permission is available to Triage, Write, Maintain, and Admin roles and custom roles that have been granted this specific permission.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_RepoRole` | `GH_Repository` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_RepoRole"]
+    n1["GH_Repository"]
+    n0 -.->|GH_AddLabel| n1
+```

{openhound_github-0.7.2 → openhound_github-0.8.0}/descriptions/edges/GH_AddMember.md

@@ -1,3 +1,20 @@
+# GH_AddMember
+
 ## General Information
 
 The non-traversable GH_AddMember edge indicates that a team role with the Maintainer permission level can add new members to the team. Maintainers already inherit the team's repository permissions through GH_MemberOf, so this edge preserves the membership-management capability as context without creating a second access path to the same team.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_TeamRole` | `GH_Team` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_TeamRole"]
+    n1["GH_Team"]
+    n0 -.->|GH_AddMember| n1
+```

{openhound_github-0.7.2 → openhound_github-0.8.0}/descriptions/edges/GH_AdminTo.md

@@ -1,3 +1,20 @@
+# GH_AdminTo
+
 ## General Information
 
 The traversable GH_AdminTo edge represents a role's full administrative access to the repository. Admin is the highest built-in repository role and grants control over all repository settings, including dangerous operations like deleting the repository or modifying its visibility. Admin access bypasses most protections including branch protection rules, unless `enforce_admins` is explicitly enabled on the branch protection rule. This edge is a key permission in the computed branch access model and is a high-value target in attack path analysis.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_RepoRole` | `GH_Repository` | `true` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_RepoRole"]
+    n1["GH_Repository"]
+    n0 -->|GH_AdminTo| n1
+```

{openhound_github-0.7.2 → openhound_github-0.8.0}/descriptions/edges/GH_ApprovesDeploymentTo.md

@@ -1,3 +1,5 @@
+# GH_ApprovesDeploymentTo
+
 ## General Information
 
 The non-traversable GH_ApprovesDeploymentTo edge represents that a user or team is configured as a required reviewer for a GitHub Environment.
@@ -5,3 +7,21 @@ The non-traversable GH_ApprovesDeploymentTo edge represents that a user or team
 This edge is emitted from GH_User or GH_Team nodes to GH_Environment nodes when the environment includes a required reviewer protection rule. Required reviewers act as an approval gate before jobs referencing the environment can continue.
 
 The edge is non-traversable because it records reviewer configuration rather than direct deployment access. When self-review is allowed, the same reviewer may also receive a traversable GH_CanDeployToEnvironment edge only if they can also supply deployable code through GH_CanCreateBranch or GH_CanWriteBranch under the environment's branch policy. When prevent_self_review is enabled, GH_ApprovesDeploymentTo remains context only because the split-principal approval flow is not currently modeled.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_Team` | `GH_Environment` | `false` |
+| `GH_User` | `GH_Environment` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_Team"]
+    n1["GH_Environment"]
+    n2["GH_User"]
+    n0 -.->|GH_ApprovesDeploymentTo| n1
+    n2 -.->|GH_ApprovesDeploymentTo| n1
+```

openhound_github-0.8.0/descriptions/edges/GH_AssignedTo.md

@@ -0,0 +1,22 @@
+# GH_AssignedTo
+
+## General Information
+
+The non-traversable GH_AssignedTo edge represents an enterprise-scoped team being assigned to an organization.
+
+This edge is not traversable because assignment alone does not directly grant a principal a privilege path.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_EnterpriseTeam` | `GH_Organization` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_EnterpriseTeam"]
+    n1["GH_Organization"]
+    n0 -.->|GH_AssignedTo| n1
+```

{openhound_github-0.7.2 → openhound_github-0.8.0}/descriptions/edges/GH_BypassBranchProtection.md

@@ -1,3 +1,20 @@
+# GH_BypassBranchProtection
+
 ## General Information
 
 The non-traversable GH_BypassBranchProtection edge represents a role's ability to bypass branch protection rules on the repository. This permission is available to Admin roles and custom roles that have been granted this specific permission. Bypassing branch protection allows merging pull requests without satisfying required review or status check requirements, effectively circumventing the merge gate. This bypass is suppressed when `enforce_admins` is enabled on the branch protection rule, which forces even admins to comply with the protection policy.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_RepoRole` | `GH_Repository` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_RepoRole"]
+    n1["GH_Repository"]
+    n0 -.->|GH_BypassBranchProtection| n1
+```

{openhound_github-0.7.2 → openhound_github-0.8.0}/descriptions/edges/GH_BypassPullRequestAllowances.md

