Project: Checkov (Provisioning / Security & Compliance)
File: Github.md

layout: default published: true title: GitHub configuration scanning nav_order: 20 Checkov supports the evaluation of policies on your GitHub organization and repositories settings. When using checkov with GitHub token it can collect your current org settings and validate it complies with GitHub security best practices such as having 2FA defined, having SSO and more. Full list of github organization and repository settings related checks can be found . | Environment Variable | Default value | Description | |-||--| | CKVGITHUBCONFIGFETCHDATA| "True" | checkov will try to fetch GitHub configuration from API by default (unless no access token provided) | | CKVGITHUBCONFDIRNAME | "githubconf" | checkov will create a new directory named "githubconf" under current working directory | | GITHUBAPIURL | "https://api.github.com/" | | | GITHUB_TOKEN | | GitHub personal access token to be used to fetch GitHub configuration | | GITHUB_REF | refs/heads/master | Github branch for which to fetch branch protection rules configuration | | GITHUB_ORG | | Github organization | | GITHUB_REPOSITORY | | Github repositry for which to fetch repository configuration info | | GITHUBREPOOWNER | | The owner of the repository. This could be either Github repository owner user name or the organization name, in which the user is the owner. | ```json { "data": { "organization": { "name": "Prisma", "login": "prismaio", "description": "Secure public cloud infrastructure", "ipAllowListEnabledSetting": "ENABLED", "ipAllowListForInstalledAppsEnabledSetting": "ENABLED", "requiresTwoFactorAuthentication": false, "samlIdentityProvider": { "ssoUrl": "https://prisma.okta.com/app/githubcloud/foo/sso/saml" } } } } ``` ```python from checkov.github.basegithuborg_security import OrgSecurity class Github2FA(OrgSecurity): def init(self): name = "Ensure GitHub organization security settings require 2FA" id = "CKVGITHUB1" super().init( name=name, id=id ) def getevaluatedkeys(self): return ['data/organization/requiresTwoFactorAuthentication'] check = Github2FA() ``` ```bash export GITHUBTOKEN="ghpabc" export REQUESTSCABUNDLE="/usr/local/etc/openssl/cert.pem" export BCCABUNDLE="globalprotect_certifi.txt" checkov -d . --framework github_configuration ``` ```bash _| | _ | | / | '_ \ / _ \/ | |/ / _ \ \ / / | (| | | | / (| < (_) \ V / \_|_| |_|\|\|_|\_\/ \/ By Prisma Cloud | version: 2.0.707 github_configuration scan results: Passed checks: 2, Failed checks: 1, Skipped checks: 0 Check: CKVGITHUB3: "Ensure GitHub organization security settings has IP allow list enabled" PASSED for resource: conf/orgsecurity.json File: /githubconf/orgsecurity.json:2-15 Check: CKVGITHUB2: "Ensure GitHub organization security settings require SSO" PASSED for resource: conf/orgsecurity.json File: /githubconf/orgsecurity.json:2-15 Check: CKVGITHUB1: "Ensure GitHub organization security settings require 2FA" FAILED for resource: conf/orgsecurity.json File: /githubconf/orgsecurity.json:2-15 2 | "data": { 3 | "organization": { 4 | "name": "Prisma", 5 | "login": "prismaio", 6 | "description": "Secure public cloud infrastructure", 7 | "ipAllowListEnabledSetting": "ENABLED", 8 | "ipAllowListForInstalledAppsEnabledSetting": "ENABLED", 9 | "requiresTwoFactorAuthentication": false, 10 | "samlIdentityProvider": { 11 | "ssoUrl": "https://prisma.okta.com/app/githubcloud/foo/sso/saml" 12 | } 13 | } 14 | } 15 | } ``` To add more GitHub policies and configuration to be inspected take a look at the