RuleType

Rule types define an evaluation (and remediation) process for an individual policy check. Rule types are evaluated as part of a profile, via multiple phases of evaluation:

1. Ingest data about the entity.
2. Evaluate state using the specified rule definition.
3. Store output from the rule evaluation.
4. Remediate failed evaluations, if enabled.
5. Alert the user about failed evaluations, if enabled.

Rule types can be defined using YAML syntax. Additionally, rules which use the Rego evaluator can be written using Rego syntax with the additional rule type fields recorded as Rego package metadata.

YAML Example

version: v1
type: rule_type
name: github_branch_protection
display_name: GitHub branch protection
description: Ensure protected branches are enabled.
guidance: Enable branch protection on default branch.
severity:
  value: high
def:
  in_entity: repository
  provider_traits: ["rest", "github"]
  rule_schema: {}
  ingest:
    type: rest
    rest:
      endpoint: '/repos/{{.Entity.Owner}}/{{.Entity.Name}}/branches/{{.Entity.DefaultBranch}}/protection'
      parse: json
  eval:
    type: rego
    rego:
      type: deny-by-default
      def: |
        package minder
        
        input.ingested.required_pull_request_reviews.required_approving_review_count >= 1
        input.ingested.enforce_admins.enabled == true
        input.ingested.allow_force_pushes == false
        input.ingested.allow_deletions == false

Rego Example

The Minder CLI will parse rego files and extract RuleType metadata from them. It will automatically fill certain fields (such as type and version), and will promote the following fields:

Rego field	RuleType field
name	populate from filename if not present
display_name	populate from title if not present
def.rule_schema	defaults to empty-object

# METADATA
#
# name: github_branch_protection
# title: GitHub branch protection
# description: Ensure protected branches are enabled.
# custom:
#  guidance: Enable branch protection on default branch.
#  severity:
#    value: high
#   def:
#     in_entity: repository
#     ingest:
#       type: rest
#       rest:
#         endpoint: '/repos/{{.Entity.Owner}}/{{.Entity.Name}}/branches/{{.Entity.DefaultBranch}}/protection'
#         parse: json
#     eval:
#       rego:
#         type: deny-by-default
package minder

import rego.v1

input.ingested.required_pull_request_reviews.required_approving_review_count >= 1
input.ingested.enforce_admins.enabled == true
input.ingested.allow_force_pushes == false
input.ingested.allow_deletions == false

Provider traits

provider_traits is an optional list on def that declares which provider capabilities a rule type depends on. Minder only evaluates the rule against providers that implement every listed trait:

def:
  provider_traits: ["rest", "github"]

The valid trait names are git, github, gitlab, image-lister, oci, repo-lister, and rest. Traits are ANDed together: a rule type requiring ["git", "github"] needs a provider that implements both, not just one. The canonical idiom is ["rest", "github"] for a rule that calls the GitHub API, and ["rest", "gitlab"] for the GitLab equivalent. Omitting the field, or leaving it empty, means the rule type is not gated and evaluates against any provider.

note

If a provider doesn't implement a rule type's declared traits, the rule produces no evaluation result for that provider at all — it isn't listed, skipped, or errored, it simply doesn't appear in minder profile status list. A rule that can't apply to a provider isn't a finding.

An unrecognized trait name is different: it's rejected at ruletype create with the valid values listed in the error message, and if one is already stored, evaluation records an error status naming the offending trait.

Fields

note

Note that the Minder CLI uses snake_case for field names, but the OpenAPI spec (shown here) uses camelCase for names like display_name, in_entity, etc.

version	string version is the version of the rule type API.
type	string type is the type of the rule.
id	string id is the id of the rule type. This is mostly optional and is set by the server.
name required	string name is the name of the rule type.
displayName	string display_name is the display name of the rule type.
shortFailureMessage	string short_failure_message is the message to display when the evaluation fails.
	object (v1Context) Context defines the context in which a rule is evaluated. this normally refers to a combination of the provider, organization and project. Removing the 'optional' keyword from the following two fields below will break buf compatibility checks.
required	object (RuleTypeDefinition) Definition defines the rule type. It encompases the schema and the data evaluation.
description required	string description is the description of the rule type. This is expected to be a valid markdown formatted string.
guidance required	string guidance are instructions we give the user in case a rule fails. This is expected to be a valid markdown formatted string.
	object (v1Severity) Severity defines the severity of the rule.
releasePhase	string (v1RuleTypeReleasePhase) Default: "RULE_TYPE_RELEASE_PHASE_UNSPECIFIED" Enum: "RULE_TYPE_RELEASE_PHASE_UNSPECIFIED" "RULE_TYPE_RELEASE_PHASE_ALPHA" "RULE_TYPE_RELEASE_PHASE_BETA" "RULE_TYPE_RELEASE_PHASE_GA" "RULE_TYPE_RELEASE_PHASE_DEPRECATED" RuleTypeReleasePhase defines the release phase of the rule type.

;