@agent-teams/engineering-foundation 0.4.1 → 0.6.0

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.js

@@ -1,22 +1,12 @@
+import { isPinnedContainerImage, isPinnedExternalWorkflowUse, isSafeLocalWorkflowUse } from "../model/repository-security.js";
 import { REPOSITORY_SECURITY_RULES } from "../rules.js";
-const FULL_SHA_ACTION = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_./-]+)?@[0-9a-fA-F]{40}$/u;
-const FULL_DIGEST_CONTAINER = /^docker:\/\/.+@sha256:[0-9a-fA-F]{64}$/u;
+import { inspectDependencyReviewOrdering, isDependencyReviewEvidence } from "./dependency-review-ordering.js";
+import { evaluateRepositorySecurityTools } from "./evaluate-repository-security-tools.js";
+import { evaluateRepositoryWorkflowUses } from "./evaluate-repository-workflow-uses.js";
+import { repositorySecurityDiagnostic as diagnostic } from "./repository-security-diagnostic.js";
 const UNSAFE_PACKAGE_SEGMENT = /^(?:\.env(?:\..*)?|\.git|node_modules|src|tests?|auth\.json)$/iu;
 const PACKAGE_PATH_META = /[*?{}[\]\\]/u;
 const UNTRUSTED_EXPRESSION_IN_RUN = /\$\{\{[^}]*github\s*(?:\.\s*(?:event|head_ref)\b|\[\s*["'](?:event|head_ref)["']\s*\])/iu;
-function diagnostic(input) {
-    return {
-        ruleId: input.rule.id,
-        severity: input.rule.severity,
-        subject: input.subject,
-        message: input.message,
-        location: { path: input.path },
-        relatedLocations: [],
-        evidence: input.evidence ?? [],
-        remediation: input.rule.remediation,
-        requiresArchitectureReview: input.rule.requiresArchitectureReview
-    };
-}
 function exactPermissions(actual, expected) {
     const actualEntries = Object.entries(actual).toSorted(([left], [right]) => left < right ? -1 : left > right ? 1 : 0);
     const expectedEntries = Object.entries(expected).toSorted(([left], [right]) => left < right ? -1 : left > right ? 1 : 0);
@@ -26,10 +16,10 @@ function policyForJob(policy, workflowPath, jobId) {
     return policy.privilegedJobs.find((candidate) => candidate.workflowPath === workflowPath && candidate.jobId === jobId);
 }
 function actionPinned(action) {
-    if (action.startsWith("./")) {
-        return !action.split("/").includes("..") && !action.includes("${{");
+    if (isSafeLocalWorkflowUse(action)) {
+        return true;
     }
-    return FULL_SHA_ACTION.test(action) || FULL_DIGEST_CONTAINER.test(action);
+    return isPinnedExternalWorkflowUse(action);
 }
 function jobPermissions(job, workflowPermissions) {
     return job.permissions ?? workflowPermissions;
@@ -40,12 +30,6 @@ function inputIsEnabledOrAbsent(step, name) {
         value === true ||
         (typeof value === "string" && value.toLowerCase() === "true"));
 }
-function inputIsDisabledOrAbsent(step, name) {
-    const value = step.inputs[name];
-    return (value === undefined ||
-        value === false ||
-        (typeof value === "string" && value.toLowerCase() === "false"));
-}
 function scansRepositoryRoot(step) {
     const path = step.inputs["path"];
     return ((path === undefined || path === "." || path === "./") &&
@@ -65,125 +49,200 @@ function unsafePackagePath(entry) {
         segment === ".." ||
         UNSAFE_PACKAGE_SEGMENT.test(segment));
 }
-export function evaluateRepositorySecurity(policy, evidence) {
-    const diagnostics = [];
-    const seenPrivilegedJobs = new Set();
-    let dependencyReviewFound = false;
-    let sbomFound = false;
-    for (const workflow of evidence.workflows) {
-        if (workflow.permissions === undefined ||
-            typeof workflow.permissions === "string" ||
-            Object.values(workflow.permissions).some((value) => value === "write")) {
-            diagnostics.push(diagnostic({
-                rule: REPOSITORY_SECURITY_RULES.permissionsInvalid,
-                subject: workflow.path,
-                path: workflow.path,
-                message: "Workflow root permissions are missing, broad, or write-capable."
-            }));
-        }
-        if (workflow.triggers.includes("pull_request_target")) {
+function inspectContainerImage(policy, workflow, job, container, state) {
+    const subject = `${workflow.path}:${job.id}.${container.scope}.${container.name}`;
+    if (!isPinnedContainerImage(container.image)) {
+        state.diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.containerNotPinned,
+            subject,
+            path: workflow.path,
+            message: `Container image is not pinned to an immutable digest: ${container.image}.`,
+            evidence: [{ kind: "container-image", value: container.image }]
+        }));
+        return;
+    }
+    state.seenContainerImages.add(container.image);
+    if (!policy.allowedContainerImages.includes(container.image)) {
+        state.diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.containerNotAllowlisted,
+            subject,
+            path: workflow.path,
+            message: `Pinned container image is not declared in allowedContainerImages: ${container.image}.`,
+            evidence: [{ kind: "container-image", value: container.image }]
+        }));
+    }
+}
+function isSbomEvidence(policy, workflow, job, step) {
+    return (workflow.path === policy.sbomWorkflow &&
+        workflow.unconditionalTriggers.includes("pull_request") &&
+        !job.conditional &&
+        !job.nonBlocking &&
+        !step.conditional &&
+        !step.nonBlocking &&
+        inputIsEnabledOrAbsent(step, "upload-artifact") &&
+        scansRepositoryRoot(step) &&
+        step.uses?.startsWith("anchore/sbom-action@") === true &&
+        actionPinned(step.uses));
+}
+function inspectWorkflowRoot(workflow, state) {
+    if (workflow.permissions === undefined ||
+        typeof workflow.permissions === "string" ||
+        Object.values(workflow.permissions).some((value) => value === "write")) {
+        state.diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.permissionsInvalid,
+            subject: workflow.path,
+            path: workflow.path,
+            message: "Workflow root permissions are missing, broad, or write-capable."
+        }));
+    }
+    if (workflow.triggers.includes("pull_request_target")) {
+        state.diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.dangerousTrigger,
+            subject: workflow.path,
+            path: workflow.path,
+            message: "Workflow uses prohibited pull_request_target."
+        }));
+    }
+}
