@agent-teams/engineering-foundation 0.5.0 → 0.6.0

package/dist/capabilities/repository-security-baseline/application/policies/dependency-review-ordering.js

@@ -0,0 +1,143 @@
+import { isPinnedExternalWorkflowUse } from "../model/repository-security.js";
+import { REPOSITORY_SECURITY_RULES } from "../rules.js";
+import { repositorySecurityDiagnostic as diagnostic } from "./repository-security-diagnostic.js";
+const EXPLICIT_STATUS_FUNCTION = /\b(?:always|cancelled|failure|success)\s*\(/iu;
+function overridesImplicitSuccessGate(value) {
+    // GitHub implicitly prepends success() only when an if expression contains no
+    // status function. Exact success() is also provable; all more complex status
+    // expressions fail closed because arbitrary expression equivalence is outside
+    // this policy.
+    if (value.condition === undefined || !EXPLICIT_STATUS_FUNCTION.test(value.condition)) {
+        return false;
+    }
+    const normalized = value.condition
+        .trim()
+        .replace(/^\$\{\{\s*/u, "")
+        .replace(/\s*\}\}$/u, "")
+        .trim();
+    return normalized !== "success()";
+}
+function inputIsEnabledOrAbsent(step, name) {
+    const value = step.inputs[name];
+    return (value === undefined ||
+        value === true ||
+        (typeof value === "string" && value.toLowerCase() === "true"));
+}
+function hasDependencyReviewSemantics(policy, job, step) {
+    return (job.id === policy.dependencyReview.jobId &&
+        !job.conditional &&
+        !job.nonBlocking &&
+        !step.conditional &&
+        !step.nonBlocking &&
+        step.inputs["base-ref"] === policy.dependencyReview.baseRef &&
+        step.inputs["head-ref"] === policy.dependencyReview.headRef &&
+        step.inputs["fail-on-severity"] === policy.dependencyReview.failOnSeverity &&
+        inputIsEnabledOrAbsent(step, "vulnerability-check") &&
+        (step.inputs["warn-only"] === false || step.inputs["warn-only"] === "false") &&
+        step.inputs["config-file"] === undefined &&
+        step.inputs["fail-on-scopes"] === undefined &&
+        step.inputs["allow-ghsas"] === undefined &&
+        step.uses?.startsWith("actions/dependency-review-action@") === true &&
+        isPinnedExternalWorkflowUse(step.uses));
+}
+export function isDependencyReviewEvidence(policy, workflow, job, step) {
+    return (workflow.path === policy.dependencyReview.workflowPath &&
+        workflow.unconditionalTriggers.includes("pull_request") &&
+        hasDependencyReviewSemantics(policy, job, step));
+}
+function repositoryCodeExecutionFromStep(step) {
+    if (step.run !== undefined) {
+        return Object.freeze({ kind: "run-step", value: step.run });
+    }
+    if (step.uses?.startsWith(".") === true) {
+        return Object.freeze({ kind: "local-action", value: step.uses });
+    }
+    return undefined;
+}
+function repositoryCodeExecutionFromJob(job) {
+    if (job.uses?.startsWith(".") === true) {
+        return Object.freeze({ kind: "reusable-workflow", value: job.uses });
+    }
+    return undefined;
+}
+function isPullRequestWorkflow(workflow) {
+    return (workflow.triggers.includes("pull_request") ||
+        workflow.triggers.includes("pull_request_target"));
+}
+function validLocalDependencyReviewJob(policy, workflow) {
+    const reviewJob = workflow.jobs.find((candidate) => candidate.id === policy.dependencyReview.jobId);
+    if (!workflow.triggers.includes("pull_request") ||
+        reviewJob === undefined ||
+        !reviewJob.steps.some((step) => hasDependencyReviewSemantics(policy, reviewJob, step))) {
+        return undefined;
+    }
+    return reviewJob;
+}
+function dependsOnDeclaredDependencyReview(policy, workflow, job, reviewJob) {
+    if (job.nonBlocking || overridesImplicitSuccessGate(job)) {
+        return false;
+    }
+    const jobsById = new Map(workflow.jobs.map((candidate) => [candidate.id, candidate]));
+    const dependsOnReview = (jobId, ancestors) => {
+        if (ancestors.has(jobId)) {
+            return false;
+        }
+        const nextAncestors = new Set(ancestors);
+        nextAncestors.add(jobId);
+        const candidate = jobsById.get(jobId);
+        if (candidate === undefined ||
+            candidate.nonBlocking ||
+            overridesImplicitSuccessGate(candidate)) {
+            return false;
+        }
+        if (candidate.id === reviewJob.id) {
+            return true;
+        }
+        return candidate.needs.some((dependency) => dependsOnReview(dependency, nextAncestors));
+    };
+    return job.needs.some((dependency) => dependsOnReview(dependency, new Set()));
+}
+function orderingDiagnostic(policy, workflow, job, execution) {
+    return diagnostic({
+        rule: REPOSITORY_SECURITY_RULES.dependencyReviewOrdering,
+        subject: `${workflow.path}:${job.id}`,
+        path: workflow.path,
+        message: "A pull-request workflow can execute before the declared Dependency Review gate.",
+        evidence: [
+            { kind: "dependency-review-job", value: policy.dependencyReview.jobId },
+            { kind: "repository-code-execution", value: execution.kind },
+            { kind: "repository-code-command", value: execution.value }
+        ]
+    });
+}
+export function inspectDependencyReviewOrdering(policy, workflow, job, diagnostics) {
+    if (!isPullRequestWorkflow(workflow)) {
+        return;
+    }
+    const reviewJob = validLocalDependencyReviewJob(policy, workflow);
+    if (workflow.path === policy.dependencyReview.workflowPath && reviewJob === undefined) {
+        return;
+    }
+    const dependsOnBlockingReview = reviewJob === undefined
+        ? false
+        : dependsOnDeclaredDependencyReview(policy, workflow, job, reviewJob);
+    const jobExecution = repositoryCodeExecutionFromJob(job);
+    if (jobExecution !== undefined && !dependsOnBlockingReview) {
+        diagnostics.push(orderingDiagnostic(policy, workflow, job, jobExecution));
+        return;
+    }
+    let reviewHasRunInJob = false;
+    for (const step of job.steps) {
+        if (hasDependencyReviewSemantics(policy, job, step)) {
+            reviewHasRunInJob = true;
+        }
+        const execution = repositoryCodeExecutionFromStep(step);
+        const sameJobGateCanBeBypassed = reviewHasRunInJob && overridesImplicitSuccessGate(step);
+        if (execution !== undefined &&
+            ((!reviewHasRunInJob && !dependsOnBlockingReview) || sameJobGateCanBeBypassed)) {
+            diagnostics.push(orderingDiagnostic(policy, workflow, job, execution));
+            return;
+        }
+    }
+}
+//# sourceMappingURL=dependency-review-ordering.js.map

