@agent-teams/engineering-foundation 0.4.1 → 0.6.0

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/workflow-evidence-parser.js

@@ -0,0 +1,208 @@
+import { compareBinaryStrings } from "../../../../../binary-string-comparator.js";
+import { parseStrictYamlSource } from "../../../../../strict-yaml.js";
+import { repositorySecurityInputError, requireRecord } from "./repository-security-input.js";
+function permissions(value, field) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (value === "read-all" || value === "write-all") {
+        return value;
+    }
+    const input = requireRecord(value, field);
+    const result = {};
+    for (const [name, permission] of Object.entries(input)) {
+        if (permission !== "none" && permission !== "read" && permission !== "write") {
+            repositorySecurityInputError("REPOSITORY_SECURITY_WORKFLOW_INVALID", `${field}.${name} must be none, read, or write.`);
+        }
+        result[name] = permission;
+    }
+    return Object.freeze(result);
+}
+function triggers(value) {
+    if (typeof value === "string") {
+        return [value];
+    }
+    if (Array.isArray(value)) {
+        if (!value.every((entry) => typeof entry === "string")) {
+            repositorySecurityInputError("REPOSITORY_SECURITY_WORKFLOW_INVALID", "Workflow triggers must be strings.");
+        }
+        return Object.freeze(value.toSorted());
+    }
+    return Object.freeze(Object.keys(requireRecord(value, "workflow.on")).toSorted());
+}
+function unconditionalTriggers(value) {
+    if (typeof value === "string") {
+        return [value];
+    }
+    if (Array.isArray(value)) {
+        return Object.freeze(value.filter((entry) => typeof entry === "string").toSorted());
+    }
+    const input = requireRecord(value, "workflow.on");
+    return Object.freeze(Object.entries(input)
+        .filter(([, configuration]) => {
+        if (configuration === null) {
+            return true;
+        }
+        return (typeof configuration === "object" &&
+            !Array.isArray(configuration) &&
+            Object.keys(configuration).length === 0);
+    })
+        .map(([trigger]) => trigger)
+        .toSorted());
+}
+function requiredString(value, field) {
+    if (typeof value !== "string" || value.length === 0) {
+        repositorySecurityInputError("REPOSITORY_SECURITY_WORKFLOW_INVALID", `${field} must be a non-empty string.`);
+    }
+    return value;
+}
+function containerImage(value, field) {
+    if (typeof value === "string") {
+        return requiredString(value, field);
+    }
+    return requiredString(requireRecord(value, field)["image"], `${field}.image`);
+}
+function containers(value, field) {
+    const discovered = [];
+    if (value["container"] !== undefined) {
+        discovered.push(Object.freeze({
+            image: containerImage(value["container"], `${field}.container`),
+            name: "container",
+            scope: "job"
+        }));
+    }
+    if (value["services"] !== undefined) {
+        const services = requireRecord(value["services"], `${field}.services`);
+        for (const [name, service] of Object.entries(services).toSorted(([left], [right]) => compareBinaryStrings(left, right))) {
+            discovered.push(Object.freeze({
+                image: containerImage(service, `${field}.services.${name}`),
+                name,
+                scope: "service"
+            }));
+        }
+    }
+    return Object.freeze(discovered);
+}
+function needs(value, field) {
+    if (value === undefined) {
+        return [];
+    }
+    const entries = typeof value === "string" ? [value] : value;
+    if (!Array.isArray(entries)) {
+        repositorySecurityInputError("REPOSITORY_SECURITY_WORKFLOW_INVALID", `${field} must be a non-empty job ID or an array of non-empty job IDs.`);
+    }
+    const normalized = entries.map((entry, index) => requiredString(entry, `${field}[${index}]`));
+    if (new Set(normalized).size !== normalized.length) {
+        repositorySecurityInputError("REPOSITORY_SECURITY_WORKFLOW_INVALID", `${field} cannot declare duplicate job IDs.`);
+    }
+    return Object.freeze(normalized);
+}
+function condition(value, field) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (typeof value === "boolean") {
+        return String(value);
+    }
+    if (typeof value !== "string" || value.trim().length === 0) {
+        repositorySecurityInputError("REPOSITORY_SECURITY_WORKFLOW_INVALID", `${field} must be a non-empty expression or boolean.`);
+    }
+    return value;
+}
+function steps(value, field) {
+    if (value === undefined) {
+        return [];