+function inspectWorkflowStep(policy, workflow, job, step, state) {
+    const subject = `${workflow.path}:${job.id}`;
+    if (step.uses !== undefined && !actionPinned(step.uses)) {
+        state.diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.actionNotPinned,
+            subject,
+            path: workflow.path,
+            message: `Action is not pinned to immutable evidence: ${step.uses}.`,
+            evidence: [{ kind: "action", value: step.uses }]
+        }));
+    }
+    if (step.run !== undefined && UNTRUSTED_EXPRESSION_IN_RUN.test(step.run)) {
+        state.diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.eventInterpolationInRun,
+            subject,
+            path: workflow.path,
+            message: "Shell script directly interpolates github.event data."
+        }));
+    }
+    if (isDependencyReviewEvidence(policy, workflow, job, step)) {
+        state.dependencyReviewFound = true;
+    }
+    if (isSbomEvidence(policy, workflow, job, step)) {
+        state.sbomFound = true;
+    }
+}
+function inspectWorkflowJob(policy, workflow, job, state) {
+    const subject = `${workflow.path}:${job.id}`;
+    const permissionSet = jobPermissions(job, workflow.permissions);
+    const privileged = policyForJob(policy, workflow.path, job.id);
+    if (privileged !== undefined) {
+        state.seenPrivilegedJobs.add(subject);
+    }
+    const hasWrite = permissionSet === "write-all" ||
+        (typeof permissionSet === "object" &&
+            Object.values(permissionSet).some((value) => value === "write"));
+    const privilegeMismatch = privileged === undefined
+        ? hasWrite
+        : typeof permissionSet !== "object" ||
+            !exactPermissions(permissionSet, privileged.permissions);
+    if (privilegeMismatch) {
+        state.diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.privilegedJobMismatch,
+            subject,
+            path: workflow.path,
+            message: "Job permissions do not match one exact privileged-job declaration."
+        }));
+    }
+    if (job.uses !== undefined && !actionPinned(job.uses)) {
+        state.diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.actionNotPinned,
+            subject,
+            path: workflow.path,
+            message: `Reusable workflow is not pinned to immutable evidence: ${job.uses}.`,
+            evidence: [{ kind: "action", value: job.uses }]
+        }));
+    }
+    for (const container of job.containers) {
+        inspectContainerImage(policy, workflow, job, container, state);
+    }
+    for (const step of job.steps) {
+        inspectWorkflowStep(policy, workflow, job, step, state);
+    }
+}
+function inspectCompositeAction(action, diagnostics) {
+    for (const [index, step] of action.steps.entries()) {
+        if (step.run !== undefined && UNTRUSTED_EXPRESSION_IN_RUN.test(step.run)) {
             diagnostics.push(diagnostic({
-                rule: REPOSITORY_SECURITY_RULES.dangerousTrigger,
-                subject: workflow.path,
-                path: workflow.path,
-                message: "Workflow uses prohibited pull_request_target."
+                rule: REPOSITORY_SECURITY_RULES.eventInterpolationInRun,
+                subject: `${action.path}:runs.steps[${index}]`,
+                path: action.path,
+                message: "Composite action shell script directly interpolates github.event data."
             }));
         }
-        for (const job of workflow.jobs) {
-            const permissionSet = jobPermissions(job, workflow.permissions);
-            const privileged = policyForJob(policy, workflow.path, job.id);
-            if (privileged !== undefined) {
-                seenPrivilegedJobs.add(`${workflow.path}:${job.id}`);
-            }
-            const hasWrite = permissionSet === "write-all" ||
-                (typeof permissionSet === "object" &&
-                    Object.values(permissionSet).some((value) => value === "write"));
-            const privilegeMismatch = privileged === undefined
-                ? hasWrite
-                : typeof permissionSet !== "object" ||
-                    !exactPermissions(permissionSet, privileged.permissions);
-            if (privilegeMismatch) {
-                diagnostics.push(diagnostic({
-                    rule: REPOSITORY_SECURITY_RULES.privilegedJobMismatch,
-                    subject: `${workflow.path}:${job.id}`,
-                    path: workflow.path,
-                    message: "Job permissions do not match one exact privileged-job declaration."
-                }));
-            }
-            if (job.uses !== undefined && !actionPinned(job.uses)) {
-                diagnostics.push(diagnostic({
-                    rule: REPOSITORY_SECURITY_RULES.actionNotPinned,
-                    subject: `${workflow.path}:${job.id}`,
-                    path: workflow.path,
-                    message: `Reusable workflow is not pinned to immutable evidence: ${job.uses}.`,
-                    evidence: [{ kind: "action", value: job.uses }]
-                }));
-            }
-            for (const step of job.steps) {
-                if (step.uses !== undefined && !actionPinned(step.uses)) {
-                    diagnostics.push(diagnostic({
-                        rule: REPOSITORY_SECURITY_RULES.actionNotPinned,
-                        subject: `${workflow.path}:${job.id}`,
-                        path: workflow.path,
-                        message: `Action is not pinned to immutable evidence: ${step.uses}.`,
-                        evidence: [{ kind: "action", value: step.uses }]
-                    }));
-                }
-                if (step.run !== undefined && UNTRUSTED_EXPRESSION_IN_RUN.test(step.run)) {
-                    diagnostics.push(diagnostic({
-                        rule: REPOSITORY_SECURITY_RULES.eventInterpolationInRun,
-                        subject: `${workflow.path}:${job.id}`,
-                        path: workflow.path,
-                        message: "Shell script directly interpolates github.event data."
-                    }));
-                }
-                if (workflow.path === policy.dependencyReviewWorkflow &&
-                    workflow.unconditionalTriggers.includes("pull_request") &&
-                    !job.conditional &&
-                    !job.nonBlocking &&
-                    !step.conditional &&
