@cyclonedx/cdxgen 12.2.0 → 12.3.0

package/lib/helpers/ciParsers/githubActions.poku.js

@@ -1,9 +1,11 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
 import { assert, describe, it } from "poku";
 
-import { githubActionsParser } from "./githubActions.js";
+import { githubActionsParser, parseWorkflowFile } from "./githubActions.js";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const repoRoot = path.resolve(__dirname, "../../..");
@@ -143,6 +145,30 @@ describe("githubActionsParser", () => {
     assert.deepStrictEqual(result.workflows, []);
   });
 
+  it("derives unnamed workflow names from the file stem without leaking Windows-style path segments", () => {
+    const tmpDir = mkdtempSync(path.join(os.tmpdir(), "cdxgen-gha-"));
+    const workflowFile = path.join(tmpDir, "nested\\workflow-file.yml");
+    mkdirSync(path.dirname(workflowFile), { recursive: true });
+    writeFileSync(
+      workflowFile,
+      [
+        "on: push",
+        "jobs:",
+        "  build:",
+        "    runs-on: ubuntu-latest",
+        '    steps:\n      - run: echo "ok"',
+      ].join("\n"),
+    );
+
+    try {
+      const result = parseWorkflowFile(workflowFile, { specVersion: 1.7 });
+      assert.strictEqual(result.workflows.length, 1);
+      assert.strictEqual(result.workflows[0].name, "workflow-file");
+    } finally {
+      rmSync(tmpDir, { force: true, recursive: true });
+    }
+  });
+
   it("disambiguates identical steps (uniqueItems compliance)", () => {
     const wfFile = path.join(
       repoRoot,
@@ -324,6 +350,30 @@ describe("githubActionsParser", () => {
       );
     });
 
+    it("emits pull_request_target trigger metadata for cache poisoning analysis", () => {
+      const result = parseWorkflow("cache-pull-request-target.yml");
+
+      const workflow = result.workflows[0];
+      assert.strictEqual(
+        getProp(workflow, "cdx:github:workflow:hasPullRequestTargetTrigger"),
+        "true",
+      );
+
+      const cacheComp = findComponentByPurlSubstring(
+        result.components,
+        "actions/cache",
+      );
+      assert.ok(cacheComp, "expected actions/cache component");
+      assert.strictEqual(
+        getProp(cacheComp, "cdx:github:workflow:hasPullRequestTargetTrigger"),
+        "true",
+      );
+      assert.strictEqual(
+        getProp(cacheComp, "cdx:github:workflow:hasWritePermissions"),
+        "true",
+      );
+    });
+
     it("handles cache action without optional fields gracefully", () => {
       const result = parseWorkflow("cache-minimal.yml");
 
@@ -386,6 +436,24 @@ describe("githubActionsParser", () => {
       );
     });
 
+    it("detects github.event.comment.body interpolation in issue_comment workflows", () => {
+      const result = parseWorkflow("injection-issue-comment-body.yml");
+
+      const workflow = result.workflows[0];
+      assert.strictEqual(
+        getProp(workflow, "cdx:github:workflow:hasIssueCommentTrigger"),
+        "true",
+      );
+      const runStepComp = result.components.find((c) =>
+        hasProp(c, "cdx:github:step:hasUntrustedInterpolation", "true"),
+      );
+      assert.ok(runStepComp, "expected issue_comment injection component");
+      assert.match(
+        getProp(runStepComp, "cdx:github:step:interpolatedVars"),
+        /github\.event\.comment\.body/,
+      );
+    });
+
     it("detects inputs.* interpolation in workflow_dispatch", () => {
       const result = parseWorkflow("injection-workflow-inputs.yml");
 
@@ -417,6 +485,19 @@ describe("githubActionsParser", () => {
       }
     });
 
+    it("does not flag structured SHA interpolation as untrusted input", () => {
+      const result = parseWorkflow("safe-sha-interpolation.yml");
+
+      const runStepComp = result.components.find((c) =>
+        c.properties?.some((p) => p.name === "cdx:github:step:type"),
+      );
+      assert.ok(runStepComp, "expected a run step component");
+      assert.strictEqual(
+        getProp(runStepComp, "cdx:github:step:hasUntrustedInterpolation"),
+        undefined,
+      );
+    });
+
     it("handles multiple interpolations in single run block", () => {
       const result = parseWorkflow("injection-multiple-vars.yml");
 
