@cdxgen/cdxgen 0.0.1 → 13.0.0

package/data/rules/ci-permissions.yaml

@@ -0,0 +1,802 @@
+# CI/CD Permission Security Rules
+# Category: ci-permission
+# Evaluates GitHub Actions, GitLab CI, Azure Pipelines, etc. for privilege risks
+
+- id: CI-001
+  name: "Unpinned action in write-permission workflow"
+  description: "GitHub Actions referenced by tag/branch in workflows with write permissions pose supply chain risk"
+  severity: high
+  category: ci-permission
+  dry-run-support: full
+  attack:
+    tactics: [TA0001]
+    techniques: [T1195.001]
+  condition: |
+    $auditComponents($)[
+      $prop($, 'cdx:github:action:isShaPinned') = 'false'
+      and (
+        $prop($, 'cdx:github:workflow:hasWritePermissions') = 'true'
+        or $prop($, 'cdx:github:job:hasWritePermissions') = 'true'
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl,
+      "file": $prop($, 'cdx:github:workflow:file')
+    }
+  message: "Unpinned GitHub Action '{{ $prop($, 'cdx:github:action:uses') }}' in workflow with write permissions"
+  mitigation: "Pin action to full SHA: actions/setup-node@abc123def456..."
+  evidence: |
+    {
+      "pinningType": $prop($, 'cdx:github:action:versionPinningType'),
+      "workflowTriggers": $prop($, 'cdx:github:workflow:triggers'),
+      "jobName": $prop($, 'cdx:github:job:name')
+    }
+- id: CI-002
+  name: "OIDC token issuance to non-official action"
+  description: "Workflows or jobs granting id-token:write to third-party actions may enable token exfiltration"
+  severity: high
+  category: ci-permission
+  dry-run-support: full
+  attack:
+    tactics: [TA0006]
+    techniques: [T1528]
+  condition: |
+    $auditComponents($)[
+      (
+        $prop($, 'cdx:github:workflow:hasIdTokenWrite') = 'true'
+        or $prop($, 'cdx:github:job:hasIdTokenWrite') = 'true'
+      )
+      and $prop($, 'cdx:actions:isOfficial') = 'false'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl,
+      "file": $prop($, 'cdx:github:workflow:file')
+    }
+  message: "Workflow grants OIDC token access to non-official action '{{ $prop($, 'cdx:github:action:uses') }}'"
+  mitigation: "Restrict id-token scope or use only verified/official actions for OIDC operations"
+  evidence: |
+    {
+      "isVerified": $prop($, 'cdx:actions:isVerified'),
+      "actionGroup": group,
+      "jobHasIdTokenWrite": $prop($, 'cdx:github:job:hasIdTokenWrite'),
+      "workflowHasIdTokenWrite": $prop($, 'cdx:github:workflow:hasIdTokenWrite')
+    }
+- id: CI-003
+  name: "Action pinned to mutable tag"
+  description: "GitHub Actions pinned to tags (vs SHA) can change behavior unexpectedly if tag is moved"
+  severity: medium
+  category: ci-permission
+  dry-run-support: full
+  attack:
+    tactics: [TA0001]
+    techniques: [T1195.001]
+  condition: |
+    $auditComponents($)[
+      $prop($, 'cdx:github:action:versionPinningType') = 'tag'
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "GitHub Action '{{ $prop($, 'cdx:github:action:uses') }}' pinned to mutable tag (not SHA)"
+  mitigation: "Consider pinning to full commit SHA for immutability: actions/setup-node@<full-sha>"
+  evidence: |
+    {
+      "currentVersion": version,
+      "isOfficial": $prop($, 'cdx:actions:isOfficial')
+    }
+- id: CI-004
+  name: "Workflow uses pull_request_target trigger"
+  description: "pull_request_target can execute code in the context of the base branch, risking secret exposure"
+  severity: medium
+  category: ci-permission
+  dry-run-support: full
+  attack:
+    tactics: [TA0001, TA0004]
+  condition: |
+    $auditWorkflows($)[
+      $prop($, 'cdx:github:workflow:hasPullRequestTargetTrigger') = 'true'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "file": $prop($, 'cdx:github:workflow:file')
+    }
+  message: "Workflow '{{ $prop($, 'cdx:github:workflow:name') }}' uses pull_request_target trigger"
+  mitigation: "Ensure workflow does not checkout or run code from the PR head; use pull_request with careful permissions"
+  evidence: |
+    {
+      "triggers": $prop($, 'cdx:github:workflow:triggers'),
+      "hasWritePermissions": $prop($, 'cdx:github:workflow:hasWritePermissions')
+    }
+- id: CI-005
+  name: "Checkout step persists credentials unnecessarily"
+  description: "actions/checkout with persist-credentials=true (default) exposes GITHUB_TOKEN to subsequent steps"
+  severity: medium