-                    !step.nonBlocking &&
-                    inputIsDisabledOrAbsent(step, "warn-only") &&
-                    step.inputs["config-file"] === undefined &&
-                    step.uses?.startsWith("actions/dependency-review-action@") === true &&
-                    actionPinned(step.uses)) {
-                    dependencyReviewFound = true;
-                }
-                if (workflow.path === policy.sbomWorkflow &&
-                    workflow.unconditionalTriggers.includes("pull_request") &&
-                    !job.conditional &&
-                    !job.nonBlocking &&
-                    !step.conditional &&
-                    !step.nonBlocking &&
-                    inputIsEnabledOrAbsent(step, "upload-artifact") &&
-                    scansRepositoryRoot(step) &&
-                    step.uses?.startsWith("anchore/sbom-action@") === true &&
-                    actionPinned(step.uses)) {
-                    sbomFound = true;
-                }
-            }
-        }
     }
-    if (!dependencyReviewFound) {
-        diagnostics.push(diagnostic({
+}
+function inspectRequiredEvidence(policy, state) {
+    if (!state.dependencyReviewFound) {
+        state.diagnostics.push(diagnostic({
             rule: REPOSITORY_SECURITY_RULES.dependencyReviewMissing,
-            subject: policy.dependencyReviewWorkflow,
-            path: policy.dependencyReviewWorkflow,
+            subject: `${policy.dependencyReview.workflowPath}:${policy.dependencyReview.jobId}`,
+            path: policy.dependencyReview.workflowPath,
             message: "Declared dependency-review workflow does not run the pinned official action."
         }));
     }
-    if (!sbomFound) {
-        diagnostics.push(diagnostic({
+    if (!state.sbomFound) {
+        state.diagnostics.push(diagnostic({
             rule: REPOSITORY_SECURITY_RULES.sbomMissing,
             subject: policy.sbomWorkflow,
             path: policy.sbomWorkflow,
             message: "Declared SBOM workflow does not run the pinned Anchore action."
         }));
     }
+}
+function inspectPackageEvidence(packageEvidence, diagnostics) {
+    if (!packageEvidence.provenance) {
+        diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.packageProvenanceMissing,
+            subject: packageEvidence.packageName,
+            path: packageEvidence.manifestPath,
+            message: "Publishable package does not enable npm provenance."
+        }));
+    }
+    const unsafeFiles = packageEvidence.files?.filter(unsafePackagePath);
+    if (packageEvidence.files === undefined ||
+        packageEvidence.files.length === 0 ||
+        (unsafeFiles !== undefined && unsafeFiles.length > 0)) {
+        diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.packageFilesUnsafe,
+            subject: packageEvidence.packageName,
+            path: packageEvidence.manifestPath,
+            message: "Publishable package files allowlist is missing or unsafe.",
+            evidence: (unsafeFiles ?? []).map((value) => ({ kind: "unsafe-path", value }))
+        }));
+    }
+}
+export function evaluateRepositorySecurity(policy, evidence) {
+    const state = {
+        diagnostics: [],
+        seenContainerImages: new Set(),
+        seenPrivilegedJobs: new Set(),
+        dependencyReviewFound: false,
+        sbomFound: false
+    };
+    for (const workflow of evidence.workflows) {
+        inspectWorkflowRoot(workflow, state);
+        for (const job of workflow.jobs) {
+            inspectWorkflowJob(policy, workflow, job, state);
+            inspectDependencyReviewOrdering(policy, workflow, job, state.diagnostics);
+        }
+    }
+    for (const action of evidence.compositeActions) {
+        inspectCompositeAction(action, state.diagnostics);
+    }
+    inspectRequiredEvidence(policy, state);
     for (const privileged of policy.privilegedJobs) {
         const key = `${privileged.workflowPath}:${privileged.jobId}`;
-        if (!seenPrivilegedJobs.has(key)) {
-            diagnostics.push(diagnostic({
+        if (!state.seenPrivilegedJobs.has(key)) {
+            state.diagnostics.push(diagnostic({
                 rule: REPOSITORY_SECURITY_RULES.stalePrivilegedJob,
                 subject: key,
                 path: privileged.workflowPath,
@@ -191,28 +250,22 @@ export function evaluateRepositorySecurity(policy, evidence) {
             }));
         }
     }
-    for (const packageEvidence of evidence.packages) {
-        if (!packageEvidence.provenance) {
-            diagnostics.push(diagnostic({
-                rule: REPOSITORY_SECURITY_RULES.packageProvenanceMissing,
-                subject: packageEvidence.packageName,
-                path: packageEvidence.manifestPath,
-                message: "Publishable package does not enable npm provenance."
-            }));
-        }
-        const unsafeFiles = packageEvidence.files?.filter(unsafePackagePath);
-        if (packageEvidence.files === undefined ||
-            packageEvidence.files.length === 0 ||
-            (unsafeFiles !== undefined && unsafeFiles.length > 0)) {
-            diagnostics.push(diagnostic({
-                rule: REPOSITORY_SECURITY_RULES.packageFilesUnsafe,
-                subject: packageEvidence.packageName,
-                path: packageEvidence.manifestPath,
-                message: "Publishable package files allowlist is missing or unsafe.",
-                evidence: (unsafeFiles ?? []).map((value) => ({ kind: "unsafe-path", value }))
+    for (const image of policy.allowedContainerImages) {
+        if (!state.seenContainerImages.has(image)) {
+            state.diagnostics.push(diagnostic({
+                rule: REPOSITORY_SECURITY_RULES.staleAllowedContainerImage,
+                subject: image,
+                path: policy.workflowDirectory,
+                message: "Declared allowedContainerImages entry has no matching job or service container.",
+                evidence: [{ kind: "container-image", value: image }]
             }));
         }
     }
-    return diagnostics;
+    evaluateRepositoryWorkflowUses(policy, evidence, state.diagnostics);
+    evaluateRepositorySecurityTools(policy, evidence, state.diagnostics);
+    for (const packageEvidence of evidence.packages) {
+        inspectPackageEvidence(packageEvidence, state.diagnostics);
+    }
+    return state.diagnostics;
 }
 //# sourceMappingURL=evaluate-repository-security.js.map

