claws-scan 0.9.5 → 0.10.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 99e68a15fab38b583b1b9c34717ef25f2a1612f0da8b0bf50d5b0d4530829ce5
-  data.tar.gz: ca653965f7c90d93e2122d70ceb1a54e0c1a326d13d8cbbfbfaa8cadc8e01273
+  metadata.gz: 6b391e0e7bd1ca6d4aa75feb0cec5153e04f6e67add1091e6b5598457e8c302f
+  data.tar.gz: b8cbceff5a7faa2aaafddc877f7471314fc185c9ba5909a5716ce4a51e2ce2ee
 SHA512:
-  metadata.gz: c1fbbe050665049b3a913681debe61e374d825197e3be5883e7bcbf3e0ea7818937700e576feba9fdd5fd0edb16798a9b2ce1c6a157781036324ff8b6ab4aa59
-  data.tar.gz: f715f4ea43b80cdc3d25a41554d30b0fcf88a3055e500f325c93f31a3d35020083cf45bcbff14cf10f9373952a8fb918da674fec2bb9aebf1b6c341a522a7eec
+  metadata.gz: b5fbbba1250282c7e92395a8f2120e31b4f4376ff0949b9cabe200c0d774ef10c517684f144d0947cdabd7aeca2b64d03912c9089c776dfc85c63324ab51fd78
+  data.tar.gz: 2d11e730351d6f719068461646b7e70eb9dae159130b6a9f617e052b85f49cd254e6d0c2b6e57023ef37a1c738177ab9c4f82533ba8b1cd46f6406e176707a5b

data/.rubocop.yml

@@ -1,5 +1,7 @@
 AllCops:
-  TargetRubyVersion: 3.2.3
+  TargetRubyVersion: 3.4.10
+  NewCops: disable
+  SuggestExtensions: false
 
 Style/StringLiterals:
   Enabled: true

data/Gemfile

@@ -3,15 +3,18 @@
 source "https://rubygems.org"
 
 gemspec
+ruby "3.4.10"
 
 gem "rake", "~> 13.0"
 gem "rspec", "~> 3.0"
 gem "rubocop", "~> 1.21"
 
+gem "base64"
 gem "equation"
 gem "fakefs"
 gem "faraday-retry"
 gem "octokit"
 gem "pry"
+gem "racc"
 gem "slop", "~> 4.9"
 gem "treetop"

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    claws-scan (0.9.5)
+    claws-scan (0.10.1)
       equation (~> 0.6)
       pry
       slop (~> 4.9)
@@ -12,7 +12,8 @@ GEM
   specs:
     addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
-    ast (2.4.2)
+    ast (2.4.3)
+    base64 (0.3.0)
     coderay (1.1.3)
     diff-lcs (1.5.0)
     equation (0.6.2)
@@ -25,7 +26,9 @@ GEM
       net-http (~> 0.5)
     faraday-retry (2.0.0)
       faraday (~> 2.0)
-    json (2.21.2)
+    json (3.0.2)
+    language_server-protocol (3.17.0.6)
+    lint_roller (1.1.0)
     logger (1.7.0)
     method_source (1.0.0)
     net-http (0.9.1)
@@ -33,18 +36,20 @@ GEM
     octokit (6.0.1)
       faraday (>= 1, < 3)
       sawyer (~> 0.9)
-    parallel (1.22.1)
-    parser (3.1.2.1)
+    parallel (2.2.0)
+    parser (3.3.12.0)
       ast (~> 2.4.1)
+      racc
     polyglot (0.3.5)
+    prism (1.9.0)
     pry (0.14.2)
       coderay (~> 1.1)
       method_source (~> 1.0)
     public_suffix (7.0.5)
+    racc (1.8.1)
     rainbow (3.1.1)
     rake (13.0.6)
-    regexp_parser (2.6.0)
-    rexml (3.4.2)
+    regexp_parser (2.12.0)
     rspec (3.11.0)
       rspec-core (~> 3.11.0)
       rspec-expectations (~> 3.11.0)
@@ -58,26 +63,30 @@ GEM
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.11.0)
     rspec-support (3.11.1)
-    rubocop (1.38.0)
-      json (~> 2.3)
-      parallel (~> 1.10)
-      parser (>= 3.1.2.1)
+    rubocop (1.91.0)
+      json (>= 2.3)
+      language_server-protocol (~> 3.17.0.2)
+      lint_roller (~> 1.1.0)
+      parallel (>= 1.10)
+      parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
-      regexp_parser (>= 1.8, < 3.0)
-      rexml (>= 3.2.5, < 4.0)
-      rubocop-ast (>= 1.23.0, < 2.0)
+      regexp_parser (>= 2.9.3, < 3.0)
+      rubocop-ast (>= 1.49.0, < 2.0)
       ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 1.4.0, < 3.0)
-    rubocop-ast (1.23.0)
-      parser (>= 3.1.1.0)
-    ruby-progressbar (1.11.0)
+      unicode-display_width (>= 2.4.0, < 4.0)
+    rubocop-ast (1.50.0)
+      parser (>= 3.3.7.2)
+      prism (~> 1.7)
+    ruby-progressbar (1.13.0)
     sawyer (0.9.2)
       addressable (>= 2.3.5)
       faraday (>= 0.17.3, < 3)
     slop (4.9.3)
     treetop (1.6.12)
       polyglot (~> 0.3)
-    unicode-display_width (2.3.0)
+    unicode-display_width (3.2.0)
+      unicode-emoji (~> 4.1)
+    unicode-emoji (4.2.0)
     uri (1.1.1)
 
