@agent-teams/engineering-foundation 0.4.1 → 0.6.0

package/dist/capabilities/repository-security-baseline/application/policies/dependency-review-ordering.js

@@ -0,0 +1,143 @@
+import { isPinnedExternalWorkflowUse } from "../model/repository-security.js";
+import { REPOSITORY_SECURITY_RULES } from "../rules.js";
+import { repositorySecurityDiagnostic as diagnostic } from "./repository-security-diagnostic.js";
+const EXPLICIT_STATUS_FUNCTION = /\b(?:always|cancelled|failure|success)\s*\(/iu;
+function overridesImplicitSuccessGate(value) {
+    // GitHub implicitly prepends success() only when an if expression contains no
+    // status function. Exact success() is also provable; all more complex status
+    // expressions fail closed because arbitrary expression equivalence is outside
+    // this policy.
+    if (value.condition === undefined || !EXPLICIT_STATUS_FUNCTION.test(value.condition)) {
+        return false;
+    }
+    const normalized = value.condition
+        .trim()
+        .replace(/^\$\{\{\s*/u, "")
+        .replace(/\s*\}\}$/u, "")
+        .trim();
+    return normalized !== "success()";
+}
+function inputIsEnabledOrAbsent(step, name) {
+    const value = step.inputs[name];
+    return (value === undefined ||
+        value === true ||
+        (typeof value === "string" && value.toLowerCase() === "true"));
+}
+function hasDependencyReviewSemantics(policy, job, step) {
+    return (job.id === policy.dependencyReview.jobId &&
+        !job.conditional &&
+        !job.nonBlocking &&
+        !step.conditional &&
+        !step.nonBlocking &&
+        step.inputs["base-ref"] === policy.dependencyReview.baseRef &&
+        step.inputs["head-ref"] === policy.dependencyReview.headRef &&
+        step.inputs["fail-on-severity"] === policy.dependencyReview.failOnSeverity &&
+        inputIsEnabledOrAbsent(step, "vulnerability-check") &&
+        (step.inputs["warn-only"] === false || step.inputs["warn-only"] === "false") &&
+        step.inputs["config-file"] === undefined &&
+        step.inputs["fail-on-scopes"] === undefined &&
+        step.inputs["allow-ghsas"] === undefined &&
+        step.uses?.startsWith("actions/dependency-review-action@") === true &&
+        isPinnedExternalWorkflowUse(step.uses));
+}
+export function isDependencyReviewEvidence(policy, workflow, job, step) {
+    return (workflow.path === policy.dependencyReview.workflowPath &&
+        workflow.unconditionalTriggers.includes("pull_request") &&
+        hasDependencyReviewSemantics(policy, job, step));
+}
+function repositoryCodeExecutionFromStep(step) {
+    if (step.run !== undefined) {
+        return Object.freeze({ kind: "run-step", value: step.run });
+    }
+    if (step.uses?.startsWith(".") === true) {
+        return Object.freeze({ kind: "local-action", value: step.uses });
+    }
+    return undefined;
+}
+function repositoryCodeExecutionFromJob(job) {
+    if (job.uses?.startsWith(".") === true) {
+        return Object.freeze({ kind: "reusable-workflow", value: job.uses });
+    }
+    return undefined;
+}
+function isPullRequestWorkflow(workflow) {
+    return (workflow.triggers.includes("pull_request") ||
+        workflow.triggers.includes("pull_request_target"));
+}
+function validLocalDependencyReviewJob(policy, workflow) {
+    const reviewJob = workflow.jobs.find((candidate) => candidate.id === policy.dependencyReview.jobId);
+    if (!workflow.triggers.includes("pull_request") ||
+        reviewJob === undefined ||
+        !reviewJob.steps.some((step) => hasDependencyReviewSemantics(policy, reviewJob, step))) {
+        return undefined;
+    }
+    return reviewJob;
+}
+function dependsOnDeclaredDependencyReview(policy, workflow, job, reviewJob) {
+    if (job.nonBlocking || overridesImplicitSuccessGate(job)) {
+        return false;
+    }
+    const jobsById = new Map(workflow.jobs.map((candidate) => [candidate.id, candidate]));
+    const dependsOnReview = (jobId, ancestors) => {
+        if (ancestors.has(jobId)) {
+            return false;
+        }
+        const nextAncestors = new Set(ancestors);
+        nextAncestors.add(jobId);
+        const candidate = jobsById.get(jobId);
+        if (candidate === undefined ||
+            candidate.nonBlocking ||
