openhound-github 0.9.0__tar.gz → 0.10.1__tar.gz

{openhound_github-0.9.0 → openhound_github-0.10.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openhound-github
-Version: 0.9.0
+Version: 0.10.1
 Summary: Github collector for OpenHound
 Author-email: "jdreijer@specterops.io" <jdreijer@specterops.io>, Jared Atkinson <jatkinson@specterops.io>
 License-File: LICENSE.md

openhound_github-0.10.1/descriptions/edges/GH_CanAccessSecret.md

@@ -0,0 +1,30 @@
+# GH_CanAccessSecret
+
+## General Information
+
+The traversable GH_CanAccessSecret edge represents that a GitHub Actions workflow job execution context can access a statically referenced secret.
+
+This edge is derived from the existing non-traversable GH_UsesSecret relationships on the job's contained steps and from job-level `env` declarations. It is intended for attack-path analysis from a compromised job execution context to the secrets that context can read.
+
+The collector only emits this edge when one of the workflow job's modeled steps or the job's `env` block statically references the secret. The existence of a secret in the repository, organization, or environment scope alone is not enough. For this initial implementation, secrets passed through `jobs.<job_id>.secrets` to reusable workflows are retained as structural references but are not projected as runtime access for the caller job.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_WorkflowJob` | `GH_EnvironmentSecret` | `true` |
+| `GH_WorkflowJob` | `GH_OrgSecret` | `true` |
+| `GH_WorkflowJob` | `GH_RepoSecret` | `true` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_WorkflowJob"]
+    n1["GH_EnvironmentSecret"]
+    n2["GH_OrgSecret"]
+    n3["GH_RepoSecret"]
+    n0 -->|GH_CanAccessSecret| n1
+    n0 -->|GH_CanAccessSecret| n2
+    n0 -->|GH_CanAccessSecret| n3
+```

openhound_github-0.10.1/descriptions/edges/GH_CanInterceptJob.md

@@ -0,0 +1,24 @@
+# GH_CanInterceptJob
+
+## General Information
+
+The traversable GH_CanInterceptJob edge represents that a self-hosted runner not explicitly marked ephemeral can intercept a GitHub Actions workflow job that GitHub could schedule on it.
+
+This edge is derived from GH_RunsOn and is intended for attack-path analysis. It does not mean that the job has historically executed on the runner. It means that control of the runner may expose the future execution context of the job when the runner is not ephemeral.
+
+The collector does not emit this edge for runners GitHub explicitly marks as ephemeral.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_Runner` | `GH_WorkflowJob` | `true` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_Runner"]
+    n1["GH_WorkflowJob"]
+    n0 -->|GH_CanInterceptJob| n1
+```

openhound_github-0.10.1/descriptions/edges/GH_CanRequestOIDCTokenFor.md

@@ -0,0 +1,26 @@
+# GH_CanRequestOIDCTokenFor
+
+## General Information
+
+The traversable GH_CanRequestOIDCTokenFor edge represents a static upper-bound capability: based on the collected workflow configuration, a GitHub Actions workflow job execution context may be able to request a GitHub-signed OIDC token containing claims for its associated GitHub Environment.
+
+This edge is derived from the existing GH_DeploysTo relationship and the job's calculated `effective_github_token_permissions`. The collector emits it only when the job targets a statically resolved environment and its effective permissions include `id-token:write`.
+
+This is a capability edge, not evidence that the workflow has historically requested a token or contains an explicit OIDC-related step. Code executing in a job with `id-token:write` can request the token directly.
+
+The edge does not model run-specific permission recalculation. In particular, a `pull_request` run originating from a fork may receive downgraded `GITHUB_TOKEN` permissions at runtime and therefore may not be able to request an OIDC token even when this edge exists. The edge should not be interpreted as proof that every execution of the job can request OIDC.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_WorkflowJob` | `GH_Environment` | `true` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_WorkflowJob"]
+    n1["GH_Environment"]
+    n0 -->|GH_CanRequestOIDCTokenFor| n1
+```

{openhound_github-0.9.0 → openhound_github-0.10.1}/descriptions/nodes/GH_EnterpriseRunner.md

@@ -8,6 +8,8 @@ The node captures runner metadata such as operating system, status, busy state,
 
 GH_RunsOn edges from GH_WorkflowJob nodes identify statically resolvable jobs that GitHub could schedule on this runner through the inherited enterprise runner-group topology. These edges do not indicate that the job has actually executed on the runner.
 