@@ -524,6 +605,221 @@ describe("githubActionsParser", () => {
     });
   });
 
+  describe("explicit permissions metadata and sensitive-operation heuristics", () => {
+    it("emits false explicit-permissions metadata and sensitive-operation flags for implicit high-risk workflows", () => {
+      const result = parseWorkflow(
+        "heuristic-implicit-permissions-sensitive.yml",
+      );
+
+      const workflow = result.workflows[0];
+      assert.strictEqual(
+        getProp(workflow, "cdx:github:workflow:hasHighRiskTrigger"),
+        "true",
+      );
+      assert.strictEqual(
+        getProp(workflow, "cdx:github:workflow:hasExplicitPermissionsBlock"),
+        "false",
+      );
+      assert.strictEqual(
+        getProp(workflow, "cdx:github:workflow:hasAnyExplicitPermissionsBlock"),
+        "false",
+      );
+
+      const runStepComp = result.components.find(
+        (component) => component.name === "Trigger downstream release",
+      );
+      assert.ok(runStepComp, "expected sensitive run-step component");
+      assert.strictEqual(
+        getProp(
+          runStepComp,
+          "cdx:github:workflow:hasAnyExplicitPermissionsBlock",
+        ),
+        "false",
+      );
+      assert.strictEqual(
+        getProp(runStepComp, "cdx:github:step:hasSensitiveOperations"),
+        "true",
+      );
+      assert.match(
+        getProp(runStepComp, "cdx:github:step:sensitiveOperations"),
+        /dispatches-workflow/,
+      );
+      assert.match(
+        getProp(runStepComp, "cdx:github:step:sensitiveOperations"),
+        /references-sensitive-context/,
+      );
+    });
+
+    it("emits true explicit-permissions metadata when a permissions block is present", () => {
+      const result = parseWorkflow(
+        "heuristic-explicit-permissions-sensitive.yml",
+      );
+
+      const workflow = result.workflows[0];
+      assert.strictEqual(
+        getProp(workflow, "cdx:github:workflow:hasExplicitPermissionsBlock"),
+        "true",
+      );
+      assert.strictEqual(
+        getProp(workflow, "cdx:github:workflow:hasAnyExplicitPermissionsBlock"),
+        "true",
+      );
+
+      const runStepComp = result.components.find(
+        (component) => component.name === "Trigger downstream release",
+      );
+      assert.ok(runStepComp, "expected sensitive run-step component");
+      assert.strictEqual(
+        getProp(
+          runStepComp,
+          "cdx:github:workflow:hasAnyExplicitPermissionsBlock",
+        ),
+        "true",
+      );
+      assert.strictEqual(
+        getProp(runStepComp, "cdx:github:step:hasSensitiveOperations"),
+        "true",
+      );
+    });
+  });
+
+  describe("job-scoped privilege and trust metadata", () => {
+    it("propagates job-scoped id-token write to components and workflows", () => {
+      const result = parseWorkflow("job-id-token-write.yml");
+
+      const workflow = result.workflows[0];
+      assert.strictEqual(
+        getProp(workflow, "cdx:github:workflow:hasIdTokenWrite"),
+        "true",
+      );
+
+      const actionComp = findComponentByPurlSubstring(
+        result.components,
+        "vendor/deploy-action",
+      );
+      assert.ok(actionComp, "expected third-party deploy action");
+      assert.strictEqual(
+        getProp(actionComp, "cdx:github:workflow:hasIdTokenWrite"),
+        "true",
+      );
+      assert.strictEqual(
+        getProp(actionComp, "cdx:github:job:hasIdTokenWrite"),
+        "true",
+      );
+      assert.strictEqual(
+        getProp(actionComp, "cdx:actions:isOfficial"),
+        "false",
+      );
+      assert.strictEqual(
+        getProp(actionComp, "cdx:actions:isVerified"),
+        "false",
+      );
+    });
+
+    it("emits workflow dispatch input metadata", () => {
+      const result = parseWorkflow("injection-workflow-inputs.yml");
+
+      const workflow = result.workflows[0];
+      assert.strictEqual(
+        getProp(workflow, "cdx:github:workflow:hasWorkflowDispatchInputs"),
+        "true",
+      );