 PLATFORMS
@@ -89,17 +98,22 @@ PLATFORMS
   x86_64-linux
 
 DEPENDENCIES
+  base64
   claws-scan!
   equation
   fakefs
   faraday-retry
   octokit
   pry
+  racc
   rake (~> 13.0)
   rspec (~> 3.0)
   rubocop (~> 1.21)
   slop (~> 4.9)
   treetop
 
+RUBY VERSION
+   ruby 3.4.10p104
+
 BUNDLED WITH
    2.4.2

data/README.md

@@ -40,9 +40,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set Up Ruby
-        uses: ruby/setup-ruby@d8d83c3960843afb664e821fed6be52f37da5267 # v1.231.0
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
-          ruby-version: '3.0'
+          ruby-version: '3.4'
       # Grab your configuration file however makes sense for you
       # We keep ours in a separate Github repo.
       - name: Set Up Claws Config

data/lib/claws/application.rb

@@ -27,7 +27,7 @@ module Claws
     def get_violations(filename, workflow)
       violations = get_workflow_violations(filename, workflow)
 
-      workflow.jobs.each do |_job_name, job|
+      workflow.jobs.each_value do |job|
         violations += get_job_violations(filename, workflow, job)
 
         job.fetch("steps", []).each do |step|

data/lib/claws/base_rule.rb

@@ -15,7 +15,7 @@ class BaseRule
               difference: ->(arr1, arr2) { arr1.difference arr2 },
               intersection: ->(arr1, arr2) { arr1.intersection arr2 },
               get_key: ->(arr, key) { (arr || {}).fetch(key, nil) },
-              count: ->(n) { n.length },
+              count: lambda(&:length),
               dig: lambda { |object, path, default = nil|
                 # sometimes we might want to traverse the object as if it were a hash
                 # sometimes we might want to traverse it as a Ruby object

data/lib/claws/engine.rb

@@ -18,7 +18,7 @@ class ExpressionParser
         startswith: ->(string, needle) { string.to_s.start_with? needle },
         endswith: ->(string, needle) { string.to_s.end_with? needle },
         difference: ->(arr1, arr2) { arr1.difference arr2 },
-        count: ->(n) { n.length }
+        count: lambda(&:length)
       }
     )
   end

data/lib/claws/rule/checkout_with_static_credentials.rb

@@ -24,10 +24,13 @@ module Claws
         )
       ), highlight: "with.ssh-key"
 