+When the runner is not explicitly marked ephemeral, GH_CanInterceptJob edges identify workflow jobs whose future execution context may be exposed to an actor controlling the runner.
+
 ## Properties
 
 | Property | Type | Description |
@@ -34,6 +36,7 @@ GH_RunsOn edges from GH_WorkflowJob nodes identify statically resolvable jobs th
 | `query_group` | `string` | Query for group. |
 | `query_repositories` | `string` | Query for repositories. |
 | `query_jobs` | `string` | Query for workflow jobs that can be scheduled on the runner. |
+| `query_interceptable_jobs` | `string` | Query for workflow jobs the runner can intercept. |
 
 ## Diagram
 
@@ -45,4 +48,5 @@ graph LR
     n0 -.->|GH_Contains| n1
     n0 -->|GH_HasRunner| n1
     n2 -.->|GH_RunsOn| n1
+    n1 -->|GH_CanInterceptJob| n2
 ```

{openhound_github-0.9.0 → openhound_github-0.10.1}/descriptions/nodes/GH_Environment.md

@@ -6,6 +6,8 @@ Represents a GitHub Actions deployment environment configured on a repository. E
 
 Repositories always contain their environments. When custom branch policies are configured, the environment also contains one or more GH_EnvironmentBranchPolicy nodes that describe which branches are allowed to deploy. Environment-scoped secrets and variables are modeled as child nodes of the environment and become available to workflow jobs that reference it.
 
+GH_CanRequestOIDCTokenFor edges from GH_WorkflowJob nodes identify jobs with a static upper-bound capability to request a GitHub-signed OIDC token for this environment because their effective `GITHUB_TOKEN` permissions include `id-token:write`. Runtime permission recalculation, such as forked `pull_request` permission downgrades, may prevent a specific execution from requesting OIDC even when this edge exists.
+
 ## Properties
 
 | Property | Type | Description |
@@ -57,4 +59,5 @@ graph LR
     n8 -.->|GH_ApprovesDeploymentTo| n1
     n8 -->|GH_CanDeployToEnvironment| n1
     n9 -.->|GH_DeploysTo| n1
+    n9 -->|GH_CanRequestOIDCTokenFor| n1
 ```

{openhound_github-0.9.0 → openhound_github-0.10.1}/descriptions/nodes/GH_OrgRunner.md

@@ -8,6 +8,8 @@ The node captures runner metadata such as operating system, status, busy state,
 
 GH_RunsOn edges from GH_WorkflowJob nodes identify statically resolvable jobs that GitHub could schedule on this runner under the current runner-group access policy. These edges do not indicate that the job has actually executed on the runner.
 
+When the runner is not explicitly marked ephemeral, GH_CanInterceptJob edges identify workflow jobs whose future execution context may be exposed to an actor controlling the runner.
+
 ## Properties
 
 | Property | Type | Description |
@@ -34,6 +36,7 @@ GH_RunsOn edges from GH_WorkflowJob nodes identify statically resolvable jobs th
 | `query_group` | `string` | Query for group. |
 | `query_repositories` | `string` | Query for repositories. |
 | `query_jobs` | `string` | Query for workflow jobs that can be scheduled on the runner. |
+| `query_interceptable_jobs` | `string` | Query for workflow jobs the runner can intercept. |
 
 ## Diagram
 
@@ -45,4 +48,5 @@ graph LR
     n0 -.->|GH_Contains| n1
     n0 -->|GH_HasRunner| n1
     n2 -.->|GH_RunsOn| n1
+    n1 -->|GH_CanInterceptJob| n2
 ```

{openhound_github-0.9.0 → openhound_github-0.10.1}/descriptions/nodes/GH_RepoRunner.md

@@ -8,6 +8,8 @@ The node captures runner metadata such as operating system, status, busy state,
 
 GH_RunsOn edges from GH_WorkflowJob nodes identify statically resolvable jobs in the containing repository that GitHub could schedule on this runner. These edges do not indicate that the job has actually executed on the runner.
 
+When the runner is not explicitly marked ephemeral, GH_CanInterceptJob edges identify workflow jobs whose future execution context may be exposed to an actor controlling the runner.
+
 ## Properties
 
 | Property | Type | Description |
@@ -34,6 +36,7 @@ GH_RunsOn edges from GH_WorkflowJob nodes identify statically resolvable jobs in
 | `query_group` | `string` | Query for group. |
 | `query_repositories` | `string` | Query for repositories. |
 | `query_jobs` | `string` | Query for workflow jobs that can be scheduled on the runner. |
+| `query_interceptable_jobs` | `string` | Query for workflow jobs the runner can intercept. |
 
 ## Diagram
 
@@ -45,4 +48,5 @@ graph LR
     n0 -.->|GH_CanUseRunner| n1
     n0 -.->|GH_Contains| n1
     n2 -.->|GH_RunsOn| n1
+    n1 -->|GH_CanInterceptJob| n2
 ```

