@intentius/chant-lexicon-github 0.1.23 → 0.2.0

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "342371d6e50839e96a0e26116644681538de0a1990904009ba9853c64c938a1e",
+    "manifest.json": "9bfb1e2f89ab306d4369dbd5df0a9cb0fc22cc8d282f37a1c6195ce86b812410",
     "meta.json": "798c5f5f37b0174756d2451299acfdc95c014f11d06d32b9153bbdfa9f3a580c",
     "types/index.d.ts": "39c0791f0e58025bcef82e0f7a92240508f899fc2771d5dd51b2369b4d330f13",
     "rules/deprecated-action-version.ts": "d41e6e532ab7f623af1bee4ac5279fcb2baada7defa1c5d022a5bc71983e8797",
@@ -20,10 +20,10 @@
     "rules/gha006.ts": "7e2977d34851ce2ed9f91c4dd78ecda8d4de099ceaac1cd9ab74960a193133a3",
     "rules/gha009.ts": "0f9a261e886309679494da32b72a0d9ea20017e5da75a9d59a04846a0e4d78db",
     "rules/gha011.ts": "53b7ca79b5bf56e5793a9b7a44ae0ac766eb5acf0669005e7810cb7762bab79c",
+    "rules/gha013.ts": "47c1b28565aced3370b85d00a03b6110a32e451661e34badd731ffbb24b45d9a",
     "rules/gha017.ts": "ec62dac7f9d69f36978cb461c4ba391a7e445d410bbfa497cddcb1b12cfd5904",
     "rules/gha018.ts": "2c71c5accb96bccfa01075e7f8f4ad66e6d9a68a81b86f89a68cabb9c144e140",
     "rules/gha019.ts": "d0b33d63812c9cba2ebf9f2d85d8cf22068ea96460cd2143bdfb4d2a4d58fe2e",
-    "rules/gha020.ts": "72dc68a1eae98e0e4611dfe62eecda6900c22f286825bc3c5133f1f5e2e62d43",
     "rules/gha021.ts": "01463240871326c2798abb3a3cdccba95b44efa1e0083e54a81824e8875dcc37",
     "rules/gha022.ts": "7bfb5e280ace280f06b8b64645863210320cd38380a2fc7b95a3455753a50f9c",
     "rules/gha023.ts": "708468e098e434739bd62573d8559318c08a2830aa8ac39d2bf465e7da012b38",
@@ -32,10 +32,40 @@
     "rules/gha026.ts": "1c0278cb453dad28f417fd11fd30d83402a64ccb809f366a5b46ffceb3466da6",
     "rules/gha027.ts": "5a266987c65dc92ca77c1d4c9b8fa29d6435275d399819dec5027be3f2d96239",
     "rules/gha028.ts": "5d1f06b635354b67557f0dbdc2f11ca4c5b8e8541b85b1c135b6f02ef147d9a0",
-    "rules/yaml-helpers.ts": "4729afd9ff287dbef38b84298b130f5ab8822a351d9d37111a7ed4cb589ced58",
+    "rules/gha029.ts": "6e2c3262761fd2d21a1c8b6e85a8b77df9fb0ef049c8856e62ff6aef6670c870",
+    "rules/gha030.ts": "310fd8e8acc7ea6ceba4dfb8fb133080cf91fd5fc90f7f1d9dfb11527a7ed0ca",
+    "rules/gha031.ts": "a5c702ab22b7031eddb21406bc4e92ada4a835a27a7469b2e0db2b1c0965a9b1",
+    "rules/gha032.ts": "ee2c9da89457765671cab774ecd9de2202dbf8a6832e83f2d1678ea091596ca8",
+    "rules/gha033.ts": "0e8608c22fe9e263c867b75aa000d83583cfd1ad1fe1ef177fe9cc8dcbbf7157",
+    "rules/gha034.ts": "afce9e7d49a78d6684e6f361a76bf909b9303aef18cc284c0737252e5eaf4a46",
+    "rules/gha035.ts": "078fb87dcfc3fa902085291ff35fa1adadda77e5e261cfb6cea4cb0672150b11",
+    "rules/gha036.ts": "4dd0594d22a3318bb7140549811709814fb44641a632ca20cf8a1da674e37a0f",
