@intentius/chant-lexicon-github 0.1.23 → 0.3.0

package/dist/rules/gha040.ts

@@ -0,0 +1,43 @@
+/**
+ * GHA040: Self-Hosted Runner on a Trigger That Can Run Untrusted Code
+ *
+ * Flags a job that runs on a self-hosted runner under a trigger reachable by a
+ * fork or outside contributor (`pull_request`, `pull_request_target`,
+ * `workflow_run`). Self-hosted runners are non-ephemeral by default and share a
+ * host, so untrusted code can persist on the runner and compromise later jobs.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractTriggers, extractRunsOnByJob } from "./yaml-helpers";
+
+const UNTRUSTED_TRIGGERS = ["pull_request", "pull_request_target", "workflow_run"];
+
+export const gha040: PostSynthCheck = {
+  id: "GHA040",
+  description: "Self-hosted runner on a trigger that can run untrusted code",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      const triggers = extractTriggers(yaml);
+      const untrusted = UNTRUSTED_TRIGGERS.filter((t) => triggers[t]);
+      if (untrusted.length === 0) continue;
+
+      for (const [job, labels] of extractRunsOnByJob(yaml)) {
+        if (labels.some((l) => l === "self-hosted")) {
+          diagnostics.push({
+            checkId: "GHA040",
+            severity: "warning",
+            message: `Job "${job}" runs on a self-hosted runner under the ${untrusted.join("/")} trigger, which a fork can reach. Use ephemeral GitHub-hosted runners for untrusted code, or require approval before the job runs.`,
+            entity: job,
+            lexicon: "github",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/gha041.ts

@@ -0,0 +1,38 @@
+/**
+ * GHA041: Blanket `secrets: inherit` into a Reusable Workflow
+ *
+ * Flags a reusable-workflow call that passes `secrets: inherit`. Inheritance
+ * hands the called workflow every secret the caller can see, regardless of what
+ * it needs. Pass through only the specific secrets the reusable workflow uses.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, jobLines } from "./yaml-helpers";
+
+export const gha041: PostSynthCheck = {
+  id: "GHA041",
+  description: "Blanket secrets: inherit into a reusable workflow",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      const seen = new Set<string>();
+      for (const { job, line } of jobLines(yaml)) {
+        if (/^\s+secrets:\s*inherit\s*$/.test(line) && !seen.has(job)) {
+          seen.add(job);
+          diagnostics.push({
+            checkId: "GHA041",
+            severity: "warning",
+            message: `Job "${job}" calls a reusable workflow with secrets: inherit, passing every caller secret. Pass through only the specific secrets it needs.`,
+            entity: job,
+            lexicon: "github",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/gha042.ts

@@ -0,0 +1,40 @@
+/**
+ * GHA042: Whole Secrets Context Passed Where Specific Secrets Would Do
+ *
+ * Flags `toJSON(secrets)` (serializing the entire secrets context) passed into
+ * a step's `with:`/`env:` or to a reusable workflow. It hands the consumer every
+ * secret instead of the one or two it needs. Reference specific secrets.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, jobLines } from "./yaml-helpers";
+
+const TO_JSON_SECRETS = /to_?json\s*\(\s*secrets\s*\)/i;
+
+export const gha042: PostSynthCheck = {
+  id: "GHA042",
+  description: "Entire secrets context passed where specific secrets would do",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      const seen = new Set<string>();
+      for (const { job, line } of jobLines(yaml)) {
+        if (TO_JSON_SECRETS.test(line) && !seen.has(job)) {
+          seen.add(job);
+          diagnostics.push({
+            checkId: "GHA042",
+            severity: "warning",
+            message: `Job "${job}" passes the entire secrets context via toJSON(secrets). Reference only the specific secrets the consumer needs.`,
+            entity: job,
+            lexicon: "github",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/gha043.ts