{openhound_github-0.9.0 → openhound_github-0.10.1}/descriptions/nodes/GH_WorkflowJob.md

@@ -8,6 +8,10 @@ When the job has a statically resolvable self-hosted `runs-on` selector, GH_Runs
 
 When present, `job_permissions` captures the job-level `permissions` declaration from the workflow YAML. `effective_github_token_permissions` captures the calculated static `GITHUB_TOKEN` permissions after applying the repository default, workflow-level declaration, and job-level declaration.
 
+GH_CanAccessSecret edges identify secrets statically referenced by the job's modeled steps or job-level `env` block that the job execution context can access. GH_CanInterceptJob edges from GH_Runner nodes not explicitly marked ephemeral identify jobs whose future execution context may be exposed if that runner is controlled. When a job targets an environment and its effective permissions include `id-token:write`, GH_CanRequestOIDCTokenFor identifies a static upper-bound OIDC capability for that environment. Runtime permission recalculation, such as forked `pull_request` permission downgrades, may prevent a specific execution from requesting OIDC even when this edge exists.
+
+When `runs_on_is_dynamic` is true, runner matching and interception status remain unresolved: the collector does not emit GH_CanInterceptJob edges for the job, so `query_interceptable_jobs` cannot match it and the absence of an edge must not be treated as evidence that the job is definitively non-interceptable.
+
 ## Properties
 
 | Property | Type | Description |
@@ -37,6 +41,7 @@ When present, `job_permissions` captures the job-level `permissions` declaration
 | `query_steps` | `string` | Query for workflow steps. |
 | `query_references` | `string` | Query for workflow references (secrets and variables). |
 | `query_runners` | `string` | Query for eligible self-hosted runners. |
+| `query_accessible_secrets` | `string` | Query for secrets accessible to the job execution context. |
 
 ## Diagram
 
@@ -62,6 +67,11 @@ graph LR
     n1 -.->|GH_UsesSecret| n7
     n1 -.->|GH_UsesVariable| n8
     n1 -.->|GH_RunsOn| n9
+    n1 -->|GH_CanAccessSecret| n3
+    n1 -->|GH_CanAccessSecret| n5
+    n1 -->|GH_CanAccessSecret| n7
+    n1 -->|GH_CanRequestOIDCTokenFor| n2
+    n9 -->|GH_CanInterceptJob| n1
     n1 -.->|GH_CallsWorkflow| n0
     n1 -.->|GH_DependsOn| n1
     n1 -.->|GH_Contains| n10

{openhound_github-0.9.0 → openhound_github-0.10.1}/extension/saved_searches/README.md

@@ -2,6 +2,15 @@
 
 Pre-built Cypher queries for identifying security-relevant configurations across your GitHub organization. Each query is stored as an individual JSON file with `name`, `query`, and `description` fields, designed to be imported into BloodHound's saved queries feature.
 
+## Runner Interception Analysis
+
+Use the runner interception searches as a progression:
+
+1. Start with `workflow-jobs-interceptable-by-self-hosted-runners.json` to inventory jobs whose future execution context may be exposed to collected self-hosted runners.
+2. Prioritize `shared-self-hosted-runners-can-intercept-secret-bearing-jobs.json` because organization- and enterprise-scoped runners can create cross-repository blast radius.
+3. Use `self-hosted-runners-can-intercept-broad-token-jobs.json` and `workflow-jobs-with-id-token-write-on-self-hosted-runners.json` to find interceptable jobs with high-impact GITHUB_TOKEN or OIDC permissions.
+4. For a specific finding, follow `GH_RunsOn`, `GH_CanUseRunner`, `GH_CanAccessSecret`, and the workflow/job/step nodes to verify why the runner is eligible and what the job can access.
+
 ## Severity Levels
 
