gcp-sr-repo-config-update

id: gcp-sr-repo-config-update
emits: CanModifyConfiguration
description: source.repos.updateRepoConfig can relax branch-protection rules or change push configurations,
  potentially upgrading a CONDITIONAL CanModifyCode (gated by branch protection) to ACTIVE.
match_effective_permission:
  action: source.repos.updateRepoConfig
  resource_type: google.sourcerepo.Repository
emit:
  source_type: Identity
  target_type: ArtifactRepository
  source: <principal>
  target: <CSR repository in scope>
  permissions:
  - source.repos.updateRepoConfig
  conditions: []
  state_logic: 'ACTIVE when the permission is effective. The downstream consequence depends on the current
    configuration: if the repo enforces branch-protection rules that gate direct pushes to the branch
    a Cloud Build trigger watches, removing those rules upgrades the CanModifyCode edge from CONDITIONAL(branch_protection)
    to ACTIVE. BLOCKED if IAM deny or VPC-SC prevents the call. Inherit weakest from contributing role
    binding.'
  confidence: 0.8
  derived_from:
  - 'effective permission: source.repos.updateRepoConfig on <repo>'
  false_positive_note: CanModifyConfiguration on a repo does NOT itself push code; it is a precondition
    that may unlock a subsequent push. CSR's native branch- protection configuration is limited; verify
    whether the protection being removed actually gates the build trigger's target branch before treating
    the config change as a direct path to code execution. The escalation consequence is still cicd-chains';
    this edge only records the config mutation capability.
  narrative: "{principal.name} can update the configuration of repository {repo.name} (source.repos.updateRepoConfig),\
    \ for example relaxing branch-protection rules to allow direct pushes to the branch a Cloud Build\
    \ trigger watches \u2014 upgrading a CONDITIONAL CanModifyCode to ACTIVE."