@@ -1,3 +1,20 @@
+# GH_BypassPullRequestAllowances
+
 ## General Information
 
 The non-traversable GH_BypassPullRequestAllowances edge represents a per-actor allowance that bypasses the pull request review requirement on a branch protection rule. This edge identifies specific users or teams that can merge code without going through the normal PR review process. This is a significant security concern because these actors can push or merge changes directly, circumventing code review controls that protect branch integrity. Note that this bypass is suppressed when `enforce_admins` is enabled on the branch protection rule, meaning even listed actors must follow the PR review requirement.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_User` | `GH_BranchProtectionRule` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_User"]
+    n1["GH_BranchProtectionRule"]
+    n0 -.->|GH_BypassPullRequestAllowances| n1
+```

{openhound_github-0.7.2 → openhound_github-0.8.0}/descriptions/edges/GH_CallsWorkflow.md

@@ -1,3 +1,5 @@
+# GH_CallsWorkflow
+
 ## General Information
 
 The traversable GH_CallsWorkflow edge links a workflow job to a reusable workflow it invokes via the `uses:` key at the job level. This edge captures the reusable workflow call graph, enabling analysts to trace inherited permissions and secret access through called workflows.
@@ -8,3 +10,18 @@ The traversable GH_CallsWorkflow edge links a workflow job to a reusable workflo
 - **Remote** (`org/repo/.github/workflows/file.yml@ref`): the destination is matched by the full reference string. If the called workflow has not been collected, the edge destination will not resolve.
 
 The `reusable_ref` property on the edge always contains the raw `uses:` value from the workflow file.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_WorkflowJob` | `GH_Workflow` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_WorkflowJob"]
+    n1["GH_Workflow"]
+    n0 -.->|GH_CallsWorkflow| n1
+```

openhound_github-0.8.0/descriptions/edges/GH_CanAccess.md

@@ -0,0 +1,26 @@
+# GH_CanAccess
+
+## General Information
+
+The non-traversable GH_CanAccess edge indicates that a personal access token or app installation has been granted access to specific repositories. This edge represents the scope of access granted to a token or app rather than a direct attack path, providing visibility into which repositories are reachable through non-human credentials. It is non-traversable because token and app access does not transitively extend to other principals.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_AppInstallation` | `GH_Repository` | `false` |
+| `GH_PersonalAccessToken` | `GH_Organization` | `false` |
+| `GH_PersonalAccessToken` | `GH_Repository` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_AppInstallation"]
+    n1["GH_Repository"]
+    n2["GH_PersonalAccessToken"]
+    n3["GH_Organization"]
+    n0 -.->|GH_CanAccess| n1
+    n2 -.->|GH_CanAccess| n3
+    n2 -.->|GH_CanAccess| n1
+```

{openhound_github-0.7.2 → openhound_github-0.8.0}/descriptions/edges/GH_CanAssumeIdentity.md

@@ -1,3 +1,20 @@
+# GH_CanAssumeIdentity
+
 ## General Information
 
 The traversable GH_CanAssumeIdentity edge is a hybrid edge connecting GitHub OIDC token sources to cloud identity targets configured for GitHub Actions federation. This edge represents a verified path from GitHub Actions to cloud resource access. It is traversable because an attacker who can execute workflows in the source repository, branch, or environment can obtain an OIDC token that the cloud provider will accept, granting access to the associated cloud identity and its permissions. This edge is critical for identifying cross-cloud lateral movement paths from GitHub into Azure and AWS.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_Repository` | `External cloud identity` | `true` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_Repository"]
+    n1["External cloud identity"]
+    n0 -->|GH_CanAssumeIdentity| n1
+```

openhound_github-0.8.0/descriptions/edges/GH_CanCreateBranch.md

@@ -0,0 +1,26 @@
+# GH_CanCreateBranch
+
+## General Information
+
+The traversable GH_CanCreateBranch edge is a computed edge indicating that a role or actor can create new branches in a repository. The computation evaluates whether a wildcard (`*`) BPR with push restrictions and `blocks_creations` exists. If no such BPR exists, any write-capable role can create branches. If one exists, admin or `push_protected_branch` permission is required, or the actor must be listed in pushAllowances. Per-actor edges from GH_User or GH_Team are only emitted when BPR allowances grant branch creation access beyond what the role provides. Each edge includes a `reason` property and a `query_composition` Cypher query showing the underlying graph evidence.
+
+## Scenarios
+
+### `no_protection` — No wildcard BPR blocking creations
+
+No wildcard (`*`) BPR with `blocks_creations` exists. Any write-capable role can create new branches.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_RepoRole` | `GH_Repository` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_RepoRole"]
+    n1["GH_Repository"]
+    n0 -.->|GH_CanCreateBranch| n1
+```