+      assert.strictEqual(
+        getProp(workflow, "cdx:github:workflow:hasWorkflowDispatchTrigger"),
+        "true",
+      );
+      assert.ok(
+        getProp(workflow, "cdx:github:workflow:workflowDispatchInputs")?.split(
+          ",",
+        ).length >= 1,
+      );
+    });
+  });
+
+  describe("reusable workflow parsing", () => {
+    it("models external reusable workflows with secrets inheritance", () => {
+      const result = parseWorkflow("reusable-workflow-secrets-inherit.yml");
+
+      const reusableComp = result.components.find((c) =>
+        hasProp(c, "cdx:github:reusableWorkflow:secretsInherit", "true"),
+      );
+      assert.ok(reusableComp, "expected reusable workflow component");
+      assert.strictEqual(
+        getProp(reusableComp, "cdx:github:reusableWorkflow:isExternal"),
+        "true",
+      );
+      assert.strictEqual(
+        getProp(reusableComp, "cdx:github:reusableWorkflow:isShaPinned"),
+        "false",
+      );
+      assert.strictEqual(
+        getProp(reusableComp, "cdx:github:reusableWorkflow:versionPinningType"),
+        "branch",
+      );
+    });
+
+    it("models external reusable workflows pinned to mutable refs", () => {
+      const result = parseWorkflow("reusable-workflow-external-unpinned.yml");
+
+      const reusableComp = result.components.find((c) =>
+        hasProp(c, "cdx:github:reusableWorkflow:isExternal", "true"),
+      );
+      assert.ok(reusableComp, "expected external reusable workflow component");
+      assert.strictEqual(
+        getProp(reusableComp, "cdx:github:reusableWorkflow:isShaPinned"),
+        "false",
+      );
+      assert.strictEqual(
+        getProp(reusableComp, "cdx:github:reusableWorkflow:withKeys"),
+        "run-tests",
+      );
+    });
+
+    it("emits workflow_call producer metadata for reusable workflow definitions", () => {
+      const result = parseWorkflow("workflow-call-producer-risky.yml");
+
+      const workflow = result.workflows[0];
+      assert.strictEqual(
+        getProp(workflow, "cdx:github:workflow:hasWorkflowCallTrigger"),
+        "true",
+      );
+      assert.strictEqual(
+        getProp(workflow, "cdx:github:workflow:isWorkflowCallProducer"),
+        "true",
+      );
+      assert.strictEqual(
+        getProp(workflow, "cdx:github:workflow:workflowCallInputs"),
+        "release_tag",
+      );
+      assert.strictEqual(
+        getProp(workflow, "cdx:github:workflow:workflowCallSecrets"),
+        "release_token",
+      );
+      assert.strictEqual(
+        getProp(workflow, "cdx:github:workflow:workflowCallOutputs"),
+        "image_tag",
+      );
+      assert.strictEqual(
+        getProp(workflow, "cdx:github:workflow:hasWritePermissions"),
+        "true",
+      );
+
+      const actionComp = findComponentByPurlSubstring(
+        result.components,
+        "vendor/publish-action",
+      );
+      assert.ok(actionComp, "expected publish action component");
+      assert.strictEqual(
+        getProp(actionComp, "cdx:github:workflow:hasWorkflowCallTrigger"),
+        "true",
+      );
+      assert.strictEqual(
+        getProp(actionComp, "cdx:github:workflow:workflowCallSecrets"),
+        "release_token",
+      );
+    });
+  });
+
   describe("combined security risk scenarios", () => {
     it("detects cache poisoning risk: cache + pull_request + write perms", () => {
       const result = parseWorkflow("risk-cache-poisoning.yml");
@@ -548,6 +844,14 @@ describe("githubActionsParser", () => {
         "true",
         "write permissions should be duplicated",
       );
+      assert.strictEqual(
+        getProp(cacheComp, "cdx:github:workflow:hasPullRequestTrigger"),
+        "true",
+      );
+      assert.strictEqual(
+        getProp(cacheComp, "cdx:github:cache:keyUsesHashFiles"),
+        undefined,
+      );
     });
 
     it("detects credential exposure: checkout persist + privileged workflow", () => {
@@ -569,6 +873,39 @@ describe("githubActionsParser", () => {
       );
     });
 
