@intentius/chant-lexicon-github 0.1.23 → 0.3.0

package/src/codegen/docs.ts

@@ -25,7 +25,7 @@ npm install --save-dev @intentius/chant-lexicon-github
 
 {{file:docs-snippets/src/quickstart.ts}}
 
-The lexicon provides **2 resources** (Workflow, Job), **13 composites** (Checkout, SetupNode, SetupGo, SetupPython, CacheAction, UploadArtifact, DownloadArtifact, NodeCI, NodePipeline, PythonCI, DockerBuild, DeployEnvironment, GoCI) + **3 presets** (BunPipeline, PnpmPipeline, YarnPipeline), a typed **Expression** system with 24 GitHub and 5 Runner context variables, and **13 lint rules** + **6 post-synth checks**.
+The lexicon provides **3 resources** (Workflow, Job, Dependabot config), **14 composites** (Checkout, SetupNode, SetupGo, SetupPython, CacheAction, UploadArtifact, DownloadArtifact, NodeCI, NodePipeline, PythonCI, DockerBuild, DeployEnvironment, GoCI, Dependabot) + **3 presets** (BunPipeline, PnpmPipeline, YarnPipeline), a typed **Expression** system with 24 GitHub and 5 Runner context variables, and **13 lint rules** + **45 post-synth checks** (including a CI/CD supply-chain security pass, GHA029–058).
 `;
 
 const outputFormat = `The GitHub Actions lexicon serializes resources into **\`.github/workflows/*.yml\`** YAML files.
@@ -184,7 +184,7 @@ GitHub automatically picks up any \`.github/workflows/*.yml\` files and runs the
 - [Workflow Concepts](/chant/lexicons/github/workflow-concepts/) — resource types, triggers, permissions
 - [Expressions](/chant/lexicons/github/expressions/) — typed expression system and condition helpers
 - [Composites](/chant/lexicons/github/composites/) — pre-built action wrappers (Checkout, SetupNode, etc.)
-- [Lint Rules](/chant/lexicons/github/lint-rules/) — 13 lint rules and 6 post-synth checks`,
+- [Lint Rules](/chant/lexicons/github/lint-rules/) — 13 lint rules and 45 post-synth checks`,
       },
       {
         slug: "workflow-concepts",
@@ -838,7 +838,27 @@ const { workflow, buildJob, testJob, lintJob } = GoCI({
 const noLint = GoCI({ lintCommand: null });
 \`\`\`
 
-**Props:** \`goVersion?\`, \`testCommand?\`, \`buildCommand?\`, \`lintCommand?\` (null to omit), \`runsOn?\``,
+**Props:** \`goVersion?\`, \`testCommand?\`, \`buildCommand?\`, \`lintCommand?\` (null to omit), \`runsOn?\`
+
+## Dependabot
+
+Models the repository's dependency-update configuration (\`.github/dependabot.yml\`) as a chant resource, so it is emitted and lintable like a workflow. The composite ships **safe defaults**: a cooldown window on every ecosystem (so a version published moments ago — including a compromised one — is not adopted before anyone can react) and external code execution explicitly denied.
+
+\`\`\`typescript
+import { Dependabot } from "@intentius/chant-lexicon-github";
+
+export const dependabot = Dependabot({
+  ecosystems: [
+    { packageEcosystem: "npm", directory: "/" },
+    { packageEcosystem: "github-actions", directory: "/" },
+  ],
+  // cooldownDays defaults to 7, openPullRequestsLimit to 5
+});
+\`\`\`
+
+**Props:** \`ecosystems\` (required — each \`{ packageEcosystem, directory?, interval? }\`), \`cooldownDays?\` (default 7), \`openPullRequestsLimit?\` (default 5)
+
+For full control, construct the \`DependabotConfig\` resource directly with raw \`updates:\` entries. Two post-synth checks validate the emitted config: **GHA057** (\`insecure-external-code-execution: allow\`) and **GHA058** (no cooldown). See [Lint Rules](/chant/lexicons/github/lint-rules/).`,
       },
       {
         slug: "lint-rules",
@@ -952,6 +972,12 @@ Flags matrix strategy dimensions with an empty values array. An empty dimension
 
 Flags jobs whose \`needs:\` entries reference a job not defined in the workflow. This causes a workflow validation error on GitHub.
 