package/dist/capabilities/repository-security-baseline/application/policies/dependency-review-ordering.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-review-ordering.js","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/dependency-review-ordering.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,4BAA4B,IAAI,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAOjG,MAAM,wBAAwB,GAAG,+CAA+C,CAAC;AAEjF,SAAS,4BAA4B,CACnC,KAAiD;IAEjD,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,eAAe;IACf,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACrF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS;SAC/B,IAAI,EAAE;SACN,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;SAC1B,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;SACxB,IAAI,EAAE,CAAC;IACV,OAAO,UAAU,KAAK,WAAW,CAAC;AACpC,CAAC;AAED,SAAS,sBAAsB,CAAC,IAA0B,EAAE,IAAY;IACtE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,CACL,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,IAAI;QACd,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CACnC,MAAgC,EAChC,GAAwB,EACxB,IAA0B;IAE1B,OAAO,CACL,GAAG,CAAC,EAAE,KAAK,MAAM,CAAC,gBAAgB,CAAC,KAAK;QACxC,CAAC,GAAG,CAAC,WAAW;QAChB,CAAC,GAAG,CAAC,WAAW;QAChB,CAAC,IAAI,CAAC,WAAW;QACjB,CAAC,IAAI,CAAC,WAAW;QACjB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC,gBAAgB,CAAC,OAAO;QAC3D,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC,gBAAgB,CAAC,OAAO;QAC3D,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,MAAM,CAAC,gBAAgB,CAAC,cAAc;QAC1E,sBAAsB,CAAC,IAAI,EAAE,qBAAqB,CAAC;QACnD,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,SAAS;QACxC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,SAAS;QAC3C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,SAAS;QACxC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,mCAAmC,CAAC,KAAK,IAAI;QACnE,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,MAAgC,EAChC,QAA0B,EAC1B,GAAwB,EACxB,IAA0B;IAE1B,OAAO,CACL,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,gBAAgB,CAAC,YAAY;QACtD,QAAQ,CAAC,qBAAqB,CAAC,QAAQ,CAAC,cAAc,CAAC;QACvD,4BAA4B,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CACtC,IAA0B;IAE1B,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,8BAA8B,CACrC,GAAwB;IAExB,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,qBAAqB,CAAC,QAA0B;IACvD,OAAO,CACL,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC1C,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAClD,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,MAAgC,EAChC,QAA0B;IAE1B,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACpG,IACE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC3C,SAAS,KAAK,SAAS;QACvB,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC7B,4BAA4B,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CACtD,EACD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iCAAiC,CACxC,MAAgC,EAChC,QAA0B,EAC1B,GAAwB,EACxB,SAA8B;IAE9B,IAAI,GAAG,CAAC,WAAW,IAAI,4BAA4B,CAAC,GAAG,CAAC,EAAE,CAAC;QACzD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IACtF,MAAM,eAAe,GAAG,CAAC,KAAa,EAAE,SAA8B,EAAW,EAAE;QACjF,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IACE,SAAS,KAAK,SAAS;YACvB,SAAS,CAAC,WAAW;YACrB,4BAA4B,CAAC,SAAS,CAAC,EACvC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,SAAS,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC;IAC1F,CAAC,CAAC;IACF,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAgC,EAChC,QAA0B,EAC1B,GAAwB,EACxB,SAAkC;IAElC,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,yBAAyB,CAAC,wBAAwB;QACxD,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE;QACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,OAAO,EAAE,iFAAiF;QAC1F,QAAQ,EAAE;YACR,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE;YACvE,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE;YAC5D,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE;SAC5D;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,MAAgC,EAChC,QAA0B,EAC1B,GAAwB,EACxB,WAAmC;IAEnC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,6BAA6B,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClE,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,gBAAgB,CAAC,YAAY,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACtF,OAAO;IACT,CAAC;IACD,MAAM,uBAAuB,GAC3B,SAAS,KAAK,SAAS;QACrB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,iCAAiC,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IAC1E,MAAM,YAAY,GAAG,8BAA8B,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC3D,WAAW,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;QAC1E,OAAO;IACT,CAAC;IACD,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,4BAA4B,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;YACpD,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;QACD,MAAM,SAAS,GAAG,+BAA+B,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,wBAAwB,GAAG,iBAAiB,IAAI,4BAA4B,CAAC,IAAI,CAAC,CAAC;QACzF,IACE,SAAS,KAAK,SAAS;YACvB,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,uBAAuB,CAAC,IAAI,wBAAwB,CAAC,EAC9E,CAAC;YACD,WAAW,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-security-tools.d.ts

@@ -0,0 +1,4 @@
+import type { FoundationDiagnostic } from "../../../../check-contract.js";
+import type { RepositorySecurityEvidence, RepositorySecurityPolicy } from "../model/repository-security.js";
+export declare function evaluateRepositorySecurityTools(policy: RepositorySecurityPolicy, evidence: RepositorySecurityEvidence, diagnostics: FoundationDiagnostic[]): void;
+//# sourceMappingURL=evaluate-repository-security-tools.d.ts.map

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-security-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-repository-security-tools.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/evaluate-repository-security-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC9F,OAAO,KAAK,EACV,0BAA0B,EAC1B,wBAAwB,EAKzB,MAAM,iCAAiC,CAAC;AAqKzC,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,wBAAwB,EAChC,QAAQ,EAAE,0BAA0B,EACpC,WAAW,EAAE,oBAAoB,EAAE,GAClC,IAAI,CAaN"}