+    }
+    if (!Array.isArray(value)) {
+        repositorySecurityInputError("REPOSITORY_SECURITY_WORKFLOW_INVALID", `${field} must be an array.`);
+    }
+    return Object.freeze(value.map((entry, index) => {
+        const step = requireRecord(entry, `${field}[${index}]`);
+        const stepInputs = step["with"];
+        const stepCondition = condition(step["if"], `${field}[${index}].if`);
+        return Object.freeze({
+            conditional: stepCondition !== undefined,
+            ...(stepCondition === undefined ? {} : { condition: stepCondition }),
+            nonBlocking: step["continue-on-error"] !== undefined && step["continue-on-error"] !== false,
+            inputs: Object.freeze(stepInputs === undefined ? {} : requireRecord(stepInputs, `${field}[${index}].with`)),
+            ...(typeof step["uses"] === "string" ? { uses: step["uses"] } : {}),
+            ...(typeof step["run"] === "string" ? { run: step["run"] } : {})
+        });
+    }));
+}
+export function parseWorkflow(path, source) {
+    const input = requireRecord(parseStrictYamlSource(source, `workflow:${path}`), `workflow ${path}`);
+    const jobsInput = requireRecord(input["jobs"], `workflow ${path}.jobs`);
+    const jobs = Object.entries(jobsInput).map(([id, value]) => {
+        const job = requireRecord(value, `workflow ${path}.jobs.${id}`);
+        const jobPermissions = permissions(job["permissions"], `workflow ${path}.jobs.${id}.permissions`);
+        const jobCondition = condition(job["if"], `workflow ${path}.jobs.${id}.if`);
+        return Object.freeze({
+            conditional: jobCondition !== undefined,
+            ...(jobCondition === undefined ? {} : { condition: jobCondition }),
+            containers: containers(job, `workflow ${path}.jobs.${id}`),
+            needs: needs(job["needs"], `workflow ${path}.jobs.${id}.needs`),
+            nonBlocking: job["continue-on-error"] !== undefined && job["continue-on-error"] !== false,
+            id,
+            ...(typeof job["uses"] === "string" ? { uses: job["uses"] } : {}),
+            ...(jobPermissions === undefined ? {} : { permissions: jobPermissions }),
+            steps: steps(job["steps"], `workflow ${path}.jobs.${id}.steps`)
+        });
+    });
+    const workflowPermissions = permissions(input["permissions"], `workflow ${path}.permissions`);
+    return Object.freeze({
+        path,
+        triggers: triggers(input["on"]),
+        unconditionalTriggers: unconditionalTriggers(input["on"]),
+        ...(workflowPermissions === undefined ? {} : { permissions: workflowPermissions }),
+        jobs: Object.freeze(jobs.toSorted((left, right) => compareBinaryStrings(left.id, right.id)))
+    });
+}
+export function collectWorkflowUses(workflows) {
+    const uses = [];
+    for (const workflow of workflows) {
+        for (const job of workflow.jobs) {
+            if (job.uses !== undefined) {
+                uses.push({
+                    path: workflow.path,
+                    subject: `${workflow.path}:jobs.${job.id}`,
+                    uses: job.uses
+                });
+            }
+            for (const [index, step] of job.steps.entries()) {
+                if (step.uses !== undefined) {
+                    uses.push({
+                        path: workflow.path,
+                        subject: `${workflow.path}:jobs.${job.id}.steps[${index}]`,
+                        uses: step.uses
+                    });
+                }
+            }
+        }
+    }
+    return Object.freeze(uses);
+}
+export function collectCompositeActionUses(path, source) {
+    const input = requireRecord(parseStrictYamlSource(Buffer.from(source).toString("utf8"), `composite-action:${path}`), `composite action ${path}`);
+    const runs = requireRecord(input["runs"], `composite action ${path}.runs`);
+    if (runs["using"] !== "composite") {
+        repositorySecurityInputError("REPOSITORY_SECURITY_LOCAL_ACTION_RUNTIME_UNSUPPORTED", `Local action must use the auditable composite runtime: ${path}.`);
+    }
+    const compositeSteps = steps(runs["steps"], `composite action ${path}.runs.steps`);
+    return Object.freeze({
+        path,
+        steps: compositeSteps
+    });
+}
+export function collectCompositeActionWorkflowUses(action) {
+    return Object.freeze(action.steps.flatMap((step, index) => step.uses === undefined
+        ? []
+        : [
+            {
+                path: action.path,
+                subject: `${action.path}:runs.steps[${index}]`,
+                uses: step.uses
+            }
+        ]));
+}
+//# sourceMappingURL=workflow-evidence-parser.js.map