@@ -0,0 +1,41 @@
+/**
+ * GHA043: Secret Consumed in a Job Without an Environment Gate
+ *
+ * Extends GHA026 (which fires only when a workflow uses secrets and defines no
+ * environment at all). When a workflow *does* gate some jobs with an
+ * `environment:`, this flags the specific jobs that consume secrets without one
+ * — the inconsistent-gating case, where a secret-using job skips the approval
+ * and scoping the author applied elsewhere.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, jobsReferencingSecrets, extractJobEnvironments } from "./yaml-helpers";
+
+export const gha043: PostSynthCheck = {
+  id: "GHA043",
+  description: "Secret consumed in a job without an environment gate",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      const gated = extractJobEnvironments(yaml);
+      if (gated.size === 0) continue; // no environments used anywhere — GHA026 territory
+
+      for (const job of jobsReferencingSecrets(yaml)) {
+        if (!gated.has(job)) {
+          diagnostics.push({
+            checkId: "GHA043",
+            severity: "warning",
+            message: `Job "${job}" consumes a secret but declares no environment:, while other jobs in this workflow are environment-gated. Gate this job too, or confirm it should bypass the approval/scoping the others use.`,
+            entity: job,
+            lexicon: "github",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/gha044.ts

@@ -0,0 +1,41 @@
+/**
+ * GHA044: Hardcoded Registry / Container Credential
+ *
+ * Flags a `password:` / `token:` / `registry-password:` value that is a literal
+ * rather than a `${{ secrets.* }}` reference — e.g. a registry login or service
+ * credential inlined in plain text. Move it into a secret.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, jobLines } from "./yaml-helpers";
+
+const CRED_KEY_RE = /^\s+(?:- )?(password|token|registry-password):\s*(.+)$/;
+
+export const gha044: PostSynthCheck = {
+  id: "GHA044",
+  description: "Hardcoded registry/container credential",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const { job, line } of jobLines(yaml)) {
+        const m = line.match(CRED_KEY_RE);
+        if (!m) continue;
+        const key = m[1];
+        const value = m[2].trim().replace(/^['"]|['"]$/g, "");
+        if (value === "" || value.includes("${{")) continue; // empty or a proper expression
+        diagnostics.push({
+          checkId: "GHA044",
+          severity: "error",
+          message: `Job "${job}" sets ${key}: to a hardcoded literal. Reference a secret (\${{ secrets.NAME }}) instead of inlining the credential.`,
+          entity: job,
+          lexicon: "github",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/gha045.ts

@@ -0,0 +1,38 @@
+/**
+ * GHA045: Secret Interpolated Directly into a Shell Command
+ *
+ * Flags `${{ secrets.* }}` expanded straight into a `run:` script. The value is
+ * substituted into the command line before the shell runs, where a transform
+ * (base64, reversing, splitting) can defeat GitHub's log masking and leak it,
+ * and the raw value is exposed to argument-injection. Pass secrets through an
+ * `env:` variable and reference "$VAR" quoted instead.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractRunBlocks, extractExpressions } from "./yaml-helpers";
+
+export const gha045: PostSynthCheck = {
+  id: "GHA045",
+  description: "Secret interpolated directly into a run: shell command",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const { job, run } of extractRunBlocks(yaml)) {
+        const leaked = extractExpressions(run).some((e) => /\bsecrets\./.test(e));
+        if (!leaked) continue;
+        diagnostics.push({
+          checkId: "GHA045",
+          severity: "warning",
+          message: `Job "${job}" interpolates a secret directly into a run: script, where a transform can defeat log masking. Pass it through an env: variable and reference "$VAR" quoted instead.`,
+          entity: job,
+          lexicon: "github",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/gha046.ts

@@ -0,0 +1,56 @@
+/**
+ * GHA046: Logically Unsound Guard Condition
+ *
+ * Flags an `if:` condition that reads like a security/flow gate but evaluates to
+ * a constant — `true`/`false` literals, an `X == X` tautology, or an expression
+ * that collapses via `|| true` / `&& false`. These pass review by looking like a
+ * control while gating nothing (or everything).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractIfConditions } from "./yaml-helpers";
+
+/** Strip a leading `${{` / trailing `}}` wrapper from an expression. */
+function inner(expr: string): string {
+  return expr.replace(/^\$\{\{/, "").replace(/\}\}$/, "").trim();
+}
+
+/** Classify a condition as a constant guard, returning a reason or undefined. */
+export function unsoundReason(expr: string): string | undefined {
+  const e = inner(expr);
+  if (e === "true") return "always true (true literal)";
+  if (e === "false") return "always false (false literal)";
+  if (/\|\|\s*true\b/.test(e)) return "always true (|| true collapses the condition)";
+  if (/&&\s*false\b/.test(e)) return "always false (&& false collapses the condition)";
+  const eq = e.match(/^([\w.$'"[\]-]+)\s*==\s*([\w.$'"[\]-]+)$/);
+  if (eq && eq[1] === eq[2]) return "always true (both sides of == are identical)";
+  const ne = e.match(/^([\w.$'"[\]-]+)\s*!=\s*([\w.$'"[\]-]+)$/);
+  if (ne && ne[1] === ne[2]) return "always false (both sides of != are identical)";
+  return undefined;
+}
+
+export const gha046: PostSynthCheck = {
+  id: "GHA046",
+  description: "Logically unsound (constant) guard condition",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const { job, expr } of extractIfConditions(yaml)) {
+        const reason = unsoundReason(expr);
+        if (!reason) continue;
+        diagnostics.push({
+          checkId: "GHA046",
+          severity: "warning",
+          message: `Job "${job}" has an if: condition that is ${reason}: "${expr}". A gate that does not constrain anything is misleading — remove it or write the real condition.`,
+          entity: job,
+          lexicon: "github",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/gha047.ts

