<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-repository-security-controls
description: >-
  Implement repository security controls including branch protection, commit
  signing, CODEOWNERS enforcement, secret scanning, dependency review, and
  merge policies to prevent unauthorized code changes and supply chain attacks.
domain: cybersecurity
subdomain: supply-chain-security
tags:
  - repository-security
  - branch-protection
  - commit-signing
  - codeowners
  - secret-scanning
  - merge-policy
  - github-security
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
---

# Implementing Repository Security Controls

## Overview

Repository security controls are the first line of defense against supply chain
attacks — preventing unauthorized code from entering the build pipeline. This
skill covers branch protection rules, required commit signing, CODEOWNERS
enforcement, secret scanning, dependency review workflows, and merge approval
policies across GitHub, GitLab, and Bitbucket.

Mode: `[MODE: ARCHITECT]` — Design repository security policies; `[MODE: BLUE]` — Audit existing controls.

## Prerequisites

| Requirement | Details |
|---|---|
| GitHub CLI (`gh`) with admin access | Required |
| GPG or SSH key for commit signing | Required |
| Repository admin permissions | Required |
| Python 3.10+ | Required |

## Key Concepts

### Branch Protection Rules

```bash
# GitHub — configure branch protection via API
gh api repos/{owner}/{repo}/branches/main/protection -X PUT \
  -f required_status_checks='{"strict":true,"contexts":["ci/build","ci/test","security/scan"]}' \
  -f enforce_admins=true \
  -f required_pull_request_reviews='{"required_approving_review_count":2,"dismiss_stale_reviews":true,"require_code_owner_reviews":true}' \
  -f required_linear_history=true \
  -f allow_force_pushes=false \
  -f allow_deletions=false

# GitHub — require signed commits
gh api repos/{owner}/{repo}/branches/main/protection/required_signatures -X POST
```

### Commit Signing Setup

```bash
# GPG commit signing
gpg --full-generate-key
git config --global user.signingkey <KEY_ID>
git config --global commit.gpgsign true

# SSH commit signing (GitHub)
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true

# Verify signed commits
git log --show-signature -1
```

### CODEOWNERS Configuration

```
# .github/CODEOWNERS
# Security-sensitive files require security team review
/security/                @org/security-team
*.pem                     @org/security-team
*.key                     @org/security-team
.github/workflows/        @org/platform-team @org/security-team
Dockerfile                @org/platform-team
*.tf                      @org/infrastructure-team

# Default owners
*                         @org/engineering-leads
```

### Secret Scanning

```bash
# GitHub — enable secret scanning
gh api repos/{owner}/{repo} -X PATCH -f security_and_analysis='{"secret_scanning":{"status":"enabled"},"secret_scanning_push_protection":{"status":"enabled"}}'

# GitLeaks — local pre-commit scanning
gitleaks detect --source . --verbose
gitleaks protect --staged  # Pre-commit hook

# TruffleHog — deep scan
trufflehog git file://. --only-verified
```

## Workflow

### Step 1: Audit Repository Controls

```bash
node scripts/agent.js --action audit --repo owner/repo --output /tmp/repo-audit.json
```

### Step 2: Apply Recommended Controls

```bash
node scripts/agent.js --action apply --repo owner/repo --policy strict --output /tmp/applied.json
```

### Step 3: Check Compliance

```bash
node scripts/agent.js --action compliance --org my-org --output /tmp/compliance.json
```

## Detection

```yaml
title: Repository Security Controls Detection
id: 114ef758-9747-4dbf-b013-06e094ba8054
status: experimental
description: Detects suspicious activity related to implementing repository security controls techniques in supply chain security context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*implementing*repository*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.initial_access
falsepositives:
  - Package manager performing routine dependency resolution
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Repository Security Controls Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- [ ] Branch protection enabled on all default branches
- [ ] Minimum 2 approving reviews required for merges
- [ ] CODEOWNERS file configured and enforced
- [ ] Commit signing required on protected branches
- [ ] Secret scanning and push protection enabled
- [ ] Force pushes disabled on protected branches
- [ ] Dependency review workflow blocks vulnerable dependencies

## References

- [GitHub Branch Protection](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-a-branch-protection-rule)
- [GitHub Secret Scanning](https://docs.github.com/en/code-security/secret-scanning)
- [GitLeaks](https://github.com/gitleaks/gitleaks)
- [CODEOWNERS Syntax](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners)
