@intentius/chant-lexicon-github 0.101.0 → 0.104.0

package/dist/lint/post-synth/yaml-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"yaml-helpers.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/yaml-helpers.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEpE;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAGvF;AAED,iEAAiE;AACjE,wBAAgB,wBAAwB,CAAC,cAAc,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAS/F;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CA4DhE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAarE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,OAAO,CAE1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAOnE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGpE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,sDAAsD;AACtD,MAAM,WAAW,SAAS;IACxB,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;CACvB;AAED,sEAAsE;AACtE,MAAM,WAAW,QAAQ;IACvB,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;CAC1C;AAED,kFAAkF;AAClF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAM1E;AAED,sFAAsF;AACtF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAWjF;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAW3F;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,CAgB3D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAgCzD;AAyBD,iDAAiD;AACjD,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAyBzD;AAED,8CAA8C;AAC9C,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAO/D;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAwBtE;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAQzD;AAED,2EAA2E;AAC3E,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAI3E;AAED,gEAAgE;AAChE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAQ9D;AAED,kDAAkD;AAClD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAMhE;AAED,8DAA8D;AAC9D,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAMhE;AAED,iFAAiF;AACjF,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE/D,2DAA2D;AAC3D,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAMrF;AAED,oFAAoF;AACpF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAQjF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,gBAAgB,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAS7F;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAG5D;AAED;;;;GAIG;AACH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAItE;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAS1H"}
+{"version":3,"file":"yaml-helpers.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/yaml-helpers.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEpE;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAGvF;AAED,iEAAiE;AACjE,wBAAgB,wBAAwB,CAAC,cAAc,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAS/F;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CA6BhE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAarE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,OAAO,CAE1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAOnE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGpE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,sDAAsD;AACtD,MAAM,WAAW,SAAS;IACxB,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;CACvB;AAED,sEAAsE;AACtE,MAAM,WAAW,QAAQ;IACvB,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;CAC1C;AAED,kFAAkF;AAClF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAM1E;AAED,sFAAsF;AACtF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAWjF;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAW3F;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,CAgB3D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAgCzD;AAyBD,iDAAiD;AACjD,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAyBzD;AAED,8CAA8C;AAC9C,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAO/D;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAwBtE;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAQzD;AAED,2EAA2E;AAC3E,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAI3E;AAED,gEAAgE;AAChE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAQ9D;AAED,kDAAkD;AAClD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAMhE;AAED,8DAA8D;AAC9D,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAMhE;AAED,iFAAiF;AACjF,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE/D,2DAA2D;AAC3D,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAMrF;AAED,oFAAoF;AACpF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAQjF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,gBAAgB,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAS7F;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAG5D;AAED;;;;GAIG;AACH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAItE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC,CAOlG;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAS1H"}

package/dist/lint/rules/data/deprecated-versions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deprecated-versions.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/data/deprecated-versions.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAQ5F,CAAC"}
+{"version":3,"file":"deprecated-versions.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/data/deprecated-versions.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAS5F,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "github",
-  "version": "0.101.0",
+  "version": "0.104.0",
   "chantVersion": ">=0.1.0",
   "namespace": "GitHub",
   "intrinsics": [

package/dist/okf/index.md

@@ -78,3 +78,4 @@ okf_version: '0.2'
 * [GHA066](/rules/GHA066.md) - Uploaded artifact has no explicit retention-days
 * [GHA067](/rules/GHA067.md) - Unconditional docker build with no path filter or guard
 * [GHA068](/rules/GHA068.md) - Pull-request workflow missing a concurrency group
+* [GHA069](/rules/GHA069.md) - Job-level permissions block drops the workflow's id-token: write that an OIDC credential step needs

package/dist/okf/rules/GHA069.md

@@ -0,0 +1,16 @@
+---
+type: post-synth-check
+title: GHA069
+description: 'Job-level permissions block drops the workflow''s id-token: write that an OIDC credential step needs'
+id: GHA069
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Job-level permissions block drops the workflow's id-token: write that an OIDC credential step needs
+
+## Applies to
+
+- [Job](/types/Job.md)
+- [Workflow](/types/Workflow.md)