+  category: ci-permission
+  dry-run-support: full
+  attack:
+    tactics: [TA0006]
+    techniques: [T1552]
+  condition: |
+    $auditComponents($)[
+      $contains($nullSafeProp($, 'cdx:github:action:uses'), 'actions/checkout')
+      and $propBool($, 'cdx:github:checkout:persistCredentials') != false
+      and (
+        $propBool($, 'cdx:github:workflow:hasWritePermissions') = true
+        or $propBool($, 'cdx:github:job:hasWritePermissions') = true
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl,
+      "file": $prop($, 'cdx:github:workflow:file')
+    }
+  message: "Checkout step uses persist-credentials=true in privileged workflow; consider persist-credentials: false;"
+  mitigation: "Add persist-credentials: false to checkout steps that don't require git push operations"
+  evidence: |
+    {
+      "persistCredentials": $prop($, 'cdx:github:checkout:persistCredentials'),
+      "workflowPermissions": $prop($, 'cdx:github:workflow:hasWritePermissions')
+    }
+- id: CI-006
+  name: "Cache usage in untrusted trigger context"
+  description: "GitHub Actions cache can be poisoned when used in workflows triggered by untrusted input (e.g., pull_request from forks)"
+  severity: high
+  category: ci-permission
+  dry-run-support: full
+  attack:
+    tactics: [TA0001]
+    techniques: [T1195.001]
+  condition: |
+    $auditComponents($)[
+      $nullSafeProp($, 'cdx:github:action:uses') ~> $contains('actions/cache')
+      and (
+        $prop($, 'cdx:github:workflow:hasPullRequestTrigger') = 'true'
+        or $prop($, 'cdx:github:workflow:hasPullRequestTargetTrigger') = 'true'
+      )
+      and (
+        $propBool($, 'cdx:github:workflow:hasWritePermissions') = true
+        or $propBool($, 'cdx:github:job:hasWritePermissions') = true
+        or $prop($, 'cdx:github:cache:hasRestoreKeys') = 'true'
+        or $prop($, 'cdx:github:cache:keyUsesHashFiles') != 'true'
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl,
+      "file": $prop($, 'cdx:github:workflow:file')
+    }
+  message: "Cache action used in pull-request-reachable workflow; cache key '{{ $prop($, 'cdx:github:cache:key') }}' may be writable by untrusted code"
+  mitigation: "Scope cache keys to PR-specific values, validate restored cache contents, or avoid caching in untrusted workflows"
+  evidence: |
+    {
+      "cacheKey": $prop($, 'cdx:github:cache:key'),
+      "hasRestoreKeys": $prop($, 'cdx:github:cache:hasRestoreKeys'),
+      "keyUsesHashFiles": $prop($, 'cdx:github:cache:keyUsesHashFiles'),
+      "cachePath": $prop($, 'cdx:github:cache:path'),
+      "triggers": $prop($, 'cdx:github:workflow:triggers')
+    }
+- id: CI-007
+  name: "Script injection via untrusted context interpolation"
+  description: "Direct interpolation of github.event.* or inputs.* into run: blocks enables command injection"
+  severity: critical
+  category: ci-permission
+  dry-run-support: full
+  attack:
+    tactics: [TA0002]
+    techniques: [T1059]
+  condition: |
+    $auditComponents($)[
+      $prop($, 'cdx:github:step:hasUntrustedInterpolation') = 'true'
+      and $prop($, 'cdx:github:step:type') = 'run'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "file": $prop($, 'cdx:github:workflow:file')
+    }
+  message: "Untrusted input interpolated into shell command: variables '{{ $prop($, 'cdx:github:step:interpolatedVars') }}'"
+  mitigation: "Use intermediate environment variables: env: TITLE: ${{ github.event.pull_request.title }} then reference $TITLE in run:"
+  evidence: |
+    {
+      "interpolatedVars": $prop($, 'cdx:github:step:interpolatedVars'),
+      "stepCommand": $prop($, 'cdx:github:step:command')
+    }
+- id: CI-008
+  name: "High-risk trigger with write permissions"
+  description: "Triggers like pull_request_target, issue_comment, or workflow_run combined with write permissions enable privilege escalation"
+  severity: high
+  category: ci-permission
+  dry-run-support: full
+  attack:
+    tactics: [TA0001, TA0004]
+  condition: |
+    $auditWorkflows($)[
+      (
+        $prop($, 'cdx:github:workflow:hasPullRequestTargetTrigger') = 'true'
+        or $prop($, 'cdx:github:workflow:hasIssueCommentTrigger') = 'true'
+        or $prop($, 'cdx:github:workflow:hasWorkflowRunTrigger') = 'true'
+      )
+      and $prop($, 'cdx:github:workflow:hasWritePermissions') = 'true'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "file": $prop($, 'cdx:github:workflow:file')