+            overridesImplicitSuccessGate(candidate)) {
+            return false;
+        }
+        if (candidate.id === reviewJob.id) {
+            return true;
+        }
+        return candidate.needs.some((dependency) => dependsOnReview(dependency, nextAncestors));
+    };
+    return job.needs.some((dependency) => dependsOnReview(dependency, new Set()));
+}
+function orderingDiagnostic(policy, workflow, job, execution) {
+    return diagnostic({
+        rule: REPOSITORY_SECURITY_RULES.dependencyReviewOrdering,
+        subject: `${workflow.path}:${job.id}`,
+        path: workflow.path,
+        message: "A pull-request workflow can execute before the declared Dependency Review gate.",
+        evidence: [
+            { kind: "dependency-review-job", value: policy.dependencyReview.jobId },
+            { kind: "repository-code-execution", value: execution.kind },
+            { kind: "repository-code-command", value: execution.value }
+        ]
+    });
+}
+export function inspectDependencyReviewOrdering(policy, workflow, job, diagnostics) {
+    if (!isPullRequestWorkflow(workflow)) {
+        return;
+    }
+    const reviewJob = validLocalDependencyReviewJob(policy, workflow);
+    if (workflow.path === policy.dependencyReview.workflowPath && reviewJob === undefined) {
+        return;
+    }
+    const dependsOnBlockingReview = reviewJob === undefined
+        ? false
+        : dependsOnDeclaredDependencyReview(policy, workflow, job, reviewJob);
+    const jobExecution = repositoryCodeExecutionFromJob(job);
+    if (jobExecution !== undefined && !dependsOnBlockingReview) {
+        diagnostics.push(orderingDiagnostic(policy, workflow, job, jobExecution));
+        return;
+    }
+    let reviewHasRunInJob = false;
+    for (const step of job.steps) {
+        if (hasDependencyReviewSemantics(policy, job, step)) {
+            reviewHasRunInJob = true;
+        }
+        const execution = repositoryCodeExecutionFromStep(step);
+        const sameJobGateCanBeBypassed = reviewHasRunInJob && overridesImplicitSuccessGate(step);
+        if (execution !== undefined &&
+            ((!reviewHasRunInJob && !dependsOnBlockingReview) || sameJobGateCanBeBypassed)) {
+            diagnostics.push(orderingDiagnostic(policy, workflow, job, execution));
+            return;
+        }
+    }
+}
+//# sourceMappingURL=dependency-review-ordering.js.map

package/dist/capabilities/repository-security-baseline/application/policies/dependency-review-ordering.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-review-ordering.js","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/dependency-review-ordering.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,4BAA4B,IAAI,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAOjG,MAAM,wBAAwB,GAAG,+CAA+C,CAAC;AAEjF,SAAS,4BAA4B,CACnC,KAAiD;IAEjD,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,eAAe;IACf,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACrF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS;SAC/B,IAAI,EAAE;SACN,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;SAC1B,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;SACxB,IAAI,EAAE,CAAC;IACV,OAAO,UAAU,KAAK,WAAW,CAAC;AACpC,CAAC;AAED,SAAS,sBAAsB,CAAC,IAA0B,EAAE,IAAY;IACtE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,CACL,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,IAAI;QACd,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CACnC,MAAgC,EAChC,GAAwB,EACxB,IAA0B;IAE1B,OAAO,CACL,GAAG,CAAC,EAAE,KAAK,MAAM,CAAC,gBAAgB,CAAC,KAAK;QACxC,CAAC,GAAG,CAAC,WAAW;QAChB,CAAC,GAAG,CAAC,WAAW;QAChB,CAAC,IAAI,CAAC,WAAW;QACjB,CAAC,IAAI,CAAC,WAAW;QACjB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC,gBAAgB,CAAC,OAAO;QAC3D,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC,gBAAgB,CAAC,OAAO;QAC3D,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,MAAM,CAAC,gBAAgB,CAAC,cAAc;QAC1E,sBAAsB,CAAC,IAAI,EAAE,qBAAqB,CAAC;QACnD,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,SAAS;QACxC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,SAAS;QAC3C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,SAAS;QACxC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,mCAAmC,CAAC,KAAK,IAAI;QACnE,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,MAAgC,EAChC,QAA0B,EAC1