{openhound_github-0.7.2 → openhound_github-0.8.0}/descriptions/edges/GH_CanCreateEnvironment.md

@@ -1,5 +1,22 @@
+# GH_CanCreateEnvironment
+
 ## General Information
 
 The traversable GH_CanCreateEnvironment edge is a computed edge indicating that a repository role can cause a new GitHub environment to be created in the repository. This is derived from the ability to create and modify runnable branches/workflows: if a workflow references an environment name that does not already exist, GitHub will create that environment automatically.
 
 This edge is useful for modeling OIDC and deployment scenarios where trust is tied to an environment name. An attacker who can create a new environment through workflow changes may be able to instantiate a trusted environment on demand, even if it was not previously configured.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_RepoRole` | `GH_Repository` | `true` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_RepoRole"]
+    n1["GH_Repository"]
+    n0 -->|GH_CanCreateEnvironment| n1
+```

openhound_github-0.8.0/descriptions/edges/GH_CanCreateInternalRepositories.md

@@ -0,0 +1,20 @@
+# GH_CanCreateInternalRepositories
+
+## General Information
+
+Role can create internal repositories in the organization.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_OrgRole` | `GH_Organization` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_OrgRole"]
+    n1["GH_Organization"]
+    n0 -.->|GH_CanCreateInternalRepositories| n1
+```

openhound_github-0.8.0/descriptions/edges/GH_CanCreatePrivateRepositories.md

@@ -0,0 +1,20 @@
+# GH_CanCreatePrivateRepositories
+
+## General Information
+
+Role can create private repositories in the organization.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_OrgRole` | `GH_Organization` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_OrgRole"]
+    n1["GH_Organization"]
+    n0 -.->|GH_CanCreatePrivateRepositories| n1
+```

openhound_github-0.8.0/descriptions/edges/GH_CanCreatePublicRepositories.md

@@ -0,0 +1,20 @@
+# GH_CanCreatePublicRepositories
+
+## General Information
+
+Role can create public repositories in the organization.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_OrgRole` | `GH_Organization` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_OrgRole"]
+    n1["GH_Organization"]
+    n0 -.->|GH_CanCreatePublicRepositories| n1
+```

openhound_github-0.8.0/descriptions/edges/GH_CanCreateRepositories.md

@@ -0,0 +1,20 @@
+# GH_CanCreateRepositories
+
+## General Information
+
+Role can create repositories in the organization.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_OrgRole` | `GH_Organization` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_OrgRole"]
+    n1["GH_Organization"]
+    n0 -.->|GH_CanCreateRepositories| n1
+```

{openhound_github-0.7.2 → openhound_github-0.8.0}/descriptions/edges/GH_CanCreateRepositoryWithRunnerAccess.md

@@ -1,3 +1,5 @@
+# GH_CanCreateRepositoryWithRunnerAccess
+
 ## General Information
 
 The traversable GH_CanCreateRepositoryWithRunnerAccess edge is a computed edge indicating that a GH_OrgRole can create a repository that will immediately be able to dispatch workflows to a GH_OrgRunnerGroup.
@@ -7,3 +9,18 @@ This edge is emitted only for runner groups with `visibility=all` or `visibility
 The collector emits this edge only when new repositories in the organization have GitHub Actions enabled by default (`actions_enabled_repositories=all`), the organization-facing runner group has `restricted_to_workflows=false`, and inherited enterprise-backed access also has `restricted_to_workflows=false` on the source GH_EnterpriseRunnerGroup.
 
 The computation follows repository-creation capability edges from the org role to the organization and then GH_Contains to the runner group. Each edge includes a `query_composition` Cypher query showing the repository-creation path and the Actions and runner-group policy predicates that make the path immediately usable.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_OrgRole` | `GH_OrgRunnerGroup` | `true` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_OrgRole"]
+    n1["GH_OrgRunnerGroup"]
+    n0 -->|GH_CanCreateRepositoryWithRunnerAccess| n1
+```

{openhound_github-0.7.2 → openhound_github-0.8.0}/descriptions/edges/GH_CanDeployToEnvironment.md

@@ -1,3 +1,5 @@
+# GH_CanDeployToEnvironment
+
 ## General Information
 
 The traversable GH_CanDeployToEnvironment edge represents the ability for a repository, branch, repository role, or reviewer to satisfy the modeled deployment constraints for a GitHub Environment.
@@ -7,3 +9,30 @@ This edge is computed from environment deployment branch policy, branch protecti
 When required reviewers are configured and self-review is allowed, a configured GH_User or GH_Team reviewer receives GH_CanDeployToEnvironment only when the same actor can also supply deployable code. For unrestricted environments this means the actor can create a branch in the repository. For protected-branch-only or custom branch policy environments this means the actor can write to an eligible branch under the existing GH_CanWriteBranch rules.
 