+    }
+  message: "Workflow '{{ $prop($, 'cdx:github:workflow:name') }}' uses high-risk trigger with write permissions"
+  mitigation: "Use pull_request instead of pull_request_target; require manual approval for issue_comment triggers; restrict permissions per job"
+  evidence: |
+    {
+      "triggers": $prop($, 'cdx:github:workflow:triggers'),
+      "hasWritePermissions": $prop($, 'cdx:github:workflow:hasWritePermissions')
+    }
+
+- id: CI-009
+  name: "Workflow file contains hidden Unicode characters"
+  description: "Hidden Unicode in workflow files can disguise malicious logic, comments, or diffs and should be reviewed before merge"
+  severity: medium
+  category: ci-permission
+  dry-run-support: full
+  attack:
+    tactics: [TA0005]
+    techniques: [T1027]
+  condition: |
+    $auditWorkflows($)[
+      $prop($, 'cdx:github:workflow:hasHiddenUnicode') = 'true'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "file": $prop($, 'cdx:github:workflow:file')
+    }
+  message: "Workflow '{{ $prop($, 'cdx:github:workflow:name') }}' contains hidden Unicode characters"
+  mitigation: "Review the file in an editor that reveals bidirectional, zero-width, and control characters; remove suspicious hidden Unicode before merge"
+  evidence: |
+    {
+      "codePoints": $prop($, 'cdx:github:workflow:hiddenUnicodeCodePoints'),
+      "lineNumbers": $prop($, 'cdx:github:workflow:hiddenUnicodeLineNumbers'),
+      "inComments": $prop($, 'cdx:github:workflow:hiddenUnicodeInComments')
+    }
+
+- id: CI-010
+  name: "Legacy token-based package publishing step"
+  description: "npm and PyPI publishing should prefer trusted publishing or OIDC-backed flows instead of long-lived token secrets or explicit --token arguments"
+  severity: medium
+  category: ci-permission
+  dry-run-support: full
+  attack:
+    tactics: [TA0006]
+    techniques: [T1528]
+  condition: |
+    $auditComponents($)[
+      $prop($, 'cdx:github:step:isPublishCommand') = 'true'
+      and $prop($, 'cdx:github:step:usesLegacyPublishToken') = 'true'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "file": $prop($, 'cdx:github:workflow:file')
+    }
+  message: "Workflow publish step '{{ name }}' uses legacy {{ $prop($, 'cdx:github:step:publishEcosystem') }} token-based publishing"
+  mitigation: "Prefer trusted publishing or short-lived OIDC-backed release flows instead of persistent package tokens or explicit --token arguments"
+  evidence: |
+    {
+      "ecosystem": $prop($, 'cdx:github:step:publishEcosystem'),
+      "tokenSources": $prop($, 'cdx:github:step:legacyPublishTokenSources'),
+      "stepCommand": $prop($, 'cdx:github:step:command')
+    }
+
+- id: CI-011
+  name: "External reusable workflow inherits caller secrets"
+  description: "Reusable workflows invoked from external repositories with secrets: inherit expand the trust boundary and can expose repository credentials"
+  severity: high
+  category: ci-permission
+  dry-run-support: full
+  attack:
+    tactics: [TA0006]
+    techniques: [T1528, T1552]
+  condition: |
+    $auditComponents($)[
+      $prop($, 'cdx:github:reusableWorkflow:isExternal') = 'true'
+      and $prop($, 'cdx:github:reusableWorkflow:secretsInherit') = 'true'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl,
+      "file": $prop($, 'cdx:github:workflow:file')
+    }
+  message: "Reusable workflow '{{ $prop($, 'cdx:github:reusableWorkflow:uses') }}' inherits caller secrets from an external repository"
+  mitigation: "Avoid secrets: inherit for external reusable workflows; pass only the minimum explicit secrets and pin the reusable workflow to a full SHA"
+  evidence: |
+    {
+      "uses": $prop($, 'cdx:github:reusableWorkflow:uses'),
+      "isShaPinned": $prop($, 'cdx:github:reusableWorkflow:isShaPinned'),
+      "withKeys": $prop($, 'cdx:github:reusableWorkflow:withKeys')
+    }
+
+- id: CI-012
+  name: "External reusable workflow pinned to mutable ref"
+  description: "Reusable workflows referenced by tag or branch can change behavior without review and should be pinned to immutable SHAs"
+  severity: medium
+  category: ci-permission
+  dry-run-support: full
+  attack:
+    tactics: [TA0001]
+    techniques: [T1195.001]
+  condition: |
+    $auditComponents($)[
+      $prop($, 'cdx:github:reusableWorkflow:isExternal') = 'true'