+    "rules/gha037.ts": "46aa9c12e6f65d64a7bb62894427c8c22b9a994c336acecb4d179936be907287",
+    "rules/gha038.ts": "1b589319db7635927e9489e3e6590d4e41b87dc56214a8a2daab789f381497e1",
+    "rules/gha039.ts": "cad2d726386d6a36b0af3958aa9c3decc7789049b4b44003680d75f5964b1603",
+    "rules/gha040.ts": "b56203cda4519fcc0a10c7f5e07998fdd448eae6b2e884458c27a4822162fdc9",
+    "rules/gha041.ts": "030d0fba36b72dbdbfa1cd976d733f1cd29c132b79efa0842392e77d66cd54bc",
+    "rules/gha042.ts": "bdf719250ed6749712755d96a4aab4ebdd94ac468b9c132b514751dc838445c7",
+    "rules/gha043.ts": "5f2d7dc63f4de13f4ee316d2b1ce1efc52d4fa3599d47d4cd91af344cb73abc1",
+    "rules/gha044.ts": "9c80a0aed056ec11f17ae0ddff38a2c481f417352cbda55f01ab1e81825eb5b5",
+    "rules/gha045.ts": "93b0de6cb6206992674c58cdf50a734209e7eb6cc1ae84ef1b846426e9021172",
+    "rules/gha046.ts": "bb57f4b6664043c02ce20f0773dcb9e59b1134e36f50645b2c4d79aab49e7fb7",
+    "rules/gha047.ts": "26e7dd636d815c27f627cf6d51aa60fd1ce198c87b83dd6fef9d7f6929636301",
+    "rules/gha048.ts": "f26c3f95c4710621b58bee7b867cb6e83dc95edbca7cef97fdfa8034bdc322bb",
+    "rules/gha049.ts": "3d35beee07777532f4bccf940d6e34cfb541986429419d50ce75d65faf7fac70",
+    "rules/gha050.ts": "da3263efc790ce790456152ebbe900502b2516901028662e710b17c27efb8e90",
+    "rules/gha051.ts": "40ca97d7f861f2acb2af54ccd33aa3b11a53a07a7188b3023ca67c831ae73b99",
+    "rules/gha052.ts": "f7d1d44b695b02462030e209cbd7610f29fabc53eda21eca74ccbdd8f6dfa8e6",
+    "rules/gha053.ts": "a0b42e53b0b6894b6f17f4394cb9a5d864af07ca7f32dac44519dc1bc6541476",
+    "rules/gha054.ts": "daede5dbd2bb42985d48dbe1c43c2806924272e701f109f30c1e590fc52255e0",
+    "rules/gha055.ts": "fa335dcded664147a468d11c54c18393571df7efdc36d64ada029ac8994651b5",
+    "rules/gha056.ts": "73fa2eea80504522cb53db1e48b36e97ede0eeb7b60ed531a476d2f43d3746ae",
+    "rules/gha057.ts": "78e896232d6f5c3e4c1bab873eae97960dbb8a0c108f1546f32d943aafc41a91",
+    "rules/gha058.ts": "cdcb60916e3ce091b0e6c73295f24b77fca1480fb0a5907ae6d1fc5b1805f794",
+    "rules/yaml-helpers.ts": "74b430ec4810135be1e5dcd198b907c2cd179a9cc5a339041b6dab31edb4d2a0",
     "skills/chant-github.md": "f3707f09634be4bbb45a6be279f17bb27f275b98e6d3337cc8872c1623ba050f",
     "skills/chant-github-patterns.md": "bb3abef289a8fdfcf07d6bb2d7289dcb2f38bc0cb0321ea320b78b45a6f548c0",
     "skills/chant-github-security.md": "aab111cb0871cad30281ce48d7da23663689619351029219e2be019a1a61e394"
   },
-  "composite": "c22cd8e0736c58805457ba2afd209376bc095117797f7bac07145de793f0dd61"
+  "composite": "c655b1bc501ac68358351aa669e0eeca83ba58bf483d5503949bb1dad5410586"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "github",
-  "version": "0.1.23",
+  "version": "0.2.0",
   "chantVersion": ">=0.1.0",
   "namespace": "GitHub",
   "intrinsics": [