+### GHA013 — Missing job-level permissions for sensitive triggers
+
+**Severity:** warning
+
+Flags jobs without an explicit \`permissions:\` block when the workflow uses a sensitive trigger (\`pull_request_target\` or \`workflow_dispatch\`). Declaring job-level permissions keeps least-privilege scope on workflows that run with elevated context.
+
 ### GHA017 — Missing permissions block
 
 **Severity:** info
@@ -970,6 +996,242 @@ Flags workflows triggered by \`pull_request_target\` that include \`actions/chec
 
 Detects cycles in the \`needs:\` dependency graph. If job A needs B and B needs A (directly or transitively), GitHub rejects the workflow. Reports the full cycle chain in the diagnostic message.
 
+### GHA021 — Checkout action not pinned to a SHA
+
+**Severity:** warning
+
+Flags \`actions/checkout\` referenced by a tag (e.g. \`@v4\`) instead of a pinned commit SHA. The narrower precursor to GHA029, kept because checkout is the most common unpinned action.
+
+### GHA022 — Job without timeout-minutes
+
+**Severity:** info
+
+Flags jobs that omit \`timeout-minutes\`. A hung step otherwise runs to the runner's default cap, burning minutes — set an explicit ceiling.
+
+### GHA023 — Deprecated set-output command
+
+**Severity:** warning
+
+Flags \`::set-output\` in \`run:\` steps. The workflow command is deprecated and disabled on current runners — write to \`$GITHUB_OUTPUT\` instead.
+
+### GHA024 — Missing concurrency for deploy workflows
+
+**Severity:** info
+
+Flags deploy workflows without a \`concurrency:\` block. Without one, two pushes can deploy concurrently and race — add a concurrency group to serialize them.
+
+### GHA025 — pull_request_target without restrictions
+
+**Severity:** warning
+
+Flags \`pull_request_target\` used without a \`types:\` filter. The trigger runs with repository secrets in the base-branch context, so it should be scoped to the specific PR events that need it.
+
+### GHA026 — Secret used without environment protection
+
+**Severity:** info
+
+Flags workflows that reference \`secrets.\` in steps but declare no \`environment:\` on any job, so the secret skips the approval and scoping rules an environment gate provides.
+
+### GHA027 — Cleanup step missing if: always()
+
+**Severity:** info
+
+Flags steps named "cleanup" / "teardown" / "clean up" that lack an \`if:\` condition. Cleanup should run even when a prior step fails — add \`if: always()\`.
+
+### GHA028 — Workflow with no on: triggers
+
+**Severity:** error
+
+Flags a workflow file with no top-level \`on:\` key. Without a trigger the workflow can never run.
+
+## Supply-chain security pass (GHA029–058)
+
+GHA029 onward are a CI/CD supply-chain security pass: pin & vet external references, enforce least-privilege token scopes, guard trust boundaries against untrusted input, contain secrets, reject unsound expressions, and keep artifacts/caches honest. They run statically on the emitted YAML — everything answerable without leaving the build.
+
+The checks that need a *moving external truth* — whether a pinned SHA still maps to a real upstream tag, whether a ref still exists, whether a new advisory now covers an action in use — can't be deterministic, so they live in the operational layer instead. Schedule the [\`WorkflowAuditOp\`](/chant/guide/ops/#audit-supply-chain-drift) (temporal lexicon) for that live, always-fresh half; it reads the same emitted workflow references and reports drift via \`report | issue | pull-request\`.
+
+### GHA029 — Action or reusable workflow not pinned to a commit SHA
+
+**Severity:** warning
+
+Flags any \`uses:\` — step action or job-level reusable workflow — pinned to a mutable tag or branch instead of a full commit SHA. Tags can be repointed to malicious code after review, so every external reference should be pinned. \`actions/checkout\` is covered by the more specific GHA021; local (\`./\`) and \`docker://\` references are out of scope. Owners in the vendored trusted allowlist are exempt.
+
+### GHA030 — Container image not pinned to a digest
+
+**Severity:** warning
+
+Flags job \`container:\` images, \`services:\` images, and \`docker://\` step references that are not pinned to an immutable \`@sha256:\` digest. A mutable tag can be repointed to a different image after review.
+
+### GHA031 — Action resembles a well-known action