+      and $prop($, 'cdx:github:reusableWorkflow:isShaPinned') = 'false'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl,
+      "file": $prop($, 'cdx:github:workflow:file')
+    }
+  message: "External reusable workflow '{{ $prop($, 'cdx:github:reusableWorkflow:uses') }}' is pinned to a mutable ref"
+  mitigation: "Pin reusable workflows to full SHAs and review updates through a normal change-management process"
+  evidence: |
+    {
+      "pinningType": $prop($, 'cdx:github:reusableWorkflow:versionPinningType'),
+      "ref": $prop($, 'cdx:github:reusableWorkflow:ref')
+    }
+
+- id: CI-013
+  name: "High-risk trigger reaches a self-hosted runner"
+  description: "High-risk triggers executing on self-hosted runners can expose internal network access, credentials, and long-lived runner state"
+  severity: high
+  category: ci-permission
+  dry-run-support: full
+  attack:
+    tactics: [TA0004, TA0008]
+  condition: |
+    $auditComponents($)[
+      (
+        $prop($, 'cdx:github:workflow:hasPullRequestTargetTrigger') = 'true'
+        or $prop($, 'cdx:github:workflow:hasIssueCommentTrigger') = 'true'
+        or $prop($, 'cdx:github:workflow:hasWorkflowRunTrigger') = 'true'
+      )
+      and $prop($, 'cdx:github:job:isSelfHosted') = 'true'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl,
+      "file": $prop($, 'cdx:github:workflow:file')
+    }
+  message: "High-risk workflow trigger reaches self-hosted runner in job '{{ $prop($, 'cdx:github:job:name') }}'"
+  mitigation: "Restrict self-hosted runners to trusted workflows only, isolate runner credentials, and gate high-risk triggers with manual approval"
+  evidence: |
+    {
+      "triggers": $prop($, 'cdx:github:workflow:triggers'),
+      "jobRunner": $prop($, 'cdx:github:job:runner'),
+      "jobName": $prop($, 'cdx:github:job:name')
+    }
+
+- id: CI-014
+  name: "Privileged workflow mutates downstream runner state"
+  description: "Writing to GITHUB_ENV, GITHUB_PATH, or GITHUB_OUTPUT in privileged workflows can persist attacker-controlled state across later steps and jobs"
+  severity: high
+  category: ci-permission
+  dry-run-support: full
+  attack:
+    tactics: [TA0002]
+    techniques: [T1059]
+  condition: |
+    $auditComponents($)[
+      $prop($, 'cdx:github:step:type') = 'run'
+      and $prop($, 'cdx:github:step:mutatesRunnerState') = 'true'
+      and (
+        $prop($, 'cdx:github:workflow:hasWritePermissions') = 'true'
+        or $prop($, 'cdx:github:job:hasWritePermissions') = 'true'
+        or $prop($, 'cdx:github:workflow:hasIdTokenWrite') = 'true'
+        or $prop($, 'cdx:github:job:hasIdTokenWrite') = 'true'
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "file": $prop($, 'cdx:github:workflow:file')
+    }
+  message: "Privileged workflow step '{{ name }}' mutates runner state via '{{ $prop($, 'cdx:github:step:runnerStateTargets') }}'"
+  mitigation: "Avoid mutating shared runner state in privileged jobs; prefer tightly-scoped step outputs and review all GITHUB_ENV/GITHUB_PATH/GITHUB_OUTPUT writes"
+  evidence: |
+    {
+      "runnerStateTargets": $prop($, 'cdx:github:step:runnerStateTargets'),
+      "stepCommand": $prop($, 'cdx:github:step:command'),
+      "jobName": $prop($, 'cdx:github:job:name')
+    }
+
+- id: CI-015
+  name: "Outbound network command references sensitive context"
+  description: "Run steps that invoke outbound network tools while transmitting secrets, github.token, or OIDC request context are strong exfiltration indicators"
+  severity: high
+  category: ci-permission
+  dry-run-support: full
+  attack:
+    tactics: [TA0010]
+    techniques: [T1048]
+  condition: |
+    $auditComponents($)[
+      $prop($, 'cdx:github:step:type') = 'run'
+      and $prop($, 'cdx:github:step:hasOutboundNetworkCommand') = 'true'
+      and $prop($, 'cdx:github:step:referencesSensitiveContext') = 'true'
+      and $prop($, 'cdx:github:step:likelyExfiltration') = 'true'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "file": $prop($, 'cdx:github:workflow:file')
+    }
+  message: "Outbound command in step '{{ name }}' references sensitive context '{{ $prop($, 'cdx:github:step:sensitiveContextRefs') }}'"
+  mitigation: "Review outbound network steps for secret or token use, disable unnecessary network egress, and move sensitive values into least-privileged isolated jobs"