+    it("detects checkout of pull_request head context inside pull_request_target", () => {
+      const result = parseWorkflow("checkout-untrusted-pr-head.yml");
+
+      const checkoutComp = findComponentByPurlSubstring(
+        result.components,
+        "actions/checkout",
+      );
+      assert.ok(checkoutComp, "expected actions/checkout component");
+      assert.strictEqual(
+        getProp(
+          checkoutComp,
+          "cdx:github:workflow:hasPullRequestTargetTrigger",
+        ),
+        "true",
+      );
+      assert.strictEqual(
+        getProp(checkoutComp, "cdx:github:checkout:checksOutUntrustedRef"),
+        "true",
+      );
+      assert.match(
+        getProp(checkoutComp, "cdx:github:checkout:untrustedRefContexts"),
+        /github\.event\.pull_request\.head\.sha/,
+      );
+      assert.strictEqual(
+        getProp(checkoutComp, "cdx:github:checkout:referencesForkContext"),
+        "true",
+      );
+      assert.match(
+        getProp(checkoutComp, "cdx:github:checkout:forkContextRefs"),
+        /github\.event\.pull_request\.head\.repo\.full_name/,
+      );
+    });
+
     it("detects script injection in privileged context", () => {
       const result = parseWorkflow("risk-injection-privileged.yml");
 