 | Indicator | Severity | Description |
@@ -80,24 +89,27 @@ Pre-built Cypher queries for identifying security-relevant configurations across
 | 40 | `org-roles-bypass-security-scanning.json` | Org Roles That Can Bypass Security Scanning | Finds organization roles with permissions to bypass or manage security scanning dismissals. These roles can suppress secret scanning and code scanning findings. |
 | 41 | `github-to-azure-identity.json` | GitHub-to-Azure Identity Assumptions | Finds GitHub entities (repositories, branches, environments) that can assume Azure identities via OIDC federation. Verify that each trust relationship is intentional and scoped appropriately. |
 | 42 | `workflow-jobs-with-id-token-write.json` | Workflow Jobs with OIDC Token Permission | Returns workflow jobs whose effective GITHUB_TOKEN permissions include `id-token:write`. |
-| 43 | `workflow-jobs-with-id-token-write-on-self-hosted-runners.json` | OIDC-Capable Workflow Jobs on Self-Hosted Runners | Returns OIDC-capable jobs that can be scheduled on collected self-hosted runners. |
+| 43 | `workflow-jobs-with-id-token-write-on-self-hosted-runners.json` | OIDC-Capable Workflow Jobs Interceptable by Self-Hosted Runners | Returns OIDC-capable jobs whose execution context may be exposed to collected self-hosted runners. |
 | 44 | `workflow-jobs-with-broad-token-write-permissions.json` | Workflow Jobs with Broad GITHUB_TOKEN Write Permissions | Returns jobs with effective write access to repository contents, Actions, or pull requests. |
 | 45 | `workflow-jobs-with-observed-oidc-auth-steps.json` | Workflow Jobs with Observed OIDC Authentication Steps | Returns OIDC-capable jobs with descendant steps that show likely token consumption. |
+| 46 | `workflow-jobs-interceptable-by-self-hosted-runners.json` | Workflow Jobs Interceptable by Self-Hosted Runners | Returns workflow jobs whose future execution context may be exposed to collected self-hosted runners. |
+| 47 | `shared-self-hosted-runners-can-intercept-secret-bearing-jobs.json` | Shared Self-Hosted Runners Can Intercept Secret-Bearing Jobs | Returns shared organization- and enterprise-scoped runners that can intercept jobs with secret access. |
+| 48 | `self-hosted-runners-can-intercept-broad-token-jobs.json` | Self-Hosted Runners Can Intercept Broad-Token Jobs | Returns self-hosted runners that can intercept jobs with high-impact GITHUB_TOKEN write permissions. |
 