+  evidence: |
+    {
+      "networkTools": $prop($, 'cdx:github:step:outboundNetworkTools'),
+      "sensitiveContextRefs": $prop($, 'cdx:github:step:sensitiveContextRefs'),
+      "exfiltrationIndicators": $prop($, 'cdx:github:step:exfiltrationIndicators'),
+      "stepCommand": $prop($, 'cdx:github:step:command')
+    }
+
+- id: CI-016
+  name: "Privileged reusable workflow accepts caller secrets"
+  description: "workflow_call producers that request caller-provided secrets while also holding write or OIDC permissions expand the blast radius across repositories and workflows"
+  severity: high
+  category: ci-permission
+  dry-run-support: full
+  attack:
+    tactics: [TA0006]
+    techniques: [T1528, T1552]
+  condition: |
+    $auditWorkflows($)[
+      $prop($, 'cdx:github:workflow:isWorkflowCallProducer') = 'true'
+      and $safeStr($prop($, 'cdx:github:workflow:workflowCallSecrets')) != ''
+      and (
+        $propBool($, 'cdx:github:workflow:hasWritePermissions') = true
+        or $propBool($, 'cdx:github:workflow:hasIdTokenWrite') = true
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "file": $prop($, 'cdx:github:workflow:file')
+    }
+  message: "Reusable workflow '{{ $prop($, 'cdx:github:workflow:name') }}' accepts caller secrets while running with privileged permissions"
+  mitigation: "Avoid broad secret interfaces on reusable workflows with write or OIDC permissions; split privileged work into a narrowly scoped follow-up job and require only explicit minimal secrets"
+  evidence: |
+    {
+      "workflowCallSecrets": $prop($, 'cdx:github:workflow:workflowCallSecrets'),
+      "writeScopes": $prop($, 'cdx:github:workflow:writeScopes'),
+      "hasWritePermissions": $prop($, 'cdx:github:workflow:hasWritePermissions'),
+      "hasIdTokenWrite": $prop($, 'cdx:github:workflow:hasIdTokenWrite')
+    }
+
+- id: CI-017
+  name: "Privileged reusable workflow exports caller-influenced outputs"
+  description: "workflow_call producers that both accept caller-controlled inputs and emit outputs from privileged execution contexts can propagate unsafe values into downstream trusted jobs"
+  severity: medium
+  category: ci-permission
+  dry-run-support: full
+  attack:
+    tactics: [TA0003, TA0004]
+  condition: |
+    $auditWorkflows($)[
+      $prop($, 'cdx:github:workflow:isWorkflowCallProducer') = 'true'
+      and $safeStr($prop($, 'cdx:github:workflow:workflowCallInputs')) != ''
+      and $safeStr($prop($, 'cdx:github:workflow:workflowCallOutputs')) != ''
+      and (
+        $propBool($, 'cdx:github:workflow:hasWritePermissions') = true
+        or $propBool($, 'cdx:github:workflow:hasIdTokenWrite') = true
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "file": $prop($, 'cdx:github:workflow:file')
+    }
+  message: "Reusable workflow '{{ $prop($, 'cdx:github:workflow:name') }}' exports outputs from a privileged workflow_call interface that also accepts caller inputs"
+  mitigation: "Review workflow_call outputs for trust-boundary crossings, sanitize caller-controlled data before emitting outputs, and avoid combining privileged permissions with broad producer interfaces"
+  evidence: |
+    {
+      "workflowCallInputs": $prop($, 'cdx:github:workflow:workflowCallInputs'),
+      "workflowCallOutputs": $prop($, 'cdx:github:workflow:workflowCallOutputs'),
+      "hasWritePermissions": $prop($, 'cdx:github:workflow:hasWritePermissions'),
+      "hasIdTokenWrite": $prop($, 'cdx:github:workflow:hasIdTokenWrite')
+    }
+
+- id: CI-018
+  name: "Fork-reachable workflow dispatches downstream workflow or repository events"
+  description: "Dispatching workflow_dispatch or repository_dispatch from fork-reachable or privileged jobs can create a lateral-movement path into downstream workflows with broader credentials"
+  severity: high
+  category: ci-permission
+  dry-run-support: full
+  attack:
+    tactics: [TA0006]
+    techniques: [T1528]
+  condition: |
+    $auditComponents($)[
+      $prop($, 'cdx:github:step:dispatchesWorkflow') = 'true'
+      and $prop($, 'cdx:github:step:referencesSensitiveContext') = 'true'
+      and (
+        $propBool($, 'cdx:github:workflow:hasPullRequestTrigger') = true
+        or $propBool($, 'cdx:github:workflow:hasPullRequestTargetTrigger') = true
+        or $propBool($, 'cdx:github:workflow:hasIssueCommentTrigger') = true
