From e5833a4263dd130cc594faef2fd21c7bd46f4334 Mon Sep 17 00:00:00 2001 From: Jared Atkinson Date: Wed, 4 Nov 2026 20:27:38 -0800 Subject: [PATCH] BED-10432: Fix Tier Zero role matching and exclude expired PATs --- extension/privilege_zone_rules/t0-all-repo-admin-role.json | 2 +- extension/privilege_zone_rules/t0-pats-all-repos.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/extension/privilege_zone_rules/t0-all-repo-admin-role.json b/extension/privilege_zone_rules/t0-all-repo-admin-role.json index 4b61324..2ae4299 100644 --- a/extension/privilege_zone_rules/t0-all-repo-admin-role.json +++ b/extension/privilege_zone_rules/t0-all-repo-admin-role.json @@ -1,7 +1,7 @@ { "name": "GitHub: Tier Zero All-Repo Admin Role", "description": "The synthetic all_repo_admin role grants admin access to every repository in the organization. This role is inherited by the owners role via GH_HasBaseRole and cascades admin permissions including branch protection editing, secret access, and deploy key management to all repositories.", - "cypher": "MATCH (n:GH_OrgRole)\nWHERE n.name CONTAINS 'ALL_REPO_ADMIN'\nRETURN n", + "cypher": "MATCH (n:GH_OrgRole)\nWHERE n.name CONTAINS 'all_repo_admin'\nRETURN n", "enabled": true, "zone": "Tier Zero", "allow_disable": true diff --git a/extension/privilege_zone_rules/t0-pats-all-repos.json b/extension/privilege_zone_rules/t0-pats-all-repos.json index 4eadaed..25ab118 100644 --- a/extension/privilege_zone_rules/t0-pats-all-repos.json +++ b/extension/privilege_zone_rules/t0-pats-all-repos.json @@ -1,7 +1,7 @@ { "name": "GitHub: Tier Zero PATs (All Repositories)", "description": "Fine-grained personal access tokens scoped to all repositories in the organization that have repository-control write permissions. A single compromised token may grant code, workflow, Actions, or administrative control across every repository. PATs with only read or lower-impact write permissions are excluded.", - "cypher": "MATCH (n:GH_PersonalAccessToken)-[:GH_CanAccess]->(:GH_Scope {scope_type:'repository', scope:'all'})\nWHERE ANY(permission IN n.repository_permissions WHERE permission IN ['contents:write', 'administration:write', 'workflows:write', 'actions:write'])\nRETURN n", + "cypher": "MATCH (n:GH_PersonalAccessToken {token_expired:false})-[:GH_CanAccess]->(:GH_Scope {scope_type:'repository', scope:'all'})\nWHERE ANY(permission IN n.repository_permissions WHERE permission IN ['contents:write', 'administration:write', 'workflows:write', 'actions:write'])\nRETURN n", "enabled": true, "zone": "Tier Zero", "allow_disable": true