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/workflow-evidence-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-evidence-parser.js","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/workflow-evidence-parser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAUtE,OAAO,EACL,4BAA4B,EAC5B,aAAa,EACd,MAAM,gCAAgC,CAAC;AAExC,SAAS,WAAW,CAClB,KAAc,EACd,KAAa;IAEb,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAuC,EAAE,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YAC7E,4BAA4B,CAC1B,sCAAsC,EACtC,GAAG,KAAK,IAAI,IAAI,gCAAgC,CACjD,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC;IAC5B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;YACvD,4BAA4B,CAC1B,sCAAsC,EACtC,oCAAoC,CACrC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,MAAM,CAClB,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAC/E,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,MAAM,CAClB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,EAAE;QAC5B,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CACL,OAAO,aAAa,KAAK,QAAQ;YACjC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,KAAK,CAAC,CACxC,CAAC;IACJ,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC;SAC3B,QAAQ,EAAE,CACd,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,4BAA4B,CAC1B,sCAAsC,EACtC,GAAG,KAAK,8BAA8B,CACvC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,cAAc,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,UAAU,CAAC,KAA8B,EAAE,KAAa;IAC/D,MAAM,UAAU,GAAgC,EAAE,CAAC;IACnD,IAAI,KAAK,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;QACrC,UAAU,CAAC,IAAI,CACb,MAAM,CAAC,MAAM,CAAC;YACZ,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,YAAY,CAAC;YAC/D,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,KAAK;SACb,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,WAAW,CAAC,CAAC;QACvE,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAClF,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAClC,EAAE,CAAC;YACF,UAAU,CAAC,IAAI,CACb,MAAM,CAAC,MAAM,CAAC;gBACZ,KAAK,EAAE,cAAc,CAAC,OAAO,EAAE,GAAG,KAAK,aAAa,IAAI,EAAE,CAAC;gBAC3D,IAAI;gBACJ,KAAK,EAAE,SAAS;aACjB,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,KAAK,CAAC,KAAc,EAAE,KAAa;IAC1C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAY,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACrE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,4BAA4B,CAC1B,sCAAsC,EACtC,GAAG,KAAK,+DAA+D,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAC9C,cAAc,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,KAAK,GAAG,CAAC,CAC5C,CAAC;IACF,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACnD,4BAA4B,CAC1B,sCAAsC,EACtC,GAAG,KAAK,oCAAoC,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,KAAa;IAC9C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,4BAA4B,CAC1B,sCAAsC,EACtC,GAAG,KAAK,6CAA6C,CACtD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,KAAK,CAAC,KAAc,EAAE,KAAa;IAC1C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,4BAA4B,CAC1B,sCAAsC,EACtC,GAAG,KAAK,oBAAoB,CAC7B,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAClB,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACzB,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,KAAK,GAAG,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,IAAI,KAAK,MAAM,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,WAAW,EAAE,aAAa,KAAK,SAAS;YACxC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;YACpE,WAAW,EACT,IAAI,CAAC,mBAAmB,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,mBAAmB,CAAC,KAAK,KAAK;YAChF,MAAM,EAAE,MAAM,CAAC,MAAM,CACnB,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,KAAK,IAAI,KAAK,QAAQ,CAAC,CACrF;YACD,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,MAAc;IACxD,MAAM,KAAK,GAAG,aAAa,CAAC,qBAAqB,CAAC,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC;IACnG,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,YAAY,IAAI,OAAO,CAAC,CAAC;IACxE,MAAM,IAAI,GAA0B,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE;QAChF,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,EAAE,YAAY,IAAI,SAAS,EAAE,EAAE,CAAC,CAAC;QAChE,MAAM,cAAc,GAAG,WAAW,CAChC,GAAG,CAAC,aAAa,CAAC,EAClB,YAAY,IAAI,SAAS,EAAE,cAAc,CAC1C,CAAC;QACF,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,IAAI,SAAS,EAAE,KAAK,CAAC,CAAC;QAC5E,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,WAAW,EAAE,YAAY,KAAK,SAAS;YACvC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;YAClE,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE,YAAY,IAAI,SAAS,EAAE,EAAE,CAAC;YAC1D,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,YAAY,IAAI,SAAS,EAAE,QAAQ,CAAC;YAC/D,WAAW,EACT,GAAG,CAAC,mBAAmB,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,mBAAmB,CAAC,KAAK,KAAK;YAC9E,EAAE;YACF,GAAG,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;YACxE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,YAAY,IAAI,SAAS,EAAE,QAAQ,CAAC;SAChE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,mBAAmB,GAAG,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,YAAY,IAAI,cAAc,CAAC,CAAC;IAC9F,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI;QACJ,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,qBAAqB,EAAE,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzD,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;QAClF,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;KAC7F,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,SAAsC;IAEtC,MAAM,IAAI,GAA0B,EAAE,CAAC;IACvC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,EAAE;oBAC1C,IAAI,EAAE,GAAG,CAAC,IAAI;iBACf,CAAC,CAAC;YACL,CAAC;YACD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;gBAChD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBAC5B,IAAI,CAAC,IAAI,CAAC;wBACR,IAAI,EAAE,QAAQ,CAAC,IAAI;wBACnB,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,UAAU,KAAK,GAAG;wBAC1D,IAAI,EAAE,IAAI,CAAC,IAAI;qBAChB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,IAAY,EACZ,MAAkB;IAElB,MAAM,KAAK,GAAG,aAAa,CACzB,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,IAAI,EAAE,CAAC,EACvF,oBAAoB,IAAI,EAAE,CAC3B,CAAC;IACF,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,oBAAoB,IAAI,OAAO,CAAC,CAAC;IAC3E,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,WAAW,EAAE,CAAC;QAClC,4BAA4B,CAC1B,sDAAsD,EACtD,0DAA0D,IAAI,GAAG,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,oBAAoB,IAAI,aAAa,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI;QACJ,KAAK,EAAE,cAAc;KACtB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,MAA+B;IAE/B,OAAO,MAAM,CAAC,MAAM,CAClB,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACnC,IAAI,CAAC,IAAI,KAAK,SAAS;QACrB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,eAAe,KAAK,GAAG;gBAC9C,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB;SACF,CACN,CACF,CAAC;AACJ,CAAC"}