@@ -0,0 +1,51 @@
+/**
+ * GHA047: Ineffective `contains()` Guard (Reversed Arguments)
+ *
+ * Flags `contains('literal', <dynamic>)` — a string literal as the haystack and
+ * a dynamic value as the needle. `contains(search, item)` checks whether `item`
+ * is in `search`, so a constant first argument makes the result depend on a
+ * fixed string rather than the runtime value the author intended to test. The
+ * usual fix is to swap the arguments.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractIfConditions } from "./yaml-helpers";
+
+// contains( 'literal' | "literal" , <something that is not a literal> )
+const REVERSED_CONTAINS = /contains\(\s*(['"][^'"]*['"])\s*,\s*([^)]+)\)/g;
+
+function isLiteral(arg: string): boolean {
+  const t = arg.trim();
+  return (t.startsWith("'") && t.endsWith("'")) || (t.startsWith('"') && t.endsWith('"'));
+}
+
+export const gha047: PostSynthCheck = {
+  id: "GHA047",
+  description: "Ineffective contains() guard with reversed arguments",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const { job, expr } of extractIfConditions(yaml)) {
+        let m: RegExpExecArray | null;
+        REVERSED_CONTAINS.lastIndex = 0;
+        while ((m = REVERSED_CONTAINS.exec(expr)) !== null) {
+          // First arg is a literal; flag only when the second arg is dynamic.
+          if (isLiteral(m[2])) continue;
+          diagnostics.push({
+            checkId: "GHA047",
+            severity: "warning",
+            message: `Job "${job}" calls contains() with a string-literal haystack and a dynamic needle: "${m[0]}". contains(search, item) tests whether item is in search — swap the arguments so the dynamic value is searched.`,
+            entity: job,
+            lexicon: "github",
+          });
+          break;
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/gha048.ts

@@ -0,0 +1,41 @@
+/**
+ * GHA048: Obfuscated Guard Condition
+ *
+ * Flags an `if:` condition that builds its compared value through string
+ * indirection — `format()`, `join()`, or `fromJSON()` feeding a comparison.
+ * Constructing the operand at evaluation time hides what the gate actually
+ * checks, which is how an unsound condition (GHA046/GHA047) is disguised to pass
+ * review. Write the comparison against the value directly.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractIfConditions } from "./yaml-helpers";
+
+const INDIRECTION = /\b(format|join|fromJSON)\s*\(/i;
+const COMPARISON = /==|!=|&&|\|\||contains\(|startsWith\(|endsWith\(/;
+
+export const gha048: PostSynthCheck = {
+  id: "GHA048",
+  description: "Obfuscated guard condition (operand built by indirection)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const { job, expr } of extractIfConditions(yaml)) {
+        if (INDIRECTION.test(expr) && COMPARISON.test(expr)) {
+          diagnostics.push({
+            checkId: "GHA048",
+            severity: "warning",
+            message: `Job "${job}" builds its if: gate through string indirection (format/join/fromJSON) feeding a comparison: "${expr}". Compare against the value directly so the condition is auditable.`,
+            entity: job,
+            lexicon: "github",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/gha049.ts