@@ -607,6 +944,328 @@ describe("githubActionsParser", () => {
         "true",
       );
     });
+
+    it("detects self-hosted runners in high-risk workflows", () => {
+      const result = parseWorkflow("self-hosted-high-risk.yml");
+
+      const actionComp = findComponentByPurlSubstring(
+        result.components,
+        "actions/checkout",
+      );
+      assert.ok(actionComp, "expected actions/checkout component");
+      assert.strictEqual(
+        getProp(actionComp, "cdx:github:job:isSelfHosted"),
+        "true",
+      );
+      assert.strictEqual(
+        getProp(actionComp, "cdx:github:workflow:hasHighRiskTrigger"),
+        "true",
+      );
+    });
+
+    it("detects runner-state mutation in privileged run steps", () => {
+      const result = parseWorkflow("runner-state-mutation.yml");
+
+      const runStepComp = result.components.find((c) =>
+        hasProp(c, "cdx:github:step:mutatesRunnerState", "true"),
+      );
+      assert.ok(runStepComp, "expected runner-state mutation component");
+      assert.strictEqual(
+        getProp(runStepComp, "cdx:github:step:runnerStateTargets"),
+        "GITHUB_ENV",
+      );
+      assert.strictEqual(
+        getProp(runStepComp, "cdx:github:workflow:hasWritePermissions"),
+        "true",
+      );
+    });
+
+    it("detects outbound commands that reference sensitive context", () => {
+      const result = parseWorkflow("outbound-sensitive-context.yml");
+
+      const runStepComp = result.components.find((c) =>
+        hasProp(c, "cdx:github:step:hasOutboundNetworkCommand", "true"),
+      );
+      assert.ok(runStepComp, "expected outbound network component");
+      assert.strictEqual(
+        getProp(runStepComp, "cdx:github:step:referencesSensitiveContext"),
+        "true",
+      );
+      assert.match(
+        getProp(runStepComp, "cdx:github:step:sensitiveContextRefs"),
+        /env:UPLOAD_AUTH/,
+      );
+      assert.strictEqual(
+        getProp(runStepComp, "cdx:github:step:likelyExfiltration"),
+        "true",
+      );
+      assert.match(
+        getProp(runStepComp, "cdx:github:step:exfiltrationIndicators"),
+        /auth-header/,
+      );
+      assert.match(
+        getProp(runStepComp, "cdx:github:step:exfiltrationIndicators"),
+        /state-changing-method/,
+      );
+    });
+
+    it("does not mark low-signal outbound steps as likely exfiltration", () => {
+      const result = parseWorkflow("outbound-sensitive-context-low-signal.yml");
+
+      const runStepComp = result.components.find((c) =>
+        hasProp(c, "cdx:github:step:hasOutboundNetworkCommand", "true"),
+      );
+      assert.ok(runStepComp, "expected outbound network component");
+      assert.strictEqual(
+        getProp(runStepComp, "cdx:github:step:referencesSensitiveContext"),
+        "true",
+      );
+      assert.strictEqual(
+        getProp(runStepComp, "cdx:github:step:likelyExfiltration"),
+        undefined,
+      );
+    });
+
+    it("detects fork-aware workflow dispatch chains in run steps", () => {
+      const result = parseWorkflow("dispatch-chain-fork-sensitive.yml");
+
+      const dispatchStepComp = result.components.find((c) =>
+        hasProp(c, "cdx:github:step:dispatchesWorkflow", "true"),
+      );
+      assert.ok(
+        dispatchStepComp,
+        "expected dispatching workflow step component",
+      );
+      assert.strictEqual(
+        getProp(dispatchStepComp, "cdx:github:step:dispatchKinds"),
+        "workflow_dispatch",
+      );
+      assert.match(
+        getProp(dispatchStepComp, "cdx:github:step:dispatchMechanisms"),
+        /gh-workflow-run/,
+      );
+      assert.match(
+        getProp(dispatchStepComp, "cdx:github:step:dispatchTargets"),
+        /workflow:release.yml/,
+      );
+      assert.strictEqual(
+        getProp(dispatchStepComp, "cdx:github:step:referencesForkContext"),
+        "true",
+      );
+      assert.match(
+        getProp(dispatchStepComp, "cdx:github:step:sensitiveContextRefs"),
+        /env:GH_TOKEN/,
+      );
+    });
+
+    it("detects workflow dispatches from actions/github-script", () => {
+      const tmpDir = mkdtempSync(path.join(os.tmpdir(), "cdxgen-gha-"));
+      const workflowFile = path.join(tmpDir, "github-script-dispatch.yml");
+      writeFileSync(
+        workflowFile,
+        [
+          "name: Script dispatch",
+          "on: workflow_run",
+          "permissions:",
+          "  actions: write",
+          "jobs:",
+          "  relay:",
+          "    runs-on: ubuntu-latest",
+          "    steps:",
+          "      - uses: actions/github-script@v7",
+          "        with:",
+          "          github-token: $" + "{{ secrets.GITHUB_TOKEN }}",
+          "          script: |",
+          "            await github.rest.actions.createWorkflowDispatch({",
+          "              owner: 'octo-org',",
+          "              repo: 'release-repo',",
+          "              workflow_id: 'release.yml',",
+          "              ref: 'main',",
+          "            });",
+        ].join("\n"),
+      );
+
+      try {
+        const result = parseWorkflowFile(workflowFile, { specVersion: 1.7 });
+        const githubScriptComp = findComponentByPurlSubstring(
+          result.components,
+          "actions/github-script",
+        );
+        assert.ok(githubScriptComp, "expected actions/github-script component");