 ### :white_circle: Low — Hygiene & Governance
 
 | # | File | Name | Description |
 |---|------|------|-------------|
-| 46 | `environments-admin-bypass.json` | Environments Where Admins Can Bypass Protections | Finds deployment environments where administrators can bypass protection rules such as required reviewers and wait timers. Admins can deploy to these environments without any approval. |
-| 47 | `app-installations-all-repos.json` | App Installations with Access to All Repositories | Finds GitHub App installations that have access to every repository in the organization. A compromised app credential would affect all repositories. |
-| 48 | `users-without-external-identity.json` | GitHub Users Without External Identity Mapping | Finds GitHub users that are not linked to any external identity via SAML or SCIM. These users cannot be centrally offboarded through the identity provider and may retain access after employment ends. |
-| 49 | `external-identities-without-scim.json` | External Identities Without SCIM Provisioning | Finds external identities that lack SCIM synchronization. Without SCIM, user deprovisioning in the identity provider will not automatically revoke GitHub access. |
-| 50 | `org-owners.json` | Organization Owners | Returns all users who hold the organization owners role. |
-| 51 | `privileged-custom-org-roles.json` | Privileged Custom Org Roles | Returns all custom organization roles that are privileged (i.e., have permissions that are not default). |
-| 52 | `global-repo-perms.json` | Global Repo Permissions | Returns all users who hold a global repository permission role (i.e., roles that are not default). |
-| 53 | `hybrid-identities.json` | External Identities | Returns all external identities (e.g., Azure or Okta users) that are associated with GitHub users. |
-| 54 | `privileged-hybrid-identities.json` | Privileged Hybrid Identities | Returns all hybrid identities (e.g., Azure or Okta users) that are associated with GitHub users who hold the organization owners role. |
-| 55 | `saml-configuration.json` | SAML Configuration Mapping | Finds SAML Identity Providers, their external identities, and mapped users. |
-| 56 | `team-membership-admin.json` | Team Membership Admins | Returns all users who hold the maintainer role over a team, including team nesting. |
-| 57 | `team-structure.json` | Team Structure | Returns the structure of teams within organizations, including team roles and their members. |
-| 58 | `repository-workflows.json` | Repository Workflows | Returns all repository workflows. |
+| 49 | `environments-admin-bypass.json` | Environments Where Admins Can Bypass Protections | Finds deployment environments where administrators can bypass protection rules such as required reviewers and wait timers. Admins can deploy to these environments without any approval. |
+| 50 | `app-installations-all-repos.json` | App Installations with Access to All Repositories | Finds GitHub App installations that have access to every repository in the organization. A compromised app credential would affect all repositories. |
+| 51 | `users-without-external-identity.json` | GitHub Users Without External Identity Mapping | Finds GitHub users that are not linked to any external identity via SAML or SCIM. These users cannot be centrally offboarded through the identity provider and may retain access after employment ends. |
+| 52 | `external-identities-without-scim.json` | External Identities Without SCIM Provisioning | Finds external identities that lack SCIM synchronization. Without SCIM, user deprovisioning in the identity provider will not automatically revoke GitHub access. |
+| 53 | `org-owners.json` | Organization Owners | Returns all users who hold the organization owners role. |
+| 54 | `privileged-custom-org-roles.json` | Privileged Custom Org Roles | Returns all custom organization roles that are privileged (i.e., have permissions that are not default). |
+| 55 | `global-repo-perms.json` | Global Repo Permissions | Returns all users who hold a global repository permission role (i.e., roles that are not default). |
+| 56 | `hybrid-identities.json` | External Identities | Returns all external identities (e.g., Azure or Okta users) that are associated with GitHub users. |
+| 57 | `privileged-hybrid-identities.json` | Privileged Hybrid Identities | Returns all hybrid identities (e.g., Azure or Okta users) that are associated with GitHub users who hold the organization owners role. |
+| 58 | `saml-configuration.json` | SAML Configuration Mapping | Finds SAML Identity Providers, their external identities, and mapped users. |
+| 59 | `team-membership-admin.json` | Team Membership Admins | Returns all users who hold the maintainer role over a team, including team nesting. |
+| 60 | `team-structure.json` | Team Structure | Returns the structure of teams within organizations, including team roles and their members. |
+| 61 | `repository-workflows.json` | Repository Workflows | Returns all repository workflows. |

openhound_github-0.10.1/extension/saved_searches/self-hosted-runners-can-intercept-broad-token-jobs.json

@@ -0,0 +1,5 @@
+{
+  "name": "GitHub: Self-Hosted Runners Can Intercept Broad-Token Jobs",
+  "query": "MATCH p=(runner:GH_Runner)-[:GH_CanInterceptJob]->(job:GH_WorkflowJob)\nWHERE 'contents:write' IN job.effective_github_token_permissions\nOR 'actions:write' IN job.effective_github_token_permissions\nOR 'pull-requests:write' IN job.effective_github_token_permissions\nRETURN p\nLIMIT 1000",
+  "description": "Returns self-hosted runners that can intercept workflow jobs whose effective GITHUB_TOKEN has high-impact write permissions. These jobs can materially increase the blast radius of runner compromise."
+}

openhound_github-0.10.1/extension/saved_searches/shared-self-hosted-runners-can-intercept-secret-bearing-jobs.json

@@ -0,0 +1,5 @@
+{
+  "name": "GitHub: Shared Self-Hosted Runners Can Intercept Secret-Bearing Jobs",
+  "query": "MATCH p=(runner:GH_Runner)-[:GH_CanInterceptJob]->(job:GH_WorkflowJob)-[:GH_CanAccessSecret]->(secret:GH_Secret)\nWHERE runner:GH_OrgRunner\nOR runner:GH_EnterpriseRunner\nRETURN p\nLIMIT 1000",
+  "description": "Returns organization- and enterprise-scoped self-hosted runners that can intercept workflow jobs with statically resolvable secret access. Shared runners are especially important to review because compromise can expose execution contexts across multiple repositories."
+}

openhound_github-0.10.1/extension/saved_searches/workflow-jobs-interceptable-by-self-hosted-runners.json

@@ -0,0 +1,5 @@
+{
+  "name": "GitHub: Workflow Jobs Interceptable by Self-Hosted Runners",
+  "query": "MATCH p=(runner:GH_Runner)-[:GH_CanInterceptJob]->(job:GH_WorkflowJob)\nRETURN p\nLIMIT 1000",
+  "description": "Returns workflow jobs whose future execution context may be exposed to an actor controlling a collected self-hosted runner that is not explicitly marked ephemeral."
+}

openhound_github-0.10.1/extension/saved_searches/workflow-jobs-with-id-token-write-on-self-hosted-runners.json