B,GAAwB,EACxB,IAA0B;IAE1B,OAAO,CACL,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,gBAAgB,CAAC,YAAY;QACtD,QAAQ,CAAC,qBAAqB,CAAC,QAAQ,CAAC,cAAc,CAAC;QACvD,4BAA4B,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CACtC,IAA0B;IAE1B,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,8BAA8B,CACrC,GAAwB;IAExB,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,qBAAqB,CAAC,QAA0B;IACvD,OAAO,CACL,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC1C,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAClD,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,MAAgC,EAChC,QAA0B;IAE1B,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACpG,IACE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC3C,SAAS,KAAK,SAAS;QACvB,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC7B,4BAA4B,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CACtD,EACD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iCAAiC,CACxC,MAAgC,EAChC,QAA0B,EAC1B,GAAwB,EACxB,SAA8B;IAE9B,IAAI,GAAG,CAAC,WAAW,IAAI,4BAA4B,CAAC,GAAG,CAAC,EAAE,CAAC;QACzD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IACtF,MAAM,eAAe,GAAG,CAAC,KAAa,EAAE,SAA8B,EAAW,EAAE;QACjF,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IACE,SAAS,KAAK,SAAS;YACvB,SAAS,CAAC,WAAW;YACrB,4BAA4B,CAAC,SAAS,CAAC,EACvC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,SAAS,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC;IAC1F,CAAC,CAAC;IACF,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAgC,EAChC,QAA0B,EAC1B,GAAwB,EACxB,SAAkC;IAElC,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,yBAAyB,CAAC,wBAAwB;QACxD,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE;QACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,OAAO,EAAE,iFAAiF;QAC1F,QAAQ,EAAE;YACR,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE;YACvE,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE;YAC5D,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE;SAC5D;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,MAAgC,EAChC,QAA0B,EAC1B,GAAwB,EACxB,WAAmC;IAEnC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,6BAA6B,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClE,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,gBAAgB,CAAC,YAAY,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACtF,OAAO;IACT,CAAC;IACD,MAAM,uBAAuB,GAC3B,SAAS,KAAK,SAAS;QACrB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,iCAAiC,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IAC1E,MAAM,YAAY,GAAG,8BAA8B,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC3D,WAAW,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;QAC1E,OAAO;IACT,CAAC;IACD,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,4BAA4B,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;YACpD,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;QACD,MAAM,SAAS,GAAG,+BAA+B,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,wBAAwB,GAAG,iBAAiB,IAAI,4BAA4B,CAAC,IAAI,CAAC,CAAC;QACzF,IACE,SAAS,KAAK,SAAS;YACvB,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,uBAAuB,CAAC,IAAI,wBAAwB,CAAC,EAC9E,CAAC;YACD,WAAW,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-security-tools.d.ts

@@ -0,0 +1,4 @@
+import type { FoundationDiagnostic } from "../../../../check-contract.js";
+import type { RepositorySecurityEvidence, RepositorySecurityPolicy } from "../model/repository-security.js";
+export declare function evaluateRepositorySecurityTools(policy: RepositorySecurityPolicy, evidence: RepositorySecurityEvidence, diagnostics: FoundationDiagnostic[]): void;
+//# sourceMappingURL=evaluate-repository-security-tools.d.ts.map

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-security-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-repository-security-tools.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/evaluate-repository-security-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC9F,OAAO,KAAK,EACV,0BAA0B,EAC1B,wBAAwB,EAKzB,MAAM,iCAAiC,CAAC;AAqKzC,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,wBAAwB,EAChC,QAAQ,EAAE,0BAA0B,EACpC,WAAW,EAAE,oBAAoB,EAAE,GAClC,IAAI,CAaN"}

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-security-tools.js

@@ -0,0 +1,136 @@
+import { configuredRepositorySecurityTools } from "../model/repository-security.js";
+import { REPOSITORY_SECURITY_RULES } from "../rules.js";