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.js.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate-repository-security.js","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,yBAAyB,EAE1B,MAAM,aAAa,CAAC;AAErB,MAAM,eAAe,GAAG,4EAA4E,CAAC;AACrG,MAAM,qBAAqB,GAAG,yCAAyC,CAAC;AACxE,MAAM,sBAAsB,GAAG,iEAAiE,CAAC;AACjG,MAAM,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,2BAA2B,GAC/B,0FAA0F,CAAC;AAE7F,SAAS,UAAU,CAAC,KAMnB;IACC,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;QACrB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;QAC9B,gBAAgB,EAAE,EAAE;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;QAC9B,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;QACnC,0BAA0B,EAAE,KAAK,CAAC,IAAI,CAAC,0BAA0B;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAoD,EACpD,QAAsD;IAEtD,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CACxE,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC;IACF,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAC5E,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,YAAY,CACnB,MAAgC,EAChC,YAAoB,EACpB,KAAa;IAEb,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAC/B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,KAAK,YAAY,IAAI,SAAS,CAAC,KAAK,KAAK,KAAK,CACpF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,cAAc,CACrB,GAAwB,EACxB,mBAAmF;IAEnF,OAAO,GAAG,CAAC,WAAW,IAAI,mBAAmB,CAAC;AAChD,CAAC;AAED,SAAS,sBAAsB,CAC7B,IAA0C,EAC1C,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,CACL,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,IAAI;QACd,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,IAA0C,EAC1C,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,CACL,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,KAAK;QACf,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAA0C;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,CACL,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,SAAS;QACjC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,SAAS,CACnC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,IAAI,CAClB,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,KAAK,GAAG;QACf,OAAO,KAAK,IAAI;QAChB,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,MAAgC,EAChC,QAAoC;IAEpC,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,IAAI,qBAAqB,GAAG,KAAK,CAAC;IAClC,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC1C,IACE,QAAQ,CAAC,WAAW,KAAK,SAAS;YAClC,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ;YACxC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,EACtE,CAAC;YACD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;gBAClD,OAAO,EAAE,QAAQ,CAAC,IAAI;gBACtB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,OAAO,EAAE,iEAAiE;aAC3E,CAAC,CACH,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACtD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,gBAAgB;gBAChD,OAAO,EAAE,QAAQ,CAAC,IAAI;gBACtB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,OAAO,EAAE,+CAA+C;aACzD,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;YAChE,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,kBAAkB,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACvD,CAAC;YACD,MAAM,QAAQ,GACZ,aAAa,KAAK,WAAW;gBAC7B,CAAC,OAAO,aAAa,KAAK,QAAQ;oBAChC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC;YACrE,MAAM,iBAAiB,GACrB,UAAU,KAAK,SAAS;gBACtB,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,OAAO,aAAa,KAAK,QAAQ;oBACjC,CAAC,gBAAgB,CAAC,aAAa,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;YAC/D,IAAI,iBAAiB,EAAE,CAAC;gBACtB,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;oBACT,IAAI,EAAE,yBAAyB,CAAC,qBAAqB;oBACrD,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE;oBACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,OAAO,EAAE,oEAAoE;iBAC9E,CAAC,CACH,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;oBACT,IAAI,EAAE,yBAAyB,CAAC,eAAe;oBAC/C,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE;oBACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,OAAO,EAAE,0DAA0D,GAAG,CAAC,IAAI,GAAG;oBAC9E,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;iBAChD,CAAC,CACH,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC7B,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;wBACT,IAAI,EAAE,yBAAyB,CAAC,eAAe;wBAC/C,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE;wBACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;wBACnB,OAAO,EAAE,+CAA+C,IAAI,CAAC,IAAI,GAAG;wBACpE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;qBACjD,CAAC,CACH,CAAC;gBACJ,CAAC;gBACD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzE,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;wBACT,IAAI,EAAE,yBAAyB,CAAC,uBAAuB;wBACvD,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE;wBACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;wBACnB,OAAO,EAAE,uDAAuD;qBACjE,CAAC,CACH,CAAC;gBACJ,CAAC;gBACD,IACE,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,wBAAwB;oBACjD,QAAQ,CAAC,qBAAqB,CAAC,QAAQ,CAAC,cAAc,CAAC;oBACvD,CAAC,GAAG,CAAC,WAAW;oBAChB,CAAC,GAAG,CAAC,WAAW;oBAChB,CAAC,IAAI,CAAC,WAAW;oBACjB,CAAC,IAAI,CAAC,WAAW;oBACjB,uBAAuB,CAAC,IAAI,EAAE,WAAW,CAAC;oBAC1C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,SAAS;oBACxC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,mCAAmC,CAAC,KAAK,IAAI;oBACnE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EACvB,CAAC;oBACD,qBAAqB,GAAG,IAAI,CAAC;gBAC/B,CAAC;gBACD,IACE,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,YAAY;oBACrC,QAAQ,CAAC,qBAAqB,CAAC,QAAQ,CAAC,cAAc,CAAC;oBACvD,CAAC,GAAG,CAAC,WAAW;oBAChB,CAAC,GAAG,CAAC,WAAW;oBAChB,CAAC,IAAI,CAAC,WAAW;oBACjB,CAAC,IAAI,CAAC,WAAW;oBACjB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,CAAC;oBAC/C,mBAAmB,CAAC,IAAI,CAAC;oBACzB,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,sBAAsB,CAAC,KAAK,IAAI;oBACtD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EACvB,CAAC;oBACD,SAAS,GAAG,IAAI,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,uBAAuB;YACvD,OAAO,EAAE,MAAM,CAAC,wBAAwB;YACxC,IAAI,EAAE,MAAM,CAAC,wBAAwB;YACrC,OAAO,EAAE,8EAA8E;SACxF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,WAAW;YAC3C,OAAO,EAAE,MAAM,CAAC,YAAY;YAC5B,IAAI,EAAE,MAAM,CAAC,YAAY;YACzB,OAAO,EAAE,gEAAgE;SAC1E,CAAC,CACH,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,GAAG,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QAC7D,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;gBAClD,OAAO,EAAE,GAAG;gBACZ,IAAI,EAAE,UAAU,CAAC,YAAY;gBAC7B,OAAO,EAAE,0DAA0D;aACpE,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,eAAe,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAChD,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,CAAC;YAChC,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,wBAAwB;gBACxD,OAAO,EAAE,eAAe,CAAC,WAAW;gBACpC,IAAI,EAAE,eAAe,CAAC,YAAY;gBAClC,OAAO,EAAE,qDAAqD;aAC/D,CAAC,CACH,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACrE,IACE,eAAe,CAAC,KAAK,KAAK,SAAS;YACnC,eAAe,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAClC,CAAC,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,EACrD,CAAC;YACD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;gBAClD,OAAO,EAAE,eAAe,CAAC,WAAW;gBACpC,IAAI,EAAE,eAAe,CAAC,YAAY;gBAClC,OAAO,EAAE,2DAA2D;gBACpE,QAAQ,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;aAC/E,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}
