@intentius/chant-lexicon-github 0.1.23 → 0.3.0

package/src/lint/post-synth/gha053.test.ts

@@ -0,0 +1,65 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { gha053 } from "./gha053";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["github", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["github", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("GHA053: unsafe workflow-command opt-in", () => {
+  test("flags ACTIONS_ALLOW_UNSECURE_COMMANDS", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    env:
+      ACTIONS_ALLOW_UNSECURE_COMMANDS: true
+    steps:
+      - run: echo build
+`;
+    const diags = gha053.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("GHA053");
+    expect(diags[0].severity).toBe("error");
+  });
+
+  test("flags ::set-env:: emission", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "::set-env name=FOO::bar"
+`;
+    const diags = gha053.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+  });
+
+  test("does not flag normal env file usage", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "FOO=bar" >> "$GITHUB_ENV"
+`;
+    const diags = gha053.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/gha053.ts

@@ -0,0 +1,41 @@
+/**
+ * GHA053: Re-enabling Unsafe Workflow-Command Processing
+ *
+ * Flags opt-ins that reintroduce the `set-env` / `add-path` workflow commands
+ * removed for security (CVE-2020-15228) — `ACTIONS_ALLOW_UNSECURE_COMMANDS` and
+ * direct `::set-env::` / `::add-path::` emission. These let a logged string set
+ * arbitrary environment/PATH state for later steps, a code-execution path.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, linesByJob } from "./yaml-helpers";
+
+const UNSAFE_COMMANDS = /ACTIONS_ALLOW_UNSECURE_COMMANDS|::set-env\s|::add-path\s/;
+
+export const gha053: PostSynthCheck = {
+  id: "GHA053",
+  description: "Re-enables unsafe set-env / add-path workflow commands",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      const seen = new Set<string>();
+      for (const [job, lines] of linesByJob(yaml)) {
+        if (lines.some((l) => UNSAFE_COMMANDS.test(l)) && !seen.has(job)) {
+          seen.add(job);
+          diagnostics.push({
+            checkId: "GHA053",
+            severity: "error",
+            message: `Job "${job}" re-enables the unsafe set-env/add-path workflow commands (ACTIONS_ALLOW_UNSECURE_COMMANDS or ::set-env::/::add-path::). Use $GITHUB_ENV / $GITHUB_PATH files instead — the legacy commands were removed for security.`,
+            entity: job,
+            lexicon: "github",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/gha054.test.ts

@@ -0,0 +1,49 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { gha054 } from "./gha054";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["github", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["github", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("GHA054: known-bad feature usage", () => {
+  test("flags deprecated ::set-output::", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "::set-output name=version::1.0.0"
+`;
+    const diags = gha054.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("GHA054");
+    expect(diags[0].message).toContain("set-output");
+  });
+
+  test("does not flag $GITHUB_OUTPUT usage", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "version=1.0.0" >> "$GITHUB_OUTPUT"
+`;
+    const diags = gha054.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/gha054.ts

@@ -0,0 +1,41 @@
+/**
+ * GHA054: Use of a Feature with a Known Security Footgun
+ *
+ * Catch-all, data-driven check: flags emitted workflow content matching a
+ * vendored snapshot of known-risky GitHub Actions features (deprecated workflow
+ * commands, unsafe runtime opt-ins, masking footguns). Advisory; the dataset is
+ * necessarily incomplete.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, linesByJob } from "./yaml-helpers";
+import { RISKY_FEATURES } from "../rules/data/risky-features";
+
+export const gha054: PostSynthCheck = {
+  id: "GHA054",
+  description: "Use of a feature with a known security footgun",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const [job, lines] of linesByJob(yaml)) {
+        const text = lines.join("\n");
+        for (const feature of RISKY_FEATURES) {
+          if (feature.pattern.test(text)) {
+            diagnostics.push({
+              checkId: "GHA054",
+              severity: "warning",
+              message: `Job "${job}" uses ${feature.label} — ${feature.advice}.`,
+              entity: job,
+              lexicon: "github",
+            });
+          }
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/gha055.test.ts

@@ -0,0 +1,49 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { gha055 } from "./gha055";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["github", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["github", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("GHA055: redundant runtime install", () => {
+  test("flags apt-get install of a preinstalled tool", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - run: sudo apt-get install -y jq
+`;
+    const diags = gha055.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("GHA055");
+    expect(diags[0].message).toContain("jq");
+  });
+
+  test("does not flag installing a tool not on the runner", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - run: sudo apt-get install -y libpq-dev
+`;
+    const diags = gha055.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/gha055.ts