+        assert.strictEqual(
+          getProp(githubScriptComp, "cdx:github:step:dispatchesWorkflow"),
+          "true",
+        );
+        assert.match(
+          getProp(githubScriptComp, "cdx:github:step:dispatchTargets"),
+          /repo:octo-org\/release-repo/,
+        );
+        assert.match(
+          getProp(githubScriptComp, "cdx:github:step:sensitiveContextRefs"),
+          /input:github-token/,
+        );
+      } finally {
+        rmSync(tmpDir, { force: true, recursive: true });
+      }
+    });
+
+    it("correlates dispatch senders with local receiver workflow definitions", () => {
+      const tmpDir = mkdtempSync(path.join(os.tmpdir(), "cdxgen-gha-"));
+      const senderWorkflow = path.join(tmpDir, "sender.yml");
+      const dispatchReceiverWorkflow = path.join(tmpDir, "release.yml");
+      const repoDispatchReceiverWorkflow = path.join(
+        tmpDir,
+        "repo-dispatch.yml",
+      );
+      writeFileSync(
+        senderWorkflow,
+        [
+          "name: Sender workflow",
+          "on: push",
+          "jobs:",
+          "  relay:",
+          "    runs-on: ubuntu-latest",
+          "    steps:",
+          "      - name: Trigger release receiver",
+          "        env:",
+          "          GH_TOKEN: $" + "{{ github.token }}",
+          "        run: gh workflow run release.yml --ref main",
+          "      - name: Trigger promote event",
+          "        uses: peter-evans/repository-dispatch@v3",
+          "        with:",
+          "          event-type: promote",
+        ].join("\n"),
+      );
+      writeFileSync(
+        dispatchReceiverWorkflow,
+        [
+          "name: Release workflow",
+          "on:",
+          "  workflow_dispatch:",
+          "    inputs:",
+          "      version:",
+          "        required: true",
+          "jobs:",
+          "  release:",
+          "    runs-on: ubuntu-latest",
+          "    steps:",
+          "      - run: echo release",
+        ].join("\n"),
+      );
+      writeFileSync(
+        repoDispatchReceiverWorkflow,
+        [
+          "name: Promote workflow",
+          "on:",
+          "  repository_dispatch:",
+          "    types: [promote]",
+          "jobs:",
+          "  promote:",
+          "    runs-on: ubuntu-latest",
+          "    steps:",
+          "      - run: echo promote",
+        ].join("\n"),
+      );
+
+      try {
+        const result = githubActionsParser.parse(
+          [
+            senderWorkflow,
+            dispatchReceiverWorkflow,
+            repoDispatchReceiverWorkflow,
+          ],
+          { specVersion: 1.7 },
+        );
+        const runDispatchStep = result.components.find(
+          (component) => component.name === "Trigger release receiver",
+        );
+        assert.ok(
+          runDispatchStep,
+          "expected local workflow_dispatch sender step",
+        );
+        assert.strictEqual(
+          getProp(runDispatchStep, "cdx:github:step:hasLocalDispatchReceiver"),
+          "true",
+        );
+        assert.match(
+          getProp(
+            runDispatchStep,
+            "cdx:github:step:dispatchReceiverWorkflowFiles",
+          ),
+          /release\.yml/,
+        );
+        assert.match(
+          getProp(
+            runDispatchStep,
+            "cdx:github:step:dispatchReceiverWorkflowNames",
+          ),
+          /Release workflow/,
+        );
+
+        const actionDispatchStep = result.components.find(
+          (component) =>
+            getProp(component, "cdx:github:action:uses") ===
+            "peter-evans/repository-dispatch@v3",
+        );
+        assert.ok(
+          actionDispatchStep,
+          "expected local repository_dispatch sender step",
+        );
+        assert.strictEqual(
+          getProp(
+            actionDispatchStep,
+            "cdx:github:step:hasLocalDispatchReceiver",
+          ),
+          "true",
+        );
+        assert.match(
+          getProp(
+            actionDispatchStep,
+            "cdx:github:step:dispatchReceiverMatchBasis",
+          ),
+          /repository_dispatch:promote/,
+        );
+
+        const releaseWorkflow = result.workflows.find(
+          (workflow) => workflow.name === "Release workflow",
+        );
+        assert.ok(
+          releaseWorkflow,
+          "expected workflow_dispatch receiver workflow",
+        );
+        assert.strictEqual(
+          getProp(
+            releaseWorkflow,
+            "cdx:github:workflow:hasLocalDispatchSender",
+          ),
+          "true",
+        );
+        assert.match(
+          getProp(
+            releaseWorkflow,
+            "cdx:github:workflow:dispatchSenderWorkflowNames",
+          ),
+          /Sender workflow/,
+        );
+
+        const repoDispatchWorkflow = result.workflows.find(
+          (workflow) => workflow.name === "Promote workflow",
+        );
+        assert.ok(
+          repoDispatchWorkflow,
+          "expected repository_dispatch receiver workflow",
+        );
+        assert.match(
+          getProp(
+            repoDispatchWorkflow,
+            "cdx:github:workflow:repositoryDispatchTypes",
+          ),
+          /promote/,
+        );
+      } finally {
+        rmSync(tmpDir, { force: true, recursive: true });
+      }
+    });
   });
 