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/workflow-evidence-reader.d.ts

@@ -0,0 +1,10 @@
+import type { CompositeActionEvidence, RepositorySecurityPolicy, WorkflowEvidence, WorkflowUseEvidence } from "../../../application/model/repository-security.js";
+interface WorkflowDirectoryEvidence {
+    readonly compositeActions: readonly CompositeActionEvidence[];
+    readonly workflows: readonly WorkflowEvidence[];
+    readonly workflowUses: readonly WorkflowUseEvidence[];
+    readonly workflowDigest: string;
+}
+export declare function readWorkflowDirectoryEvidence(root: string, policy: RepositorySecurityPolicy, signal?: AbortSignal): Promise<WorkflowDirectoryEvidence>;
+export {};
+//# sourceMappingURL=workflow-evidence-reader.d.ts.map

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/workflow-evidence-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-evidence-reader.d.ts","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/workflow-evidence-reader.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,mDAAmD,CAAC;AAgB3D,UAAU,yBAAyB;IACjC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAC9D,QAAQ,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAChD,QAAQ,CAAC,YAAY,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACtD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAuFD,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,wBAAwB,EAChC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,yBAAyB,CAAC,CAqCpC"}

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/workflow-evidence-reader.js

@@ -0,0 +1,95 @@
+import { opendir } from "node:fs/promises";
+import { compareBinaryStrings } from "../../../../../binary-string-comparator.js";
+import { assertNotCancelled } from "../../../../../strict-yaml.js";
+import { isSafeLocalWorkflowUse } from "../../../application/model/repository-security.js";
+import { digestWorkflowSources } from "./repository-security-digests.js";
+import { readOptionalEvidenceFile, readRequiredEvidenceFile, resolveSafeEvidencePath } from "./repository-security-filesystem.js";
+import { repositorySecurityInputError } from "./repository-security-input.js";
+import { collectCompositeActionWorkflowUses, collectCompositeActionUses, collectWorkflowUses, parseWorkflow } from "./workflow-evidence-parser.js";
+function isReusableWorkflowUse(use, workflowDirectory) {
+    const repositoryPath = use.slice(2);
+    return repositoryPath.startsWith(`${workflowDirectory}/`) && /\.ya?ml$/iu.test(repositoryPath);
+}
+async function readCompositeActionDescriptor(root, localUse) {
+    const actionDirectory = localUse.slice(2);
+    await resolveSafeEvidencePath(root, actionDirectory);
+    const candidates = await Promise.all(["action.yml", "action.yaml"].map(async (name) => {
+        const path = `${actionDirectory}/${name}`;
+        const source = await readOptionalEvidenceFile(root, path);
+        return source === undefined ? undefined : { path, source };
+    }));
+    const descriptors = candidates.flatMap((candidate) => candidate === undefined ? [] : [candidate]);
+    if (descriptors.length !== 1) {
+        repositorySecurityInputError("REPOSITORY_SECURITY_LOCAL_ACTION_INVALID", `Local action must declare exactly one action.yml or action.yaml descriptor: ${localUse}.`);
+    }
+    const descriptor = descriptors[0];
+    if (descriptor === undefined) {
+        repositorySecurityInputError("REPOSITORY_SECURITY_LOCAL_ACTION_INVALID", `Local action descriptor is unavailable: ${localUse}.`);
+    }
+    return descriptor;
+}
+async function readLocalCompositeActions(root, workflowDirectory, rootUses) {
+    const pending = rootUses
+        .filter(({ uses }) => isSafeLocalWorkflowUse(uses) && !isReusableWorkflowUse(uses, workflowDirectory))
+        .toSorted(({ uses: left }, { uses: right }) => compareBinaryStrings(left, right));
+    const visited = new Set();
+    const compositeActions = [];
+    const sourceEntries = [];
+    const nestedUses = [];
+    while (pending.length > 0) {
+        const next = pending.shift();
+        if (next === undefined || visited.has(next.uses)) {
+            continue;
+        }
+        visited.add(next.uses);
+        const descriptor = await readCompositeActionDescriptor(root, next.uses);
+        sourceEntries.push(descriptor);
+        const discovered = collectCompositeActionUses(descriptor.path, descriptor.source);
+        compositeActions.push(discovered);
+        const discoveredUses = collectCompositeActionWorkflowUses(discovered);
+        nestedUses.push(...discoveredUses);
+        for (const candidate of discoveredUses) {
+            if (isSafeLocalWorkflowUse(candidate.uses) &&
+                !isReusableWorkflowUse(candidate.uses, workflowDirectory)) {
+                pending.push(candidate);
+            }
+        }
+    }
+    return Object.freeze({
+        compositeActions: Object.freeze(compositeActions),
+        sourceEntries: Object.freeze(sourceEntries),
+        workflowUses: Object.freeze(nestedUses)
+    });
+}
