mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-11-04 08:25:55 +08:00
Jim Meyer
2ff59bf33e
Widen the github-gator provider's repo-scoped rules from NVIDIA/OpenShell
to {NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*} so gator can read and
review pull requests in GitHub security advisory private forks. The search
rule already matches the forks and is unchanged.
Signed-off-by: Jim Meyer <jimeyer@nvidia.com>
89 lines
3.8 KiB
YAML
89 lines
3.8 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
id: github-gator
|
|
display_name: GitHub Gator
|
|
description: Repo-scoped GitHub access for the OpenShell gator gate agent
|
|
category: source_control
|
|
credentials:
|
|
- name: GITHUB_TOKEN
|
|
description: GitHub token used by the gator gate agent
|
|
env_vars: [GITHUB_TOKEN, GH_TOKEN]
|
|
required: true
|
|
auth_style: bearer
|
|
header_name: authorization
|
|
discovery:
|
|
credentials: [GITHUB_TOKEN]
|
|
endpoints:
|
|
- host: api.github.com
|
|
port: 443
|
|
protocol: rest
|
|
enforcement: enforce
|
|
rules:
|
|
- allow: { method: GET, path: /user }
|
|
- allow:
|
|
method: GET
|
|
path: /search/issues
|
|
query:
|
|
q:
|
|
any:
|
|
- "*repo:NVIDIA/OpenShell*"
|
|
- allow: { method: GET, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}" }
|
|
- allow: { method: GET, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/**" }
|
|
- allow: { method: POST, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/issues/*/comments" }
|
|
- allow: { method: PATCH, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/issues/comments/*" }
|
|
- allow: { method: POST, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/issues/*/labels" }
|
|
- allow: { method: PUT, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/issues/*/labels" }
|
|
- allow: { method: DELETE, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/issues/*/labels/*" }
|
|
- allow: { method: PATCH, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/issues/*" }
|
|
- allow: { method: POST, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/labels" }
|
|
- allow: { method: PATCH, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/labels/*" }
|
|
- allow: { method: POST, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/pulls/*/comments" }
|
|
- allow: { method: POST, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/pulls/*/reviews" }
|
|
- allow: { method: POST, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/pulls/*/reviews/*/comments" }
|
|
- allow: { method: POST, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/statuses/*" }
|
|
- host: api.github.com
|
|
port: 443
|
|
path: /graphql
|
|
protocol: graphql
|
|
enforcement: enforce
|
|
rules:
|
|
- allow:
|
|
operation_type: query
|
|
- allow:
|
|
operation_type: mutation
|
|
operation_name: ResolveGatorReviewThread
|
|
fields: [resolveReviewThread]
|
|
- host: github.com
|
|
port: 443
|
|
protocol: rest
|
|
enforcement: enforce
|
|
rules:
|
|
- allow: { method: GET, path: "/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}" }
|
|
- allow: { method: GET, path: "/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/**" }
|
|
- allow: { method: GET, path: "/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}.git/**" }
|
|
- allow: { method: POST, path: "/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/**/git-upload-pack" }
|
|
- allow: { method: POST, path: "/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}.git/**/git-upload-pack" }
|
|
- host: codeload.github.com
|
|
port: 443
|
|
protocol: rest
|
|
enforcement: enforce
|
|
rules:
|
|
- allow: { method: GET, path: "/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/**" }
|
|
- host: results-receiver.actions.githubusercontent.com
|
|
port: 443
|
|
protocol: rest
|
|
enforcement: enforce
|
|
rules:
|
|
- allow: { method: GET, path: /rest/runs/** }
|
|
binaries:
|
|
- /usr/bin/gh
|
|
- /usr/local/bin/gh
|
|
- /usr/bin/curl
|
|
- /usr/local/bin/curl
|
|
- /usr/bin/git
|
|
- /usr/local/bin/git
|
|
- /usr/bin/codex
|
|
- /usr/local/bin/codex
|
|
- /usr/lib/node_modules/@openai/**
|