rage.fail

gcp-sr-mirror-config

explicit gcp emits ContainsResourceReference

match (record)

{ "field": "mirrorConfig.url", "resource_type": "google.sourcerepo.Repository" }

where

mirrorConfig.url is set (repo is a read-only mirror of an external source)

emit

source type	`ArtifactRepository`
target type	`*`
source	`<CSR mirror repository node>`
target	`<upstream external repository URL (ArtifactRepository or GenericStorage node)>`

Narrative

CSR repository {repo.name} is a read-only mirror of {upstream.name}; push access to this CSR repo does not modify the upstream source.

Raw rule rules/explicit/gcp-sourcerepos.yaml

id: gcp-sr-mirror-config
emits: ContainsResourceReference
applies_to:
- gcp
match_record:
  resource_type: google.sourcerepo.Repository
  field: mirrorConfig.url
where:
- mirrorConfig.url is set (repo is a read-only mirror of an external source)
emit:
  source_type: ArtifactRepository
  target_type: '*'
  source: <CSR mirror repository node>
  target: <upstream external repository URL (ArtifactRepository or GenericStorage node)>
  api_source: sourcerepo.projects.repos.get
  evidence_field: mirrorConfig.url
  note: 'A mirrored CSR repo receives content FROM the upstream (GitHub/Bitbucket). Pushes to this CSR
    repo are BLOCKED by GCP (read-only mirror). Derived rules (gcp-sr-push-is-code-modify) should emit
    BLOCKED for mirrored repos; the attack surface is at the upstream, not here. This structural edge
    records the mirror->upstream reference and the is_mirror: true property.'
  narrative: CSR repository {repo.name} is a read-only mirror of {upstream.name}; push access to this
    CSR repo does not modify the upstream source.