+
+**Severity:** warning
+
+Flags a \`uses:\` slug that is a near-miss (edit distance 1–2) of a popular action but not an exact match — a likely typo or impersonation under different ownership. Advisory; backed by a vendored reference list.
+
+### GHA032 — Archived or compromised action
+
+**Severity:** warning
+
+Flags a \`uses:\` slug that a vendored snapshot marks as archived/abandoned or carrying a disclosed security issue, with remediation. Advisory and necessarily incomplete.
+
+### GHA033 — Blanket write-all permissions
+
+**Severity:** warning
+
+Flags \`permissions: write-all\` at the workflow or job level. It grants the \`GITHUB_TOKEN\` every write scope regardless of need — replace it with the specific scopes the job uses.
+
+### GHA034 — Write permissions granted workflow-wide
+
+**Severity:** warning
+
+Flags individual write scopes declared at the workflow level, which apply to every job even when only one needs them. Move each write scope onto the specific job that uses it. (The \`write-all\` preset is covered by GHA033.)
+
+### GHA035 — Elevated scope on an untrusted-code trigger
+
+**Severity:** error
+
+Flags a workflow that grants the token write access while using a trigger that can run untrusted code (\`pull_request_target\`, \`workflow_run\`). An injected step would run with standing write credentials — drop the write scope or isolate the privileged work in a separate trusted workflow.
+
+### GHA036 — Untrusted input in a run: command
+
+**Severity:** error
+
+Flags an attacker-controllable expression context (PR title, branch name, issue/comment body, commit message) interpolated directly into a \`run:\` script — a script-injection sink. Pass the value through an \`env:\` variable and reference it quoted instead.
+
+### GHA037 — Untrusted input written to GITHUB_ENV / GITHUB_PATH
+
+**Severity:** error
+
+Flags a \`run:\` step that writes untrusted input into \`$GITHUB_ENV\` or \`$GITHUB_PATH\`, which set environment/PATH state for later steps and can escalate into takeover of a subsequent privileged step.
+
+### GHA038 — workflow_run trigger checking out untrusted code
+
+**Severity:** warning
+
+Generalizes GHA018 to the \`workflow_run\` trigger, which runs with repo write scope and secrets. Checking out the head/artifact of the triggering run pulls untrusted code into that privileged context.
+
+### GHA039 — Authorization gate on a spoofable identity
+
+**Severity:** warning
+
+Flags an \`if:\` condition that gates on a commit-author identity field (\`author.name\` / \`author.email\`). Those come from git metadata the committer sets freely and can be spoofed — gate on a verified signal (environment protection, CODEOWNERS, verified actor).
+
+### GHA040 — Self-hosted runner on an untrusted-code trigger
+
+**Severity:** warning
+
+Flags a job on a self-hosted runner under a trigger a fork can reach (\`pull_request\`, \`pull_request_target\`, \`workflow_run\`). Self-hosted runners are non-ephemeral and shared, so untrusted code can persist and compromise later jobs.
+
+### GHA041 — Blanket secrets: inherit into a reusable workflow
+
+**Severity:** warning
+
+Flags a reusable-workflow call passing \`secrets: inherit\`, which hands the called workflow every caller secret. Pass through only the specific secrets it needs.
+
+### GHA042 — Entire secrets context passed
+
+**Severity:** warning
+
+Flags \`toJSON(secrets)\` passed into a step or reusable workflow, serializing every secret where one or two specific references would do.
+
+### GHA043 — Secret consumed without an environment gate
+
+**Severity:** warning
+
+Extends GHA026: when a workflow gates some jobs with an \`environment:\`, flags the specific secret-using jobs that have none — the inconsistent-gating case where a job skips the approval/scoping applied elsewhere.
+
+### GHA044 — Hardcoded registry/container credential
+
+**Severity:** error
+
+Flags a \`password:\` / \`token:\` / \`registry-password:\` set to a literal rather than a \`\${{ secrets.* }}\` reference. Move the credential into a secret.
+
+### GHA045 — Secret interpolated into a run: command
+
+**Severity:** warning
+
+Flags \`\${{ secrets.* }}\` expanded directly into a \`run:\` script, where a transform can defeat log masking and the raw value is exposed to argument injection. Pass it through an \`env:\` variable and reference \`"$VAR"\` quoted.