+{"version":3,"file":"evaluate-repository-security.js","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.ts"],"names":[],"mappings":"AASA,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,sBAAsB,EACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,EAC3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAC1F,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AACxF,OAAO,EAAE,4BAA4B,IAAI,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAEjG,MAAM,sBAAsB,GAAG,iEAAiE,CAAC;AACjG,MAAM,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,2BAA2B,GAC/B,0FAA0F,CAAC;AAE7F,SAAS,gBAAgB,CACvB,MAAoD,EACpD,QAAsD;IAEtD,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CACxE,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC;IACF,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAC5E,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,YAAY,CACnB,MAAgC,EAChC,YAAoB,EACpB,KAAa;IAEb,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAC/B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,KAAK,YAAY,IAAI,SAAS,CAAC,KAAK,KAAK,KAAK,CACpF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,2BAA2B,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CACrB,GAAwB,EACxB,mBAAmF;IAEnF,OAAO,GAAG,CAAC,WAAW,IAAI,mBAAmB,CAAC;AAChD,CAAC;AAED,SAAS,sBAAsB,CAC7B,IAA0C,EAC1C,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,CACL,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,IAAI;QACd,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAA0C;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,CACL,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,SAAS;QACjC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,SAAS,CACnC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,IAAI,CAClB,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,KAAK,GAAG;QACf,OAAO,KAAK,IAAI;QAChB,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CACvC,CAAC;AACJ,CAAC;AAaD,SAAS,qBAAqB,CAC5B,MAAgC,EAChC,QAA0B,EAC1B,GAAqC,EACrC,SAAiE,EACjE,KAAsB;IAEtB,MAAM,OAAO,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;IAClF,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,OAAO;YACP,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,yDAAyD,SAAS,CAAC,KAAK,GAAG;YACpF,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;SAChE,CAAC,CACH,CAAC;QACF,OAAO;IACT,CAAC;IACD,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,uBAAuB;YACvD,OAAO;YACP,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,qEAAqE,SAAS,CAAC,KAAK,GAAG;YAChG,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;SAChE,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,MAAgC,EAChC,QAA0B,EAC1B,GAAqC,EACrC,IAAuD;IAEvD,OAAO,CACL,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,YAAY;QACrC,QAAQ,CAAC,qBAAqB,CAAC,QAAQ,CAAC,cAAc,CAAC;QACvD,CAAC,GAAG,CAAC,WAAW;QAChB,CAAC,GAAG,CAAC,WAAW;QAChB,CAAC,IAAI,CAAC,WAAW;QACjB,CAAC,IAAI,CAAC,WAAW;QACjB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,CAAC;QAC/C,mBAAmB,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,sBAAsB,CAAC,KAAK,IAAI;QACtD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAA0B,EAC1B,KAAsB;IAEtB,IACE,QAAQ,CAAC,WAAW,KAAK,SAAS;QAClC,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ;QACxC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,EACtE,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,OAAO,EAAE,QAAQ,CAAC,IAAI;YACtB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,iEAAiE;SAC3E,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACtD,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,gBAAgB;YAChD,OAAO,EAAE,QAAQ,CAAC,IAAI;YACtB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,+CAA+C;SACzD,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAgC,EAChC,QAA0B,EAC1B,GAAqC,EACrC,IAAuD,EACvD,KAAsB;IAEtB,MAAM,OAAO,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;IAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,eAAe;YAC/C,OAAO;YACP,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,+CAA+C,IAAI,CAAC,IAAI,GAAG;YACpE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;SACjD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzE,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,uBAAuB;YACvD,OAAO;YACP,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,uDAAuD;SACjE,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,0BAA0B,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QAC5D,KAAK,CAAC,qBAAqB,GAAG,IAAI,CAAC;IACrC,CAAC;IACD,IAAI,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QAChD,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;IACzB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAgC,EAChC,QAA0B,EAC1B,GAAqC,EACrC,KAAsB;IAEtB,MAAM,OAAO,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;IAC7C,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,QAAQ,GACZ,aAAa,KAAK,WAAW;QAC7B,CAAC,OAAO,aAAa,KAAK,QAAQ;YAChC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC;IACrE,MAAM,iBAAiB,GAAG,UAAU,KAAK,SAAS;QAChD,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,OAAO,aAAa,KAAK,QAAQ;YACjC,CAAC,gBAAgB,CAAC,aAAa,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAC7D,IAAI,iBAAiB,EAAE,CAAC;QACtB,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,qBAAqB;YACrD,OAAO;YACP,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,oEAAoE;SAC9E,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,eAAe;YAC/C,OAAO;YACP,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,0DAA0D,GAAG,CAAC,IAAI,GAAG;YAC9E,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;SAChD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACvC,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC7B,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC7B,MAA+B,EAC/B,WAAmC;IAEnC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QACnD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACzE,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,uBAAuB;gBACvD,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,eAAe,KAAK,GAAG;gBAC9C,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,wEAAwE;aAClF,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAgC,EAChC,KAAsB;IAEtB,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC;QACjC,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,uBAAuB;YACvD,OAAO,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAC,YAAY,IAAI,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE;YACnF,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC,YAAY;YAC1C,OAAO,EAAE,8EAA8E;SACxF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,WAAW;YAC3C,OAAO,EAAE,MAAM,CAAC,YAAY;YAC5B,IAAI,EAAE,MAAM,CAAC,YAAY;YACzB,OAAO,EAAE,gEAAgE;SAC1E,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC7B,eAAgC,EAChC,WAAmC;IAEnC,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,CAAC;QAChC,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,wBAAwB;YACxD,OAAO,EAAE,eAAe,CAAC,WAAW;YACpC,IAAI,EAAE,eAAe,CAAC,YAAY;YAClC,OAAO,EAAE,qDAAqD;SAC/D,CAAC,CACH,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACrE,IACE,eAAe,CAAC,KAAK,KAAK,SAAS;QACnC,eAAe,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAClC,CAAC,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,EACrD,CAAC;QACD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,OAAO,EAAE,eAAe,CAAC,WAAW;YACpC,IAAI,EAAE,eAAe,CAAC,YAAY;YAClC,OAAO,EAAE,2DAA2D;YACpE,QAAQ,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;SAC/E,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,MAAgC,EAChC,QAAoC;IAEpC,MAAM,KAAK,GAAoB;QAC7B,WAAW,EAAE,EAAE;QACf,mBAAmB,EAAE,IAAI,GAAG,EAAU;QACtC,kBAAkB,EAAE,IAAI,GAAG,EAAU;QACrC,qBAAqB,EAAE,KAAK;QAC5B,SAAS,EAAE,KAAK;KACjB,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC1C,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChC,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACjD,+BAA+B,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC/C,sBAAsB,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACpD,CAAC;IACD,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACvC,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,GAAG,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QAC7D,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;gBAClD,OAAO,EAAE,GAAG;gBACZ,IAAI,EAAE,UAAU,CAAC,YAAY;gBAC7B,OAAO,EAAE,0DAA0D;aACpE,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAClD,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,0BAA0B;gBAC1D,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,MAAM,CAAC,iBAAiB;gBAC9B,OAAO,EAAE,iFAAiF;gBAC1F,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;aACtD,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,8BAA8B,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACpE,+BAA+B,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACrE,KAAK,MAAM,eAAe,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAChD,sBAAsB,CAAC,eAAe,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,CAAC;AAC3B,CAAC"}

