@avi770/testteam 3.0.0 → 3.2.0

package/dist/agents/102-dockerfile-auditor.js

@@ -0,0 +1,337 @@
+/**
+ * Dockerfile Auditor — static scan of Dockerfiles for the most common
+ * container security / reproducibility mistakes. Completes the deploy-
+ * readiness theme started by #97 (healthcheck routes): #97 checks the app
+ * exposes probes, #102 checks the container that runs it is hardened.
+ *
+ * Checks (on the FINAL build stage, which is what actually ships):
+ *   - 102-runs-as-root        high    code-bug-security
+ *     No USER directive, or the last USER is root / 0. A compromised
+ *     process then has root in the container.
+ *   - 102-latest-base-tag     medium  infra-issue
+ *     FROM image with no tag or `:latest` — non-reproducible builds,
+ *     surprise upgrades.
+ *   - 102-secret-in-env       high    code-bug-security
+ *     ENV / ARG with a secret-shaped name AND a literal value baked into
+ *     the image (readable via `docker history`).
+ *   - 102-no-healthcheck      low     infra-issue
+ *     No HEALTHCHECK directive — orchestrators can't tell if the
+ *     container is actually serving.
+ *   - 102-summary             info
+ *
+ * Persists `evidence/dockerfile-audit.json`. Read-only, parallel-safe,
+ * static analysis only.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { BaseAgent } from './base-agent.js';
+const SKIP_DIRS = new Set([
+    'node_modules', '.git', 'dist', 'build', '.next', '.nuxt', 'coverage', 'reports', 'baselines', 'evidence',
+]);
+/** Secret-shaped ENV/ARG key fragments. */
+const SECRET_KEY_RE = /(password|passwd|secret|api[_-]?key|access[_-]?key|private[_-]?key|token|credential)/i;
+/** Values that are obviously placeholders, not real secrets. */
+const PLACEHOLDER_VALUE_RE = /^(?:|changeme|placeholder|xxx+|<.*>|\$\{.*\}|your[_-].*|example|test|dummy|none|null)$/i;
+function isDockerfileName(name) {
+    return name === 'Dockerfile' || /\.dockerfile$/i.test(name) || /^dockerfile\./i.test(name);
+}
+function findDockerfiles(root, results = [], depth = 0) {
+    if (depth > 4 || !fs.existsSync(root))
+        return results;
+    let entries;
+    try {
+        entries = fs.readdirSync(root, { withFileTypes: true });
+    }
+    catch {
+        return results;
+    }
+    for (const entry of entries) {
+        if (SKIP_DIRS.has(entry.name))
+            continue;
+        const full = path.join(root, entry.name);
+        if (entry.isDirectory()) {
+            findDockerfiles(full, results, depth + 1);
+        }
+        else if (entry.isFile() && isDockerfileName(entry.name)) {
+            results.push(full);
+        }
+    }
+    return results;
+}
+function relativise(absPath, root) {
+    return path.relative(root, absPath).split(path.sep).join('/');
+}
+/** Join Dockerfile line continuations (`\`) and drop comments/blanks. */
+export function logicalLines(content) {
+    const rawLines = content.split(/\r?\n/);
+    const out = [];
+    let buffer = '';
+    let startLine = 0;
+    for (let i = 0; i < rawLines.length; i++) {
+        const raw = rawLines[i];
+        const trimmed = raw.trim();
+        if (buffer === '' && (trimmed === '' || trimmed.startsWith('#')))
+            continue;
+        if (buffer === '')
+            startLine = i + 1;
+        if (trimmed.endsWith('\\')) {
+            buffer += trimmed.slice(0, -1).trim() + ' ';
+        }
+        else {
+            buffer += trimmed;
+            out.push({ text: buffer.trim(), line: startLine });
+            buffer = '';
+        }
+    }
+    if (buffer.trim() !== '')
+        out.push({ text: buffer.trim(), line: startLine });
+    return out;
+}
+/**
+ * Audit a single Dockerfile's content. Splits into build stages on FROM and
+ * applies the root / healthcheck checks to the FINAL stage (the shipped
+ * image); base-tag and secret checks apply across all stages.
+ */
+export function auditDockerfile(content) {
+    const hits = [];
+    const lines = logicalLines(content);
+    // Track stage boundaries (FROM ...). Each stage = directives until next FROM.