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-security-tools.js

@@ -0,0 +1,136 @@
+import { configuredRepositorySecurityTools } from "../model/repository-security.js";
+import { REPOSITORY_SECURITY_RULES } from "../rules.js";
+import { repositorySecurityDiagnostic as diagnostic } from "./repository-security-diagnostic.js";
+function severityForRollout(rollout) {
+    return rollout === "blocking" ? "error" : "warning";
+}
+function jobMatchesToolRollout(job, rollout) {
+    return !job.conditional && (rollout === "blocking" ? !job.nonBlocking : job.nonBlocking);
+}
+function workflowMatchesToolRollout(workflow, rollout) {
+    return rollout !== "blocking" || workflow.unconditionalTriggers.includes("pull_request");
+}
+function jobInvokes(job, invocationUse, rollout) {
+    if (job.uses === invocationUse) {
+        return true;
+    }
+    return job.steps.some((step) => step.uses === invocationUse &&
+        !step.conditional &&
+        (rollout !== "blocking" || !step.nonBlocking));
+}
+function evaluateToolBinding(input) {
+    const { diagnostics, evidence, expected, observedEvidence } = input;
+    const severity = severityForRollout(expected.policy.rollout);
+    const workflow = evidence.workflows.find((candidate) => candidate.path === expected.policy.workflowPath);
+    const job = workflow?.jobs.find((candidate) => candidate.id === expected.policy.jobId);
+    if (workflow === undefined || job === undefined) {
+        diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.toolEvidenceJobMissing,
+            severity,
+            subject: `${expected.policy.workflowPath}:${expected.policy.jobId}`,
+            path: expected.policy.workflowPath,
+            message: `Declared ${expected.tool} external gate job is unavailable.`,
+            evidence: [{ kind: "tool", value: expected.tool }]
+        }));
+    }
+    else if (!workflowMatchesToolRollout(workflow, expected.policy.rollout) ||
+        !jobMatchesToolRollout(job, expected.policy.rollout)) {
+        diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.toolEvidenceRolloutMismatch,
+            severity,
+            subject: `${expected.policy.workflowPath}:${expected.policy.jobId}`,
+            path: expected.policy.workflowPath,
+            message: `Declared ${expected.tool} external gate job does not match ${expected.policy.rollout} rollout.`,
+            evidence: [{ kind: "tool", value: expected.tool }]
+        }));
+    }
+    else if (!jobInvokes(job, expected.policy.invocationUse, expected.policy.rollout)) {
+        diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.toolEvidenceInvocationMissing,
+            severity,
+            subject: `${expected.policy.workflowPath}:${expected.policy.jobId}`,
+            path: expected.policy.workflowPath,
+            message: `Declared ${expected.tool} external gate job does not invoke its reviewed immutable runner.`,
+            evidence: [{ kind: "invocation-use", value: expected.policy.invocationUse }]
+        }));
+    }
+    if (observedEvidence === undefined || observedEvidence.kind === "missing") {
+        diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.toolEvidenceMissing,
+            severity,
+            subject: expected.tool,
+            path: expected.policy.evidencePath,
+            message: `Required ${expected.tool} ${observedEvidence?.kind === "missing" ? observedEvidence.missing : "evidence"} is unavailable.`,
+            evidence: [
+                { kind: "evidence-path", value: expected.policy.evidencePath },
+                { kind: "result-path", value: expected.policy.resultPath }
+            ]
+        }));
+        return;
+    }
+    if (observedEvidence.toolVersion !== expected.policy.version) {
+        diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.toolEvidenceVersionMismatch,
+            severity,
+            subject: expected.tool,
+            path: expected.policy.evidencePath,
+            message: `${expected.tool} evidence was produced by ${observedEvidence.toolVersion}, not declared version ${expected.policy.version}.`,
+            evidence: [
+                { kind: "actual-version", value: observedEvidence.toolVersion },
+                { kind: "expected-version", value: expected.policy.version }
+            ]
+        }));
+    }
+    if (observedEvidence.configDigest !== observedEvidence.actualConfigDigest ||
+        observedEvidence.workflowDigest !== observedEvidence.actualWorkflowDigest) {
+        diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.toolEvidenceStale,
+            severity,
+            subject: expected.tool,
+            path: expected.policy.evidencePath,
+            message: `${expected.tool} evidence does not match the current opaque tool config or workflow inputs.`,
+            evidence: [
+                { kind: "actual-config-digest", value: observedEvidence.actualConfigDigest },
+                { kind: "actual-workflow-digest", value: observedEvidence.actualWorkflowDigest },
+                { kind: "reported-config-digest", value: observedEvidence.configDigest },
+                { kind: "reported-workflow-digest", value: observedEvidence.workflowDigest }
+            ]
+        }));
+    }
+    if (observedEvidence.resultDigest !== observedEvidence.actualResultDigest) {
+        diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.toolEvidenceResultDigestMismatch,
+            severity,
+            subject: expected.tool,
+            path: expected.policy.resultPath,
+            message: `${expected.tool} result artifact does not match its evidence digest.`,
+            evidence: [
+                { kind: "actual-result-digest", value: observedEvidence.actualResultDigest },
+                { kind: "reported-result-digest", value: observedEvidence.resultDigest }
+            ]
+        }));
+    }
+    if (observedEvidence.outcome === "failed") {
+        diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.toolEvidenceFailed,
+            severity,
+            subject: expected.tool,
+            path: expected.policy.evidencePath,
+            message: `${expected.tool} evidence reports a failed tool execution.`,
+            evidence: [{ kind: "result-digest", value: observedEvidence.resultDigest }]
+        }));
+    }
+}
+export function evaluateRepositorySecurityTools(policy, evidence, diagnostics) {
+    const observed = new Map(evidence.toolEvidence.map((entry) => [entry.tool, entry]));
+    for (const expected of configuredRepositorySecurityTools(policy.toolEvidence)) {
+        const observedEvidence = observed.get(expected.tool);
+        evaluateToolBinding({
+            diagnostics,
+            evidence,
+            expected,
+            ...(observedEvidence === undefined ? {} : { observedEvidence })
+        });
+    }
+}
+//# sourceMappingURL=evaluate-repository-security-tools.js.map