@@ -0,0 +1,5 @@
+{
+  "name": "GitHub: OIDC-Capable Workflow Jobs Interceptable by Self-Hosted Runners",
+  "query": "MATCH p=(runner:GH_Runner)-[:GH_CanInterceptJob]->(job:GH_WorkflowJob)\nWHERE 'id-token:write' IN job.effective_github_token_permissions\nRETURN p\nLIMIT 1000",
+  "description": "Returns OIDC-capable workflow jobs whose execution context may be exposed to an actor controlling a collected self-hosted runner that is not explicitly marked ephemeral. These jobs are especially important to review because runner compromise could expose short-lived cloud federation tokens."
+}

{openhound_github-0.9.0 → openhound_github-0.10.1}/extension/schema.json

@@ -1035,6 +1035,11 @@
       "description": "[Workflow] Job can be scheduled on this self-hosted runner based on its static runs-on selector — GH_WorkflowJob → GH_Runner",
       "is_traversable": false
     },
+    {
+      "name": "GH_CanInterceptJob",
+      "description": "[Computed] Persistent self-hosted runner can intercept a workflow job that may be scheduled on it — GH_Runner → GH_WorkflowJob",
+      "is_traversable": true
+    },
     {
       "name": "GH_HasMember",
       "description": "Enterprise or organization has this user as a member",
@@ -1045,6 +1050,16 @@
       "description": "[Workflow] Job or step references a secret by name — GH_WorkflowJob / GH_WorkflowStep → GH_RepoSecret / GH_OrgSecret / GH_EnvironmentSecret (scope match)",
       "is_traversable": false
     },
+    {
+      "name": "GH_CanAccessSecret",
+      "description": "[Computed] Workflow job execution context can access a statically referenced secret — GH_WorkflowJob → GH_RepoSecret / GH_OrgSecret / GH_EnvironmentSecret",
+      "is_traversable": true
+    },
+    {
+      "name": "GH_CanRequestOIDCTokenFor",
+      "description": "[Computed] Workflow job has a static upper-bound capability to request a GitHub OIDC token for its deployment environment — GH_WorkflowJob → GH_Environment",
+      "is_traversable": true
+    },
     {
       "name": "GH_UsesVariable",
       "description": "[Workflow] Job or step references a variable by name — GH_WorkflowJob / GH_WorkflowStep → GH_RepoVariable / GH_OrgVariable / GH_EnvironmentVariable (scope match)",

{openhound_github-0.9.0 → openhound_github-0.10.1}/src/openhound_github/kinds/edges.py

@@ -19,6 +19,9 @@ MEMBER_OF = "GH_MemberOf"
 CAN_ACCESS = "GH_CanAccess"
 CAN_USE_RUNNER = "GH_CanUseRunner"
 RUNS_ON = "GH_RunsOn"
+CAN_INTERCEPT_JOB = "GH_CanInterceptJob"
+CAN_ACCESS_SECRET = "GH_CanAccessSecret"  # noqa: S105 - OpenGraph edge kind
+CAN_REQUEST_OIDC_TOKEN_FOR = "GH_CanRequestOIDCTokenFor"  # noqa: S105 - OpenGraph edge kind
 IS_ELIGIBLE_FOR = "GH_IsEligibleFor"
 CAN_CREATE_REPOSITORY_WITH_RUNNER_ACCESS = "GH_CanCreateRepositoryWithRunnerAccess"
 CAN_CREATE_BRANCH = "GH_CanCreateBranch"

{openhound_github-0.9.0 → openhound_github-0.10.1}/src/openhound_github/lookup.py

@@ -218,13 +218,13 @@ class GithubLookup(LookupManager):
         return True
 
     @lru_cache
-    def workflow_job_runner_node_ids(
+    def _workflow_job_runner_matches(
         self,
         repository_node_id: str,
         org_login: str,
         group_name: str | None,
         labels: tuple[str, ...],
-    ) -> list[str]:
+    ) -> list[tuple[str, bool | None]]:
         """Return accessible self-hosted runners matching a static runs-on selector."""
         if not group_name and not labels:
             return []
@@ -243,29 +243,36 @@ class GithubLookup(LookupManager):
 
         repository_visibility, actions_enabled = repository
         required_labels = {str(label).casefold() for label in labels}
-        matching_runner_node_ids: list[str] = []
+        matching_runners: list[tuple[int, str, bool | None]] = []
         seen_runner_node_ids: set[str] = set()
 