+import { repositorySecurityDiagnostic as diagnostic } from "./repository-security-diagnostic.js";
+function severityForRollout(rollout) {
+    return rollout === "blocking" ? "error" : "warning";
+}
+function jobMatchesToolRollout(job, rollout) {
+    return !job.conditional && (rollout === "blocking" ? !job.nonBlocking : job.nonBlocking);
+}
+function workflowMatchesToolRollout(workflow, rollout) {
+    return rollout !== "blocking" || workflow.unconditionalTriggers.includes("pull_request");
+}
+function jobInvokes(job, invocationUse, rollout) {
+    if (job.uses === invocationUse) {
+        return true;
+    }
+    return job.steps.some((step) => step.uses === invocationUse &&
+        !step.conditional &&
+        (rollout !== "blocking" || !step.nonBlocking));
+}
+function evaluateToolBinding(input) {
+    const { diagnostics, evidence, expected, observedEvidence } = input;
+    const severity = severityForRollout(expected.policy.rollout);
+    const workflow = evidence.workflows.find((candidate) => candidate.path === expected.policy.workflowPath);
+    const job = workflow?.jobs.find((candidate) => candidate.id === expected.policy.jobId);
+    if (workflow === undefined || job === undefined) {
+        diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.toolEvidenceJobMissing,
+            severity,
+            subject: `${expected.policy.workflowPath}:${expected.policy.jobId}`,
+            path: expected.policy.workflowPath,
+            message: `Declared ${expected.tool} external gate job is unavailable.`,
+            evidence: [{ kind: "tool", value: expected.tool }]
+        }));
+    }
+    else if (!workflowMatchesToolRollout(workflow, expected.policy.rollout) ||
+        !jobMatchesToolRollout(job, expected.policy.rollout)) {
+        diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.toolEvidenceRolloutMismatch,
+            severity,
+            subject: `${expected.policy.workflowPath}:${expected.policy.jobId}`,
+            path: expected.policy.workflowPath,
+            message: `Declared ${expected.tool} external gate job does not match ${expected.policy.rollout} rollout.`,
+            evidence: [{ kind: "tool", value: expected.tool }]
+        }));
+    }
+    else if (!jobInvokes(job, expected.policy.invocationUse, expected.policy.rollout)) {
+        diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.toolEvidenceInvocationMissing,
+            severity,
+            subject: `${expected.policy.workflowPath}:${expected.policy.jobId}`,
+            path: expected.policy.workflowPath,
+            message: `Declared ${expected.tool} external gate job does not invoke its reviewed immutable runner.`,
+            evidence: [{ kind: "invocation-use", value: expected.policy.invocationUse }]
+        }));
+    }
+    if (observedEvidence === undefined || observedEvidence.kind === "missing") {
+        diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.toolEvidenceMissing,
+            severity,
+            subject: expected.tool,
+            path: expected.policy.evidencePath,
+            message: `Required ${expected.tool} ${observedEvidence?.kind === "missing" ? observedEvidence.missing : "evidence"} is unavailable.`,
+            evidence: [
+                { kind: "evidence-path", value: expected.policy.evidencePath },
+                { kind: "result-path", value: expected.policy.resultPath }
+            ]
+        }));
+        return;
+    }
+    if (observedEvidence.toolVersion !== expected.policy.version) {
+        diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.toolEvidenceVersionMismatch,
+            severity,
+            subject: expected.tool,
+            path: expected.policy.evidencePath,
+            message: `${expected.tool} evidence was produced by ${observedEvidence.toolVersion}, not declared version ${expected.policy.version}.`,
+            evidence: [
+                { kind: "actual-version", value: observedEvidence.toolVersion },
+                { kind: "expected-version", value: expected.policy.version }
+            ]
+        }));
+    }
+    if (observedEvidence.configDigest !== observedEvidence.actualConfigDigest ||
+        observedEvidence.workflowDigest !== observedEvidence.actualWorkflowDigest) {