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-security-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-repository-security-tools.js","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/evaluate-repository-security-tools.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AACpF,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,4BAA4B,IAAI,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAEjG,SAAS,kBAAkB,CAAC,OAA4B;IACtD,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAwB,EAAE,OAA4B;IACnF,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,0BAA0B,CACjC,QAAyD,EACzD,OAA4B;IAE5B,OAAO,OAAO,KAAK,UAAU,IAAI,QAAQ,CAAC,qBAAqB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,UAAU,CACjB,GAAwB,EACxB,aAAqB,EACrB,OAA4B;IAE5B,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CACnB,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,IAAI,KAAK,aAAa;QAC3B,CAAC,IAAI,CAAC,WAAW;QACjB,CAAC,OAAO,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAK5B;IACC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC;IACpE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CACtC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,CAAC,YAAY,CAC/D,CAAC;IACF,MAAM,GAAG,GAAG,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvF,IAAI,QAAQ,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QAChD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,sBAAsB;YACtD,QAAQ;YACR,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE;YACnE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;YAClC,OAAO,EAAE,YAAY,QAAQ,CAAC,IAAI,oCAAoC;YACtE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;SACnD,CAAC,CACH,CAAC;IACJ,CAAC;SAAM,IACL,CAAC,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;QAC9D,CAAC,qBAAqB,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EACpD,CAAC;QACD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,2BAA2B;YAC3D,QAAQ;YACR,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE;YACnE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;YAClC,OAAO,EAAE,YAAY,QAAQ,CAAC,IAAI,qCAAqC,QAAQ,CAAC,MAAM,CAAC,OAAO,WAAW;YACzG,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;SACnD,CAAC,CACH,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACpF,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,6BAA6B;YAC7D,QAAQ;YACR,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE;YACnE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;YAClC,OAAO,EAAE,YAAY,QAAQ,CAAC,IAAI,mEAAmE;YACrG,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;SAC7E,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC1E,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,mBAAmB;YACnD,QAAQ;YACR,OAAO,EAAE,QAAQ,CAAC,IAAI;YACtB,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;YAClC,OAAO,EAAE,YAAY,QAAQ,CAAC,IAAI,IAAI,gBAAgB,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,kBAAkB;YACpI,QAAQ,EAAE;gBACR,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE;gBAC9D,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE;aAC3D;SACF,CAAC,CACH,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,gBAAgB,CAAC,WAAW,KAAK,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC7D,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,2BAA2B;YAC3D,QAAQ;YACR,OAAO,EAAE,QAAQ,CAAC,IAAI;YACtB,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;YAClC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,6BAA6B,gBAAgB,CAAC,WAAW,0BAA0B,QAAQ,CAAC,MAAM,CAAC,OAAO,GAAG;YACtI,QAAQ,EAAE;gBACR,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,CAAC,WAAW,EAAE;gBAC/D,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE;aAC7D;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IACE,gBAAgB,CAAC,YAAY,KAAK,gBAAgB,CAAC,kBAAkB;QACrE,gBAAgB,CAAC,cAAc,KAAK,gBAAgB,CAAC,oBAAoB,EACzE,CAAC;QACD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,iBAAiB;YACjD,QAAQ;YACR,OAAO,EAAE,QAAQ,CAAC,IAAI;YACtB,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;YAClC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,6EAA6E;YACtG,QAAQ,EAAE;gBACR,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,gBAAgB,CAAC,kBAAkB,EAAE;gBAC5E,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,gBAAgB,CAAC,oBAAoB,EAAE;gBAChF,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,gBAAgB,CAAC,YAAY,EAAE;gBACxE,EAAE,IAAI,EAAE,0BAA0B,EAAE,KAAK,EAAE,gBAAgB,CAAC,cAAc,EAAE;aAC7E;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,CAAC,YAAY,KAAK,gBAAgB,CAAC,kBAAkB,EAAE,CAAC;QAC1E,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,gCAAgC;YAChE,QAAQ;YACR,OAAO,EAAE,QAAQ,CAAC,IAAI;YACtB,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU;YAChC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,sDAAsD;YAC/E,QAAQ,EAAE;gBACR,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,gBAAgB,CAAC,kBAAkB,EAAE;gBAC5E,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,gBAAgB,CAAC,YAAY,EAAE;aACzE;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC1C,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,QAAQ;YACR,OAAO,EAAE,QAAQ,CAAC,IAAI;YACtB,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;YAClC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,4CAA4C;YACrE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,gBAAgB,CAAC,YAAY,EAAE,CAAC;SAC5E,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,MAAgC,EAChC,QAAoC,EACpC,WAAmC;IAEnC,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAC1D,CAAC;IACF,KAAK,MAAM,QAAQ,IAAI,iCAAiC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9E,MAAM,gBAAgB,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrD,mBAAmB,CAAC;YAClB,WAAW;YACX,QAAQ;YACR,QAAQ;YACR,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate-repository-security.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAEV,0BAA0B,EAC1B,wBAAwB,EAGzB,MAAM,iCAAiC,CAAC;AAuVzC,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,wBAAwB,EAChC,QAAQ,EAAE,0BAA0B,GACnC,SAAS,oBAAoB,EAAE,CAgCjC"}
+{"version":3,"file":"evaluate-repository-security.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAGV,0BAA0B,EAC1B,wBAAwB,EAGzB,MAAM,iCAAiC,CAAC;AAkWzC,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,wBAAwB,EAChC,QAAQ,EAAE,0BAA0B,GACnC,SAAS,oBAAoB,EAAE,CAoDjC"}