-        def add_matching_runner(node_id: str, raw_labels: Any) -> None:
+        def add_matching_runner(
+            source_order: int,
+            node_id: str,
+            raw_labels: Any,
+            ephemeral: bool | None,
+        ) -> None:
             if node_id in seen_runner_node_ids:
                 return
             if not required_labels.issubset(self._runner_label_names(raw_labels)):
                 return
             seen_runner_node_ids.add(node_id)
-            matching_runner_node_ids.append(node_id)
+            matching_runners.append((source_order, node_id, ephemeral))
 
         if group_name is None:
-            for runner_id, raw_labels in self._find_all_objects(
+            for runner_id, raw_labels, ephemeral in self._find_all_objects(
                 f"""
-                SELECT id, labels
+                SELECT id, labels, ephemeral
                 FROM {self.schema}.repo_runners
                 WHERE repository_node_id = ?
                 """,
                 [repository_node_id],
             ):
                 add_matching_runner(
+                    0,
                     runner_node_id(repository_node_id, int(runner_id)),
                     raw_labels,
+                    ephemeral,
                 )
 
         if actions_enabled is not True:
@@ -329,9 +336,9 @@ class GithubLookup(LookupManager):
                 if not identity:
                     continue
                 enterprise_node_id, enterprise_runner_group_id = identity
-                for runner_id, raw_labels in self._find_all_objects(
+                for runner_id, raw_labels, ephemeral in self._find_all_objects(
                     f"""
-                    SELECT r.id, r.labels
+                    SELECT r.id, r.labels, r.ephemeral
                     FROM {self.schema}.enterprise_runner_group_memberships m
                     JOIN {self.schema}.enterprise_runners r
                       ON r.enterprise_node_id = m.enterprise_node_id
@@ -342,14 +349,16 @@ class GithubLookup(LookupManager):
                     [enterprise_node_id, enterprise_runner_group_id],
                 ):
                     add_matching_runner(
+                        2,
                         runner_node_id(enterprise_node_id, int(runner_id)),
                         raw_labels,
+                        ephemeral,
                     )
                 continue
 
-            for runner_id, raw_labels in self._find_all_objects(
+            for runner_id, raw_labels, ephemeral in self._find_all_objects(
                 f"""
-                SELECT r.id, r.labels
+                SELECT r.id, r.labels, r.ephemeral
                 FROM {self.schema}.org_runner_group_memberships m
                 JOIN {self.schema}.org_runners r
                   ON r.org_login = m.org_login
@@ -360,11 +369,85 @@ class GithubLookup(LookupManager):
                 [org_login, runner_group_id],
             ):
                 add_matching_runner(
+                    1,
                     runner_node_id(self.org_id_for_login(org_login), int(runner_id)),
                     raw_labels,
+                    ephemeral,
                 )
 
-        return matching_runner_node_ids
+        return [
+            (node_id, ephemeral)
+            for _source_order, node_id, ephemeral in sorted(
+                matching_runners,
+                key=lambda runner: (runner[0], runner[1]),
+            )
+        ]
+
+    @lru_cache
+    def workflow_job_runner_node_ids(
+        self,
+        repository_node_id: str,
+        org_login: str,
+        group_name: str | None,
+        labels: tuple[str, ...],
+    ) -> list[str]:
+        """Return accessible self-hosted runner node IDs matching a static selector."""
+        return [
+            runner_node_id
+            for runner_node_id, _ephemeral in self._workflow_job_runner_matches(
+                repository_node_id,
+                org_login,
+                group_name,
+                labels,
+            )
+        ]
+
+    @lru_cache
+    def workflow_job_interceptable_runner_node_ids(
+        self,
+        repository_node_id: str,
+        org_login: str,
+        group_name: str | None,
+        labels: tuple[str, ...],
+    ) -> list[str]:
+        """Return matching runner node IDs not explicitly marked ephemeral."""
+        return [
+            runner_node_id
+            for runner_node_id, ephemeral in self._workflow_job_runner_matches(
+                repository_node_id,
+                org_login,
+                group_name,
+                labels,
+            )
+            if ephemeral is not True
+        ]
+
+    @lru_cache
+    def workflow_step_secret_reference_names(self, job_node_id: str) -> list[str]:
+        """Return unique secret names statically referenced by steps in a job."""
+        names: list[str] = []
+        seen: set[str] = set()
+        for (raw_references,) in self._find_all_objects(
+            f"""
+            SELECT secret_references
+            FROM {self.schema}.workflow_steps
+            WHERE job_node_id = ?
+            """,
+            [job_node_id],
+        ):
+            for reference in self._json_list(raw_references):
+                if not isinstance(reference, dict):
+                    continue
+                name = reference.get("name")
+                if name is None:
+                    continue
+                name = str(name)
+                key = name.casefold()
+                if key in seen:
+                    continue
+                seen.add(key)
+                names.append(name)
+        return names
 