+        or $propBool($, 'cdx:github:workflow:hasWorkflowRunTrigger') = true
+        or $propBool($, 'cdx:github:workflow:hasWritePermissions') = true
+        or $propBool($, 'cdx:github:job:hasWritePermissions') = true
+        or $propBool($, 'cdx:github:workflow:hasIdTokenWrite') = true
+        or $propBool($, 'cdx:github:job:hasIdTokenWrite') = true
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl,
+      "file": $prop($, 'cdx:github:workflow:file')
+    }
+  message: "Workflow step '{{ name }}' dispatches '{{ $prop($, 'cdx:github:step:dispatchKinds') }}' toward '{{ $prop($, 'cdx:github:step:dispatchTargets') }}' from a fork-reachable or privileged context"
+  mitigation: "Avoid chaining downstream workflow_dispatch or repository_dispatch calls from pull-request/fork-reachable jobs; isolate release dispatchers into trusted workflows with narrowly scoped credentials"
+  evidence: |
+    {
+      "dispatchKinds": $prop($, 'cdx:github:step:dispatchKinds'),
+      "dispatchMechanisms": $prop($, 'cdx:github:step:dispatchMechanisms'),
+      "dispatchTargets": $prop($, 'cdx:github:step:dispatchTargets'),
+      "localReceiverWorkflowFiles": $prop($, 'cdx:github:step:dispatchReceiverWorkflowFiles'),
+      "localReceiverWorkflowNames": $prop($, 'cdx:github:step:dispatchReceiverWorkflowNames'),
+      "sensitiveContextRefs": $prop($, 'cdx:github:step:sensitiveContextRefs'),
+      "workflowTriggers": $prop($, 'cdx:github:workflow:triggers'),
+      "writeScopes": $prop($, 'cdx:github:workflow:writeScopes')
+    }
+
+- id: CI-019
+  name: "Workflow dispatch step references explicit fork context"
+  description: "Dispatch chains that inspect pull_request head-repository or fork context before invoking downstream workflows are strong signals of fork-to-privileged lateral movement"
+  severity: critical
+  category: ci-permission
+  dry-run-support: full
+  attack:
+    tactics: [TA0006]
+    techniques: [T1528, T1552]
+  condition: |
+    $auditComponents($)[
+      $prop($, 'cdx:github:step:dispatchesWorkflow') = 'true'
+      and $prop($, 'cdx:github:step:referencesForkContext') = 'true'
+      and $prop($, 'cdx:github:step:referencesSensitiveContext') = 'true'
+      and (
+        $prop($, 'cdx:github:step:hasLocalDispatchReceiver') = 'true'
+        or $safeStr($prop($, 'cdx:github:step:hasLocalDispatchReceiver')) = ''
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl,
+      "file": $prop($, 'cdx:github:workflow:file')
+    }
+  message: "Workflow step '{{ name }}' combines explicit fork/head-repository context with downstream dispatch '{{ $safeStr($prop($, 'cdx:github:step:dispatchReceiverWorkflowNames')) != '' ? $prop($, 'cdx:github:step:dispatchReceiverWorkflowNames') : $prop($, 'cdx:github:step:dispatchTargets') }}'"
+  mitigation: "Do not route fork-derived context into workflow_dispatch or repository_dispatch calls. Split privileged follow-up workflows behind trusted branch-only triggers and avoid sharing long-lived tokens into fork-reachable jobs"
+  evidence: |
+    {
+      "forkContextRefs": $prop($, 'cdx:github:step:forkContextRefs'),
+      "dispatchKinds": $prop($, 'cdx:github:step:dispatchKinds'),
+      "dispatchTargets": $prop($, 'cdx:github:step:dispatchTargets'),
+      "hasLocalDispatchReceiver": $prop($, 'cdx:github:step:hasLocalDispatchReceiver'),
+      "localReceiverWorkflowFiles": $prop($, 'cdx:github:step:dispatchReceiverWorkflowFiles'),
+      "localReceiverWorkflowNames": $prop($, 'cdx:github:step:dispatchReceiverWorkflowNames'),
+      "localReceiverMatchBasis": $prop($, 'cdx:github:step:dispatchReceiverMatchBasis'),
+      "sensitiveContextRefs": $prop($, 'cdx:github:step:sensitiveContextRefs')
+    }
+
+- id: CI-020
+  name: "pull_request_target checks out PR head or fork context"
+  description: "Checking out github.event.pull_request.head.* repository or ref inside pull_request_target executes untrusted fork code with base-repository privileges"
+  severity: critical
+  category: ci-permission
+  dry-run-support: full
+  attack:
+    tactics: [TA0001, TA0006]
+    techniques: [T1195.001, T1552]
+  condition: |
+    $auditComponents($)[
+      $contains($nullSafeProp($, 'cdx:github:action:uses'), 'actions/checkout')
+      and $prop($, 'cdx:github:workflow:hasPullRequestTargetTrigger') = 'true'
+      and (
+        $prop($, 'cdx:github:checkout:checksOutUntrustedRef') = 'true'