@@ -0,0 +1,50 @@
+/**
+ * GHA055: Runtime Install of a Tool Already on the Runner
+ *
+ * Flags a `run:` step that installs (apt/brew/apk/choco) a tool that GitHub-
+ * hosted runners already ship. The redundant install adds a third-party
+ * download and supply-chain surface for no benefit and slows the job. Advisory;
+ * irrelevant on self-hosted runners that may lack the tool.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractRunBlocks } from "./yaml-helpers";
+import { PREINSTALLED_TOOLS } from "../rules/data/preinstalled-tools";
+
+const INSTALL_RE = /\b(?:apt(?:-get)?\s+install|brew\s+install|apk\s+add|choco\s+install)\b([^\n]*)/g;
+
+export const gha055: PostSynthCheck = {
+  id: "GHA055",
+  description: "Runtime install of a tool already present on the runner",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const preinstalled = new Set(PREINSTALLED_TOOLS);
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const { job, run } of extractRunBlocks(yaml)) {
+        const redundant = new Set<string>();
+        let m: RegExpExecArray | null;
+        INSTALL_RE.lastIndex = 0;
+        while ((m = INSTALL_RE.exec(run)) !== null) {
+          for (const tok of m[1].split(/\s+/)) {
+            const name = tok.replace(/[^\w.+-]/g, "");
+            if (name && preinstalled.has(name)) redundant.add(name);
+          }
+        }
+        if (redundant.size > 0) {
+          diagnostics.push({
+            checkId: "GHA055",
+            severity: "info",
+            message: `Job "${job}" installs ${[...redundant].join(", ")} at runtime, but GitHub-hosted runners already ship ${redundant.size > 1 ? "these tools" : "this tool"}. Drop the redundant install (or rely on the preinstalled version) to reduce supply-chain surface.`,
+            entity: job,
+            lexicon: "github",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/gha056.test.ts

@@ -0,0 +1,47 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { gha056 } from "./gha056";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["github", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["github", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("GHA056: workflow without a name", () => {
+  test("flags a workflow with no name", () => {
+    const yaml = `on:
+  push:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo build
+`;
+    const diags = gha056.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("GHA056");
+  });
+
+  test("does not flag a named workflow", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo build
+`;
+    const diags = gha056.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/gha056.ts

@@ -0,0 +1,37 @@
+/**
+ * GHA056: Workflow Without a `name:`
+ *
+ * Flags an emitted workflow with no top-level `name:`. Without one, GitHub falls
+ * back to the file path in the Actions UI and audit logs, making runs harder to
+ * identify and review. A clear name improves observability and audit output.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractWorkflowName } from "./yaml-helpers";
+
+export const gha056: PostSynthCheck = {
+  id: "GHA056",
+  description: "Workflow without a name",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [lexicon, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      // Only inspect things that look like workflows (have a jobs: block).
+      if (!/^jobs:\s*$/m.test(yaml)) continue;
+      const name = extractWorkflowName(yaml);
+      if (!name) {
+        diagnostics.push({
+          checkId: "GHA056",
+          severity: "info",
+          message: `Workflow "${lexicon}" has no top-level name: — add one so runs are identifiable in the Actions UI and audit logs.`,
+          entity: "workflow",
+          lexicon: "github",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/gha057.test.ts

@@ -0,0 +1,61 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type { SerializerResult } from "@intentius/chant/serializer";
+import { gha057 } from "./gha057";
+
+function makeCtx(dependabotYaml: string): PostSynthContext {
+  const output: SerializerResult = { primary: "", files: { "dependabot.yml": dependabotYaml } };
+  return {
+    outputs: new Map([["github", output]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["github", output]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("GHA057: dependency update executing untrusted code", () => {
+  test("flags insecure-external-code-execution: allow", () => {
+    const yaml = `version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    insecure-external-code-execution: allow
+`;
+    const diags = gha057.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("GHA057");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].entity).toBe("npm");
+  });
+
+  test("does not flag deny", () => {
+    const yaml = `version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    insecure-external-code-execution: deny
+`;
+    const diags = gha057.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+
+  test("does not flag a workflow-only output", () => {
+    const ctx: PostSynthContext = {
+      outputs: new Map([["github", "name: CI\non:\n  push:\n"]]),
+      entities: new Map(),
+      buildResult: { outputs: new Map(), entities: new Map(), warnings: [], errors: [], sourceFileCount: 1 },
+    };
+    expect(gha057.check(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/gha057.ts

