sentinel-ci 0.1.0

data/lib/workflow.rb

@@ -0,0 +1,100 @@
+require "yaml"
+
+class Workflow
+    attr_reader :filename, :raw, :raw_lines, :data
+
+    def initialize(filename:, content:)
+        @filename = filename
+        @raw = content
+        @raw_lines = content.lines
+        @data = YAML.safe_load(content, permitted_classes: [Symbol]) || {}
+    rescue YAML::SyntaxError => e
+        @data = {}
+        @parse_error = e.message
+    end
+
+    def parse_error? = !@parse_error.nil?
+
+    def triggers
+        @data["on"] || @data[true] || {}
+    end
+
+    def jobs
+        @data["jobs"] || {}
+    end
+
+    def steps(job)
+        job_hash = job.is_a?(String) ? jobs[job] : job
+        return [] unless job_hash.is_a?(Hash)
+        job_hash["steps"] || []
+    end
+
+    def permissions(scope: :workflow, job: nil)
+        case scope
+        when :workflow
+            @data["permissions"]
+        when :job
+            j = job.is_a?(String) ? jobs[job] : job
+            j&.dig("permissions")
+        end
+    end
+
+    def env(scope: :workflow, step: nil)
+        case scope
+        when :workflow
+            @data["env"] || {}
+        when :step
+            step&.dig("env") || {}
+        end
+    end
+
+    def line_of(pattern)
+        raw_lines.each_with_index do |line, i|
+            return i + 1 if line.match?(pattern)
+        end
+        nil
+    end
+
+    def lines_of(pattern)
+        results = []
+        raw_lines.each_with_index do |line, i|
+            results << (i + 1) if line.match?(pattern)
+        end
+        results
+    end
+
+    def line_content(num)
+        raw_lines[num - 1]&.rstrip
+    end
+
+    def uses_actions
+        results = []
+        seen_lines = Hash.new(0)
+        jobs.each do |_job_id, job_hash|
+            steps(job_hash).each do |step|
+                next unless step["uses"]
+                all_lines = lines_of(/uses:\s*#{Regexp.escape(step["uses"])}/)
+                idx = seen_lines[step["uses"]]
+                line = all_lines[idx] || all_lines.last
+                seen_lines[step["uses"]] += 1
+                results << { uses: step["uses"], step: step, line: line }
+            end
+        end
+        results
+    end
+
+    def run_blocks
+        results = []
+        all_run_lines = lines_of(/^\s+run:\s*[\|>]?\s*/)
+        run_idx = 0
+        jobs.each do |_job_id, job_hash|
+            steps(job_hash).each do |step|
+                next unless step["run"]
+                line = all_run_lines[run_idx] || all_run_lines.last
+                run_idx += 1
+                results << { run: step["run"], step: step, env: step["env"] || {}, line: line }
+            end
+        end
+        results
+    end
+end

metadata

@@ -0,0 +1,84 @@
+--- !ruby/object:Gem::Specification
+name: sentinel-ci
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Jordan Ritter
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies: []
+description: Scan GitHub Actions workflows for 21 security vulnerabilities. SHA pinning,
+  shell injection, credential exposure, dangerous triggers. No AI, no dependencies
+  — pure Ruby stdlib.
+email: jpr5@darkridge.com
+executables:
+- sentinel
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE
+- README.md
+- bin/gh-workflow-scanner
+- bin/sentinel
+- lib/auto_fix.rb
+- lib/cli/bot.rb
+- lib/cli/fix.rb
+- lib/cli/scan.rb
+- lib/clone_client.rb
+- lib/finding.rb
+- lib/formatter/json.rb
+- lib/formatter/terminal.rb
+- lib/github_client.rb
+- lib/local_client.rb
+- lib/rule_engine.rb
+- lib/rules/allow_forks_artifact.rb
+- lib/rules/base.rb
+- lib/rules/build_publish_same_job.rb
+- lib/rules/credential_window.rb
+- lib/rules/curl_pipe_shell.rb
+- lib/rules/dangerous_triggers.rb
+- lib/rules/docker_build_arg_secrets.rb
+- lib/rules/git_config_global.rb
+- lib/rules/missing_env_protection.rb
+- lib/rules/missing_frozen_lockfile.rb
+- lib/rules/missing_permissions.rb
+- lib/rules/missing_persist_creds.rb
+- lib/rules/missing_timeouts.rb
+- lib/rules/overly_broad_triggers.rb
+- lib/rules/shell_injection_expr.rb
+- lib/rules/shell_injection_jq.rb
+- lib/rules/static_aws_credentials.rb
+- lib/rules/unpinned_actions.rb
+- lib/rules/unpinned_docker_image.rb
+- lib/rules/unscoped_app_token.rb
+- lib/scanner.rb
+- lib/sha_resolver.rb
+- lib/version.rb
+- lib/workflow.rb
+homepage: https://sentinel.copilotkit.dev
+licenses:
+- MIT
+metadata:
+  source_code_uri: https://github.com/CopilotKit/sentinel
+  bug_tracker_uri: https://github.com/CopilotKit/sentinel/issues
+  homepage_uri: https://sentinel.copilotkit.dev
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.2'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.9
+specification_version: 4
+summary: Deterministic security scanner for GitHub Actions workflows
+test_files: []