+        or $prop($, 'cdx:github:checkout:referencesForkContext') = 'true'
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl,
+      "file": $prop($, 'cdx:github:workflow:file')
+    }
+  message: "Checkout step '{{ $prop($, 'cdx:github:action:uses') }}' pulls PR head or fork context inside pull_request_target"
+  mitigation: "Do not checkout github.event.pull_request.head.* in pull_request_target workflows. Prefer pull_request with read-only permissions or split trusted follow-up work into a separate branch-only workflow"
+  evidence: |
+    {
+      "checkoutRef": $prop($, 'cdx:github:checkout:ref'),
+      "checkoutRepository": $prop($, 'cdx:github:checkout:repository'),
+      "untrustedRefContexts": $prop($, 'cdx:github:checkout:untrustedRefContexts'),
+      "forkContextRefs": $prop($, 'cdx:github:checkout:forkContextRefs'),
+      "persistCredentials": $prop($, 'cdx:github:checkout:persistCredentials'),
+      "workflowHasWritePermissions": $prop($, 'cdx:github:workflow:hasWritePermissions')
+    }
+
+- id: CI-021
+  name: "Heuristic: high-risk trigger with implicit permissions and sensitive operations"
+  description: "High-risk GitHub Actions workflows that omit explicit permissions blocks while still performing sensitive operations may rely on repository-default token scopes. This is a review heuristic, not proof of write access."
+  severity: medium
+  category: ci-permission
+  dry-run-support: full
+  attack:
+    tactics: [TA0006]
+    techniques: [T1528, T1552]
+  condition: |
+    $auditComponents($)[
+      $prop($, 'cdx:github:workflow:hasHighRiskTrigger') = 'true'
+      and $prop($, 'cdx:github:workflow:hasAnyExplicitPermissionsBlock') = 'false'
+      and $prop($, 'cdx:github:step:hasSensitiveOperations') = 'true'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl,
+      "file": $prop($, 'cdx:github:workflow:file')
+    }
+  message: "Heuristic review: workflow '{{ $prop($, 'cdx:github:workflow:name') }}' uses a high-risk trigger without an explicit permissions block while step '{{ $safeStr($prop($, 'cdx:github:step:name')) != '' ? $prop($, 'cdx:github:step:name') : name }}' performs sensitive operation(s) '{{ $prop($, 'cdx:github:step:sensitiveOperations') }}'"
+  mitigation: "Add an explicit top-level permissions: block (for example permissions: {}) and re-grant only the minimum per-job scopes needed for the sensitive step"
+  evidence: |
+    {
+      "workflowTriggers": $prop($, 'cdx:github:workflow:triggers'),
+      "workflowHasExplicitPermissionsBlock": $prop($, 'cdx:github:workflow:hasExplicitPermissionsBlock'),
+      "workflowHasAnyExplicitPermissionsBlock": $prop($, 'cdx:github:workflow:hasAnyExplicitPermissionsBlock'),
+      "jobHasExplicitPermissionsBlock": $prop($, 'cdx:github:job:hasExplicitPermissionsBlock'),
+      "sensitiveOperations": $prop($, 'cdx:github:step:sensitiveOperations'),
+      "sensitiveContextRefs": $prop($, 'cdx:github:step:sensitiveContextRefs'),
+      "dispatchKinds": $prop($, 'cdx:github:step:dispatchKinds')
+     }
+
+- id: CI-022
+  name: "npm setup action disables build cache despite resolved package distributions"
+  description: "Explicitly disabling setup-node caching reduces tamper resistance and reviewability when npm dependencies are resolved from remote package distributions"
+  severity: medium
+  category: ci-permission
+  dry-run-support: full
+  attack:
+    tactics: [TA0001]
+    techniques: [T1195.001]
+  condition: |
+    $auditComponents($)[
+      $prop($, 'cdx:github:action:disablesBuildCache') = 'true'
+      and $prop($, 'cdx:github:action:buildCacheEcosystem') = 'npm'
+      and $count($$.components[
+        $startsWith(purl, 'pkg:npm/')
+        and (
+          $contains($lowercase($nullSafeProp($, 'cdx:npm:manifestSourceType')), 'git')
+          or $contains($lowercase($nullSafeProp($, 'cdx:npm:manifestSourceType')), 'url')
+        )
+        and $count(externalReferences[
+          type = 'distribution'
+          and (
+            $startsWith($lowercase(url), 'git+')
+            or $startsWith($lowercase(url), 'http://')
+            or $startsWith($lowercase(url), 'https://')
+          )
+        ]) > 0
+      ]) > 0
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl,
+      "file": $prop($, 'cdx:github:workflow:file')
+    }