     @lru_cache
     def enterprise_idp_for_scope(
@@ -523,6 +606,9 @@ class GithubLookup(LookupManager):
                 repository_can_approve_pull_request_reviews
             FROM {self.schema}.workflows
             WHERE repository_node_id = ?
+            ORDER BY
+                repository_default_workflow_permissions IS NULL,
+                repository_can_approve_pull_request_reviews IS NULL
             LIMIT 1
             """,
             [repository_node_id],

{openhound_github-0.9.0 → openhound_github-0.10.1}/src/openhound_github/models/runner.py

@@ -317,6 +317,7 @@ class GHRunnerProperties(GHNodeProperties):
         query_group: Query for group.
         query_repositories: Query for repositories.
         query_jobs: Query for workflow jobs that can be scheduled on the runner.
+        query_interceptable_jobs: Query for workflow jobs the runner can intercept.
     """
 
     scope: str | None = None
@@ -336,6 +337,7 @@ class GHRunnerProperties(GHNodeProperties):
     query_group: str | None = None
     query_repositories: str | None = None
     query_jobs: str | None = None
+    query_interceptable_jobs: str | None = None
 
 
 @app.asset(
@@ -387,6 +389,7 @@ class OrgRunner(BaseAsset):
                 query_group=f"MATCH p=(:GH_OrgRunnerGroup)-[:GH_HasRunner]->(:GH_OrgRunner {{node_id:'{rid}'}}) RETURN p",
                 query_repositories=f"MATCH p=(:GH_Repository)-[:GH_CanUseRunner]->(:GH_OrgRunnerGroup)-[:GH_HasRunner]->(:GH_OrgRunner {{node_id:'{rid}'}}) RETURN p",
                 query_jobs=f"MATCH p=(:GH_WorkflowJob)-[:GH_RunsOn]->(:GH_Runner {{node_id:'{rid}'}}) RETURN p",
+                query_interceptable_jobs=f"MATCH p=(:GH_Runner {{node_id:'{rid}'}})-[:GH_CanInterceptJob]->(:GH_WorkflowJob) RETURN p",
             ),
         )
 
@@ -441,6 +444,7 @@ class EnterpriseRunner(BaseAsset):
                 query_group=f"MATCH p=(:GH_EnterpriseRunnerGroup)-[:GH_HasRunner]->(:GH_EnterpriseRunner {{node_id:'{rid}'}}) RETURN p",
                 query_repositories=f"MATCH p=(:GH_Repository)-[:GH_CanUseRunner]->(:GH_OrgRunnerGroup)-[:GH_InheritedFrom]->(:GH_EnterpriseRunnerGroup)-[:GH_HasRunner]->(:GH_EnterpriseRunner {{node_id:'{rid}'}}) RETURN p",
                 query_jobs=f"MATCH p=(:GH_WorkflowJob)-[:GH_RunsOn]->(:GH_Runner {{node_id:'{rid}'}}) RETURN p",
+                query_interceptable_jobs=f"MATCH p=(:GH_Runner {{node_id:'{rid}'}})-[:GH_CanInterceptJob]->(:GH_WorkflowJob) RETURN p",
             ),
         )
 
@@ -878,6 +882,7 @@ class RepoRunner(BaseAsset):
                 environmentid=self.org_node_id,
                 query_repositories=f"MATCH p=(:GH_Repository {{node_id:'{self.repository_node_id}'}})-[:GH_CanUseRunner]->(:GH_RepoRunner {{node_id:'{rid}'}}) RETURN p",
                 query_jobs=f"MATCH p=(:GH_WorkflowJob)-[:GH_RunsOn]->(:GH_Runner {{node_id:'{rid}'}}) RETURN p",
+                query_interceptable_jobs=f"MATCH p=(:GH_Runner {{node_id:'{rid}'}})-[:GH_CanInterceptJob]->(:GH_WorkflowJob) RETURN p",
             ),
         )