@@ -0,0 +1,40 @@
+/**
+ * GHA057: Dependency Update Executing Untrusted External Code
+ *
+ * Flags a dependabot `updates:` entry with
+ * `insecure-external-code-execution: allow`. That setting lets a freshly-pulled
+ * dependency run lifecycle scripts (e.g. npm `postinstall`) during the update
+ * itself — a compromised release executes in the update job before any review.
+ * Set it to `deny`, or isolate the ecosystem.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getDependabotYaml, extractDependabotUpdates } from "./yaml-helpers";
+
+export const gha057: PostSynthCheck = {
+  id: "GHA057",
+  description: "Dependency update allows executing untrusted external code",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const dependabot = getDependabotYaml(output);
+      if (!dependabot) continue;
+      for (const update of extractDependabotUpdates(dependabot)) {
+        if (update["insecure-external-code-execution"] === "allow") {
+          const eco = String(update["package-ecosystem"] ?? "?");
+          diagnostics.push({
+            checkId: "GHA057",
+            severity: "error",
+            message: `Dependabot update for "${eco}" sets insecure-external-code-execution: allow, running dependency lifecycle scripts during the update. Set it to deny.`,
+            entity: eco,
+            lexicon: "github",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/gha058.test.ts

@@ -0,0 +1,67 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type { SerializerResult } from "@intentius/chant/serializer";
+import { gha058 } from "./gha058";
+
+function makeCtx(dependabotYaml: string): PostSynthContext {
+  const output: SerializerResult = { primary: "", files: { "dependabot.yml": dependabotYaml } };
+  return {
+    outputs: new Map([["github", output]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["github", output]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("GHA058: dependency update without cooldown", () => {
+  test("flags an update with no cooldown", () => {
+    const yaml = `version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+`;
+    const diags = gha058.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("GHA058");
+    expect(diags[0].entity).toBe("npm");
+  });
+
+  test("does not flag an update with a cooldown window", () => {
+    const yaml = `version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+`;
+    const diags = gha058.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+
+  test("flags an all-zero cooldown", () => {
+    const yaml = `version: 2
+
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: daily
+    cooldown:
+      default-days: 0
+`;
+    const diags = gha058.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("pip");
+  });
+});

package/src/lint/post-synth/gha058.ts

@@ -0,0 +1,48 @@
+/**
+ * GHA058: Dependency Update Without a Cooldown
+ *
+ * Flags a dependabot `updates:` entry with no cooldown (or an all-zero one). A
+ * version published seconds ago — including a compromised one — is adopted
+ * immediately, with no window for the ecosystem to yank it or for anyone to
+ * react. Configure a `cooldown:` so freshly-published versions wait before they
+ * are proposed.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getDependabotYaml, extractDependabotUpdates } from "./yaml-helpers";
+
+const COOLDOWN_DAY_KEYS = ["default-days", "semver-major-days", "semver-minor-days", "semver-patch-days"];
+
+function hasEffectiveCooldown(cooldown: unknown): boolean {
+  if (!cooldown || typeof cooldown !== "object") return false;
+  const c = cooldown as Record<string, unknown>;
+  return COOLDOWN_DAY_KEYS.some((k) => typeof c[k] === "number" && (c[k] as number) > 0);
+}
+
+export const gha058: PostSynthCheck = {
+  id: "GHA058",
+  description: "Dependency update has no cooldown window",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const dependabot = getDependabotYaml(output);
+      if (!dependabot) continue;
+      for (const update of extractDependabotUpdates(dependabot)) {
+        if (!hasEffectiveCooldown(update.cooldown)) {
+          const eco = String(update["package-ecosystem"] ?? "?");
+          diagnostics.push({
+            checkId: "GHA058",
+            severity: "warning",
+            message: `Dependabot update for "${eco}" has no cooldown — a version published moments ago is adopted immediately. Add a cooldown window so fresh (possibly compromised) releases wait before they are proposed.`,
+            entity: eco,
+            lexicon: "github",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};