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-workflow-uses.d.ts

@@ -0,0 +1,4 @@
+import type { FoundationDiagnostic } from "../../../../check-contract.js";
+import type { RepositorySecurityEvidence, RepositorySecurityPolicy } from "../model/repository-security.js";
+export declare function evaluateRepositoryWorkflowUses(policy: RepositorySecurityPolicy, evidence: RepositorySecurityEvidence, diagnostics: FoundationDiagnostic[]): void;
+//# sourceMappingURL=evaluate-repository-workflow-uses.d.ts.map

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-workflow-uses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-repository-workflow-uses.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/evaluate-repository-workflow-uses.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EACV,0BAA0B,EAC1B,wBAAwB,EACzB,MAAM,iCAAiC,CAAC;AAazC,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,wBAAwB,EAChC,QAAQ,EAAE,0BAA0B,EACpC,WAAW,EAAE,oBAAoB,EAAE,GAClC,IAAI,CAuDN"}

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-workflow-uses.js

@@ -0,0 +1,55 @@
+import { flattenAllowedWorkflowUses, isPinnedExternalWorkflowUse, isSafeLocalWorkflowUse } from "../model/repository-security.js";
+import { REPOSITORY_SECURITY_RULES } from "../rules.js";
+import { repositorySecurityDiagnostic as diagnostic } from "./repository-security-diagnostic.js";
+function usePinned(use) {
+    return isSafeLocalWorkflowUse(use) || isPinnedExternalWorkflowUse(use);
+}
+export function evaluateRepositoryWorkflowUses(policy, evidence, diagnostics) {
+    const flattenedAllowedUses = flattenAllowedWorkflowUses(policy.allowedUses);
+    const directAllowedUses = new Set(flattenedAllowedUses.filter(({ direct }) => direct).map(({ uses }) => uses));
+    const allAllowedUses = new Set(flattenedAllowedUses.map(({ uses }) => uses));
+    const observedDirectUses = new Set();
+    for (const use of evidence.workflowUses) {
+        if (!usePinned(use.uses)) {
+            diagnostics.push(diagnostic({
+                rule: REPOSITORY_SECURITY_RULES.actionNotPinned,
+                subject: use.subject,
+                path: use.path,
+                message: `Workflow use is not pinned to immutable evidence: ${use.uses}.`,
+                evidence: [{ kind: "use", value: use.uses }]
+            }));
+            continue;
+        }
+        if (!isPinnedExternalWorkflowUse(use.uses)) {
+            continue;
+        }
+        observedDirectUses.add(use.uses);
+        const allowlisted = allAllowedUses.has(use.uses);
+        const direct = directAllowedUses.has(use.uses);
+        if (!allowlisted || !direct) {
+            diagnostics.push(diagnostic({
+                rule: allowlisted
+                    ? REPOSITORY_SECURITY_RULES.actionAllowlistScopeMismatch
+                    : REPOSITORY_SECURITY_RULES.actionNotAllowlisted,
+                subject: use.subject,
+                path: use.path,
+                message: allowlisted
+                    ? `Direct repository use is declared only as transitive: ${use.uses}.`
+                    : `Pinned external workflow use is not declared in allowedUses: ${use.uses}.`,
+                evidence: [{ kind: "use", value: use.uses }]
+            }));
+        }
+    }
+    for (const allowedUse of directAllowedUses) {
+        if (!observedDirectUses.has(allowedUse)) {
+            diagnostics.push(diagnostic({
+                rule: REPOSITORY_SECURITY_RULES.staleAllowedUse,
+                subject: allowedUse,
+                path: policy.workflowDirectory,
+                message: `Direct allowedUses entry is not referenced by discovered local workflow sources: ${allowedUse}.`,
+                evidence: [{ kind: "use", value: allowedUse }]
+            }));
+        }
+    }
+}
+//# sourceMappingURL=evaluate-repository-workflow-uses.js.map

