Adds Required Status Checks to source provenance as 'controls'

sourcetool/pkg/attest/provenance.go

@@ -40,8 +40,8 @@ type SourceProvenancePred struct {
 
 // Summary of a summary
 type VsaSummary struct {
-	SourceRefs     []string `json:"source_refs"`
-	VerifiedLevels []string `json:"verifiedLevels"`
+	SourceRefs     []string                 `json:"source_refs"`
+	VerifiedLevels []slsa_types.ControlName `json:"verifiedLevels"`
 }
 
 type TagProvenancePred struct {
@@ -311,7 +311,7 @@ func (pa ProvenanceAttestor) CreateTagProvenance(ctx context.Context, commit, re
 		VsaSummaries: []VsaSummary{
 			{
 				SourceRefs:     vsaRefs,
-				VerifiedLevels: vsaPred.VerifiedLevels,
+				VerifiedLevels: slsa_types.StringsToControlNames(vsaPred.VerifiedLevels),
 			},
 		},
 	}

sourcetool/pkg/attest/provenance_test.go

@@ -167,7 +167,7 @@ func TestCreateTagProvenance(t *testing.T) {
 		VsaSummaries: []VsaSummary{
 			{
 				SourceRefs:     []string{"refs/some/ref"},
-				VerifiedLevels: []string{"TEST_LEVEL"},
+				VerifiedLevels: []slsa_types.ControlName{"TEST_LEVEL"},
 			},
 		},
 	}

sourcetool/pkg/attest/vsa.go

@@ -27,7 +27,7 @@ func CreateUnsignedSourceVsa(repoUri, ref, commit string, verifiedLevels slsa_ty
 		ResourceUri:        resourceUri,
 		Policy:             &vpb.VerificationSummary_Policy{Uri: policy},
 		VerificationResult: "PASSED",
-		VerifiedLevels:     verifiedLevels,
+		VerifiedLevels:     slsa_types.ControlNamesToStrings(verifiedLevels),
 	}
 
 	predJson, err := protojson.Marshal(vsaPred)

sourcetool/pkg/gh_control/checklevel.go

@@ -53,6 +53,13 @@ func (ghc *GitHubConnection) commitActivity(ctx context.Context, commit, targetR
 	return nil, fmt.Errorf("could not find repo activity for commit %s and ref %s", commit, targetRef)
 }
 
+type RequiredCheck struct {
+	// The name of the required status check as reported in the GitHub UI/API.
+	Name string
+	// How long that check has been required.
+	Since time.Time
+}
+
 type GhControlStatus struct {
 	// The time the commit we're evaluating was pushed.
 	CommitPushTime time.Time
@@ -178,6 +185,39 @@ func (ghc *GitHubConnection) computeReviewControl(ctx context.Context, rules []*
 	return nil, nil
 }
 
+func checkNameToControlName(checkName string) slsa_types.ControlName {
+	return slsa_types.ControlName(fmt.Sprintf("ORG_CONTROL_%s", checkName))
+}
+
+func (ghc *GitHubConnection) computeRequiredChecks(ctx context.Context, ghCheckRules []*github.RequiredStatusChecksBranchRule) ([]*slsa_types.Control, error) {
+	// Only return the checks we're happy about.
+	// For now that's only stuff from the GitHub Actions app.
+	requiredChecks := []*slsa_types.Control{}
+	for _, ghCheckRule := range ghCheckRules {
+		ruleset, _, err := ghc.Client().Repositories.GetRuleset(ctx, ghc.Owner(), ghc.Repo(), ghCheckRule.RulesetID, false)
+		if err != nil {
+			return nil, err
+		}
+		if ruleset.Enforcement != "active" {
+			// Only look at rules being enforced.
+			continue
+		}
+
+		for _, check := range ghCheckRule.Parameters.RequiredStatusChecks {
+			if check.IntegrationID == nil || *check.IntegrationID != GitHubActionsIntegrationId {
+				// Ignore untrusted integration id.
+				continue
+			}
+			requiredChecks = append(requiredChecks, &slsa_types.Control{
+				Name: checkNameToControlName(check.Context),
+				// TODO: get the time that indicates how long it's been enforced
+				Since: ruleset.UpdatedAt.Time,
+			})
+		}
+	}
+	return requiredChecks, nil
+}
+
 func (ghc *GitHubConnection) getOldestActiveRule(ctx context.Context, rules []*github.BranchRuleMetadata) (*github.RepositoryRuleset, error) {
 	var oldestActive *github.RepositoryRuleset
 	for _, rule := range rules {
@@ -231,6 +271,13 @@ func (ghc *GitHubConnection) GetBranchControls(ctx context.Context, commit, ref
 	}
 	controlStatus.Controls.AddControl(reviewControl)
 
+	requiredCheckControls, err := ghc.computeRequiredChecks(ctx, branchRules.RequiredStatusChecks)
+	if err != nil {
+		return nil, fmt.Errorf("could not populate RequiredChecks: %w", err)
+	}
+	controlStatus.Controls.AddControl(requiredCheckControls...)
+
+	// Check the tag rules.
 	allRulesets, _, err := ghc.Client().Repositories.GetAllRulesets(ctx, ghc.Owner(), ghc.Repo(), true)
 	if err != nil {
 		return nil, err