🌱 add cases for alerts in dangerous workflow pattern detection

Signed-off-by: Adam Korczynski <[email protected]>

Author: AdamKorcz

checks/raw/dangerous_workflow.go

@@ -45,6 +45,15 @@ func containsUntrustedContextPattern(variable string) bool {
 			`head_commit\.author\.name|` +
 			`commits.*\.author\.email|` +
 			`commits.*\.author\.name|` +
+			`alert\.resolved_by\.name|` +
+			`alert\.resolved_by\.email|` +
+			`alert\.resolution_comment|` +
+			`push_protection_bypassed_by\.name|` +
+			`push_protection_bypassed_by\.email|` +
+			`push_protection_bypass_request_reviewer\.name|` +
+			`push_protection_bypass_request_reviewer\.email|` +
+			`push_protection_bypass_request_reviewer_comment|` +
+			`push_protection_bypass_request_comment|` +
 			`pull_request\.head\.ref|` +
 			`pull_request\.head\.label|` +
 			`pull_request\.head\.repo\.default_branch).*`)

checks/raw/dangerous_workflow_test.go

@@ -76,6 +76,46 @@ func TestUntrustedContextVariables(t *testing.T) {
 			variable: "github.event.commits[0].id",
 			expected: false,
 		},
+		{
+			name:     "alert resolved by name",
+			variable: "github.event.secret_scanning_alert.alert.resolved_by.name",
+			expected: true,
+		},
+		{
+			name:     "alert resolved by email",
+			variable: "github.event.secret_scanning_alert.alert.resolved_by.name",
+			expected: true,
+		},
+		{
+			name:     "alert push_protection_bypassed_by name",
+			variable: "github.event.secret_scanning_alert.alert.push_protection_bypassed_by.name",
+			expected: true,
+		},
+		{
+			name:     "alert push_protection_bypassed_by email",
+			variable: "github.event.secret_scanning_alert.alert.push_protection_bypassed_by.email",
+			expected: true,
+		},
+		{
+			name:     "alert push_protection_bypass_request_reviewer name",
+			variable: "github.event.secret_scanning_alert.alert.push_protection_bypass_request_reviewer.name",
+			expected: true,
+		},
+		{
+			name:     "alert push_protection_bypass_request_reviewer email",
+			variable: "github.event.secret_scanning_alert.alert.push_protection_bypass_request_reviewer.email",
+			expected: true,
+		},
+		{
+			name:     "alert push_protection_bypass_request_reviewer_comment",
+			variable: "github.event.secret_scanning_alert.alert.push_protection_bypass_request_reviewer_comment",
+			expected: true,
+		},
+		{
+			name:     "alert push_protection_bypass_request_comment",
+			variable: "github.event.secret_scanning_alert.alert.push_protection_bypass_request_comment",
+			expected: true,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {