ubercylon8 · ubercylon8 · Apr 25, 2026 · Apr 25, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,49 @@
+version: 2
+updates:
+  # GitHub Actions used by .github/workflows/*.yml
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "Etc/UTC"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "ci(deps)"
+
+  # Go modules — watch the canonical reference template.
+  # The 51 test directories under tests_source/ each have their own go.mod
+  # that pins the same Prelude library; updating the template guides
+  # the rest. Add per-test entries here if you want individual PRs.
+  - package-ecosystem: "gomod"
+    directory: "/sample_tests/multistage_template"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "Etc/UTC"
+    open-pull-requests-limit: 3
+    labels:
+      - "dependencies"
+      - "go"
+    commit-message:
+      prefix: "deps(go)"
+
+  # Python tooling
+  - package-ecosystem: "pip"
+    directory: "/utils"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "Etc/UTC"
+    open-pull-requests-limit: 3
+    labels:
+      - "dependencies"
+      - "python"
+    commit-message:
+      prefix: "deps(py)"
diff --git a/.github/workflows/bandit.yml b/.github/workflows/bandit.yml
@@ -0,0 +1,66 @@
+name: Bandit (Python SAST)
+
+on:
+  push:
+    branches: [ main ]
+    paths:
+      - 'utils/**.py'
+      - 'utils/requirements.txt'
+      - 'limacharlie-iac/scripts/**.py'
+      - '.github/workflows/bandit.yml'
+  pull_request:
+    branches: [ main ]
+    paths:
+      - 'utils/**.py'
+      - 'utils/requirements.txt'
+      - 'limacharlie-iac/scripts/**.py'
+      - '.github/workflows/bandit.yml'
+  schedule:
+    - cron: '0 6 * * 1'
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  bandit:
+    name: Scan Python utilities
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: '3.11'
+          cache: 'pip'
+
+      - name: Install Bandit
+        run: |
+          python -m pip install --upgrade pip
+          pip install 'bandit[sarif,toml]'
+
+      # Scope is utils/ and limacharlie-iac/scripts/ only. These are admin
+      # tooling, not test payloads. Go test code under tests_source/ is
+      # intentionally adversarial and is covered by CodeQL with its own
+      # tuning.
+      # -ll reports medium+ severity. --exit-zero ensures step never fails;
+      # findings surface in the Security tab via SARIF.
+      - name: Run Bandit (SARIF output for Security tab)
+        run: |
+          bandit -r utils/ limacharlie-iac/scripts/ \
+            -ll \
+            --exit-zero \
+            --format sarif \
+            --output bandit.sarif || true
+
+      - name: Upload SARIF to GitHub Security tab
+        if: always() && hashFiles('bandit.sarif') != ''
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: bandit.sarif
+          category: bandit
+        continue-on-error: true
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -0,0 +1,53 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  schedule:
+    # Weekly Monday 06:00 UTC, offset from Security workflow (00:00) to spread load.
+    - cron: '0 6 * * 1'
+
+permissions:
+  contents: read
+  security-events: write
+  actions: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'go', 'python' ]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-extended
+
+      # Autobuild is best-effort: tests_source/* expect Prelude libraries
+      # that are not provisioned in CI. CodeQL analyzes whatever it can
+      # resolve and skips the rest.
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+        continue-on-error: true
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"
+        # Report-only while we tune the noise floor. Findings appear in
+        # the Security tab. Once we know the baseline, remove
+        # continue-on-error to start blocking PRs on new high/critical
+        # issues.