+    const stageStartIdx = [];
+    lines.forEach((l, idx) => {
+        if (/^FROM\s+/i.test(l.text))
+            stageStartIdx.push(idx);
+    });
+    // --- base-tag check: every FROM ---
+    for (const l of lines) {
+        const m = l.text.match(/^FROM\s+(\S+)(?:\s+AS\s+\S+)?/i);
+        if (!m)
+            continue;
+        const image = m[1];
+        if (image.startsWith('$'))
+            continue; // build-arg image ref — can't judge
+        // scratch is intentionally tagless
+        if (image === 'scratch')
+            continue;
+        // A stage referencing a previous stage name (multi-stage) — skip tag check.
+        const tagPart = image.includes('/') ? image.split('/').pop() : image;
+        const hasColon = tagPart.includes(':') || image.includes('@sha256:');
+        const isLatest = /:latest$/i.test(image);
+        if (!hasColon || isLatest) {
+            // If it's referencing a named stage (FROM builder), there'd be no registry
+            // path and it'd match a prior "AS <name>" — skip those.
+            const namedStages = lines
+                .map((x) => x.text.match(/^FROM\s+\S+\s+AS\s+(\S+)/i)?.[1])
+                .filter((x) => !!x);
+            if (namedStages.includes(image))
+                continue;
+            hits.push({
+                kind: 'latest-base-tag',
+                line: l.line,
+                detail: `FROM ${image}`,
+            });
+        }
+    }
+    // --- secret-in-env check: ENV / ARG with secret-shaped name + real value ---
+    for (const l of lines) {
+        const m = l.text.match(/^(ENV|ARG)\s+(.+)$/i);
+        if (!m)
+            continue;
+        const directive = m[1].toUpperCase();
+        const rest = m2pairs(m[2]);
+        for (const { key, value } of rest) {
+            if (!SECRET_KEY_RE.test(key))
+                continue;
+            // ARG with no default is fine (injected at build); ENV with a value is baked.
+            if (value === null)
+                continue;
+            if (PLACEHOLDER_VALUE_RE.test(value))
+                continue;
+            hits.push({
+                kind: 'secret-in-env',
+                line: l.line,
+                detail: `${directive} ${key}`,
+            });
+        }
+    }
+    // --- final-stage checks: root + healthcheck ---
+    if (stageStartIdx.length > 0) {
+        const finalStart = stageStartIdx[stageStartIdx.length - 1];
+        const finalStage = lines.slice(finalStart);
+        // USER: find the last USER in the final stage.
+        let lastUser = null;
+        let healthcheckSeen = false;
+        for (const l of finalStage) {
+            const u = l.text.match(/^USER\s+(\S+)/i);
+            if (u)
+                lastUser = u[1];
+            if (/^HEALTHCHECK\s+/i.test(l.text))
+                healthcheckSeen = true;
+        }
+        // Also honour a HEALTHCHECK in any stage? No — only the final image runs it.
+        // Distroless / `:nonroot` base images run as a non-root user by default with
+        // no explicit USER directive — so "no USER" there isn't running as root.
+        const finalImage = finalStage[0]?.text.match(/^FROM\s+(\S+)/i)?.[1] ?? '';
+        const baseIsNonRoot = /:nonroot\b|[/-]nonroot\b/i.test(finalImage);
+        if ((lastUser === null && !baseIsNonRoot) || lastUser === 'root' || lastUser === '0') {
+            hits.push({
+                kind: 'runs-as-root',
+                line: lines[finalStart].line,
+                detail: lastUser === null ? 'no USER directive' : `USER ${lastUser}`,
+            });
+        }
+        if (!healthcheckSeen) {
+            hits.push({
+                kind: 'no-healthcheck',
+                line: lines[finalStart].line,
+                detail: 'no HEALTHCHECK directive',
+            });
+        }
+    }
+    return hits;
+}
+/** Parse the operands of an ENV/ARG directive into key/value pairs. */
+function m2pairs(rest) {
+    const out = [];
+    const trimmed = rest.trim();
+    // `ENV KEY=val KEY2=val2` form (has `=`).
+    if (/^\S+=/.test(trimmed)) {
+        // Split on spaces that aren't inside quotes.
+        const tokens = trimmed.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) ?? [];
+        for (const tok of tokens) {
+            const eq = tok.indexOf('=');
+            if (eq <= 0)
+                continue;
+            const key = tok.slice(0, eq);
+            let value = tok.slice(eq + 1);
+            value = value.replace(/^['"]|['"]$/g, '');
+            out.push({ key, value });
+        }
+        return out;
+    }
+    // `ENV KEY value...` form (legacy, space-separated) or `ARG KEY` (no value).