+        diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.toolEvidenceStale,
+            severity,
+            subject: expected.tool,
+            path: expected.policy.evidencePath,
+            message: `${expected.tool} evidence does not match the current opaque tool config or workflow inputs.`,
+            evidence: [
+                { kind: "actual-config-digest", value: observedEvidence.actualConfigDigest },
+                { kind: "actual-workflow-digest", value: observedEvidence.actualWorkflowDigest },
+                { kind: "reported-config-digest", value: observedEvidence.configDigest },
+                { kind: "reported-workflow-digest", value: observedEvidence.workflowDigest }
+            ]
+        }));
+    }
+    if (observedEvidence.resultDigest !== observedEvidence.actualResultDigest) {
+        diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.toolEvidenceResultDigestMismatch,
+            severity,
+            subject: expected.tool,
+            path: expected.policy.resultPath,
+            message: `${expected.tool} result artifact does not match its evidence digest.`,
+            evidence: [
+                { kind: "actual-result-digest", value: observedEvidence.actualResultDigest },
+                { kind: "reported-result-digest", value: observedEvidence.resultDigest }
+            ]
+        }));
+    }
+    if (observedEvidence.outcome === "failed") {
+        diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.toolEvidenceFailed,
+            severity,
+            subject: expected.tool,
+            path: expected.policy.evidencePath,
+            message: `${expected.tool} evidence reports a failed tool execution.`,
+            evidence: [{ kind: "result-digest", value: observedEvidence.resultDigest }]
+        }));
+    }
+}
+export function evaluateRepositorySecurityTools(policy, evidence, diagnostics) {
+    const observed = new Map(evidence.toolEvidence.map((entry) => [entry.tool, entry]));
+    for (const expected of configuredRepositorySecurityTools(policy.toolEvidence)) {
+        const observedEvidence = observed.get(expected.tool);
+        evaluateToolBinding({
+            diagnostics,
+            evidence,
+            expected,
+            ...(observedEvidence === undefined ? {} : { observedEvidence })
+        });
+    }
+}
+//# sourceMappingURL=evaluate-repository-security-tools.js.map

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-security-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-repository-security-tools.js","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/evaluate-repository-security-tools.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AACpF,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,4BAA4B,IAAI,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAEjG,SAAS,kBAAkB,CAAC,OAA4B;IACtD,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAwB,EAAE,OAA4B;IACnF,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,0BAA0B,CACjC,QAAyD,EACzD,OAA4B;IAE5B,OAAO,OAAO,KAAK,UAAU,IAAI,QAAQ,CAAC,qBAAqB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,UAAU,CACjB,GAAwB,EACxB,aAAqB,EACrB,OAA4B;IAE5B,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CACnB,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,IAAI,KAAK,aAAa;QAC3B,CAAC,IAAI,CAAC,WAAW;QACjB,CAAC,OAAO,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAK5B;IACC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC;IACpE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CACtC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,CAAC,YAAY,CAC/D,CAAC;IACF,MAAM,GAAG,GAAG,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvF,IAAI,QAAQ,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QAChD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,sBAAsB;YACtD,QAAQ;YACR,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE;YACnE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;YAClC,OAAO,EAAE,YAAY,QAAQ,CAAC,IAAI,oCAAoC;YACtE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;SACnD,CAAC,CACH,CAAC;IACJ,CAAC;SAAM,IACL,CAAC,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;QAC9D,CAAC,qBAAqB,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EACpD,CAAC;QACD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