package/dist/rules/{gha020.ts → gha013.ts}

@@ -1,5 +1,5 @@
 /**
- * GHA020: Missing Job-Level Permissions for Sensitive Triggers
+ * GHA013: Missing Job-Level Permissions for Sensitive Triggers
  *
  * Flags jobs without explicit `permissions:` when the workflow uses
  * `pull_request_target` or `workflow_dispatch` triggers.
@@ -8,8 +8,8 @@
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
 import { getPrimaryOutput, extractJobs, extractTriggers } from "./yaml-helpers";
 
-export const gha020: PostSynthCheck = {
-  id: "GHA020",
+export const gha013: PostSynthCheck = {
+  id: "GHA013",
   description: "Missing job-level permissions for sensitive triggers",
 
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
@@ -25,7 +25,7 @@ export const gha020: PostSynthCheck = {
       for (const [jobName, job] of jobs) {
         if (!job.permissions) {
           diagnostics.push({
-            checkId: "GHA020",
+            checkId: "GHA013",
             severity: "warning",
             message: `Job "${jobName}" lacks explicit permissions but workflow uses a sensitive trigger. Add job-level permissions for least-privilege security.`,
             entity: jobName,

package/dist/rules/gha029.ts

@@ -0,0 +1,68 @@
+/**
+ * GHA029: Unpinned Action or Reusable-Workflow Reference
+ *
+ * Flags any `uses:` (step action or job-level reusable workflow) that is pinned
+ * to a mutable tag or branch instead of a full 40-character commit SHA. A tag
+ * can be repointed to malicious code after review, so every external reference
+ * is a supply-chain trust decision.
+ *
+ * `actions/checkout` is intentionally left to the more specific GHA021. Local
+ * references (`./`, `../`) and `docker://` images (GHA030) are out of scope.
+ * Owners in the trusted allowlist are exempt.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractActionRefs, parseActionUses } from "./yaml-helpers";
+import { TRUSTED_ACTION_OWNERS } from "../rules/data/trusted-action-owners";
+
+const SHA_RE = /^[0-9a-f]{40}$/;
+
+export interface UnpinnedRef {
+  job: string;
+  ref: string;
+  slug: string;
+}
+
+/**
+ * Find every action/reusable-workflow `uses:` that is not pinned to a commit
+ * SHA. Exposed as a pure function so the allowlist behaviour is testable.
+ */
+export function findUnpinnedActions(
+  yaml: string,
+  trustedOwners: ReadonlySet<string> = TRUSTED_ACTION_OWNERS,
+): UnpinnedRef[] {
+  const result: UnpinnedRef[] = [];
+  for (const { job, ref } of extractActionRefs(yaml)) {
+    const parsed = parseActionUses(ref);
+    if (!parsed) continue; // local or docker:// reference
+    if (parsed.slug === "actions/checkout") continue; // owned by GHA021
+    if (trustedOwners.has(parsed.owner)) continue;
+    if (SHA_RE.test(parsed.gitRef)) continue; // already pinned
+    result.push({ job, ref, slug: parsed.slug });
+  }
+  return result;
+}
+
+export const gha029: PostSynthCheck = {
+  id: "GHA029",
+  description: "Action or reusable workflow not pinned to a commit SHA",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const { job, ref } of findUnpinnedActions(yaml)) {
+        diagnostics.push({
+          checkId: "GHA029",
+          severity: "warning",
+          message: `Job "${job}" uses ${ref} pinned to a tag or branch — pin to a full commit SHA for supply-chain security.`,
+          entity: job,
+          lexicon: "github",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/gha030.ts