   describe("edge cases and robustness", () => {
@@ -662,6 +1321,37 @@ describe("githubActionsParser", () => {
       );
     });
 
+    it("treats short hexadecimal refs as mutable action versions, not immutable SHAs", () => {
+      const result = parseWorkflow("short-sha-pinning.yml");
+
+      const shortRefComp = result.components.find(
+        (component) => component.version === "deadbee",
+      );
+      assert.ok(shortRefComp, "expected short-ref action component");
+      assert.strictEqual(
+        getProp(shortRefComp, "cdx:github:action:isShaPinned"),
+        "false",
+      );
+      assert.strictEqual(
+        getProp(shortRefComp, "cdx:github:action:versionPinningType"),
+        "tag",
+      );
+
+      const fullShaComp = result.components.find(
+        (component) =>
+          component.version === "0123456789abcdef0123456789abcdef01234567",
+      );
+      assert.ok(fullShaComp, "expected full-SHA action component");
+      assert.strictEqual(
+        getProp(fullShaComp, "cdx:github:action:isShaPinned"),
+        "true",
+      );
+      assert.strictEqual(
+        getProp(fullShaComp, "cdx:github:action:versionPinningType"),
+        "sha",
+      );
+    });
+
     it("preserves existing properties when adding new ones", () => {
       const result = parseWorkflow("checkout-default.yml");
 
