audit-labs/gh-attest

 1-- branch_protection / repository_ruleset now report current-state status
 2-- (enabled/disabled) instead of the raw webhook action (created/edited/
 3-- deleted), so the cron poller can report the same facts for pre-existing
 4-- state that the webhook never delivered an event for.
 5DELETE FROM control_mappings WHERE resource IN ('branch_protection', 'repository_ruleset');
 6
 7INSERT INTO control_mappings (resource, status, framework, control_id, posture, rationale) VALUES
 8  ('branch_protection', 'enabled', 'soc2', 'CC8.1', 'positive', 'Change management — code changes require review before merge'),
 9  ('branch_protection', 'disabled', 'soc2', 'CC8.1', 'negative', 'Change control gap — direct pushes possible'),
10  ('branch_protection', 'enabled', 'iso27001', 'A.8.32', 'positive', 'Change management'),
11  ('branch_protection', 'disabled', 'iso27001', 'A.8.32', 'negative', 'Change control gap — direct pushes possible'),
12  ('repository_ruleset', 'enabled', 'soc2', 'CC8.1', 'positive', 'Change management — code changes require review before merge'),
13  ('repository_ruleset', 'disabled', 'soc2', 'CC8.1', 'negative', 'Change control gap — direct pushes possible'),
14  ('repository_ruleset', 'enabled', 'iso27001', 'A.8.32', 'positive', 'Change management'),
15  ('repository_ruleset', 'disabled', 'iso27001', 'A.8.32', 'negative', 'Change control gap — direct pushes possible');