@@ -0,0 +1,41 @@
+/**
+ * GHA030: Container Image Without an Immutable Digest
+ *
+ * Flags job `container:` images, `services:` images, and `docker://` step
+ * references that are not pinned to an immutable `@sha256:` digest. A mutable
+ * tag (`:latest`, `:20`) can be repointed to a different image after review.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractImageRefs } from "./yaml-helpers";
+
+const SOURCE_LABEL: Record<string, string> = {
+  container: "container image",
+  service: "service image",
+  step: "docker:// image",
+};
+
+export const gha030: PostSynthCheck = {
+  id: "GHA030",
+  description: "Container image not pinned to an immutable digest",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const { job, image, source } of extractImageRefs(yaml)) {
+        if (image.includes("@sha256:")) continue;
+        diagnostics.push({
+          checkId: "GHA030",
+          severity: "warning",
+          message: `Job "${job}" ${SOURCE_LABEL[source]} "${image}" is not pinned to a digest — reference it by @sha256:... so the image cannot change after review.`,
+          entity: job,
+          lexicon: "github",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/gha031.ts

@@ -0,0 +1,77 @@
+/**
+ * GHA031: Action Reference Resembling a Well-Known Action
+ *
+ * Flags a `uses:` slug that is a near-miss (edit distance 1–2) of a popular
+ * action but not an exact match — a likely typo or a deliberate impersonation
+ * of the well-known action under different ownership. Advisory only; backed by
+ * a vendored reference list.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractActionRefs, parseActionUses } from "./yaml-helpers";
+import { KNOWN_ACTION_SLUGS } from "../rules/data/known-action-slugs";
+
+const KNOWN = new Set(KNOWN_ACTION_SLUGS);
+
+/** Levenshtein edit distance, capped: returns early once it exceeds `max`. */
+export function editDistance(a: string, b: string, max: number): number {
+  if (a === b) return 0;
+  if (Math.abs(a.length - b.length) > max) return max + 1;
+  let prev = Array.from({ length: b.length + 1 }, (_, i) => i);
+  for (let i = 1; i <= a.length; i++) {
+    const curr = [i];
+    let rowMin = i;
+    for (let j = 1; j <= b.length; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      const val = Math.min(prev[j] + 1, curr[j - 1] + 1, prev[j - 1] + cost);
+      curr.push(val);
+      if (val < rowMin) rowMin = val;
+    }
+    if (rowMin > max) return max + 1;
+    prev = curr;
+  }
+  return prev[b.length];
+}
+
+/** Find the nearest known slug within edit distance 1–2 of `slug`, if any. */
+export function nearestLookAlike(slug: string): string | undefined {
+  if (KNOWN.has(slug)) return undefined; // exact match is legitimate
+  let best: string | undefined;
+  let bestDist = 3;
+  for (const known of KNOWN) {
+    const d = editDistance(slug, known, 2);
+    if (d >= 1 && d <= 2 && d < bestDist) {
+      best = known;
+      bestDist = d;
+    }
+  }
+  return best;
+}
+
+export const gha031: PostSynthCheck = {
+  id: "GHA031",
+  description: "Action reference resembles a well-known action (possible impersonation)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const { job, ref } of extractActionRefs(yaml)) {
+        const parsed = parseActionUses(ref);
+        if (!parsed) continue;
+        const lookAlike = nearestLookAlike(parsed.slug);
+        if (!lookAlike) continue;
+        diagnostics.push({
+          checkId: "GHA031",
+          severity: "warning",
+          message: `Job "${job}" uses "${parsed.slug}", which closely resembles the well-known action "${lookAlike}". Confirm the owner is who you intend — this may be a typo or impersonation.`,
+          entity: job,
+          lexicon: "github",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/gha032.ts