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-workflow-uses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-repository-workflow-uses.js","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/evaluate-repository-workflow-uses.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,sBAAsB,EACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,4BAA4B,IAAI,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAEjG,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,sBAAsB,CAAC,GAAG,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAAgC,EAChC,QAAoC,EACpC,WAAmC;IAEnC,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5E,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,oBAAoB,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAC5E,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACxC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,eAAe;gBAC/C,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,qDAAqD,GAAG,CAAC,IAAI,GAAG;gBACzE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;aAC7C,CAAC,CACH,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,SAAS;QACX,CAAC;QACD,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5B,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,WAAW;oBACf,CAAC,CAAC,yBAAyB,CAAC,4BAA4B;oBACxD,CAAC,CAAC,yBAAyB,CAAC,oBAAoB;gBAClD,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,WAAW;oBAClB,CAAC,CAAC,yDAAyD,GAAG,CAAC,IAAI,GAAG;oBACtE,CAAC,CAAC,gEAAgE,GAAG,CAAC,IAAI,GAAG;gBAC/E,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;aAC7C,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,iBAAiB,EAAE,CAAC;QAC3C,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,eAAe;gBAC/C,OAAO,EAAE,UAAU;gBACnB,IAAI,EAAE,MAAM,CAAC,iBAAiB;gBAC9B,OAAO,EAAE,oFAAoF,UAAU,GAAG;gBAC1G,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;aAC/C,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/capabilities/repository-security-baseline/application/policies/repository-security-diagnostic.d.ts

@@ -0,0 +1,14 @@
+import type { DiagnosticSeverity, FoundationDiagnostic } from "../../../../check-contract.js";
+import type { RepositorySecurityRuleMetadata } from "../rules.js";
+export declare function repositorySecurityDiagnostic(input: {
+    readonly evidence?: readonly {
+        readonly kind: string;
+        readonly value: string;
+    }[];
+    readonly message: string;
+    readonly path: string;
+    readonly rule: RepositorySecurityRuleMetadata;
+    readonly severity?: DiagnosticSeverity;
+    readonly subject: string;
+}): FoundationDiagnostic;
+//# sourceMappingURL=repository-security-diagnostic.d.ts.map

package/dist/capabilities/repository-security-baseline/application/policies/repository-security-diagnostic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-security-diagnostic.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/repository-security-diagnostic.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC9F,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAElE,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACjF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,8BAA8B,CAAC;IAC9C,QAAQ,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,GAAG,oBAAoB,CAYvB"}

package/dist/capabilities/repository-security-baseline/application/policies/repository-security-diagnostic.js

@@ -0,0 +1,14 @@
+export function repositorySecurityDiagnostic(input) {
+    return {
+        ruleId: input.rule.id,
+        severity: input.severity ?? input.rule.severity,
+        subject: input.subject,
+        message: input.message,
+        location: { path: input.path },
+        relatedLocations: [],
+        evidence: input.evidence ?? [],
+        remediation: input.rule.remediation,
+        requiresArchitectureReview: input.rule.requiresArchitectureReview
+    };
+}
+//# sourceMappingURL=repository-security-diagnostic.js.map

package/dist/capabilities/repository-security-baseline/application/policies/repository-security-diagnostic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-security-diagnostic.js","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/repository-security-diagnostic.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,4BAA4B,CAAC,KAO5C;IACC,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;QACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ;QAC/C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;QAC9B,gBAAgB,EAAE,EAAE;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;QAC9B,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;QACnC,0BAA0B,EAAE,KAAK,CAAC,IAAI,CAAC,0BAA0B;KAClE,CAAC;AACJ,CAAC"}

package/dist/capabilities/repository-security-baseline/application/rules.d.ts

@@ -9,7 +9,12 @@ export interface RepositorySecurityRuleMetadata {
 }
 export declare const REPOSITORY_SECURITY_RULES: Readonly<{
     actionNotPinned: RepositorySecurityRuleMetadata;
+    actionNotAllowlisted: RepositorySecurityRuleMetadata;
+    actionAllowlistScopeMismatch: RepositorySecurityRuleMetadata;
     dependencyReviewMissing: RepositorySecurityRuleMetadata;
+    dependencyReviewOrdering: RepositorySecurityRuleMetadata;
+    containerNotAllowlisted: RepositorySecurityRuleMetadata;
+    containerNotPinned: RepositorySecurityRuleMetadata;
     dangerousTrigger: RepositorySecurityRuleMetadata;
     eventInterpolationInRun: RepositorySecurityRuleMetadata;
     packageFilesUnsafe: RepositorySecurityRuleMetadata;
@@ -18,6 +23,16 @@ export declare const REPOSITORY_SECURITY_RULES: Readonly<{
     sbomMissing: RepositorySecurityRuleMetadata;
     privilegedJobMismatch: RepositorySecurityRuleMetadata;
     stalePrivilegedJob: RepositorySecurityRuleMetadata;
+    staleAllowedUse: RepositorySecurityRuleMetadata;
+    staleAllowedContainerImage: RepositorySecurityRuleMetadata;
+    toolEvidenceFailed: RepositorySecurityRuleMetadata;
+    toolEvidenceJobMissing: RepositorySecurityRuleMetadata;
+    toolEvidenceInvocationMissing: RepositorySecurityRuleMetadata;
+    toolEvidenceMissing: RepositorySecurityRuleMetadata;
+    toolEvidenceResultDigestMismatch: RepositorySecurityRuleMetadata;
+    toolEvidenceRolloutMismatch: RepositorySecurityRuleMetadata;
+    toolEvidenceStale: RepositorySecurityRuleMetadata;
+    toolEvidenceVersionMismatch: RepositorySecurityRuleMetadata;
 }>;
 export declare const REPOSITORY_SECURITY_RULES_BY_ID: ReadonlyMap<string, RepositorySecurityRuleMetadata>;
 //# sourceMappingURL=rules.d.ts.map