,2BAA2B;YAC3D,QAAQ;YACR,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE;YACnE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;YAClC,OAAO,EAAE,YAAY,QAAQ,CAAC,IAAI,qCAAqC,QAAQ,CAAC,MAAM,CAAC,OAAO,WAAW;YACzG,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;SACnD,CAAC,CACH,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACpF,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,6BAA6B;YAC7D,QAAQ;YACR,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE;YACnE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;YAClC,OAAO,EAAE,YAAY,QAAQ,CAAC,IAAI,mEAAmE;YACrG,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;SAC7E,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC1E,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,mBAAmB;YACnD,QAAQ;YACR,OAAO,EAAE,QAAQ,CAAC,IAAI;YACtB,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;YAClC,OAAO,EAAE,YAAY,QAAQ,CAAC,IAAI,IAAI,gBAAgB,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,kBAAkB;YACpI,QAAQ,EAAE;gBACR,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE;gBAC9D,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE;aAC3D;SACF,CAAC,CACH,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,gBAAgB,CAAC,WAAW,KAAK,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC7D,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,2BAA2B;YAC3D,QAAQ;YACR,OAAO,EAAE,QAAQ,CAAC,IAAI;YACtB,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;YAClC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,6BAA6B,gBAAgB,CAAC,WAAW,0BAA0B,QAAQ,CAAC,MAAM,CAAC,OAAO,GAAG;YACtI,QAAQ,EAAE;gBACR,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,CAAC,WAAW,EAAE;gBAC/D,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE;aAC7D;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IACE,gBAAgB,CAAC,YAAY,KAAK,gBAAgB,CAAC,kBAAkB;QACrE,gBAAgB,CAAC,cAAc,KAAK,gBAAgB,CAAC,oBAAoB,EACzE,CAAC;QACD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,iBAAiB;YACjD,QAAQ;YACR,OAAO,EAAE,QAAQ,CAAC,IAAI;YACtB,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;YAClC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,6EAA6E;YACtG,QAAQ,EAAE;gBACR,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,gBAAgB,CAAC,kBAAkB,EAAE;gBAC5E,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,gBAAgB,CAAC,oBAAoB,EAAE;gBAChF,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,gBAAgB,CAAC,YAAY,EAAE;gBACxE,EAAE,IAAI,EAAE,0BAA0B,EAAE,KAAK,EAAE,gBAAgB,CAAC,cAAc,EAAE;aAC7E;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,CAAC,YAAY,KAAK,gBAAgB,CAAC,kBAAkB,EAAE,CAAC;QAC1E,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,gCAAgC;YAChE,QAAQ;YACR,OAAO,EAAE,QAAQ,CAAC,IAAI;YACtB,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU;YAChC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,sDAAsD;YAC/E,QAAQ,EAAE;gBACR,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,gBAAgB,CAAC,kBAAkB,EAAE;gBAC5E,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,gBAAgB,CAAC,YAAY,EAAE;aACzE;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC1C,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,QAAQ;YACR,OAAO,EAAE,QAAQ,CAAC,IAAI;YACtB,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;YAClC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,4CAA4C;YACrE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,gBAAgB,CAAC,YAAY,EAAE,CAAC;SAC5E,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,MAAgC,EAChC,QAAoC,EACpC,WAAmC;IAEnC,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAC1D,CAAC;IACF,KAAK,MAAM,QAAQ,IAAI,iCAAiC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9E,MAAM,gBAAgB,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrD,mBAAmB,CAAC;YAClB,WAAW;YACX,QAAQ;YACR,QAAQ;YACR,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate-repository-security.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAEV,0BAA0B,EAC1B,wBAAwB,EAGzB,MAAM,iCAAiC,CAAC;AA0HzC,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,wBAAwB,EAChC,QAAQ,EAAE,0BAA0B,GACnC,SAAS,oBAAoB,EAAE,CAuLjC"}
+{"version":3,"file":"evaluate-repository-security.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAGV,0BAA0B,EAC1B,wBAAwB,EAGzB,MAAM,iCAAiC,CAAC;AAkWzC,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,wBAAwB,EAChC,QAAQ,EAAE,0BAA0B,GACnC,SAAS,oBAAoB,EAAE,CAoDjC"}