+
+### GHA046 — Logically unsound guard condition
+
+**Severity:** warning
+
+Flags an \`if:\` condition that reads like a gate but evaluates to a constant — \`true\`/\`false\` literals, an \`X == X\` tautology, or a collapse via \`|| true\` / \`&& false\`. A gate that constrains nothing is misleading.
+
+### GHA047 — Ineffective contains() guard
+
+**Severity:** warning
+
+Flags \`contains('literal', <dynamic>)\` — a constant haystack with a dynamic needle. \`contains(search, item)\` tests whether \`item\` is in \`search\`, so reversed arguments make the result depend on a fixed string. Swap them.
+
+### GHA048 — Obfuscated guard condition
+
+**Severity:** warning
+
+Flags an \`if:\` gate whose compared operand is built through \`format()\` / \`join()\` / \`fromJSON()\` indirection. Constructing the operand at evaluation time hides what the gate checks — compare against the value directly.
+
+### GHA049 — Persisted checkout credentials reachable by an artifact
+
+**Severity:** warning
+
+Flags a job that checks out with persisted credentials (the default) and uploads an artifact — the token in \`.git/config\` can be swept into the artifact. Set \`persist-credentials: false\` on the checkout.
+
+### GHA050 — Cache populated in a privileged context
+
+**Severity:** warning
+
+Flags \`actions/cache\` under a privileged trigger (\`pull_request_target\`, \`workflow_run\`). A cache entry influenced by a fork can be restored and executed by a later trusted run (cache poisoning) — restrict caching to trusted triggers.
+
+### GHA051 — Publish step using a long-lived token instead of OIDC
+
+**Severity:** info
+
+Flags a publish/release job that uses a long-lived token secret while requesting no \`id-token: write\`. If the registry supports OIDC, mint a short-lived federated credential per run instead of holding a standing token.
+
+### GHA052 — Software fetched and piped to a shell
+
+**Severity:** warning
+
+Flags a \`run:\` step that pipes a network download straight into a shell (\`curl ... | bash\`). The fetched code is unpinned and unverified — download to a file, verify a checksum/signature, then run it.
+
+### GHA053 — Unsafe set-env / add-path opt-in
+
+**Severity:** error
+
+Flags re-enabling the \`set-env\` / \`add-path\` workflow commands removed for security (CVE-2020-15228) via \`ACTIONS_ALLOW_UNSECURE_COMMANDS\` or direct \`::set-env::\` / \`::add-path::\`. Use the \`$GITHUB_ENV\` / \`$GITHUB_PATH\` files instead.
+
+### GHA054 — Known-bad feature usage
+
+**Severity:** warning
+
+Catch-all, data-driven check flagging emitted content matching a vendored snapshot of risky features (deprecated workflow commands, unsafe runtime opt-ins). Advisory and necessarily incomplete.
+
+### GHA055 — Redundant runtime tool install
+
+**Severity:** info
+
+Flags a \`run:\` step that installs a tool GitHub-hosted runners already ship. The redundant install adds supply-chain surface for no benefit (irrelevant on self-hosted runners that may lack the tool).
+
+### GHA056 — Workflow without a name
+
+**Severity:** info
+
+Flags a workflow with no top-level \`name:\`. Without one, GitHub falls back to the file path in the UI and audit logs, making runs harder to identify.
+
+> Two items from issue #295 are intentionally not implemented at the post-synth layer: over-broad/unrevoked app-installation tokens (whether a minted token is scoped wider than used cannot be determined from emitted YAML) and a reference allowlist/denylist policy (configuration, overlapping the GHA029 trusted-owner allowlist).
+
+### GHA057 — Dependency update executes untrusted code
+
+**Severity:** error
+
+Flags a Dependabot \`updates:\` entry with \`insecure-external-code-execution: allow\`, which runs a freshly-pulled dependency's lifecycle scripts during the update itself — a compromised release executes before any review. Set it to \`deny\`. Requires the \`Dependabot\` resource so the config is emitted (\`.github/dependabot.yml\`).
+
+### GHA058 — Dependency update without a cooldown
+
+**Severity:** warning
+
+Flags a Dependabot \`updates:\` entry with no cooldown — a version published moments ago (including a compromised one) is adopted immediately. Configure a \`cooldown:\` window. The \`Dependabot\` composite ships a 7-day default.
+
 ## Running lint
 
