fix: better comments

Author: jonathandavies-CS

policies/critical_vulnerabilities_count/critical_vulnerabilities_count.rego

@@ -10,7 +10,7 @@ violation[{}] if {
 		alert.security_vulnerability.severity == "critical"
 	]
 
-	# If there are 3 or more such alerts, then deny.
+	# If there are 2 or more such alerts, then deny.
 	count(open_alerts) >= 2
 }
 

policies/low_vulnerabilities_dismissal/low_vulnerabilities_dismissal.rego

@@ -6,7 +6,7 @@ violation[{}] if {
 	working_day_now_ns := time_ext.reduce_day_ns(time.now_ns())
 	three_months_ago := working_day_now_ns - (84 * time_ext.one_day_ns)
 
-	# Build a set of low alerts that have been open for more than 5 working days.
+	# Check there exists a low alert that has been open for more than 5 working days.
 	some alert in input.alerts
 	alert.state == "open"
 	alert.security_vulnerability.severity == "low"

policies/medium_vulnerabilities_count/medium_vulnerabilities_count.rego

@@ -4,9 +4,13 @@ import future.keywords.in
 
 violation[{}] if {
 	# Build a set of alerts that are open and with a medium severity.
-	some alert in input.alerts
-	alert.state == "open"
-	alert.security_vulnerability.severity == "medium"
+	open_alerts := [alert |
+		some alert in input.alerts
+		alert.state == "open"
+		alert.security_vulnerability.severity == "medium"
+	]
+
+	count(open_alerts) >= 5
 }
 
 title := "Limit amount of medium vulnerabilities"

policies/vulnerabilities_dismissed_by_security_team/vulnerabilities_dismissed_by_security_team.rego

@@ -3,12 +3,13 @@ package vulnerabilities_dismissed_by_security_team
 violation[{}] if {
 	input.security_team_members != null
 
-	# Build a set of alerts that have been dismissed by someone not in the security team
 	some alert in input.alerts
 	in_security_team := [team_member |
 		some team_member in input.security_team_members
 		alert.dismissed_by.login == team_member.login
 	]
+
+	# Ensure there is no team member that has dismissed an alert who is not part of the security team
 	count(in_security_team) == 0
 }
 

policies/vulnerability_dismissal_count/vulnerability_dimissal_count.rego

@@ -1,13 +1,12 @@
 package vulnerability_dismissal_count
 
 violation[{}] if {
-	# Build a set of alerts that have been dismissed_alerts
+	# Build a set of alerts that have been dismissed
 	dismissed_alerts := [alert |
 		some alert in input.alerts
 		alert.dismissed_at != null
 	]
 
-	# If there are 10 or more dismissed alerts, deny
 	count(dismissed_alerts) >= 10
 }
 

policies/vulnerability_patch_available/vulnerability_patch_available.rego

@@ -1,7 +1,7 @@
 package vulnerability_patch_available
 
 violation[{}] if {
-	# Build a set of alerts that have been dismissed, but a patch is available
+	# Check if there are any dismissed alerts that have patches available
 	some alert in input.alerts
 	alert.dismissed_at != null
 	alert.security_vulnerability.first_patched_version != null