+    const firstSpace = trimmed.indexOf(' ');
+    if (firstSpace === -1) {
+        out.push({ key: trimmed, value: null });
+    }
+    else {
+        const key = trimmed.slice(0, firstSpace);
+        const value = trimmed.slice(firstSpace + 1).trim().replace(/^['"]|['"]$/g, '');
+        out.push({ key, value });
+    }
+    return out;
+}
+export class DockerfileAuditorAgent extends BaseAgent {
+    agentId = 102;
+    agentName = 'Dockerfile Auditor';
+    async preFlight() {
+        const root = this.config.projectRoot ?? process.cwd();
+        if (!fs.existsSync(root)) {
+            throw new Error(`projectRoot does not exist: ${root}`);
+        }
+    }
+    async execute() {
+        const findings = [];
+        const projectRoot = this.config.projectRoot ?? process.cwd();
+        const dockerfiles = findDockerfiles(projectRoot);
+        if (dockerfiles.length === 0) {
+            findings.push({
+                id: `${this.agentId}-no-dockerfile`,
+                type: 'infra-issue',
+                severity: 'info',
+                agentId: this.agentId,
+                module: 'dockerfile-auditor',
+                description: 'No Dockerfile found — nothing to audit (not a containerised project, or build is image-based).',
+            });
+            this.persistAudit(projectRoot, [], []);
+            return findings;
+        }
+        const allHits = [];
+        for (const file of dockerfiles) {
+            let content;
+            try {
+                content = fs.readFileSync(file, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            const rel = relativise(file, projectRoot);
+            for (const hit of auditDockerfile(content)) {
+                allHits.push({ ...hit, file: rel });
+            }
+        }
+        for (const hit of allHits.slice(0, 100)) {
+            findings.push(this.toFinding(hit));
+        }
+        this.persistAudit(projectRoot, dockerfiles.map((d) => relativise(d, projectRoot)), allHits);
+        findings.push({
+            id: `${this.agentId}-summary`,
+            type: 'infra-issue',
+            severity: 'info',
+            agentId: this.agentId,
+            module: 'dockerfile-auditor',
+            description: `Dockerfile audit: ${dockerfiles.length} file(s), ${allHits.length} issue(s) (${allHits.filter((h) => h.kind === 'runs-as-root').length} root, ${allHits.filter((h) => h.kind === 'secret-in-env').length} baked secret, ${allHits.filter((h) => h.kind === 'latest-base-tag').length} latest-tag, ${allHits.filter((h) => h.kind === 'no-healthcheck').length} no-healthcheck).`,
+        });
+        return findings;
+    }
+    toFinding(hit) {
+        const slug = `${hit.file.replace(/[^\w]/g, '_')}-${hit.line}`;
+        const base = { agentId: this.agentId, module: 'dockerfile-auditor', file: hit.file, line: hit.line };
+        switch (hit.kind) {
+            case 'runs-as-root':
+                return {
+                    ...base,
+                    id: `${this.agentId}-runs-as-root-${slug}`,
+                    type: 'code-bug-security',
+                    severity: 'high',
+                    description: `${hit.file} final stage runs as root (${hit.detail}). A compromised process gets root inside the container — add a non-root \`USER\` before the entrypoint.`,
+                };
+            case 'secret-in-env':
+                return {
+                    ...base,
+                    id: `${this.agentId}-secret-in-env-${slug}`,
+                    type: 'code-bug-security',
+                    severity: 'high',
+                    description: `${hit.file}:${hit.line} bakes a secret into the image (${hit.detail}) — it's readable via \`docker history\` / image layers. Pass secrets at runtime (env, mounted file, secret store) instead.`,
+                };
+            case 'latest-base-tag':
+                return {
+                    ...base,
+                    id: `${this.agentId}-latest-base-tag-${slug}`,
+                    type: 'infra-issue',
+                    severity: 'medium',
+                    description: `${hit.file}:${hit.line} uses an untagged or \`:latest\` base image (${hit.detail}) — builds aren't reproducible and a base push can silently change behaviour. Pin a specific version (ideally a digest).`,
+                };
+            case 'no-healthcheck':
+                return {
+                    ...base,
+                    id: `${this.agentId}-no-healthcheck-${slug}`,
+                    type: 'infra-issue',
+                    severity: 'low',
+                    description: `${hit.file} has no HEALTHCHECK directive — orchestrators can't detect a wedged container. Add a HEALTHCHECK hitting one of the app's liveness routes (see #97).`,
+                };
+        }
+    }