 \`\`\`bash
@@ -1099,7 +1361,7 @@ The inline \`chant-github\` skill covers the full workflow lifecycle:
 - **Validate** — \`chant lint src/\`
 - **Deploy** — commit and push the generated YAML
 - **Status** — GitHub Actions UI or \`gh run list\`
-- **Troubleshooting** — lint rule codes (GHA001–GHA020), post-synth checks (GHA006–GHA019)
+- **Troubleshooting** — lint rule codes (GHA001–GHA020), post-synth checks (GHA006–GHA058)
 
 The skill is invocable as a slash command: \`/chant-github\`
 
@@ -1123,6 +1385,13 @@ The lexicon provides MCP (Model Context Protocol) tools and resources that AI ag
 | MCP tool | Description |
 |----------|-------------|
 | \`diff\` | Compare current build output against previous output |
+| \`github:checks\` | Build the workflow and return its security findings (the GHA checks) |
+| \`github:workflow\` | Triggers and jobs as written — name, run order, step count |
+| \`github:references\` | Actions and images pulled in, and whether each is pinned to a commit SHA |
+| \`github:affected\` | Given a job, the jobs that would re-run because they depend on it |
+| \`github:workflow-yaml\` | The generated workflow YAML |
+
+The \`github:*\` tools are **read-only context tools** (#327): each builds from your source and returns what chant already computes — before the workflow runs or merges. None touch the live GitHub instance, run history, or write anything.
 
 | MCP resource | Description |
 |--------------|-------------|

package/src/composites/dependabot.test.ts

@@ -0,0 +1,48 @@
+import { describe, test, expect } from "vitest";
+import { Dependabot, DependabotConfig } from "./dependabot";
+import { githubSerializer } from "../serializer";
+import type { SerializerResult } from "@intentius/chant/serializer";
+
+describe("Dependabot composite (#294)", () => {
+  test("ships safe defaults: cooldown + external code execution denied", () => {
+    const cfg = Dependabot({ ecosystems: [{ packageEcosystem: "npm" }, { packageEcosystem: "github-actions" }] });
+    expect(cfg).toBeInstanceOf(DependabotConfig);
+    expect(cfg.props.version).toBe(2);
+    expect(cfg.props.updates).toHaveLength(2);
+    for (const u of cfg.props.updates) {
+      expect(u.cooldown?.defaultDays).toBe(7);
+      expect(u.insecureExternalCodeExecution).toBe("deny");
+      expect(u.directory).toBe("/");
+      expect(u.schedule.interval).toBe("weekly");
+    }
+  });
+
+  test("serializes to a .github/dependabot.yml file (kebab-case keys)", () => {
+    const cfg = Dependabot({ ecosystems: [{ packageEcosystem: "npm" }] });
+    const result = githubSerializer.serialize(new Map([["deps", cfg]])) as SerializerResult;
+    expect(typeof result).toBe("object");
+    const yaml = result.files?.["dependabot.yml"];
+    expect(yaml).toBeDefined();
+    expect(yaml).toContain("version: 2");
+    expect(yaml).toContain("package-ecosystem: npm");
+    expect(yaml).toContain("open-pull-requests-limit: 5");
+    expect(yaml).toContain("insecure-external-code-execution: deny");
+    expect(yaml).toContain("default-days: 7");
+  });
+
+  test("emits dependabot.yml alongside a workflow", () => {
+    const cfg = Dependabot({ ecosystems: [{ packageEcosystem: "pip", interval: "daily" }] });
+    const wf = {
+      [Symbol.for("chant.declarable")]: true,
+      lexicon: "github",
+      entityType: "GitHub::Actions::Workflow",
+      kind: "resource" as const,
+      props: { name: "CI" },
+    };
+    const result = githubSerializer.serialize(
+      new Map<string, never>([["ci", wf as never], ["deps", cfg as never]]),
+    ) as SerializerResult;
+    expect(result.primary).toContain("name: CI");
+    expect(result.files?.["dependabot.yml"]).toContain("package-ecosystem: pip");
+  });
+});