 Self-review alone is not sufficient for this edge. GH_ApprovesDeploymentTo remains the non-traversable representation of reviewer authority, while GH_CanDeployToEnvironment represents the combined ability to satisfy both the approval gate and the code-supply path. When prevent_self_review is enabled, no direct deploy edge is emitted for the reviewer because the required split-principal flow is not currently modeled.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_Branch` | `GH_Environment` | `true` |
+| `GH_RepoRole` | `GH_Environment` | `true` |
+| `GH_Repository` | `GH_Environment` | `true` |
+| `GH_Team` | `GH_Environment` | `true` |
+| `GH_User` | `GH_Environment` | `true` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_Branch"]
+    n1["GH_Environment"]
+    n2["GH_RepoRole"]
+    n3["GH_Repository"]
+    n4["GH_Team"]
+    n5["GH_User"]
+    n0 -->|GH_CanDeployToEnvironment| n1
+    n2 -->|GH_CanDeployToEnvironment| n1
+    n3 -->|GH_CanDeployToEnvironment| n1
+    n4 -->|GH_CanDeployToEnvironment| n1
+    n5 -->|GH_CanDeployToEnvironment| n1
+```

{openhound_github-0.7.2 → openhound_github-0.8.0}/descriptions/edges/GH_CanEditEnvironment.md

@@ -1,3 +1,5 @@
+# GH_CanEditEnvironment
+
 ## General Information
 
 The traversable GH_CanEditEnvironment edge indicates that a repository role can modify the configuration of a GitHub environment. In the current model, this edge is emitted for the repository's built-in `admin` role to every environment contained in that repository.
@@ -9,7 +11,17 @@ This edge is distinct from GH_CanDeployToEnvironment:
 - **GH_CanEditEnvironment** means the role can manage the environment's settings.
 - **GH_CanDeployToEnvironment** means the source satisfies the modeled deployment policy, reviewer gate, or administrator bypass condition for the environment.
 
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_RepoRole` | `GH_Environment` | `true` |
+
+## Diagram
+
 ```mermaid
 graph LR
-    role["GH_RepoRole admin"] ==>|GH_CanEditEnvironment| env["GH_Environment production"]
+    n0["GH_RepoRole"]
+    n1["GH_Environment"]
+    n0 -->|GH_CanEditEnvironment| n1
 ```

openhound_github-0.8.0/descriptions/edges/GH_CanEditProtection.md

@@ -0,0 +1,26 @@
+# GH_CanEditProtection
+
+## General Information
+
+The traversable GH_CanEditProtection edge is a computed edge indicating that a role can modify or remove branch protection rules in a repository. This edge is emitted when the role has GH_EditRepoProtections or GH_AdminTo permissions and the repository contains at least one protected branch. Repo-targeted edges model the repo-wide security impact for attack path traversal; branch-targeted edges are also emitted as supporting evidence for each protected branch governed by those rules.
+
+## Scenarios
+
+### `admin` — Admin can edit protections
+
+The admin role has GH_AdminTo which implicitly grants the ability to modify or remove any branch protection rule.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_RepoRole` | `GH_Branch` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_RepoRole"]
+    n1["GH_Branch"]
+    n0 -.->|GH_CanEditProtection| n1
+```

{openhound_github-0.7.2 → openhound_github-0.8.0}/descriptions/edges/GH_CanPwnRequest.md

@@ -1,3 +1,5 @@
+# GH_CanPwnRequest
+
 ## General Information
 
 The traversable GH_CanPwnRequest edge indicates that a repository role can exploit a pwn-requestable workflow to execute arbitrary code with the base branch's secrets, GITHUB_TOKEN permissions, and OIDC identity. This is a computed edge that combines workflow analysis with repository access and fork policy evaluation.
@@ -42,18 +44,20 @@ An attacker who exploits a pwn request gains code execution in the workflow runn
 - **OIDC traversal requires `id-token: write`**: The attack chain from GH_CanPwnRequest through GH_CanAssumeIdentity to a cloud role is only valid if the pwn-requestable workflow (or job) explicitly declares `id-token: write` in its `permissions:` block. The `id-token` permission defaults to `none` and is never implicitly granted — even when the workflow has no `permissions:` block at all. The `permissions` property on the GH_WorkflowJob node can be inspected to verify this.
 - **GITHUB_TOKEN permissions**: The `permissions:` block controls what the `GITHUB_TOKEN` can do (e.g., push commits, create releases), but has no effect on secret access, OIDC token requests (governed separately by `id-token`), or arbitrary code execution. A workflow with `contents: read` is still fully exploitable via pwn request for secret exfiltration and lateral movement — only write-back to the repository is limited.
 