+    persistAudit(projectRoot, dockerfiles, hits) {
+        const audit = {
+            version: 1,
+            generatedAt: new Date().toISOString(),
+            projectRoot,
+            dockerfiles,
+            hits,
+        };
+        try {
+            const evidenceDir = path.join(this.runDir, 'evidence');
+            fs.mkdirSync(evidenceDir, { recursive: true });
+            fs.writeFileSync(path.join(evidenceDir, 'dockerfile-audit.json'), JSON.stringify(audit, null, 2), 'utf-8');
+            this.addEvidence({
+                type: 'report',
+                path: 'evidence/dockerfile-audit.json',
+                description: `Dockerfile audit: ${hits.length} issue(s) across ${dockerfiles.length} file(s)`,
+            });
+        }
+        catch {
+            // non-fatal
+        }
+    }
+}
+//# sourceMappingURL=102-dockerfile-auditor.js.map

package/dist/agents/102-dockerfile-auditor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"102-dockerfile-auditor.js","sourceRoot":"","sources":["../../agents/102-dockerfile-auditor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC;IAC7C,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU;CAC1G,CAAC,CAAC;AAEH,2CAA2C;AAC3C,MAAM,aAAa,GAAG,uFAAuF,CAAC;AAC9G,gEAAgE;AAChE,MAAM,oBAAoB,GAAG,yFAAyF,CAAC;AAuBvH,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,IAAI,KAAK,YAAY,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,UAAoB,EAAE,EAAE,KAAK,GAAG,CAAC;IACtE,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC;IACtD,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC5C,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,IAAY;IAC/C,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC;AAOD,yEAAyE;AACzE,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,MAAM,KAAK,EAAE,IAAI,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAAE,SAAS;QAC3E,IAAI,MAAM,KAAK,EAAE;YAAE,SAAS,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,OAAO,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACnD,MAAM,GAAG,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7E,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,IAAI,GAAuC,EAAE,CAAC;IACpD,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAEpC,8EAA8E;IAC9E,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;QACvB,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,qCAAqC;IACrC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACzD,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,oCAAoC;QACzE,mCAAmC;QACnC,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,4EAA4E;QAC5E,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC,CAAC,CAAC,KAAK,CAAC;QACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,IAAI,QAAQ,EAAE,CAAC;YAC1B,2EAA2E;YAC3E,wDAAwD;YACxD,MAAM,WAAW,GAAG,KAAK;iBACtB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;iBAC1D,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,SAAS;YAC1C,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,iBAAiB;gBACvB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,QAAQ,KAAK,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC9C,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YACvC,8EAA8E;YAC9E,IAAI,KAAK,KAAK,IAAI;gBAAE,SAAS;YAC7B,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,SAAS;YAC/C,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,GAAG,SAAS,IAAI,GAAG,EAAE;aAC9B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAE3C,+CAA+C;QAC/C,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACzC,IAAI,CAAC;gBAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,eAAe,GAAG,IAAI,CAAC;QAC9D,CAAC;QACD,6EAA6E;QAE7E,6EAA6E;QAC7E,yEAAyE;QACzE,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1E,MAAM,aAAa,GAAG,2BAA2B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEnE,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YACrF,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI;gBAC5B,MAAM,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,QAAQ,QAAQ,EAAE;aACrE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,gBAAgB;gBACtB,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI;gBAC5B,MAAM,EAAE,0BAA0B;aACnC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,GAAG,GAAiD,EAAE,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,0CAA0C;IAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,6CAA6C;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,IAAI,EAAE,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,EAAE,IAAI,CAAC;gBAAE,SAAS;YACtB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7B,IAAI,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAC9B,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,6EAA6E;IAC7E,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC/E,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,sBAAuB,SAAQ,SAAS;IAC1C,OAAO,GAAG,GAAG,CAAC;IACd,SAAS,GAAG,oBAAoB,CAAC;IAEhC,KAAK,CAAC,SAAS;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE7D,MAAM,WAAW,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,gBAAgB;gBACnC,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,oBAAoB;gBAC5B,WAAW,EAAE,gGAAgG;aAC9G,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACvC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC1C,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3C,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAE5F,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU;YAC7B,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,oBAAoB;YAC5B,WAAW,EAAE,qBAAqB,WAAW,CAAC,MAAM,aAAa,OAAO,CAAC,MAAM,cAAc,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,MAAM,UAAU,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,MAAM,kBAAkB,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,MAAM,gBAAgB,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,MAAM,mBAAmB;SAC/X,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,SAAS,CAAC,GAAkB;QAClC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;QACrG,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,cAAc;gBACjB,OAAO;oBACL,GAAG,IAAI;oBACP,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,iBAAiB,IAAI,EAAE;oBAC1C,IAAI,EAAE,mBAAmB;oBACzB,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,8BAA8B,GAAG,CAAC,MAAM,0GAA0G;iBAC3K,CAAC;YACJ,KAAK,eAAe;gBAClB,OAAO;oBACL,GAAG,IAAI;oBACP,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,kBAAkB,IAAI,EAAE;oBAC3C,IAAI,EAAE,mBAAmB;oBACzB,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,mCAAmC,GAAG,CAAC,MAAM,6HAA6H;iBAC/M,CAAC;YACJ,KAAK,iBAAiB;gBACpB,OAAO;oBACL,GAAG,IAAI;oBACP,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,oBAAoB,IAAI,EAAE;oBAC7C,IAAI,EAAE,aAAa;oBACnB,QAAQ,EAAE,QAAQ;oBAClB,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,gDAAgD,GAAG,CAAC,MAAM,0HAA0H;iBACzN,CAAC;YACJ,KAAK,gBAAgB;gBACnB,OAAO;oBACL,GAAG,IAAI;oBACP,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,mBAAmB,IAAI,EAAE;oBAC5C,IAAI,EAAE,aAAa;oBACnB,QAAQ,EAAE,KAAK;oBACf,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,sJAAsJ;iBAC/K,CAAC;QACN,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,WAAmB,EAAE,WAAqB,EAAE,IAAqB;QACpF,MAAM,KAAK,GAAoB;YAC7B,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,WAAW;YACX,WAAW;YACX,IAAI;SACL,CAAC;QACF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACvD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAC/C,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAC9B,OAAO,CACR,CAAC;YACF,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,gCAAgC;gBACtC,WAAW,EAAE,qBAAqB,IAAI,CAAC,MAAM,oBAAoB,WAAW,CAAC,MAAM,UAAU;aAC9F,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/agents/103-ci-workflow-auditor.d.ts

@@ -0,0 +1,57 @@
+/**
+ * CI Workflow Auditor — static scan of GitHub Actions workflows for the
+ * supply-chain and secret-exposure mistakes that turn CI into an attack
+ * surface. CI runs with repo secrets in scope, so a misconfigured
+ * workflow is a credential-exfiltration or RCE path.
+ *
+ * Checks (.github/workflows/*.{yml,yaml}):
+ *   - 103-pull-request-target-checkout   critical  code-bug-security
+ *     `on: pull_request_target` combined with `actions/checkout` of the
+ *     PR head ref. pull_request_target runs with secrets AND write token;
+ *     checking out untrusted PR code then running it is the classic
+ *     "pwn request" — full secret exfiltration from a forked PR.
+ *   - 103-unpinned-action               medium    infra-issue
+ *     `uses: owner/action@<branch-or-tag>` instead of a full commit SHA.
+ *     Tags/branches are mutable — a compromised action upstream runs in
+ *     your CI with your secrets.
+ *   - 103-broad-token-permissions       medium    code-bug-security
+ *     No top-level `permissions:` block — the GITHUB_TOKEN defaults to
+ *     broad write scopes. Set least-privilege permissions.
+ *   - 103-plaintext-secret              high      code-bug-security
+ *     A secret-shaped `KEY: value` literal in the workflow (an actual
+ *     credential committed, not a `${{ secrets.X }}` reference).
+ *   - 103-summary                       info
+ *
+ * Persists `evidence/ci-workflow-audit.json`. Read-only, parallel-safe,
+ * static analysis only — does not run workflows.
+ */
+import type { Finding } from '../core/types.js';
+import { BaseAgent } from './base-agent.js';
+export type CiIssueKind = 'pull-request-target-checkout' | 'unpinned-action' | 'broad-token-permissions' | 'plaintext-secret';
+export interface CiWorkflowHit {
+    kind: CiIssueKind;
+    file: string;
+    line: number;
+    detail: string;
+}
+export interface CiWorkflowAudit {
+    version: 1;
+    generatedAt: string;
+    projectRoot: string;
+    workflows: string[];
+    hits: CiWorkflowHit[];
+}
+/**
+ * Audit one workflow's YAML text. Line-based — good enough for the
+ * structural signals we care about without a YAML parser.