+export async function readWorkflowDirectoryEvidence(root, policy, signal) {
+    const directory = await resolveSafeEvidencePath(root, policy.workflowDirectory);
+    const names = [];
+    const handle = await opendir(directory);
+    for await (const entry of handle) {
+        assertNotCancelled(signal);
+        if (entry.isSymbolicLink() || !entry.isFile() || !/\.ya?ml$/iu.test(entry.name)) {
+            repositorySecurityInputError("REPOSITORY_SECURITY_WORKFLOW_ENTRY_INVALID", `Workflow directory contains an unsupported entry: ${entry.name}.`);
+        }
+        names.push(entry.name);
+    }
+    const workflows = [];
+    const sourceEntries = [];
+    for (const name of names.toSorted()) {
+        const repositoryPath = `${policy.workflowDirectory}/${name}`;
+        const source = await readRequiredEvidenceFile(root, repositoryPath);
+        sourceEntries.push({ path: repositoryPath, source });
+        workflows.push(parseWorkflow(repositoryPath, source.toString("utf8")));
+    }
+    const rootUses = collectWorkflowUses(workflows);
+    const localCompositeActions = await readLocalCompositeActions(root, policy.workflowDirectory, rootUses);
+    return Object.freeze({
+        compositeActions: localCompositeActions.compositeActions,
+        workflows: Object.freeze(workflows),
+        workflowUses: Object.freeze([...rootUses, ...localCompositeActions.workflowUses]),
+        workflowDigest: await digestWorkflowSources([
+            ...sourceEntries,
+            ...localCompositeActions.sourceEntries
+        ])
+    });
+}
+//# sourceMappingURL=workflow-evidence-reader.js.map

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/workflow-evidence-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-evidence-reader.js","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/workflow-evidence-reader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAOnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,mDAAmD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACxB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EACL,kCAAkC,EAClC,0BAA0B,EAC1B,mBAAmB,EACnB,aAAa,EACd,MAAM,+BAA+B,CAAC;AAevC,SAAS,qBAAqB,CAAC,GAAW,EAAE,iBAAyB;IACnE,MAAM,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpC,OAAO,cAAc,CAAC,UAAU,CAAC,GAAG,iBAAiB,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AACjG,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,IAAY,EACZ,QAAgB;IAEhB,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,uBAAuB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QAC/C,MAAM,IAAI,GAAG,GAAG,eAAe,IAAI,IAAI,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1D,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC7D,CAAC,CAAC,CACH,CAAC;IACF,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CACnD,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAC3C,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,4BAA4B,CAC1B,0CAA0C,EAC1C,+EAA+E,QAAQ,GAAG,CAC3F,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,4BAA4B,CAC1B,0CAA0C,EAC1C,2CAA2C,QAAQ,GAAG,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,IAAY,EACZ,iBAAyB,EACzB,QAAwC;IAExC,MAAM,OAAO,GAAG,QAAQ;SACrB,MAAM,CACL,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAC9F;SACA,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,gBAAgB,GAA8B,EAAE,CAAC;IACvD,MAAM,aAAa,GAA2C,EAAE,CAAC;IACjE,MAAM,UAAU,GAA0B,EAAE,CAAC;IAC7C,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACxE,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,0BAA0B,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAClF,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,MAAM,cAAc,GAAG,kCAAkC,CAAC,UAAU,CAAC,CAAC;QACtE,UAAU,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;QACnC,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;YACvC,IACE,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC;gBACtC,CAAC,qBAAqB,CAAC,SAAS,CAAC,IAAI,EAAE,iBAAiB,CAAC,EACzD,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACjD,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;QAC3C,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;KACxC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,IAAY,EACZ,MAAgC,EAChC,MAAoB;IAEpB,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAChF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAChF,4BAA4B,CAC1B,4CAA4C,EAC5C,qDAAqD,KAAK,CAAC,IAAI,GAAG,CACnE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,MAAM,aAAa,GAA2C,EAAE,CAAC;IACjE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;QACpC,MAAM,cAAc,GAAG,GAAG,MAAM,CAAC,iBAAiB,IAAI,IAAI,EAAE,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACpE,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,qBAAqB,GAAG,MAAM,yBAAyB,CAC3D,IAAI,EACJ,MAAM,CAAC,iBAAiB,EACxB,QAAQ,CACT,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,gBAAgB,EAAE,qBAAqB,CAAC,gBAAgB;QACxD,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;QACnC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QACjF,cAAc,EAAE,MAAM,qBAAqB,CAAC;YAC1C,GAAG,aAAa;YAChB,GAAG,qBAAqB,CAAC,aAAa;SACvC,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}