package/src/composites/dependabot.ts

@@ -0,0 +1,91 @@
+/**
+ * Dependency-update configuration (`.github/dependabot.yml`) as a chant
+ * resource, so it is emitted and lintable like workflows (#294).
+ *
+ * Two failure modes the post-synth checks target:
+ *   - an update that executes untrusted code from a freshly-pulled dependency
+ *     during the update itself (`insecure-external-code-execution: allow`), and
+ *   - a configuration with no cooldown — a version published seconds ago
+ *     (including a compromised one) is adopted before anyone can react.
+ *
+ * The `Dependabot` composite ships safe defaults: a cooldown window and an
+ * explicit deny on external code execution.
+ */
+
+import { DECLARABLE_MARKER, type Declarable } from "@intentius/chant/declarable";
+
+/** A single `updates:` entry in dependabot.yml. */
+export interface DependabotUpdate {
+  /** e.g. "npm", "pip", "github-actions", "docker". */
+  packageEcosystem: string;
+  /** Directory to scan (defaults to "/"). */
+  directory?: string;
+  directories?: string[];
+  /** Update schedule. */
+  schedule: { interval: "daily" | "weekly" | "monthly"; day?: string; time?: string };
+  /** Cooldown window — delay adopting freshly-published versions. */
+  cooldown?: {
+    defaultDays?: number;
+    semverMajorDays?: number;
+    semverMinorDays?: number;
+    semverPatchDays?: number;
+  };
+  /** Cap on concurrent update PRs. */
+  openPullRequestsLimit?: number;
+  /** Whether to run a dependency's lifecycle scripts during the update. */
+  insecureExternalCodeExecution?: "allow" | "deny";
+  /** Passthrough for the rest of the dependabot update schema. */
+  [key: string]: unknown;
+}
+
+export interface DependabotConfigProps {
+  version?: number;
+  updates: DependabotUpdate[];
+  registries?: Record<string, unknown>;
+}
+
+/** The `.github/dependabot.yml` resource. */
+export class DependabotConfig implements Declarable {
+  readonly [DECLARABLE_MARKER] = true as const;
+  readonly lexicon = "github";
+  readonly entityType = "GitHub::Dependabot::Config";
+  readonly kind = "resource" as const;
+  readonly props: DependabotConfigProps;
+
+  constructor(props: DependabotConfigProps) {
+    this.props = { version: 2, ...props };
+  }
+}
+
+export interface DependabotEcosystem {
+  packageEcosystem: string;
+  directory?: string;
+  interval?: "daily" | "weekly" | "monthly";
+}
+
+export interface DependabotProps {
+  /** Ecosystems to keep updated. */
+  ecosystems: DependabotEcosystem[];
+  /** Cooldown window in days before adopting a freshly-published version (default 7). */
+  cooldownDays?: number;
+  /** Cap on concurrent update PRs per ecosystem (default 5). */
+  openPullRequestsLimit?: number;
+}
+
+/**
+ * Build a `DependabotConfig` with safe defaults: a cooldown window on every
+ * ecosystem and external code execution explicitly denied.
+ */
+export function Dependabot(props: DependabotProps): DependabotConfig {
+  const cooldownDays = props.cooldownDays ?? 7;
+  const limit = props.openPullRequestsLimit ?? 5;
+  const updates: DependabotUpdate[] = props.ecosystems.map((e) => ({
+    packageEcosystem: e.packageEcosystem,
+    directory: e.directory ?? "/",
+    schedule: { interval: e.interval ?? "weekly" },
+    cooldown: { defaultDays: cooldownDays },
+    openPullRequestsLimit: limit,
+    insecureExternalCodeExecution: "deny",
+  }));
+  return new DependabotConfig({ version: 2, updates });
+}

package/src/composites/index.ts

@@ -24,3 +24,5 @@ export { DeployEnvironment } from "./deploy-environment";
 export type { DeployEnvironmentProps } from "./deploy-environment";
 export { GoCI } from "./go-ci";
 export type { GoCIProps } from "./go-ci";
+export { Dependabot, DependabotConfig } from "./dependabot";
+export type { DependabotProps, DependabotConfigProps, DependabotUpdate, DependabotEcosystem } from "./dependabot";

package/src/index.ts

@@ -30,6 +30,7 @@ export {
   DockerBuild,
   DeployEnvironment,
   GoCI,
+  Dependabot, DependabotConfig,
 } from "./composites/index";
 export type {
   CheckoutProps, SetupNodeProps, SetupGoProps, SetupPythonProps,
@@ -40,6 +41,7 @@ export type {
   DockerBuildProps,
   DeployEnvironmentProps,
   GoCIProps,
+  DependabotProps, DependabotConfigProps, DependabotUpdate, DependabotEcosystem,
 } from "./composites/index";
 