+      # secrets.GITHUB_TOKEN is the short lived per-run token, not a static credential.
+      # the regex retries at each secrets. reference, so GITHUB_TOKEN alongside another secret is still flagged.
+      # %() is double quoted, so \\b is needed to reach the regex as a word boundary (\b would be a backspace)
       on_step %(
         $step.meta.action.name == "actions/checkout" &&
         (
-          get_key($step.with, "token") =~ "{{.*secrets\..*" ||
+          get_key($step.with, "token") =~ "{{.*secrets\.(?!(?i:GITHUB_TOKEN)\\b)" ||
           get_key($step.with, "token") =~ "{{.*env\..*" ||
           get_key($step.with, "token") =~ "{{.*vars\..*" ||
           get_key($step.with, "token") =~ "gh[a-z]_.*"

data/lib/claws/rule/command_injection.rb

@@ -8,7 +8,9 @@ module Claws
         https://github.com/betterment/claws/blob/main/README.md#commandinjection
       DESC
 
-      on_step '$step.run =~ ".*{{.*(github\.event|inputs)\..*}}.*"', highlight: "run"
+      # only ${{ }} is expanded by the runner; bare {{ }} (e.g. gh-aw prompt templates) is literal text.
+      # (?:(?!\}\}).)* keeps the match inside a single expression while still allowing a lone } like format('{0}', ...)
+      on_step '$step.run =~ "\$\{\{(?:(?!\}\}).)*(github\.event|inputs)\."', highlight: "run"
     end
   end
 end

data/lib/claws/rule/global_permissions_block.rb

@@ -9,7 +9,8 @@ module Claws
 
         This rule will flag workflows that have multiple jobs and a root level
         permissions block. If there is a root level permissions block but just one job,
-        it will not be flagged.
+        it will not be flagged. An empty root level block (`permissions: {}`) grants
+        nothing and will not be flagged either.
 
         For more information:
         https://github.com/betterment/claws/blob/main/README.md#globalpermissionsblock
@@ -17,9 +18,10 @@ module Claws
 
       on_workflow :test_root_level_permissions
 
-      def test_root_level_permissions(workflow:, job:, step:) # rubocop:disable Lint/UnusedMethodArgument
+      def test_root_level_permissions(workflow:, job:, step:) # rubocop:disable Lint/UnusedMethodArgument, Metrics/CyclomaticComplexity
         root_permission_block_line = workflow.keys.filter { |x| x == "permissions" }.first&.line
         return if root_permission_block_line.nil?
+        return if empty_permissions?(workflow.permissions)
 
         job_count = workflow["jobs"]&.count || 0
         return if job_count < 2
@@ -29,6 +31,12 @@ module Claws
           description:
         )
       end
+
+      private
+
+      def empty_permissions?(permissions)
+        permissions.is_a?(Hash) && permissions.empty?
+      end
     end
   end
 end

data/lib/claws/rule/shellcheck.rb

@@ -66,8 +66,11 @@ module Claws
       def analyze_script(script, shell)
         sanitized_script, variables = *sanitize_script(script)
 
+        # scripts are piped in via stdin, so sourced files can never be followed
+        # https://www.shellcheck.net/wiki/SC1090
+        # https://www.shellcheck.net/wiki/SC1091
         Open3.popen3(
-          shellcheck_bin, "-", "-s", shell
+          shellcheck_bin, "-", "-s", shell, "-e", "SC1090,SC1091"
         ) do |stdin, stdout, stderr, wait_thr|
           stdin.write(sanitized_script)
           stdin.close

data/lib/claws/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Claws
-  VERSION = "0.9.5"
+  VERSION = "0.10.1"
 end

data/lib/claws/workflow.rb

@@ -36,7 +36,8 @@ class Workflow
     return @on if key.to_s == "on"
     return @jobs if key.to_s == "jobs"
     return @name if key.to_s == "name"
-    return @env if key.to_s == "env"
+
+    @env if key.to_s == "env"
   end
 
   def get_snippet(line, context: 3)
@@ -162,7 +163,7 @@ class Workflow
     return [] if env.nil?
 