package/dist/capabilities/repository-security-baseline/application/model/repository-security.d.ts

@@ -1,17 +1,30 @@
 export type WorkflowPermission = "none" | "read" | "write";
+export type ToolEvidenceRollout = "advisory" | "blocking";
+export type SecurityToolName = "actionlint" | "zizmor" | "codeql";
+export declare function isSafeLocalWorkflowUse(value: string): boolean;
+export declare function isPinnedExternalWorkflowUse(value: string): boolean;
 export interface WorkflowStepEvidence {
     readonly conditional: boolean;
+    readonly condition?: string;
     readonly nonBlocking: boolean;
     readonly inputs: Readonly<Record<string, unknown>>;
     readonly uses?: string;
     readonly run?: string;
 }
+export interface WorkflowContainerEvidence {
+    readonly image: string;
+    readonly scope: "job" | "service";
+    readonly name: string;
+}
 export interface WorkflowJobEvidence {
     readonly conditional: boolean;
+    readonly condition?: string;
     readonly nonBlocking: boolean;
+    readonly needs: readonly string[];
     readonly id: string;
     readonly uses?: string;
     readonly permissions?: Readonly<Record<string, WorkflowPermission>> | "read-all" | "write-all";
+    readonly containers: readonly WorkflowContainerEvidence[];
     readonly steps: readonly WorkflowStepEvidence[];
 }
 export interface WorkflowEvidence {
@@ -21,6 +34,15 @@ export interface WorkflowEvidence {
     readonly permissions?: Readonly<Record<string, WorkflowPermission>> | "read-all" | "write-all";
     readonly jobs: readonly WorkflowJobEvidence[];
 }
+export interface WorkflowUseEvidence {
+    readonly path: string;
+    readonly subject: string;
+    readonly uses: string;
+}
+export interface CompositeActionEvidence {
+    readonly path: string;
+    readonly steps: readonly WorkflowStepEvidence[];
+}
 export interface PublishablePackageEvidence {
     readonly manifestPath: string;
     readonly packageName: string;
@@ -28,19 +50,84 @@ export interface PublishablePackageEvidence {
     readonly provenance: boolean;
 }
 export interface RepositorySecurityEvidence {
+    readonly compositeActions: readonly CompositeActionEvidence[];
     readonly workflows: readonly WorkflowEvidence[];
+    readonly workflowUses: readonly WorkflowUseEvidence[];
+    readonly workflowDigest: string;
     readonly packages: readonly PublishablePackageEvidence[];
+    readonly toolEvidence: readonly RepositorySecurityToolEvidence[];
+}
+export interface RepositorySecurityToolPolicy {
+    readonly configPath: string;
+    readonly evidencePath: string;
+    readonly invocationUse: string;
+    readonly jobId: string;
+    readonly resultPath: string;
+    readonly rollout: ToolEvidenceRollout;
+    readonly version: string;
+    readonly workflowPath: string;
 }
+export interface RepositorySecurityToolPolicies {
+    readonly actionlint: RepositorySecurityToolPolicy;
+    readonly zizmor: RepositorySecurityToolPolicy;
+    readonly codeql?: RepositorySecurityToolPolicy;
+}
+export declare function configuredRepositorySecurityTools(policies: RepositorySecurityToolPolicies | undefined): readonly {
+    readonly policy: RepositorySecurityToolPolicy;
+    readonly tool: SecurityToolName;
+}[];
+interface BaseRepositorySecurityToolEvidence {
+    readonly evidencePath: string;
+    readonly resultPath: string;
+    readonly tool: SecurityToolName;
+}
+interface MissingRepositorySecurityToolEvidence extends BaseRepositorySecurityToolEvidence {
+    readonly kind: "missing";
+    readonly missing: "evidence" | "result";
+}
+export interface PresentRepositorySecurityToolEvidence extends BaseRepositorySecurityToolEvidence {
+    readonly actualConfigDigest: string;
+    readonly actualResultDigest: string;
+    readonly actualWorkflowDigest: string;
+    readonly configDigest: string;
+    readonly kind: "present";
+    readonly outcome: "failed" | "passed";
+    readonly resultDigest: string;
+    readonly toolVersion: string;
+    readonly workflowDigest: string;
+}
+export type RepositorySecurityToolEvidence = MissingRepositorySecurityToolEvidence | PresentRepositorySecurityToolEvidence;
+export interface AllowedWorkflowUse {
+    readonly transitiveUses: readonly AllowedWorkflowUse[];
+    readonly uses: string;
+}
+export interface AllowedWorkflowUseEntry {
+    readonly direct: boolean;
+    readonly uses: string;
+}
+export declare function flattenAllowedWorkflowUses(entries: readonly AllowedWorkflowUse[]): readonly AllowedWorkflowUseEntry[];
 export interface PrivilegedJobPolicy {
     readonly workflowPath: string;
     readonly jobId: string;
     readonly permissions: Readonly<Record<string, WorkflowPermission>>;
 }
+export interface DependencyReviewPolicy {
+    readonly baseRef: string;
+    readonly failOnSeverity: "low" | "moderate";
+    readonly headRef: string;
+    readonly jobId: string;
+    readonly workflowPath: string;
+}
 export interface RepositorySecurityPolicy {
+    readonly allowedContainerImages: readonly string[];
+    readonly allowedUses: readonly AllowedWorkflowUse[];
     readonly workflowDirectory: string;
-    readonly dependencyReviewWorkflow: string;
+    readonly dependencyReview: DependencyReviewPolicy;
     readonly sbomWorkflow: string;
     readonly privilegedJobs: readonly PrivilegedJobPolicy[];
     readonly publishablePackageManifests: readonly string[];
+    readonly toolEvidence?: RepositorySecurityToolPolicies;
 }
+export declare function isPinnedContainerImage(value: string): boolean;
+export {};
 //# sourceMappingURL=repository-security.d.ts.map