+ */
+export declare function auditWorkflow(content: string): Array<Omit<CiWorkflowHit, 'file'>>;
+export declare class CiWorkflowAuditorAgent extends BaseAgent {
+    readonly agentId = 103;
+    readonly agentName = "CI Workflow Auditor";
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private toFinding;
+    private persistAudit;
+}
+//# sourceMappingURL=103-ci-workflow-auditor.d.ts.map

package/dist/agents/103-ci-workflow-auditor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"103-ci-workflow-auditor.d.ts","sourceRoot":"","sources":["../../agents/103-ci-workflow-auditor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AA8BzC,MAAM,MAAM,WAAW,GACnB,8BAA8B,GAC9B,iBAAiB,GACjB,yBAAyB,GACzB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,EAAE,aAAa,EAAE,CAAC;CACvB;AAoBD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CA2DjF;AAED,qBAAa,sBAAuB,SAAQ,SAAS;IACnD,QAAQ,CAAC,OAAO,OAAO;IACvB,QAAQ,CAAC,SAAS,yBAAyB;cAE3B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAO1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAmD7C,OAAO,CAAC,SAAS;IAuCjB,OAAO,CAAC,YAAY;CAyBrB"}

package/dist/agents/103-ci-workflow-auditor.js

@@ -0,0 +1,247 @@
+/**
+ * CI Workflow Auditor — static scan of GitHub Actions workflows for the
+ * supply-chain and secret-exposure mistakes that turn CI into an attack
+ * surface. CI runs with repo secrets in scope, so a misconfigured
+ * workflow is a credential-exfiltration or RCE path.
+ *
+ * Checks (.github/workflows/*.{yml,yaml}):
+ *   - 103-pull-request-target-checkout   critical  code-bug-security
+ *     `on: pull_request_target` combined with `actions/checkout` of the
+ *     PR head ref. pull_request_target runs with secrets AND write token;
+ *     checking out untrusted PR code then running it is the classic
+ *     "pwn request" — full secret exfiltration from a forked PR.
+ *   - 103-unpinned-action               medium    infra-issue
+ *     `uses: owner/action@<branch-or-tag>` instead of a full commit SHA.
+ *     Tags/branches are mutable — a compromised action upstream runs in
+ *     your CI with your secrets.
+ *   - 103-broad-token-permissions       medium    code-bug-security
+ *     No top-level `permissions:` block — the GITHUB_TOKEN defaults to
+ *     broad write scopes. Set least-privilege permissions.
+ *   - 103-plaintext-secret              high      code-bug-security
+ *     A secret-shaped `KEY: value` literal in the workflow (an actual
+ *     credential committed, not a `${{ secrets.X }}` reference).
+ *   - 103-summary                       info
+ *
+ * Persists `evidence/ci-workflow-audit.json`. Read-only, parallel-safe,
+ * static analysis only — does not run workflows.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { BaseAgent } from './base-agent.js';
+const SECRET_KEY_RE = /(password|passwd|secret|api[_-]?key|access[_-]?key|private[_-]?key|token|credential)/i;
+/** A value that is a GitHub expression / placeholder — not a literal secret. */
+const SAFE_VALUE_RE = /\$\{\{|^''$|^""$|^\s*$|^<.*>$|changeme|placeholder|example/i;
+/**
+ * Well-known throwaway/default values used for CI service-container test DBs
+ * and dev defaults (`MYSQL_PASSWORD: password`, `POSTGRES_PASSWORD: postgres`,
+ * `MYSQL_ROOT_PASSWORD: admin`). These are not real committed secrets — every
+ * repo that spins up a test DB in CI uses them — so flagging them is noise. A
+ * real secret is high-entropy and won't be in this dictionary.
+ */
+const WEAK_PLACEHOLDER_VALUES = new Set([
+    'admin', 'administrator', 'password', 'passwd', 'pass', 'pwd', 'root', 'toor',
+    'postgres', 'mysql', 'mariadb', 'mongo', 'mongodb', 'redis', 'rabbitmq', 'guest',
+    'test', 'testing', 'dev', 'development', 'local', 'user', 'username', 'demo', 'sample',
+    'secret', 'dummy', 'none', 'null', 'nil', 'string', 'foo', 'bar', 'baz', 'qwerty',
+    '1234', '12345', '123456', '1234567', '12345678', 'password123', 'admin123', 'test123',
+    // SQL Server / MSSQL service containers reject weak passwords, so CI uses these
+    // canonical "strong-looking" test defaults — still throwaway, not real secrets.