package/dist/okf/types/Job.md

@@ -77,3 +77,4 @@ resource_type: GitHub::Actions::Job
 - [GHA065](/rules/GHA065.md): Matrix combines dimensions into an uncapped, large fan-out
 - [GHA066](/rules/GHA066.md): Uploaded artifact has no explicit retention-days
 - [GHA067](/rules/GHA067.md): Unconditional docker build with no path filter or guard
+- [GHA069](/rules/GHA069.md): Job-level permissions block drops the workflow's id-token: write that an OIDC credential step needs

package/dist/okf/types/Workflow.md

@@ -36,3 +36,4 @@ resource_type: GitHub::Actions::Workflow
 - [GHA053](/rules/GHA053.md): Re-enables unsafe set-env / add-path workflow commands
 - [GHA056](/rules/GHA056.md): Workflow without a name
 - [GHA068](/rules/GHA068.md): Pull-request workflow missing a concurrency group
+- [GHA069](/rules/GHA069.md): Job-level permissions block drops the workflow's id-token: write that an OIDC credential step needs

package/dist/rules/gha021.ts

@@ -6,7 +6,8 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, extractJobs } from "./yaml-helpers";
+import { getPrimaryOutput, extractActionRefs, stripUsesComment } from "./yaml-helpers";
+import { pinFixHint } from "../../action-pins";
 
 export const gha021: PostSynthCheck = {
   id: "GHA021",
@@ -17,29 +18,28 @@ export const gha021: PostSynthCheck = {
 
     for (const [, output] of ctx.outputs) {
       const yaml = getPrimaryOutput(output);
-      const jobs = extractJobs(yaml);
-
-      for (const [jobName, job] of jobs) {
-        if (!job.steps) continue;
-
-        for (const step of job.steps) {
-          if (!step.uses) continue;
-
-          const match = step.uses.match(/^actions\/checkout@(.+)$/);
-          if (!match) continue;
-
-          const ref = match[1];
-          // A pinned SHA is 40 hex characters
-          if (/^[0-9a-f]{40}$/.test(ref)) continue;
-
-          diagnostics.push({
-            checkId: "GHA021",
-            severity: "warning",
-            message: `Job "${jobName}" uses actions/checkout@${ref} — pin to a full commit SHA for supply-chain security.`,
-            entity: jobName,
-            lexicon: "github",
-          });
-        }
+      // The structural parser sees every step. The line-based extractJobs
+      // only reads a step's first line, so it missed `uses:` whenever a step
+      // starts with `name:`, which is how every composite emits it.
+      for (const { job: jobName, ref: uses, level } of extractActionRefs(yaml)) {
+        if (level !== "step") continue;
+
+        // A pinned ref carries its version as a trailing comment
+        // (`actions/checkout@<sha> # v7.0.1`); only the ref is judged.
+        const match = stripUsesComment(uses).match(/^actions\/checkout@(.+)$/);
+        if (!match) continue;
+
+        const ref = match[1];
+        // A pinned SHA is 40 hex characters
+        if (/^[0-9a-f]{40}$/.test(ref)) continue;
+
+        diagnostics.push({
+          checkId: "GHA021",
+          severity: "warning",
+          message: `Job "${jobName}" uses actions/checkout@${ref} — pin to a full commit SHA for supply-chain security.${pinFixHint("actions/checkout")}`,
+          entity: jobName,
+          lexicon: "github",
+        });
       }
     }
 

package/dist/rules/gha029.ts

@@ -14,6 +14,7 @@
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
 import { getPrimaryOutput, extractActionRefs, parseActionUses } from "./yaml-helpers";
 import { TRUSTED_ACTION_OWNERS } from "../rules/data/trusted-action-owners";
+import { pinFixHint } from "../../action-pins";
 
 const SHA_RE = /^[0-9a-f]{40}$/;
 