package/dist/capabilities/repository-security-baseline/application/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../../src/capabilities/repository-security-baseline/application/rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAErE,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;CAC9C;AAiBD,eAAO,MAAM,yBAAyB;;;;;;;;;;;EAmDpC,CAAC;AAEH,eAAO,MAAM,+BAA+B,EAAE,WAAW,CACvD,MAAM,EACN,8BAA8B,CAG/B,CAAC"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../../src/capabilities/repository-security-baseline/application/rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAErE,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;CAC9C;AAiBD,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;EA8HpC,CAAC;AAEH,eAAO,MAAM,+BAA+B,EAAE,WAAW,CACvD,MAAM,EACN,8BAA8B,CAG/B,CAAC"}

package/dist/capabilities/repository-security-baseline/application/rules.js

@@ -10,7 +10,12 @@ function rule(suffix, rationale, remediation) {
 }
 export const REPOSITORY_SECURITY_RULES = Object.freeze({
     actionNotPinned: rule("action-not-pinned", "Mutable action references can change without repository review.", "Pin external actions to a full 40-character commit SHA."),
+    actionNotAllowlisted: rule("action-not-allowlisted", "A pinned reference is not necessarily a trusted reference.", "Add the exact immutable external use to allowedUses after reviewing its owner, revision, and purpose."),
+    actionAllowlistScopeMismatch: rule("action-allowlist-scope-mismatch", "A direct repository dependency is declared only as a transitive dependency of another use.", "Move the reference to allowedUses or remove the direct repository invocation."),
     dependencyReviewMissing: rule("dependency-review-missing", "Dependency changes need a pull-request vulnerability gate.", "Run the pinned actions/dependency-review-action from the declared workflow."),
+    dependencyReviewOrdering: rule("dependency-review-ordering", "A pull-request workflow can execute a run step, local action, or reusable workflow before Dependency Review completes.", "Make each pull-request job with a run step, local action, or reusable workflow depend on the declared Dependency Review job, or run the governed review step first in that same job."),
+    containerNotAllowlisted: rule("container-not-allowlisted", "A pinned container image is not automatically an approved supply-chain dependency.", "Add the exact immutable container image to allowedContainerImages after reviewing its owner, digest, and purpose."),
+    containerNotPinned: rule("container-not-pinned", "Mutable job and service container references can change without repository review.", "Pin every job and service container image to an immutable sha256 digest."),
     dangerousTrigger: rule("dangerous-trigger", "pull_request_target executes privileged base-branch code around untrusted pull-request data.", "Use pull_request or introduce a separately reviewed privileged workflow design."),
     eventInterpolationInRun: rule("event-interpolation-in-run", "Direct event-data interpolation into a shell command enables command injection.", "Pass event data through a quoted environment variable instead of interpolating it in run."),
     packageFilesUnsafe: rule("package-files-unsafe", "A broad npm files declaration can publish source, tests, local state, or credentials.", "Use a narrow explicit files allowlist without root, parent, recursive, source, test, or secret paths."),
@@ -18,7 +23,17 @@ export const REPOSITORY_SECURITY_RULES = Object.freeze({
     permissionsInvalid: rule("permissions-invalid", "Workflow token permissions must default to an explicit read-only map.", "Declare root permissions as an object containing only read or none values."),
     sbomMissing: rule("sbom-missing", "The dependency inventory must be reproducibly exported for each reviewed revision.", "Run a pinned anchore/sbom-action from the declared SBOM workflow."),
     privilegedJobMismatch: rule("privileged-job-mismatch", "Write-capable jobs need an exact reviewed permission declaration.", "Declare the job in privilegedJobs with the exact permission map, or remove write access."),
-    stalePrivilegedJob: rule("stale-privileged-job", "A stale privilege declaration can hide workflow ownership drift.", "Remove the declaration or restore the exact governed workflow job.")
+    stalePrivilegedJob: rule("stale-privileged-job", "A stale privilege declaration can hide workflow ownership drift.", "Remove the declaration or restore the exact governed workflow job."),
+    staleAllowedUse: rule("stale-allowed-use", "An unused trust declaration can conceal action ownership drift.", "Remove the unused allowedUses entry or restore the reviewed workflow reference."),
+    staleAllowedContainerImage: rule("stale-allowed-container-image", "An unused container trust declaration can conceal supply-chain ownership drift.", "Remove the declaration or restore the exact reviewed job or service container image."),
+    toolEvidenceFailed: rule("tool-evidence-failed", "A required external security tool reported a failed result.", "Fix the tool findings and publish fresh evidence with a passed outcome."),
+    toolEvidenceJobMissing: rule("tool-evidence-job-missing", "The declared external security tool gate has no matching workflow job.", "Declare an existing workflow path and job ID that runs the external tool gate."),
+    toolEvidenceInvocationMissing: rule("tool-evidence-invocation-missing", "The declared external tool job does not invoke its reviewed immutable runner.", "Declare the exact pinned invocation in the tool policy and use it from the governed job."),
+    toolEvidenceMissing: rule("tool-evidence-missing", "Required external security evidence is unavailable.", "Run the declared tool and publish its evidence envelope and opaque result artifact."),
+    toolEvidenceResultDigestMismatch: rule("tool-evidence-result-digest-mismatch", "The result artifact no longer matches the reviewed evidence envelope.", "Regenerate the evidence envelope and result artifact together from one tool execution."),
+    toolEvidenceRolloutMismatch: rule("tool-evidence-rollout-mismatch", "The declared external tool job does not enforce the configured blocking or advisory rollout.", "Use an unconditional blocking job, or an unconditional continue-on-error advisory job, as declared."),
+    toolEvidenceStale: rule("tool-evidence-stale", "Tool evidence does not describe the current workflow or tool configuration input.", "Rerun the declared tool against the current inputs and publish fresh evidence."),
+    toolEvidenceVersionMismatch: rule("tool-evidence-version-mismatch", "Tool evidence was produced by a version different from the declared pinned version.", "Run the declared exact tool version and publish fresh evidence.")
 });
 export const REPOSITORY_SECURITY_RULES_BY_ID = new Map(Object.values(REPOSITORY_SECURITY_RULES).map((metadata) => [metadata.id, metadata]));
 //# sourceMappingURL=rules.js.map