package/dist/capabilities/repository-security-baseline/application/model/repository-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-security.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/model/repository-security.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,GAAG,UAAU,GAAG,WAAW,CAAC;IAC/F,QAAQ,CAAC,KAAK,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACjD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,GAAG,UAAU,GAAG,WAAW,CAAC;IAC/F,QAAQ,CAAC,IAAI,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,SAAS,0BAA0B,EAAE,CAAC;CAC1D;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;CACpE;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxD,QAAQ,CAAC,2BAA2B,EAAE,SAAS,MAAM,EAAE,CAAC;CACzD"}
+{"version":3,"file":"repository-security.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/model/repository-security.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAC3D,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,UAAU,CAAC;AAC1D,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAUlE,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAM7D;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAElE;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,GAAG,UAAU,GAAG,WAAW,CAAC;IAC/F,QAAQ,CAAC,UAAU,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAC1D,QAAQ,CAAC,KAAK,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACjD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,GAAG,UAAU,GAAG,WAAW,CAAC;IAC/F,QAAQ,CAAC,IAAI,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACjD;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAC9D,QAAQ,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAChD,QAAQ,CAAC,YAAY,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACtD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACzD,QAAQ,CAAC,YAAY,EAAE,SAAS,8BAA8B,EAAE,CAAC;CAClE;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,UAAU,EAAE,4BAA4B,CAAC;IAClD,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAC;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,4BAA4B,CAAC;CAChD;AAED,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,8BAA8B,GAAG,SAAS,GACnD,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,EAAE,CAW/F;AAED,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;CACjC;AAED,UAAU,qCACR,SAAQ,kCAAkC;IAC1C,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,QAAQ,CAAC;CACzC;AAED,MAAM,WAAW,qCACf,SAAQ,kCAAkC;IAC1C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,MAAM,8BAA8B,GACtC,qCAAqC,GACrC,qCAAqC,CAAC;AAE1C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,cAAc,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,SAAS,kBAAkB,EAAE,GACrC,SAAS,uBAAuB,EAAE,CAUpC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;CACpE;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,KAAK,GAAG,UAAU,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAC;IACnD,QAAQ,CAAC,WAAW,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACpD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,gBAAgB,EAAE,sBAAsB,CAAC;IAClD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxD,QAAQ,CAAC,2BAA2B,EAAE,SAAS,MAAM,EAAE,CAAC;IACxD,QAAQ,CAAC,YAAY,CAAC,EAAE,8BAA8B,CAAC;CACxD;AAKD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE7D"}

package/dist/capabilities/repository-security-baseline/application/model/repository-security.js

