audit-labs/gh-attest

 1-- Migration 0007: close the asymmetric-coverage gaps from the framework-mapping
 2-- review. Three signals were mapped in only one framework although the
 3-- equivalent control clearly exists in the other. See docs/framework-mapping.md.
 4--
 5-- 1. Dependabot -> ISO A.8.8 (Management of technical vulnerabilities). A.8.8 is
 6--    one control covering the whole vulnerability lifecycle (identify -> evaluate
 7--    -> remediate), so — unlike the SOC 2 split across CC7.1/CC7.2 — every status
 8--    maps to this single control.
 9-- 2. Code scanning -> SOC 2 CC7.1 (detection & monitoring), mirroring how
10--    Dependabot's tooling-active fact already maps to CC7.1. Only the tooling-
11--    active (NULL) row is added; finding-level rows are deliberately NOT routed
12--    to CC7.2 here, pending the CC7.1-vs-CC7.2 decision noted in the doc.
13-- 3. Secret scanning -> ISO A.5.17 (Authentication information). A leaked
14--    credential is exposed authentication information; mirrors the SOC 2
15--    CC6.6/CC6.1 rows into ISO.
16INSERT INTO control_mappings (resource, status, framework, control_id, posture, rationale) VALUES
17  -- Dependabot: ISO technical-vulnerability management (full lifecycle, one control)
18  ('dependabot_alert', NULL, 'iso27001', 'A.8.8', 'positive', 'Technical vulnerability management — detection tooling is active'),
19  ('dependabot_alert', 'open', 'iso27001', 'A.8.8', 'negative', 'Unremediated known technical vulnerability'),
20  ('dependabot_alert', 'fixed', 'iso27001', 'A.8.8', 'positive', 'Vulnerability remediated'),
21  ('dependabot_alert', 'dismissed', 'iso27001', 'A.8.8', 'positive', 'Vulnerability remediated (risk accepted)'),
22  ('dependabot_alert', 'auto_dismissed', 'iso27001', 'A.8.8', 'positive', 'Vulnerability remediated (e.g. dependency removed)'),
23
24  -- Code scanning: SOC 2 detection tooling active (findings intentionally unmapped here)
25  ('code_scanning_alert', NULL, 'soc2', 'CC7.1', 'positive', 'Detection tooling is active — SAST runs in the development pipeline'),
26
27  -- Secret scanning: ISO authentication-information protection
28  ('secret_scanning_alert', NULL, 'iso27001', 'A.5.17', 'positive', 'Authentication information protection — leaked-credential detection is active'),
29  ('secret_scanning_alert', 'open', 'iso27001', 'A.5.17', 'negative', 'Exposed authentication information'),
30  ('secret_scanning_alert', 'resolved', 'iso27001', 'A.5.17', 'positive', 'Authentication information exposure remediated');