@@ -0,0 +1,42 @@
+/**
+ * GHA049: Persisted Checkout Credentials Reachable by an Uploaded Artifact
+ *
+ * `actions/checkout` writes the job token into `.git/config` by default
+ * (`persist-credentials: true`). A job that also uploads an artifact can sweep
+ * that `.git` directory into the artifact, leaking the token to anyone who can
+ * download it. Set `persist-credentials: false` on the checkout when the job
+ * uploads artifacts.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, linesByJob } from "./yaml-helpers";
+
+export const gha049: PostSynthCheck = {
+  id: "GHA049",
+  description: "Persisted checkout credentials reachable by an uploaded artifact",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const [job, lines] of linesByJob(yaml)) {
+        const text = lines.join("\n");
+        const hasCheckout = /uses:\s*actions\/checkout/.test(text);
+        const persistDisabled = /persist-credentials:\s*false/.test(text);
+        const uploadsArtifact = /uses:\s*actions\/upload-artifact/.test(text);
+        if (hasCheckout && uploadsArtifact && !persistDisabled) {
+          diagnostics.push({
+            checkId: "GHA049",
+            severity: "warning",
+            message: `Job "${job}" checks out with persisted credentials (default) and uploads an artifact — the token in .git/config can leak into the artifact. Set persist-credentials: false on the checkout.`,
+            entity: job,
+            lexicon: "github",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/gha050.ts

@@ -0,0 +1,44 @@
+/**
+ * GHA050: Cache Populated in a Privileged Context (Poisoning Risk)
+ *
+ * Flags `actions/cache` use under a privileged trigger (`pull_request_target`,
+ * `workflow_run`) that runs in the base-repo context. Cache entries written from
+ * code influenced by a fork can later be restored by a trusted run and executed,
+ * a cache-poisoning path. Restrict caching to trusted triggers or scope keys so
+ * untrusted runs cannot write entries a privileged run will restore.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractTriggers, linesByJob } from "./yaml-helpers";
+
+const PRIVILEGED_TRIGGERS = ["pull_request_target", "workflow_run"];
+
+export const gha050: PostSynthCheck = {
+  id: "GHA050",
+  description: "Cache populated in a privileged context (poisoning risk)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      const triggers = extractTriggers(yaml);
+      const privileged = PRIVILEGED_TRIGGERS.filter((t) => triggers[t]);
+      if (privileged.length === 0) continue;
+
+      for (const [job, lines] of linesByJob(yaml)) {
+        if (lines.some((l) => /uses:\s*actions\/cache/.test(l))) {
+          diagnostics.push({
+            checkId: "GHA050",
+            severity: "warning",
+            message: `Job "${job}" populates a cache under the ${privileged.join("/")} trigger, which runs in the privileged base context. A poisoned cache entry could be restored and executed by a trusted run — restrict caching to trusted triggers.`,
+            entity: job,
+            lexicon: "github",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/gha051.ts

@@ -0,0 +1,45 @@
+/**
+ * GHA051: Publish/Release Step Using a Long-Lived Token Instead of OIDC
+ *
+ * Flags a job that publishes a release/package using a long-lived token secret
+ * (`*_TOKEN`, `*_PASSWORD`, `*_API_KEY`) while the workflow requests no
+ * `id-token: write` permission. Registries that support OIDC let a workflow mint
+ * a short-lived, audience-scoped credential per run instead of holding a
+ * standing secret. Advisory — not every registry supports OIDC.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, linesByJob } from "./yaml-helpers";
+
+const PUBLISH_RE = /npm publish|yarn publish|pnpm publish|twine upload|poetry publish|cargo publish|gh release create|docker push|gh-action-pypi-publish|npm-publish/;
+const LONG_LIVED_SECRET_RE = /secrets\.(?!GITHUB_TOKEN\b)\w*(TOKEN|PASSWORD|API_KEY|APIKEY)/i;
+
+export const gha051: PostSynthCheck = {
+  id: "GHA051",
+  description: "Publish/release step using a long-lived token instead of OIDC",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      const requestsOidc = /id-token:\s*write/.test(yaml);
+      if (requestsOidc) continue;
+
+      for (const [job, lines] of linesByJob(yaml)) {
+        const text = lines.join("\n");
+        if (PUBLISH_RE.test(text) && LONG_LIVED_SECRET_RE.test(text)) {
+          diagnostics.push({
+            checkId: "GHA051",
+            severity: "info",
+            message: `Job "${job}" publishes using a long-lived token secret and requests no id-token: write. If the registry supports OIDC, mint a short-lived federated credential (permissions: id-token: write) instead of holding a standing token.`,
+            entity: job,
+            lexicon: "github",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/gha052.ts