@@ -1,2 +1,41 @@
-export {};
+const FULL_SHA_ACTION = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_./-]+)?@[0-9a-fA-F]{40}$/u;
+const FULL_DIGEST_CONTAINER = /^docker:\/\/.+@sha256:[0-9a-fA-F]{64}$/u;
+function isLocalWorkflowUse(value) {
+    return value.startsWith("./");
+}
+export function isSafeLocalWorkflowUse(value) {
+    return (isLocalWorkflowUse(value) &&
+        !value.split("/").includes("..") &&
+        !value.includes("${{"));
+}
+export function isPinnedExternalWorkflowUse(value) {
+    return FULL_SHA_ACTION.test(value) || FULL_DIGEST_CONTAINER.test(value);
+}
+export function configuredRepositorySecurityTools(policies) {
+    if (policies === undefined) {
+        return [];
+    }
+    return [
+        { tool: "actionlint", policy: policies.actionlint },
+        { tool: "zizmor", policy: policies.zizmor },
+        ...(policies.codeql === undefined
+            ? []
+            : [{ tool: "codeql", policy: policies.codeql }])
+    ];
+}
+export function flattenAllowedWorkflowUses(entries) {
+    const flattened = [];
+    const append = (candidates, direct) => {
+        for (const candidate of candidates) {
+            flattened.push({ direct, uses: candidate.uses });
+            append(candidate.transitiveUses, false);
+        }
+    };
+    append(entries, true);
+    return Object.freeze(flattened);
+}
+const FULL_DIGEST_CONTAINER_IMAGE = /^(?!docker:\/\/)[A-Za-z0-9][A-Za-z0-9._/-]*(?::[A-Za-z0-9][A-Za-z0-9._.-]*)?@sha256:[a-fA-F0-9]{64}$/u;
+export function isPinnedContainerImage(value) {
+    return FULL_DIGEST_CONTAINER_IMAGE.test(value);
+}
 //# sourceMappingURL=repository-security.js.map

package/dist/capabilities/repository-security-baseline/application/model/repository-security.js.map

@@ -1 +1 @@
-{"version":3,"file":"repository-security.js","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/model/repository-security.ts"],"names":[],"mappings":""}
+{"version":3,"file":"repository-security.js","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/model/repository-security.ts"],"names":[],"mappings":"AAIA,MAAM,eAAe,GACnB,4EAA4E,CAAC;AAC/E,MAAM,qBAAqB,GAAG,yCAAyC,CAAC;AAExE,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,CACL,kBAAkB,CAAC,KAAK,CAAC;QACzB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAa;IACvD,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAiFD,MAAM,UAAU,iCAAiC,CAC/C,QAAoD;IAEpD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO;QACL,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE;QACnD,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;QAC3C,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS;YAC/B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;KAC5D,CAAC;AACJ,CAAC;AAyCD,MAAM,UAAU,0BAA0B,CACxC,OAAsC;IAEtC,MAAM,SAAS,GAA8B,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,CAAC,UAAyC,EAAE,MAAe,EAAQ,EAAE;QAClF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;YACjD,MAAM,CAAC,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC,CAAC;IACF,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AA2BD,MAAM,2BAA2B,GAC/B,uGAAuG,CAAC;AAE1G,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACjD,CAAC"}

package/dist/capabilities/repository-security-baseline/application/policies/dependency-review-ordering.d.ts

@@ -0,0 +1,5 @@
+import type { FoundationDiagnostic } from "../../../../check-contract.js";
+import type { RepositorySecurityPolicy, WorkflowEvidence, WorkflowJobEvidence, WorkflowStepEvidence } from "../model/repository-security.js";
+export declare function isDependencyReviewEvidence(policy: RepositorySecurityPolicy, workflow: WorkflowEvidence, job: WorkflowJobEvidence, step: WorkflowStepEvidence): boolean;
+export declare function inspectDependencyReviewOrdering(policy: RepositorySecurityPolicy, workflow: WorkflowEvidence, job: WorkflowJobEvidence, diagnostics: FoundationDiagnostic[]): void;
+//# sourceMappingURL=dependency-review-ordering.d.ts.map

package/dist/capabilities/repository-security-baseline/application/policies/dependency-review-ordering.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-review-ordering.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/dependency-review-ordering.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EACV,wBAAwB,EACxB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACrB,MAAM,iCAAiC,CAAC;AA+DzC,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,wBAAwB,EAChC,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,EAAE,mBAAmB,EACxB,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAMT;AAkGD,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,wBAAwB,EAChC,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,EAAE,mBAAmB,EACxB,WAAW,EAAE,oBAAoB,EAAE,GAClC,IAAI,CAgCN"}