@@ -799,4 +1489,166 @@ describe("githubActionsParser", () => {
       );
     });
   });
+
+  describe("safe vs risky workflow corpus", () => {
+    it("distinguishes safe cache keys from risky PR cache usage", () => {
+      const safeResult = parseWorkflow("cache-pull-request.yml");
+      const riskyResult = parseWorkflow("risk-cache-poisoning.yml");
+
+      const safeCache = findComponentByPurlSubstring(
+        safeResult.components,
+        "actions/cache",
+      );
+      const riskyCache = findComponentByPurlSubstring(
+        riskyResult.components,
+        "actions/cache",
+      );
+      assert.ok(safeCache, "expected safe cache component");
+      assert.ok(riskyCache, "expected risky cache component");
+      assert.strictEqual(
+        getProp(safeCache, "cdx:github:cache:keyUsesHashFiles"),
+        "true",
+      );
+      assert.strictEqual(
+        getProp(safeCache, "cdx:github:cache:hasRestoreKeys"),
+        undefined,
+      );
+      assert.strictEqual(
+        getProp(riskyCache, "cdx:github:cache:keyUsesHashFiles"),
+        undefined,
+      );
+      assert.strictEqual(
+        getProp(riskyCache, "cdx:github:workflow:hasWritePermissions"),
+        "true",
+      );
+    });
+
+    it("distinguishes safe and risky workflow_call producers", () => {
+      const safeResult = parseWorkflow("workflow-call-producer-safe.yml");
+      const riskyResult = parseWorkflow("workflow-call-producer-risky.yml");
+
+      const safeWorkflow = safeResult.workflows[0];
+      const riskyWorkflow = riskyResult.workflows[0];
+      assert.strictEqual(
+        getProp(safeWorkflow, "cdx:github:workflow:hasWorkflowCallTrigger"),
+        "true",
+      );
+      assert.strictEqual(
+        getProp(riskyWorkflow, "cdx:github:workflow:hasWorkflowCallTrigger"),
+        "true",
+      );
+      assert.strictEqual(
+        getProp(safeWorkflow, "cdx:github:workflow:workflowCallSecrets"),
+        undefined,
+      );
+      assert.strictEqual(
+        getProp(riskyWorkflow, "cdx:github:workflow:workflowCallSecrets"),
+        "release_token",
+      );
+      assert.strictEqual(
+        getProp(riskyWorkflow, "cdx:github:workflow:workflowCallOutputs"),
+        "image_tag",
+      );
+    });
+  });
+
+  describe("workflow security metadata", () => {
+    it("emits hidden Unicode workflow properties when dangerous characters appear in comments", () => {
+      const tmpDir = mkdtempSync(path.join(os.tmpdir(), "cdxgen-gha-"));
+      const workflowFile = path.join(tmpDir, "unicode-workflow.yml");
+      writeFileSync(
+        workflowFile,
+        [
+          "name: Unicode workflow",
+          "on: push",
+          "# suspicious comment \u202E marker",
+          "jobs:",
+          "  test:",
+          "    runs-on: ubuntu-latest",
+          '    steps:\n      - run: echo "ok"',
+        ].join("\n"),
+      );
+
+      try {
+        const result = parseWorkflowFile(workflowFile, { specVersion: 1.7 });
+        assert.strictEqual(result.workflows.length, 1);
+        const workflow = result.workflows[0];
+        assert.strictEqual(
+          getProp(workflow, "cdx:github:workflow:hasHiddenUnicode"),
+          "true",
+        );
+        assert.strictEqual(
+          getProp(workflow, "cdx:github:workflow:hiddenUnicodeInComments"),
+          "true",
+        );
+        assert.match(
+          getProp(workflow, "cdx:github:workflow:hiddenUnicodeCodePoints"),
+          /U\+202E/,
+        );
+      } finally {
+        rmSync(tmpDir, { force: true, recursive: true });
+      }
+    });
+
+    it("flags legacy npm and PyPI token-based publish commands in run steps", () => {
+      const tmpDir = mkdtempSync(path.join(os.tmpdir(), "cdxgen-gha-"));
+      const workflowFile = path.join(tmpDir, "publish-workflow.yml");
+      writeFileSync(
+        workflowFile,
+        [
+          "name: Publish packages",
+          "on: push",
+          "env:",
+          "  NPM_TOKEN: $" + "{{ secrets.NPM_TOKEN }}",
+          "jobs:",
+          "  release:",
+          "    runs-on: ubuntu-latest",
+          "    env:",
+          "      TWINE_PASSWORD: $" + "{{ secrets.PYPI_TOKEN }}",
+          "    steps:",
+          "      - name: Publish npm",
+          "        run: npm publish --token=$" + "{NPM_TOKEN}",
+          "      - name: Publish pypi",
+          "        run: twine upload dist/*",
+        ].join("\n"),
+      );
+
+      try {
+        const result = parseWorkflowFile(workflowFile, { specVersion: 1.7 });
+        const npmStep = result.components.find(
+          (component) =>
+            getProp(component, "cdx:github:step:publishEcosystem") === "npm",
+        );
+        const pypiStep = result.components.find(
+          (component) =>
+            getProp(component, "cdx:github:step:publishEcosystem") === "pypi",
+        );
+
+        assert.ok(npmStep, "expected npm publish run-step component");
+        assert.ok(pypiStep, "expected PyPI publish run-step component");
+        assert.strictEqual(
+          getProp(npmStep, "cdx:github:step:usesLegacyPublishToken"),
+          "true",
+        );
+        assert.match(
+          getProp(npmStep, "cdx:github:step:legacyPublishTokenSources"),
+          /cli-flag/,
+        );
+        assert.match(
+          getProp(npmStep, "cdx:github:step:legacyPublishTokenSources"),
+          /env:NPM_TOKEN/,
+        );
+        assert.strictEqual(
+          getProp(pypiStep, "cdx:github:step:usesLegacyPublishToken"),
+          "true",
+        );
+        assert.match(
+          getProp(pypiStep, "cdx:github:step:legacyPublishTokenSources"),
+          /env:TWINE_PASSWORD/,
+        );
+      } finally {
+        rmSync(tmpDir, { force: true, recursive: true });
+      }
+    });
+  });
 });