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_RepoRole` | `GH_Branch` | `true` |
+| `GH_RepoRole` | `GH_Repository` | `true` |
+
+## Diagram
+
 ```mermaid
 graph LR
-    role("GH_RepoRole repo-read")
-    repo("GH_Repository private-app")
-    branch("GH_Branch main")
-    wf("GH_Workflow vulnerable-ci.yml")
-    secret("GH_RepoSecret DEPLOY_KEY")
-    cloud("AWSRole deploy-prod")
-
-    role -- GH_CanPwnRequest --> repo
-    role -- GH_CanPwnRequest --> branch
-    repo -.- |GH_HasWorkflow| wf
-    repo -.- |GH_Contains| secret
-    branch -- GH_CanAssumeIdentity --> cloud
-```
+    n0["GH_RepoRole"]
+    n1["GH_Branch"]
+    n2["GH_Repository"]
+    n0 -->|GH_CanPwnRequest| n1
+    n0 -->|GH_CanPwnRequest| n2
+```

openhound_github-0.8.0/descriptions/edges/GH_CanReadSecret.md

@@ -0,0 +1,20 @@
+# GH_CanReadSecret
+
+## General Information
+
+Org role can read an organization secret by creating a repository in scope.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_OrgRole` | `GH_OrgSecret` | `true` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_OrgRole"]
+    n1["GH_OrgSecret"]
+    n0 -->|GH_CanReadSecret| n1
+```

{openhound_github-0.7.2 → openhound_github-0.8.0}/descriptions/edges/GH_CanReadSecretScanningAlert.md

@@ -1,3 +1,5 @@
+# GH_CanReadSecretScanningAlert
+
 ## General Information
 
 The traversable GH_CanReadSecretScanningAlert edge is a computed edge indicating that a role can read a specific secret scanning alert, including the leaked secret value. The computation cross-references GH_ViewSecretScanningAlerts permission edges with GH_Contains structural edges (org-level and repo-level) to determine which alerts each role can access. This edge is traversable because reading an alert reveals the leaked secret — if the secret is a valid GitHub Personal Access Token, the GH_ValidToken edge enables identity compromise of the token's owner.
@@ -10,22 +12,20 @@ Each edge includes a `reason` property (`org_role_permission` or `repo_role_perm
 
 An org role with GH_ViewSecretScanningAlerts to the organization can read all secret scanning alerts across the entire org. The computation follows GH_Contains edges from the organization to each alert.
 
-```mermaid
-graph LR
-    role("GH_OrgRole security_manager") -->|GH_ViewSecretScanningAlerts| org("GH_Organization")
-    org -->|GH_Contains| alert("GH_SecretScanningAlert #42")
-    role ==>|GH_CanReadSecretScanningAlert| alert
-    alert -.->|GH_ValidToken| user("GH_User jdoe")
-```
+## Edge Schema
 
-### `repo_role_permission` — Repo role views alerts via repository
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_OrgRole` | `GH_SecretScanningAlert` | `true` |
+| `GH_RepoRole` | `GH_SecretScanningAlert` | `true` |
 
-A repo role with GH_ViewSecretScanningAlerts to the repository can read secret scanning alerts in that specific repo. The computation follows GH_Contains edges from the repository to each alert.
+## Diagram
 
 ```mermaid
 graph LR
-    role("GH_RepoRole admin") -->|GH_ViewSecretScanningAlerts| repo("GH_Repository")
-    repo -->|GH_Contains| alert("GH_SecretScanningAlert #17")
-    role ==>|GH_CanReadSecretScanningAlert| alert
-    alert -.->|GH_ValidToken| user("GH_User jdoe")
+    n0["GH_OrgRole"]
+    n1["GH_SecretScanningAlert"]
+    n2["GH_RepoRole"]
+    n0 -->|GH_CanReadSecretScanningAlert| n1
+    n2 -->|GH_CanReadSecretScanningAlert| n1
 ```