audit-labs/audit-tools

 1"""
 2Collect organization-level security settings.
 3
 4Reads the org object; several fields are only populated when the token has org
 5admin access.
 6"""
 7
 8import requests
 9
10
11def org_security(org, cfg):
12    resp = requests.get(
13        f"https://api.github.com/orgs/{org}",
14        headers=cfg["headers"],
15        timeout=cfg["timeout"],
16    )
17    resp.raise_for_status()
18    o = resp.json()
19    return [
20        {
21            "org": org,
22            "two_factor_required": o.get("two_factor_requirement_enabled"),
23            "default_repo_permission": o.get("default_repository_permission"),
24            "members_can_create_repos": o.get("members_can_create_repositories"),
25            "members_can_create_public_repos": o.get(
26                "members_can_create_public_repositories"
27            ),
28            "members_can_create_pages": o.get("members_can_create_pages"),
29            "web_commit_signoff_required": o.get("web_commit_signoff_required"),
30            "advanced_security_for_new_repos": o.get(
31                "advanced_security_enabled_for_new_repositories"
32            ),
33            "secret_scanning_for_new_repos": o.get(
34                "secret_scanning_enabled_for_new_repositories"
35            ),
36            "secret_scanning_push_protection_for_new_repos": o.get(
37                "secret_scanning_push_protection_enabled_for_new_repositories"
38            ),
39        }
40    ]