+        continue-on-error: true
diff --git a/tests_source/cyber-hygiene/db0738eb-848e-442b-b43c-208029063fe9/README.md b/tests_source/cyber-hygiene/db0738eb-848e-442b-b43c-208029063fe9/README.md
@@ -0,0 +1,66 @@
+# ISACA ITGC Windows Endpoint Validation Bundle
+
+**Test UUID**: `db0738eb-848e-442b-b43c-208029063fe9`
+**Test Score**: **8.5/10** (rubric v2.1 — pending lab verification)
+**Subcategory**: `isaca-itgc-windows`
+**Target**: Windows 10/11, Windows Server 2019/2022
+
+## Overview
+
+Validates 31 IT General Controls (ITGCs) defined in the ISACA ITGC Validation Bundle for CISA-credentialed auditors. Each control produces auditor-ready JSON evidence (ITGC ID + CISA domain + COBIT 2019 objective + CIS v8 mapping + MITRE ATT&CK + actual values + manual residual procedures) plus an aggregated workpaper file.
+
+The bundle implements 7 multi-binary validators (one per ITGC control family) for quarantine resilience — if AV/EDR quarantines one validator, the rest still execute.
+
+## Status
+
+**Phase 2 milestone (2026-04-25)**: scaffolding + 7 representative checks (one per family) shipped. Architecture, evidence sidecar emitter, and auditor workpaper output verified.
+
+| Family | Controls in scope | Implemented (Phase 2) | Remaining |
+|---|---|---|---|
+| Access Management (AM) | AM-001, AM-002, AM-005 | AM-005 | 2 |
+| Change Management (CM) | CM-001..005 | CM-005 | 4 |
+| Logging & Monitoring (LM) | LM-001..005 | LM-005 | 4 |
+| Endpoint Protection (EP) | EP-001..006 | EP-004, EP-006 (1 ASR rule) | 4 |
+| Backup & Recovery (BR) | BR-001..003 | BR-003 | 2 |
+| Network Security (NS) | NS-001, NS-002, NS-004 | NS-004 | 2 |
+| Governance & Policy (GV) | GV-001..006 | GV-002 | 5 |
+| **TOTAL** | **31** | **8** | **23** |
+
+Companion bundles (planned):
+- ISACA ITGC AD Identity Bundle (UUID TBD) — covers AM-001 (local admin inv), AM-003 (dormant accts), AM-004 (service accts), NS-003 (LAPS) on a DC / mgmt server
+- AM-006 MFA Enrollment lifted into existing Entra ID Tenant bundle (`4f484076-...`)
+
+## Output
+
+Bundle writes three things to `c:\F0\`:
+
+1. **`bundle_results.json`** — standard F0RT1KA per-control fan-out for PA ingestion
+2. **`itgc_evidence_<control_id>.json`** — one per control, ISACA workpaper schema
+3. **`itgc_audit_workpaper.json`** — aggregated auditor evidence pack with all 31 controls
+
+## Framework Coverage
+
+- **CISA 2024 ECO domains**: D2 (Governance), D4 (Operations & Resilience), D5 (Protection of Information Assets)
+- **COBIT 2019 objectives**: APO13.01, BAI06.01, BAI09.01, DSS01.05, DSS04.01, DSS05.01-07
+- **CIS Controls v8**: 1.1, 4.1, 4.3, 4.8, 5.2-5.4, 7.4, 8.2-8.11, 10.1-10.7, 11.2
+- **MITRE ATT&CK**: T1078, T1110, T1078.001, T1562.001, T1562.004, T1059.001, T1021.001, T1490, T1486, T1003.001, T1070.001, T1070.006, T1053.005, T1210, T1021.006
+
+## Build & Deploy
+
+```bash
+./build_all.sh                       # Build + sign all 7 validators + orchestrator
+./build_all.sh --es <profile>        # With Elasticsearch direct export
+```
+
+Output: `build/db0738eb-.../db0738eb-....exe` (single-binary deployment, signed F0RT1KA).
+
+## Prerequisites
+
+- Windows 10/11, Windows Server 2019/2022
+- Local Administrator or SYSTEM context (registry, audit policy, BitLocker, ASR rules)
+- PowerShell 5.1+ (for Get-WinEvent, Get-ScheduledTask, w32tm queries)
+
+## See also
+
+- `db0738eb-848e-442b-b43c-208029063fe9_info.md` — control-level info card
+- ISACA spec: `~/Downloads/ITGC_Validation_Bundle_ISACA_Auditors.xlsx`