+  message: "GitHub Action '{{ $prop($, 'cdx:github:action:uses') }}' explicitly disables npm build caching while resolved npm package distributions are present in the BOM"
+  mitigation: "Keep setup-node caching enabled unless you have a reviewed exception; disabling cache can weaken integrity checks and provenance review for resolved npm artifacts"
+  evidence: |
+    {
+      "cacheDisableInput": $prop($, 'cdx:github:action:buildCacheDisableInput'),
+      "cacheDisableValue": $prop($, 'cdx:github:action:buildCacheDisableValue'),
+      "matchingPackages": $$.components[
+        $startsWith(purl, 'pkg:npm/')
+        and (
+          $contains($lowercase($nullSafeProp($, 'cdx:npm:manifestSourceType')), 'git')
+          or $contains($lowercase($nullSafeProp($, 'cdx:npm:manifestSourceType')), 'url')
+        )
+        and $count(externalReferences[
+          type = 'distribution'
+          and (
+            $startsWith($lowercase(url), 'git+')
+            or $startsWith($lowercase(url), 'http://')
+            or $startsWith($lowercase(url), 'https://')
+          )
+        ]) > 0
+      ].purl
+    }
+
+- id: CI-023
+  name: "Python setup action disables build cache despite resolved package distributions"
+  description: "Explicitly disabling setup-python caching reduces tamper resistance and reviewability when PyPI dependencies are resolved from remote archives or VCS sources"
+  severity: medium
+  category: ci-permission
+  dry-run-support: full
+  attack:
+    tactics: [TA0001]
+    techniques: [T1195.001]
+  condition: |
+    $auditComponents($)[
+      $prop($, 'cdx:github:action:disablesBuildCache') = 'true'
+      and $prop($, 'cdx:github:action:buildCacheEcosystem') = 'pypi'
+      and $count($$.components[
+        $startsWith(purl, 'pkg:pypi/')
+        and (
+          $contains($lowercase($nullSafeProp($, 'cdx:pypi:manifestSourceType')), 'git')
+          or $contains($lowercase($nullSafeProp($, 'cdx:pypi:manifestSourceType')), 'url')
+        )
+      ]) > 0
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl,
+      "file": $prop($, 'cdx:github:workflow:file')
+    }
+  message: "GitHub Action '{{ $prop($, 'cdx:github:action:uses') }}' explicitly disables Python build caching while resolved PyPI package distributions are present in the BOM"
+  mitigation: "Keep setup-python caching enabled when lockfiles resolve remote archives or VCS sources unless you have a reviewed exception"
+  evidence: |
+    {
+      "cacheDisableInput": $prop($, 'cdx:github:action:buildCacheDisableInput'),
+      "cacheDisableValue": $prop($, 'cdx:github:action:buildCacheDisableValue'),
+      "matchingPackages": $$.components[
+        $startsWith(purl, 'pkg:pypi/')
+        and (
+          $contains($lowercase($nullSafeProp($, 'cdx:pypi:manifestSourceType')), 'git')
+          or $contains($lowercase($nullSafeProp($, 'cdx:pypi:manifestSourceType')), 'url')
+        )
+      ].purl
+    }
+
+- id: CI-024
+  name: "Cargo setup action disables build cache despite manifest-declared git dependencies"
+  description: "Explicitly disabling Cargo setup caching reduces tamper resistance and reviewability when Cargo manifests rely on git dependencies"
+  severity: medium
+  category: ci-permission
+  dry-run-support: full
+  attack:
+    tactics: [TA0001]
+    techniques: [T1195.001]
+  condition: |
+    $auditComponents($)[
+      $prop($, 'cdx:github:action:disablesBuildCache') = 'true'
+      and $prop($, 'cdx:github:action:buildCacheEcosystem') = 'cargo'
+      and $count($$.components[
+        $startsWith(purl, 'pkg:cargo/')
+        and $hasProp($, 'cdx:cargo:git')
+      ]) > 0
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl,
+      "file": $prop($, 'cdx:github:workflow:file')
+    }
+  message: "GitHub Action '{{ $prop($, 'cdx:github:action:uses') }}' explicitly disables Cargo build caching while manifest-declared Cargo git dependencies are present in the BOM"
+  mitigation: "Keep Cargo setup caching enabled when manifests rely on git dependencies unless you have a reviewed exception"
+  evidence: |
+    {
+      "cacheDisableInput": $prop($, 'cdx:github:action:buildCacheDisableInput'),
+      "cacheDisableValue": $prop($, 'cdx:github:action:buildCacheDisableValue'),
+      "matchingPackages": $$.components[
+        $startsWith(purl, 'pkg:cargo/')
+        and $hasProp($, 'cdx:cargo:git')
+      ].purl
+    }