@@ -0,0 +1,39 @@
+/**
+ * GHA032: Reference to an Archived or Compromised Action
+ *
+ * Flags a `uses:` slug that a vendored snapshot marks as archived/abandoned or
+ * carrying a disclosed security issue. Advisory only — the dataset is
+ * necessarily incomplete and may lag upstream changes.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractActionRefs, parseActionUses } from "./yaml-helpers";
+import { FLAGGED_ACTIONS } from "../rules/data/flagged-actions";
+
+export const gha032: PostSynthCheck = {
+  id: "GHA032",
+  description: "Action is archived/abandoned or has a disclosed security issue",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const { job, ref } of extractActionRefs(yaml)) {
+        const parsed = parseActionUses(ref);
+        if (!parsed) continue;
+        const flagged = FLAGGED_ACTIONS[parsed.slug];
+        if (!flagged) continue;
+        diagnostics.push({
+          checkId: "GHA032",
+          severity: "warning",
+          message: `Job "${job}" uses "${parsed.slug}" — ${flagged.reason}. ${flagged.remediation}.`,
+          entity: job,
+          lexicon: "github",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/gha033.ts

@@ -0,0 +1,47 @@
+/**
+ * GHA033: Blanket `write-all` Token Permissions
+ *
+ * Flags a `permissions: write-all` grant at the workflow or job level. It hands
+ * the `GITHUB_TOKEN` every write scope regardless of what the job uses, so any
+ * compromised or injected step becomes a write-capable actor across the repo.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractWorkflowPermissions, extractJobPermissions, writeSurface } from "./yaml-helpers";
+
+export const gha033: PostSynthCheck = {
+  id: "GHA033",
+  description: "Blanket write-all token permissions",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+
+      const wf = extractWorkflowPermissions(yaml);
+      if (wf && writeSurface(wf).writeAll) {
+        diagnostics.push({
+          checkId: "GHA033",
+          severity: "warning",
+          message: `Workflow declares permissions: write-all — replace it with the specific scopes the jobs actually need (least privilege).`,
+          lexicon: "github",
+        });
+      }
+
+      for (const [job, perms] of extractJobPermissions(yaml)) {
+        if (writeSurface(perms).writeAll) {
+          diagnostics.push({
+            checkId: "GHA033",
+            severity: "warning",
+            message: `Job "${job}" declares permissions: write-all — replace it with the specific scopes this job needs (least privilege).`,
+            entity: job,
+            lexicon: "github",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/gha034.ts

@@ -0,0 +1,41 @@
+/**
+ * GHA034: Workflow-Wide Write Scope (Prefer Job-Scoped Permissions)
+ *
+ * Flags individual write scopes granted at the workflow level. A workflow-wide
+ * grant gives every job that scope even when only one needs it. Least privilege
+ * prefers declaring the write scope on the single job that uses it.
+ *
+ * The `write-all` blanket preset is handled by GHA033 and skipped here.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractWorkflowPermissions, writeSurface } from "./yaml-helpers";
+
+export const gha034: PostSynthCheck = {
+  id: "GHA034",
+  description: "Write permissions granted workflow-wide instead of per-job",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+
+      const wf = extractWorkflowPermissions(yaml);
+      if (!wf) continue;
+
+      const { writeAll, scopes } = writeSurface(wf);
+      if (writeAll) continue; // GHA033 owns write-all
+      if (scopes.length === 0) continue;
+
+      diagnostics.push({
+        checkId: "GHA034",
+        severity: "warning",
+        message: `Workflow grants write scope (${scopes.join(", ")}) for all jobs — move each write scope onto the specific job that needs it for least privilege.`,
+        lexicon: "github",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/gha035.ts