@@ -0,0 +1,42 @@
+/**
+ * GHA052: Software Fetched and Executed at Runtime Without Verification
+ *
+ * Flags a `run:` step that pipes a network download straight into a shell
+ * (`curl ... | bash`, `wget ... | sh`, `iwr ... | iex`). The fetched script is
+ * unpinned and unverified, so whoever controls the URL controls what executes
+ * in the job. Download to a file, verify a checksum/signature, then run it.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractRunBlocks } from "./yaml-helpers";
+
+const PIPE_TO_SHELL = [
+  /\b(curl|wget)\b[^\n|]*\|\s*(sudo\s+)?(ba)?sh\b/i,
+  /\b(iwr|invoke-webrequest|irm|invoke-restmethod)\b[^\n|]*\|\s*(iex|invoke-expression)\b/i,
+];
+
+export const gha052: PostSynthCheck = {
+  id: "GHA052",
+  description: "Software fetched and piped to a shell without verification",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const { job, run } of extractRunBlocks(yaml)) {
+        if (PIPE_TO_SHELL.some((re) => re.test(run))) {
+          diagnostics.push({
+            checkId: "GHA052",
+            severity: "warning",
+            message: `Job "${job}" pipes a network download directly into a shell — the fetched code is unpinned and unverified. Download to a file, verify a checksum or signature, then execute it.`,
+            entity: job,
+            lexicon: "github",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/gha053.ts

@@ -0,0 +1,41 @@
+/**
+ * GHA053: Re-enabling Unsafe Workflow-Command Processing
+ *
+ * Flags opt-ins that reintroduce the `set-env` / `add-path` workflow commands
+ * removed for security (CVE-2020-15228) — `ACTIONS_ALLOW_UNSECURE_COMMANDS` and
+ * direct `::set-env::` / `::add-path::` emission. These let a logged string set
+ * arbitrary environment/PATH state for later steps, a code-execution path.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, linesByJob } from "./yaml-helpers";
+
+const UNSAFE_COMMANDS = /ACTIONS_ALLOW_UNSECURE_COMMANDS|::set-env\s|::add-path\s/;
+
+export const gha053: PostSynthCheck = {
+  id: "GHA053",
+  description: "Re-enables unsafe set-env / add-path workflow commands",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      const seen = new Set<string>();
+      for (const [job, lines] of linesByJob(yaml)) {
+        if (lines.some((l) => UNSAFE_COMMANDS.test(l)) && !seen.has(job)) {
+          seen.add(job);
+          diagnostics.push({
+            checkId: "GHA053",
+            severity: "error",
+            message: `Job "${job}" re-enables the unsafe set-env/add-path workflow commands (ACTIONS_ALLOW_UNSECURE_COMMANDS or ::set-env::/::add-path::). Use $GITHUB_ENV / $GITHUB_PATH files instead — the legacy commands were removed for security.`,
+            entity: job,
+            lexicon: "github",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/gha054.ts

@@ -0,0 +1,41 @@
+/**
+ * GHA054: Use of a Feature with a Known Security Footgun
+ *
+ * Catch-all, data-driven check: flags emitted workflow content matching a
+ * vendored snapshot of known-risky GitHub Actions features (deprecated workflow
+ * commands, unsafe runtime opt-ins, masking footguns). Advisory; the dataset is
+ * necessarily incomplete.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, linesByJob } from "./yaml-helpers";
+import { RISKY_FEATURES } from "../rules/data/risky-features";
+
+export const gha054: PostSynthCheck = {
+  id: "GHA054",
+  description: "Use of a feature with a known security footgun",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const [job, lines] of linesByJob(yaml)) {
+        const text = lines.join("\n");
+        for (const feature of RISKY_FEATURES) {
+          if (feature.pattern.test(text)) {
+            diagnostics.push({
+              checkId: "GHA054",
+              severity: "warning",
+              message: `Job "${job}" uses ${feature.label} — ${feature.advice}.`,
+              entity: job,
+              lexicon: "github",
+            });
+          }
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};