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.js

@@ -1,22 +1,12 @@
+import { isPinnedContainerImage, isPinnedExternalWorkflowUse, isSafeLocalWorkflowUse } from "../model/repository-security.js";
 import { REPOSITORY_SECURITY_RULES } from "../rules.js";
-const FULL_SHA_ACTION = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_./-]+)?@[0-9a-fA-F]{40}$/u;
-const FULL_DIGEST_CONTAINER = /^docker:\/\/.+@sha256:[0-9a-fA-F]{64}$/u;
+import { inspectDependencyReviewOrdering, isDependencyReviewEvidence } from "./dependency-review-ordering.js";
+import { evaluateRepositorySecurityTools } from "./evaluate-repository-security-tools.js";
+import { evaluateRepositoryWorkflowUses } from "./evaluate-repository-workflow-uses.js";
+import { repositorySecurityDiagnostic as diagnostic } from "./repository-security-diagnostic.js";
 const UNSAFE_PACKAGE_SEGMENT = /^(?:\.env(?:\..*)?|\.git|node_modules|src|tests?|auth\.json)$/iu;
 const PACKAGE_PATH_META = /[*?{}[\]\\]/u;
 const UNTRUSTED_EXPRESSION_IN_RUN = /\$\{\{[^}]*github\s*(?:\.\s*(?:event|head_ref)\b|\[\s*["'](?:event|head_ref)["']\s*\])/iu;
-function diagnostic(input) {
-    return {
-        ruleId: input.rule.id,
-        severity: input.rule.severity,
-        subject: input.subject,
-        message: input.message,
-        location: { path: input.path },
-        relatedLocations: [],
-        evidence: input.evidence ?? [],
-        remediation: input.rule.remediation,
-        requiresArchitectureReview: input.rule.requiresArchitectureReview
-    };
-}
 function exactPermissions(actual, expected) {
     const actualEntries = Object.entries(actual).toSorted(([left], [right]) => left < right ? -1 : left > right ? 1 : 0);
     const expectedEntries = Object.entries(expected).toSorted(([left], [right]) => left < right ? -1 : left > right ? 1 : 0);
@@ -26,10 +16,10 @@ function policyForJob(policy, workflowPath, jobId) {
     return policy.privilegedJobs.find((candidate) => candidate.workflowPath === workflowPath && candidate.jobId === jobId);
 }
 function actionPinned(action) {
-    if (action.startsWith("./")) {
-        return !action.split("/").includes("..") && !action.includes("${{");
+    if (isSafeLocalWorkflowUse(action)) {
+        return true;
     }
-    return FULL_SHA_ACTION.test(action) || FULL_DIGEST_CONTAINER.test(action);
+    return isPinnedExternalWorkflowUse(action);
 }
 function jobPermissions(job, workflowPermissions) {
     return job.permissions ?? workflowPermissions;
@@ -40,12 +30,6 @@ function inputIsEnabledOrAbsent(step, name) {
         value === true ||
         (typeof value === "string" && value.toLowerCase() === "true"));
 }
-function inputIsDisabledOrAbsent(step, name) {
-    const value = step.inputs[name];
-    return (value === undefined ||
-        value === false ||
-        (typeof value === "string" && value.toLowerCase() === "false"));
-}
 function scansRepositoryRoot(step) {
     const path = step.inputs["path"];
     return ((path === undefined || path === "." || path === "./") &&
@@ -65,17 +49,28 @@ function unsafePackagePath(entry) {
         segment === ".." ||
         UNSAFE_PACKAGE_SEGMENT.test(segment));
 }
-function isDependencyReviewEvidence(policy, workflow, job, step) {
-    return (workflow.path === policy.dependencyReviewWorkflow &&
-        workflow.unconditionalTriggers.includes("pull_request") &&
-        !job.conditional &&
-        !job.nonBlocking &&
-        !step.conditional &&
-        !step.nonBlocking &&
-        inputIsDisabledOrAbsent(step, "warn-only") &&
-        step.inputs["config-file"] === undefined &&
-        step.uses?.startsWith("actions/dependency-review-action@") === true &&
-        actionPinned(step.uses));
+function inspectContainerImage(policy, workflow, job, container, state) {
+    const subject = `${workflow.path}:${job.id}.${container.scope}.${container.name}`;
+    if (!isPinnedContainerImage(container.image)) {
+        state.diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.containerNotPinned,
+            subject,
+            path: workflow.path,
+            message: `Container image is not pinned to an immutable digest: ${container.image}.`,
+            evidence: [{ kind: "container-image", value: container.image }]
+        }));
+        return;
+    }
+    state.seenContainerImages.add(container.image);
+    if (!policy.allowedContainerImages.includes(container.image)) {
+        state.diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.containerNotAllowlisted,
+            subject,
+            path: workflow.path,
+            message: `Pinned container image is not declared in allowedContainerImages: ${container.image}.`,
+            evidence: [{ kind: "container-image", value: container.image }]
+        }));
+    }
 }
 function isSbomEvidence(policy, workflow, job, step) {
     return (workflow.path === policy.sbomWorkflow &&
@@ -166,16 +161,31 @@ function inspectWorkflowJob(policy, workflow, job, state) {
             evidence: [{ kind: "action", value: job.uses }]
         }));
     }
+    for (const container of job.containers) {
+        inspectContainerImage(policy, workflow, job, container, state);
+    }
     for (const step of job.steps) {
         inspectWorkflowStep(policy, workflow, job, step, state);
     }
 }
+function inspectCompositeAction(action, diagnostics) {
+    for (const [index, step] of action.steps.entries()) {
+        if (step.run !== undefined && UNTRUSTED_EXPRESSION_IN_RUN.test(step.run)) {
+            diagnostics.push(diagnostic({
+                rule: REPOSITORY_SECURITY_RULES.eventInterpolationInRun,
+                subject: `${action.path}:runs.steps[${index}]`,
+                path: action.path,
+                message: "Composite action shell script directly interpolates github.event data."
+            }));
+        }
+    }
+}
 function inspectRequiredEvidence(policy, state) {
     if (!state.dependencyReviewFound) {
         state.diagnostics.push(diagnostic({
             rule: REPOSITORY_SECURITY_RULES.dependencyReviewMissing,
-            subject: policy.dependencyReviewWorkflow,
-            path: policy.dependencyReviewWorkflow,
+            subject: `${policy.dependencyReview.workflowPath}:${policy.dependencyReview.jobId}`,
+            path: policy.dependencyReview.workflowPath,
             message: "Declared dependency-review workflow does not run the pinned official action."
         }));
     }
@@ -213,6 +223,7 @@ function inspectPackageEvidence(packageEvidence, diagnostics) {
 export function evaluateRepositorySecurity(policy, evidence) {
     const state = {
         diagnostics: [],
+        seenContainerImages: new Set(),
         seenPrivilegedJobs: new Set(),
         dependencyReviewFound: false,
         sbomFound: false
@@ -221,8 +232,12 @@ export function evaluateRepositorySecurity(policy, evidence) {
         inspectWorkflowRoot(workflow, state);
         for (const job of workflow.jobs) {
             inspectWorkflowJob(policy, workflow, job, state);
+            inspectDependencyReviewOrdering(policy, workflow, job, state.diagnostics);
         }
     }
+    for (const action of evidence.compositeActions) {
+        inspectCompositeAction(action, state.diagnostics);
+    }
     inspectRequiredEvidence(policy, state);
     for (const privileged of policy.privilegedJobs) {
         const key = `${privileged.workflowPath}:${privileged.jobId}`;
@@ -235,6 +250,19 @@ export function evaluateRepositorySecurity(policy, evidence) {
             }));
         }
     }
+    for (const image of policy.allowedContainerImages) {
+        if (!state.seenContainerImages.has(image)) {
+            state.diagnostics.push(diagnostic({
+                rule: REPOSITORY_SECURITY_RULES.staleAllowedContainerImage,
+                subject: image,
+                path: policy.workflowDirectory,
+                message: "Declared allowedContainerImages entry has no matching job or service container.",
+                evidence: [{ kind: "container-image", value: image }]
+            }));
+        }
+    }
+    evaluateRepositoryWorkflowUses(policy, evidence, state.diagnostics);
+    evaluateRepositorySecurityTools(policy, evidence, state.diagnostics);
     for (const packageEvidence of evidence.packages) {
         inspectPackageEvidence(packageEvidence, state.diagnostics);
     }