 // Spec utilities (for tooling)

package/src/lint/post-synth/{gha020.test.ts → gha013.test.ts}

@@ -1,6 +1,6 @@
 import { describe, test, expect } from "vitest";
 import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
-import { gha020 } from "./gha020";
+import { gha013 } from "./gha013";
 
 function makeCtx(yaml: string): PostSynthContext {
   return {
@@ -16,7 +16,7 @@ function makeCtx(yaml: string): PostSynthContext {
   };
 }
 
-describe("GHA020: missing job-level permissions for sensitive triggers", () => {
+describe("GHA013: missing job-level permissions for sensitive triggers", () => {
   test("flags job without permissions when using pull_request_target", () => {
     const yaml = `name: Review
 on:
@@ -27,9 +27,9 @@ jobs:
     steps:
       - run: echo review
 `;
-    const diags = gha020.check(makeCtx(yaml));
+    const diags = gha013.check(makeCtx(yaml));
     expect(diags).toHaveLength(1);
-    expect(diags[0].checkId).toBe("GHA020");
+    expect(diags[0].checkId).toBe("GHA013");
     expect(diags[0].severity).toBe("warning");
     expect(diags[0].message).toContain("review");
   });
@@ -44,9 +44,9 @@ jobs:
     steps:
       - run: echo deploy
 `;
-    const diags = gha020.check(makeCtx(yaml));
+    const diags = gha013.check(makeCtx(yaml));
     expect(diags).toHaveLength(1);
-    expect(diags[0].checkId).toBe("GHA020");
+    expect(diags[0].checkId).toBe("GHA013");
     expect(diags[0].message).toContain("deploy");
   });
 
@@ -60,7 +60,7 @@ jobs:
     steps:
       - run: echo build
 `;
-    const diags = gha020.check(makeCtx(yaml));
+    const diags = gha013.check(makeCtx(yaml));
     expect(diags).toHaveLength(0);
   });
 });

package/src/lint/post-synth/{gha020.ts → gha013.ts}

@@ -1,5 +1,5 @@
 /**
- * GHA020: Missing Job-Level Permissions for Sensitive Triggers
+ * GHA013: Missing Job-Level Permissions for Sensitive Triggers
  *
  * Flags jobs without explicit `permissions:` when the workflow uses
  * `pull_request_target` or `workflow_dispatch` triggers.
@@ -8,8 +8,8 @@
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
 import { getPrimaryOutput, extractJobs, extractTriggers } from "./yaml-helpers";
 
-export const gha020: PostSynthCheck = {
-  id: "GHA020",
+export const gha013: PostSynthCheck = {
+  id: "GHA013",
   description: "Missing job-level permissions for sensitive triggers",
 
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
@@ -25,7 +25,7 @@ export const gha020: PostSynthCheck = {
       for (const [jobName, job] of jobs) {
         if (!job.permissions) {
           diagnostics.push({
-            checkId: "GHA020",
+            checkId: "GHA013",
             severity: "warning",
             message: `Job "${jobName}" lacks explicit permissions but workflow uses a sensitive trigger. Add job-level permissions for least-privilege security.`,
             entity: jobName,

package/src/lint/post-synth/gha029.test.ts

@@ -0,0 +1,108 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { gha029, findUnpinnedActions } from "./gha029";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["github", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["github", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("GHA029: unpinned action / reusable workflow", () => {
+  test("flags a step action pinned to a tag", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/setup-node@v4
+      - run: echo build
+`;
+    const diags = gha029.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("GHA029");
+    expect(diags[0].severity).toBe("warning");
+    expect(diags[0].entity).toBe("build");
+    expect(diags[0].message).toContain("actions/setup-node@v4");
+  });
+
+  test("flags a job-level reusable workflow pinned to a tag", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  call:
+    uses: org/repo/.github/workflows/reusable.yml@v1
+`;
+    const diags = gha029.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("reusable.yml@v1");
+  });
+
+  test("does not flag an action pinned to a full SHA", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/setup-node@1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b
+      - run: echo build
+`;
+    const diags = gha029.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+
+  test("does not flag actions/checkout (owned by GHA021)", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+`;
+    const diags = gha029.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+
+  test("does not flag local actions", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: ./.github/actions/local
+`;
+    const diags = gha029.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+
+  test("allowlist exempts a trusted owner", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: trustedco/action@v1
+`;
+    expect(findUnpinnedActions(yaml)).toHaveLength(1);
+    expect(findUnpinnedActions(yaml, new Set(["trustedco"]))).toHaveLength(0);
+  });
+});