@@ -0,0 +1,66 @@
+/**
+ * GHA035: Elevated Token Scope on an Untrusted-Code Trigger
+ *
+ * Raises the stakes of GHA033/GHA034: when a workflow can run untrusted code
+ * (`pull_request_target`, `workflow_run`) and also grants the token write
+ * access, an injected step runs with standing write credentials. This is the
+ * combination behind most CI privilege-escalation incidents, so it is an error.
+ *
+ * Cross-references the trust-boundary checks (GHA018 / GHA025 / GHA038).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import {
+  getPrimaryOutput,
+  extractTriggers,
+  extractWorkflowPermissions,
+  extractJobPermissions,
+  writeSurface,
+  grantsWrite,
+} from "./yaml-helpers";
+
+const UNTRUSTED_TRIGGERS = ["pull_request_target", "workflow_run"];
+
+function describeWrite(perms: ReturnType<typeof writeSurface>): string {
+  return perms.writeAll ? "write-all" : perms.scopes.map((s) => `${s}: write`).join(", ");
+}
+
+export const gha035: PostSynthCheck = {
+  id: "GHA035",
+  description: "Elevated token scope on a trigger that can run untrusted code",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      const triggers = extractTriggers(yaml);
+      const untrusted = UNTRUSTED_TRIGGERS.filter((t) => triggers[t]);
+      if (untrusted.length === 0) continue;
+
+      const wf = extractWorkflowPermissions(yaml);
+      if (wf && grantsWrite(wf)) {
+        diagnostics.push({
+          checkId: "GHA035",
+          severity: "error",
+          message: `Workflow grants write token scope (${describeWrite(writeSurface(wf))}) while using the ${untrusted.join("/")} trigger, which can run untrusted code. Drop write scope or gate the privileged work behind a separate trusted workflow.`,
+          lexicon: "github",
+        });
+      }
+
+      for (const [job, perms] of extractJobPermissions(yaml)) {
+        if (grantsWrite(perms)) {
+          diagnostics.push({
+            checkId: "GHA035",
+            severity: "error",
+            message: `Job "${job}" grants write token scope (${describeWrite(writeSurface(perms))}) while the workflow uses the ${untrusted.join("/")} trigger, which can run untrusted code. Drop write scope or isolate the privileged work.`,
+            entity: job,
+            lexicon: "github",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/gha036.ts

@@ -0,0 +1,42 @@
+/**
+ * GHA036: Untrusted Input Interpolated into a Shell Command
+ *
+ * Flags attacker-controllable expression contexts (PR titles, branch names,
+ * issue/comment bodies, commit messages) interpolated directly into a `run:`
+ * script. The value is expanded into the shell before the script runs, so a
+ * crafted payload becomes command execution. Pass untrusted input through an
+ * `env:` variable and reference it quoted instead.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractRunBlocks, extractExpressions } from "./yaml-helpers";
+import { matchUntrustedContext } from "../rules/data/untrusted-contexts";
+
+export const gha036: PostSynthCheck = {
+  id: "GHA036",
+  description: "Untrusted input interpolated into a run: shell command",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const { job, run } of extractRunBlocks(yaml)) {
+        for (const expr of extractExpressions(run)) {
+          const ctxName = matchUntrustedContext(expr);
+          if (!ctxName) continue;
+          diagnostics.push({
+            checkId: "GHA036",
+            severity: "error",
+            message: `Job "${job}" interpolates untrusted input \${{ ${ctxName} ... }} into a run: script — this is a script-injection sink. Pass it through an env: variable and reference "$VAR" quoted instead.`,
+            entity: job,
+            lexicon: "github",
+          });
+          break; // one diagnostic per run block is enough
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/gha037.ts