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.js.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate-repository-security.js","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,yBAAyB,EAE1B,MAAM,aAAa,CAAC;AAErB,MAAM,eAAe,GAAG,4EAA4E,CAAC;AACrG,MAAM,qBAAqB,GAAG,yCAAyC,CAAC;AACxE,MAAM,sBAAsB,GAAG,iEAAiE,CAAC;AACjG,MAAM,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,2BAA2B,GAC/B,0FAA0F,CAAC;AAE7F,SAAS,UAAU,CAAC,KAMnB;IACC,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;QACrB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;QAC9B,gBAAgB,EAAE,EAAE;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;QAC9B,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;QACnC,0BAA0B,EAAE,KAAK,CAAC,IAAI,CAAC,0BAA0B;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAoD,EACpD,QAAsD;IAEtD,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CACxE,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC;IACF,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAC5E,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,YAAY,CACnB,MAAgC,EAChC,YAAoB,EACpB,KAAa;IAEb,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAC/B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,KAAK,YAAY,IAAI,SAAS,CAAC,KAAK,KAAK,KAAK,CACpF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,cAAc,CACrB,GAAwB,EACxB,mBAAmF;IAEnF,OAAO,GAAG,CAAC,WAAW,IAAI,mBAAmB,CAAC;AAChD,CAAC;AAED,SAAS,sBAAsB,CAC7B,IAA0C,EAC1C,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,CACL,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,IAAI;QACd,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,IAA0C,EAC1C,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,CACL,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,KAAK;QACf,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAA0C;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,CACL,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,SAAS;QACjC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,SAAS,CACnC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,IAAI,CAClB,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,KAAK,GAAG;QACf,OAAO,KAAK,IAAI;QAChB,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CACvC,CAAC;AACJ,CAAC;AAYD,SAAS,0BAA0B,CACjC,MAAgC,EAChC,QAA0B,EAC1B,GAAqC,EACrC,IAAuD;IAEvD,OAAO,CACL,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,wBAAwB;QACjD,QAAQ,CAAC,qBAAqB,CAAC,QAAQ,CAAC,cAAc,CAAC;QACvD,CAAC,GAAG,CAAC,WAAW;QAChB,CAAC,GAAG,CAAC,WAAW;QAChB,CAAC,IAAI,CAAC,WAAW;QACjB,CAAC,IAAI,CAAC,WAAW;QACjB,uBAAuB,CAAC,IAAI,EAAE,WAAW,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,SAAS;QACxC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,mCAAmC,CAAC,KAAK,IAAI;QACnE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,MAAgC,EAChC,QAA0B,EAC1B,GAAqC,EACrC,IAAuD;IAEvD,OAAO,CACL,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,YAAY;QACrC,QAAQ,CAAC,qBAAqB,CAAC,QAAQ,CAAC,cAAc,CAAC;QACvD,CAAC,GAAG,CAAC,WAAW;QAChB,CAAC,GAAG,CAAC,WAAW;QAChB,CAAC,IAAI,CAAC,WAAW;QACjB,CAAC,IAAI,CAAC,WAAW;QACjB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,CAAC;QAC/C,mBAAmB,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,sBAAsB,CAAC,KAAK,IAAI;QACtD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAA0B,EAC1B,KAAsB;IAEtB,IACE,QAAQ,CAAC,WAAW,KAAK,SAAS;QAClC,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ;QACxC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,EACtE,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,OAAO,EAAE,QAAQ,CAAC,IAAI;YACtB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,iEAAiE;SAC3E,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACtD,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,gBAAgB;YAChD,OAAO,EAAE,QAAQ,CAAC,IAAI;YACtB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,+CAA+C;SACzD,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAgC,EAChC,QAA0B,EAC1B,GAAqC,EACrC,IAAuD,EACvD,KAAsB;IAEtB,MAAM,OAAO,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;IAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,eAAe;YAC/C,OAAO;YACP,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,+CAA+C,IAAI,CAAC,IAAI,GAAG;YACpE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;SACjD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzE,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,uBAAuB;YACvD,OAAO;YACP,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,uDAAuD;SACjE,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,0BAA0B,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QAC5D,KAAK,CAAC,qBAAqB,GAAG,IAAI,CAAC;IACrC,CAAC;IACD,IAAI,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QAChD,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;IACzB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAgC,EAChC,QAA0B,EAC1B,GAAqC,EACrC,KAAsB;IAEtB,MAAM,OAAO,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;IAC7C,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,QAAQ,GACZ,aAAa,KAAK,WAAW;QAC7B,CAAC,OAAO,aAAa,KAAK,QAAQ;YAChC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC;IACrE,MAAM,iBAAiB,GAAG,UAAU,KAAK,SAAS;QAChD,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,OAAO,aAAa,KAAK,QAAQ;YACjC,CAAC,gBAAgB,CAAC,aAAa,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAC7D,IAAI,iBAAiB,EAAE,CAAC;QACtB,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,qBAAqB;YACrD,OAAO;YACP,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,oEAAoE;SAC9E,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,eAAe;YAC/C,OAAO;YACP,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,0DAA0D,GAAG,CAAC,IAAI,GAAG;YAC9E,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;SAChD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC7B,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAgC,EAChC,KAAsB;IAEtB,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC;QACjC,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,uBAAuB;YACvD,OAAO,EAAE,MAAM,CAAC,wBAAwB;YACxC,IAAI,EAAE,MAAM,CAAC,wBAAwB;YACrC,OAAO,EAAE,8EAA8E;SACxF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,WAAW;YAC3C,OAAO,EAAE,MAAM,CAAC,YAAY;YAC5B,IAAI,EAAE,MAAM,CAAC,YAAY;YACzB,OAAO,EAAE,gEAAgE;SAC1E,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC7B,eAAgC,EAChC,WAAmC;IAEnC,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,CAAC;QAChC,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,wBAAwB;YACxD,OAAO,EAAE,eAAe,CAAC,WAAW;YACpC,IAAI,EAAE,eAAe,CAAC,YAAY;YAClC,OAAO,EAAE,qDAAqD;SAC/D,CAAC,CACH,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACrE,IACE,eAAe,CAAC,KAAK,KAAK,SAAS;QACnC,eAAe,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAClC,CAAC,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,EACrD,CAAC;QACD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,OAAO,EAAE,eAAe,CAAC,WAAW;YACpC,IAAI,EAAE,eAAe,CAAC,YAAY;YAClC,OAAO,EAAE,2DAA2D;YACpE,QAAQ,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;SAC/E,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,MAAgC,EAChC,QAAoC;IAEpC,MAAM,KAAK,GAAoB;QAC7B,WAAW,EAAE,EAAE;QACf,kBAAkB,EAAE,IAAI,GAAG,EAAU;QACrC,qBAAqB,EAAE,KAAK;QAC5B,SAAS,EAAE,KAAK;KACjB,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC1C,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChC,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACvC,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,GAAG,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QAC7D,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;gBAClD,OAAO,EAAE,GAAG;gBACZ,IAAI,EAAE,UAAU,CAAC,YAAY;gBAC7B,OAAO,EAAE,0DAA0D;aACpE,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,eAAe,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAChD,sBAAsB,CAAC,eAAe,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"evaluate-repository-security.js","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.ts"],"names":[],"mappings":"AASA,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,sBAAsB,EACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,EAC3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAC1F,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AACxF,OAAO,EAAE,4BAA4B,IAAI,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAEjG,MAAM,sBAAsB,GAAG,iEAAiE,CAAC;AACjG,MAAM,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,2BAA2B,GAC/B,0FAA0F,CAAC;AAE7F,SAAS,gBAAgB,CACvB,MAAoD,EACpD,QAAsD;IAEtD,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CACxE,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC;IACF,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAC5E,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,YAAY,CACnB,MAAgC,EAChC,YAAoB,EACpB,KAAa;IAEb,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAC/B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,KAAK,YAAY,IAAI,SAAS,CAAC,KAAK,KAAK,KAAK,CACpF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,2BAA2B,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CACrB,GAAwB,EACxB,mBAAmF;IAEnF,OAAO,GAAG,CAAC,WAAW,IAAI,mBAAmB,CAAC;AAChD,CAAC;AAED,SAAS,sBAAsB,CAC7B,IAA0C,EAC1C,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,CACL,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,IAAI;QACd,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAA0C;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,CACL,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,SAAS;QACjC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,SAAS,CACnC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,IAAI,CAClB,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,KAAK,GAAG;QACf,OAAO,KAAK,IAAI;QAChB,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CACvC,CAAC;AACJ,CAAC;AAaD,SAAS,qBAAqB,CAC5B,MAAgC,EAChC,QAA0B,EAC1B,GAAqC,EACrC,SAAiE,EACjE,KAAsB;IAEtB,MAAM,OAAO,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;IAClF,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,OAAO;YACP,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,yDAAyD,SAAS,CAAC,KAAK,GAAG;YACpF,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;SAChE,CAAC,CACH,CAAC;QACF,OAAO;IACT,CAAC;IACD,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,uBAAuB;YACvD,OAAO;YACP,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,qEAAqE,SAAS,CAAC,KAAK,GAAG;YAChG,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;SAChE,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,MAAgC,EAChC,QAA0B,EAC1B,GAAqC,EACrC,IAAuD;IAEvD,OAAO,CACL,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,YAAY;QACrC,QAAQ,CAAC,qBAAqB,CAAC,QAAQ,CAAC,cAAc,CAAC;QACvD,CAAC,GAAG,CAAC,WAAW;QAChB,CAAC,GAAG,CAAC,WAAW;QAChB,CAAC,IAAI,CAAC,WAAW;QACjB,CAAC,IAAI,CAAC,WAAW;QACjB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,CAAC;QAC/C,mBAAmB,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,sBAAsB,CAAC,KAAK,IAAI;QACtD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAA0B,EAC1B,KAAsB;IAEtB,IACE,QAAQ,CAAC,WAAW,KAAK,SAAS;QAClC,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ;QACxC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,EACtE,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,OAAO,EAAE,QAAQ,CAAC,IAAI;YACtB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,iEAAiE;SAC3E,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACtD,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,gBAAgB;YAChD,OAAO,EAAE,QAAQ,CAAC,IAAI;YACtB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,+CAA+C;SACzD,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAgC,EAChC,QAA0B,EAC1B,GAAqC,EACrC,IAAuD,EACvD,KAAsB;IAEtB,MAAM,OAAO,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;IAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,eAAe;YAC/C,OAAO;YACP,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,+CAA+C,IAAI,CAAC,IAAI,GAAG;YACpE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;SACjD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzE,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,uBAAuB;YACvD,OAAO;YACP,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,uDAAuD;SACjE,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,0BAA0B,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QAC5D,KAAK,CAAC,qBAAqB,GAAG,IAAI,CAAC;IACrC,CAAC;IACD,IAAI,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QAChD,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;IACzB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAgC,EAChC,QAA0B,EAC1B,GAAqC,EACrC,KAAsB;IAEtB,MAAM,OAAO,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;IAC7C,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,QAAQ,GACZ,aAAa,KAAK,WAAW;QAC7B,CAAC,OAAO,aAAa,KAAK,QAAQ;YAChC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC;IACrE,MAAM,iBAAiB,GAAG,UAAU,KAAK,SAAS;QAChD,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,OAAO,aAAa,KAAK,QAAQ;YACjC,CAAC,gBAAgB,CAAC,aAAa,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAC7D,IAAI,iBAAiB,EAAE,CAAC;QACtB,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,qBAAqB;YACrD,OAAO;YACP,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,oEAAoE;SAC9E,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,eAAe;YAC/C,OAAO;YACP,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,0DAA0D,GAAG,CAAC,IAAI,GAAG;YAC9E,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;SAChD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACvC,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC7B,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC7B,MAA+B,EAC/B,WAAmC;IAEnC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QACnD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACzE,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,uBAAuB;gBACvD,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,eAAe,KAAK,GAAG;gBAC9C,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,wEAAwE;aAClF,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAgC,EAChC,KAAsB;IAEtB,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC;QACjC,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,uBAAuB;YACvD,OAAO,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAC,YAAY,IAAI,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE;YACnF,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC,YAAY;YAC1C,OAAO,EAAE,8EAA8E;SACxF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,WAAW;YAC3C,OAAO,EAAE,MAAM,CAAC,YAAY;YAC5B,IAAI,EAAE,MAAM,CAAC,YAAY;YACzB,OAAO,EAAE,gEAAgE;SAC1E,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC7B,eAAgC,EAChC,WAAmC;IAEnC,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,CAAC;QAChC,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,wBAAwB;YACxD,OAAO,EAAE,eAAe,CAAC,WAAW;YACpC,IAAI,EAAE,eAAe,CAAC,YAAY;YAClC,OAAO,EAAE,qDAAqD;SAC/D,CAAC,CACH,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACrE,IACE,eAAe,CAAC,KAAK,KAAK,SAAS;QACnC,eAAe,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAClC,CAAC,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,EACrD,CAAC;QACD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,OAAO,EAAE,eAAe,CAAC,WAAW;YACpC,IAAI,EAAE,eAAe,CAAC,YAAY;YAClC,OAAO,EAAE,2DAA2D;YACpE,QAAQ,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;SAC/E,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,MAAgC,EAChC,QAAoC;IAEpC,MAAM,KAAK,GAAoB;QAC7B,WAAW,EAAE,EAAE;QACf,mBAAmB,EAAE,IAAI,GAAG,EAAU;QACtC,kBAAkB,EAAE,IAAI,GAAG,EAAU;QACrC,qBAAqB,EAAE,KAAK;QAC5B,SAAS,EAAE,KAAK;KACjB,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC1C,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChC,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACjD,+BAA+B,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC/C,sBAAsB,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACpD,CAAC;IACD,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACvC,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,GAAG,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QAC7D,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;gBAClD,OAAO,EAAE,GAAG;gBACZ,IAAI,EAAE,UAAU,CAAC,YAAY;gBAC7B,OAAO,EAAE,0DAA0D;aACpE,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAClD,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,0BAA0B;gBAC1D,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,MAAM,CAAC,iBAAiB;gBAC9B,OAAO,EAAE,iFAAiF;gBAC1F,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;aACtD,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,8BAA8B,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACpE,+BAA+B,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACrE,KAAK,MAAM,eAAe,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAChD,sBAAsB,CAAC,eAAe,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,CAAC;AAC3B,CAAC"}