+    'admin12345', 'password1', 'passw0rd', 'p@ssw0rd', 'yourstrong(!)password',
+    'yourstrong!passw0rd', 'strongpassword', 'sqlserver', 'mssql', 'sa',
+]);
+/** True for an obvious default/placeholder credential value (quotes stripped). */
+function isWeakPlaceholder(value) {
+    const v = value.trim().replace(/^['"]|['"]$/g, '').toLowerCase();
+    return WEAK_PLACEHOLDER_VALUES.has(v);
+}
+function relativise(absPath, root) {
+    return path.relative(root, absPath).split(path.sep).join('/');
+}
+function findWorkflows(projectRoot) {
+    const dir = path.join(projectRoot, '.github', 'workflows');
+    if (!fs.existsSync(dir))
+        return [];
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    return entries
+        .filter((e) => e.isFile() && /\.ya?ml$/i.test(e.name))
+        .map((e) => path.join(dir, e.name));
+}
+/**
+ * Audit one workflow's YAML text. Line-based — good enough for the
+ * structural signals we care about without a YAML parser.
+ */
+export function auditWorkflow(content) {
+    const hits = [];
+    const lines = content.split(/\r?\n/);
+    const usesPullRequestTarget = /(^|\s)pull_request_target(\s|:|$)/m.test(content);
+    // Does the workflow check out a PR-controlled ref? Heuristic: a checkout
+    // step with a `ref:` mentioning head.sha / head.ref / event.pull_request.
+    const checksOutPrRef = /uses:\s*actions\/checkout/.test(content) &&
+        /ref:\s*\$\{\{\s*github\.event\.pull_request\.head\.(?:sha|ref)/.test(content);
+    if (usesPullRequestTarget && checksOutPrRef) {
+        const idx = lines.findIndex((l) => /pull_request_target/.test(l));
+        hits.push({
+            kind: 'pull-request-target-checkout',
+            line: idx >= 0 ? idx + 1 : 1,
+            detail: 'pull_request_target + checkout of PR head ref',
+        });
+    }
+    // Top-level permissions block? Look for a `permissions:` at column 0.
+    const hasTopLevelPermissions = lines.some((l) => /^permissions\s*:/.test(l));
+    if (!hasTopLevelPermissions) {
+        hits.push({
+            kind: 'broad-token-permissions',
+            line: 1,
+            detail: 'no top-level permissions: block (GITHUB_TOKEN defaults to broad write scopes)',
+        });
+    }
+    lines.forEach((raw, i) => {
+        const line = raw.trim();
+        if (line.startsWith('#'))
+            return;
+        // Unpinned action: uses: owner/repo@ref where ref is not a 40-char SHA.
+        const uses = line.match(/uses:\s*([^\s#]+)/);
+        if (uses) {
+            const ref = uses[1];
+            // Local actions (./.github/...) and docker:// refs are exempt.
+            if (!ref.startsWith('./') && !ref.startsWith('docker://') && ref.includes('@')) {
+                const afterAt = ref.split('@')[1];
+                const isSha = /^[0-9a-f]{40}$/i.test(afterAt);
+                if (!isSha) {
+                    hits.push({ kind: 'unpinned-action', line: i + 1, detail: ref });
+                }
+            }
+        }
+        // Plaintext secret: KEY: value where KEY is secret-shaped and value is literal.