@@ -0,0 +1,46 @@
+/**
+ * GHA037: Untrusted Input Written to GITHUB_ENV / GITHUB_PATH
+ *
+ * Flags a `run:` step that writes attacker-controllable input into the
+ * `$GITHUB_ENV` or `$GITHUB_PATH` files. Those files set environment variables
+ * and PATH entries for *later* steps, so injecting into them escalates a data
+ * value into influence over subsequent privileged steps (a known path to
+ * `LD_PRELOAD`/`NODE_OPTIONS`-style takeover).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractRunBlocks, extractExpressions } from "./yaml-helpers";
+import { matchUntrustedContext } from "../rules/data/untrusted-contexts";
+
+const ENV_FILE_RE = /GITHUB_ENV|GITHUB_PATH/;
+
+export const gha037: PostSynthCheck = {
+  id: "GHA037",
+  description: "Untrusted input written to GITHUB_ENV / GITHUB_PATH",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const { job, run } of extractRunBlocks(yaml)) {
+        if (!ENV_FILE_RE.test(run)) continue;
+        for (const expr of extractExpressions(run)) {
+          const ctxName = matchUntrustedContext(expr);
+          if (!ctxName) continue;
+          const file = run.includes("GITHUB_PATH") ? "GITHUB_PATH" : "GITHUB_ENV";
+          diagnostics.push({
+            checkId: "GHA037",
+            severity: "error",
+            message: `Job "${job}" writes untrusted input \${{ ${ctxName} ... }} into $${file}, which sets state for later steps. Sanitize/validate the value or avoid persisting untrusted input across steps.`,
+            entity: job,
+            lexicon: "github",
+          });
+          break;
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/gha038.ts

@@ -0,0 +1,41 @@
+/**
+ * GHA038: Privileged `workflow_run` Trigger Checking Out Untrusted Code
+ *
+ * Generalizes GHA018 (pull_request_target + checkout) to the other privileged
+ * trigger that runs in the base-repo context: `workflow_run`. A `workflow_run`
+ * workflow has repo write scope and secrets, and checking out the artifact/head
+ * of the triggering run pulls untrusted code into that privileged context.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractTriggers, extractJobs, hasCheckoutAction } from "./yaml-helpers";
+
+export const gha038: PostSynthCheck = {
+  id: "GHA038",
+  description: "workflow_run trigger with checkout runs untrusted code in a privileged context",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      const triggers = extractTriggers(yaml);
+      if (!triggers["workflow_run"]) continue;
+
+      const jobs = extractJobs(yaml);
+      for (const [jobName, job] of jobs) {
+        if (job.steps && hasCheckoutAction(job.steps)) {
+          diagnostics.push({
+            checkId: "GHA038",
+            severity: "warning",
+            message: `Job "${jobName}" checks out code under a workflow_run trigger, which runs with repo write scope and secrets. Treat the checked-out code as untrusted — avoid executing it, or move execution to an unprivileged workflow.`,
+            entity: jobName,
+            lexicon: "github",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/gha039.ts

@@ -0,0 +1,41 @@
+/**
+ * GHA039: Spoofable Identity Used as an Authorization Gate
+ *
+ * Flags an `if:` condition that gates execution on a commit-author identity
+ * field (`...author.name` / `...author.email`). Those values come straight from
+ * git metadata the committer sets freely, so an attacker can forge them to pass
+ * the gate. Use a trustworthy signal — environment protection rules, CODEOWNERS,
+ * or membership checks against a verified actor.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractIfConditions } from "./yaml-helpers";
+
+const SPOOFABLE_FIELD_RE = /\.author\.(name|email)\b/;
+const COMPARISON_RE = /==|!=|contains\s*\(/;
+
+export const gha039: PostSynthCheck = {
+  id: "GHA039",
+  description: "Authorization gate on a spoofable commit-author identity field",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const { job, expr } of extractIfConditions(yaml)) {
+        if (SPOOFABLE_FIELD_RE.test(expr) && COMPARISON_RE.test(expr)) {
+          diagnostics.push({
+            checkId: "GHA039",
+            severity: "warning",
+            message: `Job "${job}" gates on a commit-author identity field in an if: condition (${expr}). Author name/email are attacker-controlled and can be spoofed — gate on a verified signal (environment protection, CODEOWNERS, verified actor) instead.`,
+            entity: job,
+            lexicon: "github",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};