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-workflow-uses.d.ts

@@ -0,0 +1,4 @@
+import type { FoundationDiagnostic } from "../../../../check-contract.js";
+import type { RepositorySecurityEvidence, RepositorySecurityPolicy } from "../model/repository-security.js";
+export declare function evaluateRepositoryWorkflowUses(policy: RepositorySecurityPolicy, evidence: RepositorySecurityEvidence, diagnostics: FoundationDiagnostic[]): void;
+//# sourceMappingURL=evaluate-repository-workflow-uses.d.ts.map

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-workflow-uses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-repository-workflow-uses.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/evaluate-repository-workflow-uses.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EACV,0BAA0B,EAC1B,wBAAwB,EACzB,MAAM,iCAAiC,CAAC;AAazC,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,wBAAwB,EAChC,QAAQ,EAAE,0BAA0B,EACpC,WAAW,EAAE,oBAAoB,EAAE,GAClC,IAAI,CAuDN"}

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-workflow-uses.js

@@ -0,0 +1,55 @@
+import { flattenAllowedWorkflowUses, isPinnedExternalWorkflowUse, isSafeLocalWorkflowUse } from "../model/repository-security.js";
+import { REPOSITORY_SECURITY_RULES } from "../rules.js";
+import { repositorySecurityDiagnostic as diagnostic } from "./repository-security-diagnostic.js";
+function usePinned(use) {
+    return isSafeLocalWorkflowUse(use) || isPinnedExternalWorkflowUse(use);
+}
+export function evaluateRepositoryWorkflowUses(policy, evidence, diagnostics) {
+    const flattenedAllowedUses = flattenAllowedWorkflowUses(policy.allowedUses);
+    const directAllowedUses = new Set(flattenedAllowedUses.filter(({ direct }) => direct).map(({ uses }) => uses));
+    const allAllowedUses = new Set(flattenedAllowedUses.map(({ uses }) => uses));
+    const observedDirectUses = new Set();
+    for (const use of evidence.workflowUses) {
+        if (!usePinned(use.uses)) {
+            diagnostics.push(diagnostic({
+                rule: REPOSITORY_SECURITY_RULES.actionNotPinned,
+                subject: use.subject,
+                path: use.path,
+                message: `Workflow use is not pinned to immutable evidence: ${use.uses}.`,
+                evidence: [{ kind: "use", value: use.uses }]
+            }));
+            continue;
+        }
+        if (!isPinnedExternalWorkflowUse(use.uses)) {
+            continue;
+        }
+        observedDirectUses.add(use.uses);
+        const allowlisted = allAllowedUses.has(use.uses);
+        const direct = directAllowedUses.has(use.uses);
+        if (!allowlisted || !direct) {
+            diagnostics.push(diagnostic({
+                rule: allowlisted
+                    ? REPOSITORY_SECURITY_RULES.actionAllowlistScopeMismatch
+                    : REPOSITORY_SECURITY_RULES.actionNotAllowlisted,
+                subject: use.subject,
+                path: use.path,
+                message: allowlisted
+                    ? `Direct repository use is declared only as transitive: ${use.uses}.`
+                    : `Pinned external workflow use is not declared in allowedUses: ${use.uses}.`,
+                evidence: [{ kind: "use", value: use.uses }]
+            }));
+        }
+    }
+    for (const allowedUse of directAllowedUses) {
+        if (!observedDirectUses.has(allowedUse)) {
+            diagnostics.push(diagnostic({
+                rule: REPOSITORY_SECURITY_RULES.staleAllowedUse,
+                subject: allowedUse,
+                path: policy.workflowDirectory,
+                message: `Direct allowedUses entry is not referenced by discovered local workflow sources: ${allowedUse}.`,
+                evidence: [{ kind: "use", value: allowedUse }]
+            }));
+        }
+    }
+}
+//# sourceMappingURL=evaluate-repository-workflow-uses.js.map

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-workflow-uses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-repository-workflow-uses.js","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/evaluate-repository-workflow-uses.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,sBAAsB,EACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,4BAA4B,IAAI,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAEjG,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,sBAAsB,CAAC,GAAG,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAAgC,EAChC,QAAoC,EACpC,WAAmC;IAEnC,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5E,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,oBAAoB,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAC5E,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACxC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,eAAe;gBAC/C,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,qDAAqD,GAAG,CAAC,IAAI,GAAG;gBACzE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;aAC7C,CAAC,CACH,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,SAAS;QACX,CAAC;QACD,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5B,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,WAAW;oBACf,CAAC,CAAC,yBAAyB,CAAC,4BAA4B;oBACxD,CAAC,CAAC,yBAAyB,CAAC,oBAAoB;gBAClD,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,WAAW;oBAClB,CAAC,CAAC,yDAAyD,GAAG,CAAC,IAAI,GAAG;oBACtE,CAAC,CAAC,gEAAgE,GAAG,CAAC,IAAI,GAAG;gBAC/E,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;aAC7C,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,iBAAiB,EAAE,CAAC;QAC3C,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,eAAe;gBAC/C,OAAO,EAAE,UAAU;gBACnB,IAAI,EAAE,MAAM,CAAC,iBAAiB;gBAC9B,OAAO,EAAE,oFAAoF,UAAU,GAAG;gBAC1G,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;aAC/C,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/capabilities/repository-security-baseline/application/policies/repository-security-diagnostic.d.ts

@@ -0,0 +1,14 @@
+import type { DiagnosticSeverity, FoundationDiagnostic } from "../../../../check-contract.js";
+import type { RepositorySecurityRuleMetadata } from "../rules.js";
+export declare function repositorySecurityDiagnostic(input: {
+    readonly evidence?: readonly {
+        readonly kind: string;
+        readonly value: string;
+    }[];
+    readonly message: string;
+    readonly path: string;
+    readonly rule: RepositorySecurityRuleMetadata;
+    readonly severity?: DiagnosticSeverity;
+    readonly subject: string;
+}): FoundationDiagnostic;
+//# sourceMappingURL=repository-security-diagnostic.d.ts.map

package/dist/capabilities/repository-security-baseline/application/policies/repository-security-diagnostic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-security-diagnostic.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/repository-security-diagnostic.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC9F,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAElE,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACjF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,8BAA8B,CAAC;IAC9C,QAAQ,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,GAAG,oBAAoB,CAYvB"}