+        const kv = line.match(/^([A-Za-z0-9_]+)\s*:\s*(.+)$/);
+        if (kv && SECRET_KEY_RE.test(kv[1])) {
+            const value = kv[2].trim().replace(/\s+#.*$/, ''); // strip inline comment
+            if (!SAFE_VALUE_RE.test(value) && !isWeakPlaceholder(value)) {
+                hits.push({ kind: 'plaintext-secret', line: i + 1, detail: kv[1] });
+            }
+        }
+    });
+    return hits;
+}
+export class CiWorkflowAuditorAgent extends BaseAgent {
+    agentId = 103;
+    agentName = 'CI Workflow Auditor';
+    async preFlight() {
+        const root = this.config.projectRoot ?? process.cwd();
+        if (!fs.existsSync(root)) {
+            throw new Error(`projectRoot does not exist: ${root}`);
+        }
+    }
+    async execute() {
+        const findings = [];
+        const projectRoot = this.config.projectRoot ?? process.cwd();
+        const workflows = findWorkflows(projectRoot);
+        if (workflows.length === 0) {
+            findings.push({
+                id: `${this.agentId}-no-workflows`,
+                type: 'infra-issue',
+                severity: 'info',
+                agentId: this.agentId,
+                module: 'ci-workflow-auditor',
+                description: 'No .github/workflows/*.yml found — no CI workflows to audit.',
+            });
+            this.persistAudit(projectRoot, [], []);
+            return findings;
+        }
+        const allHits = [];
+        for (const file of workflows) {
+            let content;
+            try {
+                content = fs.readFileSync(file, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            const rel = relativise(file, projectRoot);
+            for (const hit of auditWorkflow(content)) {
+                allHits.push({ ...hit, file: rel });
+            }
+        }
+        for (const hit of allHits.slice(0, 100)) {
+            findings.push(this.toFinding(hit));
+        }
+        this.persistAudit(projectRoot, workflows.map((w) => relativise(w, projectRoot)), allHits);
+        const count = (k) => allHits.filter((h) => h.kind === k).length;
+        findings.push({
+            id: `${this.agentId}-summary`,
+            type: 'infra-issue',
+            severity: 'info',
+            agentId: this.agentId,
+            module: 'ci-workflow-auditor',
+            description: `CI workflow audit: ${workflows.length} workflow(s), ${allHits.length} issue(s) (${count('pull-request-target-checkout')} pwn-request, ${count('plaintext-secret')} plaintext secret, ${count('unpinned-action')} unpinned action, ${count('broad-token-permissions')} broad-perms).`,
+        });
+        return findings;
+    }
+    toFinding(hit) {
+        const slug = `${hit.file.replace(/[^\w]/g, '_')}-${hit.line}`;
+        const base = { agentId: this.agentId, module: 'ci-workflow-auditor', file: hit.file, line: hit.line };
+        switch (hit.kind) {
+            case 'pull-request-target-checkout':
+                return {
+                    ...base,
+                    id: `${this.agentId}-pull-request-target-checkout-${slug}`,
+                    type: 'code-bug-security',
+                    severity: 'critical',
+                    description: `${hit.file} uses pull_request_target AND checks out the PR head ref. pull_request_target runs with repo secrets and a write token; running untrusted forked code in that context is the "pwn request" pattern — a forked PR can exfiltrate every secret. Build untrusted PRs with on: pull_request (no secrets) instead.`,
+                };
+            case 'plaintext-secret':
+                return {
+                    ...base,
+                    id: `${this.agentId}-plaintext-secret-${slug}`,
+                    type: 'code-bug-security',
+                    severity: 'high',
+                    description: `${hit.file}:${hit.line} appears to commit a literal secret (${hit.detail}) into the workflow. Move it to repo/org secrets and reference it via \${{ secrets.${hit.detail} }}.`,
+                };
+            case 'unpinned-action':
+                return {
+                    ...base,
+                    id: `${this.agentId}-unpinned-action-${slug}`,
+                    type: 'infra-issue',
+                    severity: 'medium',
+                    description: `${hit.file}:${hit.line} pins an action to a mutable tag/branch (${hit.detail}). A compromised upstream tag would run in CI with your token/secrets — pin to a full commit SHA.`,
+                };
+            case 'broad-token-permissions':
+                return {
+                    ...base,
+                    id: `${this.agentId}-broad-token-permissions-${slug}`,
+                    type: 'code-bug-security',
+                    severity: 'medium',
+                    description: `${hit.file} has no top-level permissions: block, so GITHUB_TOKEN gets broad default scopes. Add a least-privilege permissions: block (e.g. contents: read).`,
+                };
+        }
+    }
+    persistAudit(projectRoot, workflows, hits) {
+        const audit = {
+            version: 1,
+            generatedAt: new Date().toISOString(),
+            projectRoot,
+            workflows,
+            hits,
+        };
+        try {
+            const evidenceDir = path.join(this.runDir, 'evidence');
+            fs.mkdirSync(evidenceDir, { recursive: true });
+            fs.writeFileSync(path.join(evidenceDir, 'ci-workflow-audit.json'), JSON.stringify(audit, null, 2), 'utf-8');
+            this.addEvidence({
+                type: 'report',
+                path: 'evidence/ci-workflow-audit.json',
+                description: `CI workflow audit: ${hits.length} issue(s) across ${workflows.length} workflow(s)`,
+            });
+        }
+        catch {
+            // non-fatal
+        }
+    }
+}
+//# sourceMappingURL=103-ci-workflow-auditor.js.map