     secrets = []
-    env.each do |_k, v|
+    env.each_value do |v|
       next unless v.is_a? String
 
       secrets += v.scan(/secrets\.([a-zA-Z0-9_]+)/).flatten

data/mise.lock

@@ -0,0 +1,46 @@
+# @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html
+
+lockfile_version = 2
+
+[[tools.ruby]]
+version = "3.4.10"
+backend = "core:ruby"
+specifiers = ["3.4.10"]
+
+[tools.ruby."platforms.windows-x64"]
+checksum = "sha256:89e3c5e235ac88b9b7e8daaf639eaaab74d7c470667354f6bf0f7432f3191ebb"
+url = "https://github.com/oneclick/rubyinstaller2/releases/download/RubyInstaller-3.4.10-1/rubyinstaller-3.4.10-1-x64.7z"
+
+[[tools.ruby]]
+version = "3.4.10"
+backend = "core:ruby"
+specifiers = ["3.4.10"]
+
+[tools.ruby.options]
+compile = "true"
+ruby_build_repo = "https://github.com/rbenv/ruby-build.git"
+ruby_install = "false"
+
+[tools.ruby."platforms.linux-arm64"]
+checksum = "sha256:ecee2d072a14f2d14347dd56dfd8fe5c3130abf5117bfaacbda0f4ef9cc429ec"
+url = "https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.10.tar.gz"
+
+[tools.ruby."platforms.linux-arm64-musl"]
+checksum = "sha256:ecee2d072a14f2d14347dd56dfd8fe5c3130abf5117bfaacbda0f4ef9cc429ec"
+url = "https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.10.tar.gz"
+
+[tools.ruby."platforms.linux-x64"]
+checksum = "sha256:ecee2d072a14f2d14347dd56dfd8fe5c3130abf5117bfaacbda0f4ef9cc429ec"
+url = "https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.10.tar.gz"
+
+[tools.ruby."platforms.linux-x64-musl"]
+checksum = "sha256:ecee2d072a14f2d14347dd56dfd8fe5c3130abf5117bfaacbda0f4ef9cc429ec"
+url = "https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.10.tar.gz"
+
+[tools.ruby."platforms.macos-arm64"]
+checksum = "sha256:ecee2d072a14f2d14347dd56dfd8fe5c3130abf5117bfaacbda0f4ef9cc429ec"
+url = "https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.10.tar.gz"
+
+[tools.ruby."platforms.macos-x64"]
+checksum = "sha256:ecee2d072a14f2d14347dd56dfd8fe5c3130abf5117bfaacbda0f4ef9cc429ec"
+url = "https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.10.tar.gz"

data/mise.toml

@@ -0,0 +1,2 @@
+[tools]
+ruby = "3.4.10"

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: claws-scan
 version: !ruby/object:Gem::Version
-  version: 0.9.5
+  version: 0.10.1
 platform: ruby
 authors:
 - Omar
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-20 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: equation
@@ -76,7 +75,6 @@ extra_rdoc_files: []
 files:
 - ".rspec"
 - ".rubocop.yml"
-- ".ruby-version"
 - CONTRIBUTING.md
 - Gemfile
 - Gemfile.lock
@@ -114,12 +112,13 @@ files:
 - lib/claws/version.rb
 - lib/claws/violation.rb
 - lib/claws/workflow.rb
+- mise.lock
+- mise.toml
 homepage: https://github.com/Betterment/claws
 licenses: []
 metadata:
   homepage_uri: https://github.com/Betterment/claws
   source_code_uri: https://github.com/Betterment/claws
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -127,15 +126,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.2'
+      version: '3.4'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.20
-signing_key:
+rubygems_version: 3.6.7
 specification_version: 4
 summary: Analyzes your Github Actions
 test_files: []

data/.ruby-version

@@ -1 +0,0 @@
-3.2.3