@@ -52,11 +53,11 @@ export const gha029: PostSynthCheck = {
 
     for (const [, output] of ctx.outputs) {
       const yaml = getPrimaryOutput(output);
-      for (const { job, ref } of findUnpinnedActions(yaml)) {
+      for (const { job, ref, slug } of findUnpinnedActions(yaml)) {
         diagnostics.push({
           checkId: "GHA029",
           severity: "warning",
-          message: `Job "${job}" uses ${ref} pinned to a tag or branch — pin to a full commit SHA for supply-chain security.`,
+          message: `Job "${job}" uses ${ref} pinned to a tag or branch — pin to a full commit SHA for supply-chain security.${pinFixHint(slug)}`,
           entity: job,
           lexicon: "github",
         });

package/dist/rules/gha059.ts

@@ -21,7 +21,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, extractActionRefs, extractUsesComment, parseActionUses } from "./yaml-helpers";
+import { getPrimaryOutput, extractActionRefs, extractUsesComment, parseActionUses, usesLineComments } from "./yaml-helpers";
 
 const SHA_RE = /^[0-9a-f]{40}$/;
 
@@ -49,9 +49,17 @@ export function findStalePinAnnotations(yaml: string): StalePinFinding[] {
   const findings: StalePinFinding[] = [];
 
   // First pass: missing annotations.
+  // The parsed value carries no comment, so match each ref to its `uses:`
+  // line, in document order, to read the label.
+  const lines = usesLineComments(yaml);
+  const commentFor = (ref: string): string | undefined => {
+    const k = lines.findIndex((l) => l.ref === ref);
+    if (k === -1) return extractUsesComment(ref);
+    return lines.splice(k, 1)[0].comment;
+  };
   const withComment: Array<{ job: string; ref: string; slug: string; sha: string; comment: string }> = [];
   for (const { job, ref, parsed } of refs) {
-    const comment = extractUsesComment(ref);
+    const comment = commentFor(ref);
     if (!comment) {
       findings.push({ job, ref, slug: parsed.slug, sha: parsed.gitRef, kind: "missing" });
     } else {

package/dist/rules/gha069.ts

@@ -0,0 +1,111 @@
+/**
+ * GHA069: Job-Level Permissions Block Drops the Workflow's `id-token: write`
+ *
+ * A job-level `permissions:` block replaces the workflow-level one; GitHub
+ * does not merge the two. A workflow that grants `id-token: write` at the top
+ * and then gives a job its own block without that scope leaves the job with
+ * no OIDC token, and the job's cloud-credential action fails with an error
+ * that names neither the scope nor the job block (#2273).
+ *
+ * Fires when all three hold:
+ * - the workflow-level block grants `id-token: write` (directly, or through
+ *   `write-all`);
+ * - a job declares its own block that does not (a map without
+ *   `id-token: write`, `{}`, `read-all`, or any other preset but `write-all`);
+ * - that job has a step using a known OIDC credential action, matched on the
+ *   action path whatever the ref (tag, major or full SHA), with no static
+ *   credential input that would make the step skip OIDC.
+ *
+ * Only `id-token` is checked. The reasoning for not generalising to every
+ * scope a job block narrows is recorded on #2273.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import {
+  getPrimaryOutput,
+  extractWorkflowPermissions,
+  extractJobPermissions,
+  extractStepsByJob,
+  parseActionUses,
+  type PermissionsValue,
+} from "./yaml-helpers";
+
+/**
+ * Actions that exchange the job's OIDC token for cloud credentials, keyed by
+ * lowercased `owner/repo`, each with the inputs that select a static
+ * credential instead (when one is set, the step does not need `id-token`).
+ */
+export const OIDC_CREDENTIAL_ACTIONS: ReadonlyMap<string, readonly string[]> = new Map([
+  ["aws-actions/configure-aws-credentials", ["aws-access-key-id", "web-identity-token-file"]],
+  ["azure/login", ["creds"]],
+  ["google-github-actions/auth", ["credentials_json"]],
+]);
+
+/** True when the permissions value grants `id-token: write`. */
+export function grantsIdTokenWrite(perms: PermissionsValue): boolean {
+  if (typeof perms === "string") return perms.trim() === "write-all";
+  return perms["id-token"] === "write";
+}
+
+/** The OIDC credential action a step uses, as written, or undefined. */
+function oidcActionOf(step: Record<string, unknown>): string | undefined {
+  if (typeof step.uses !== "string") return undefined;
+  const parsed = parseActionUses(step.uses);
+  if (!parsed) return undefined;
+  const staticInputs = OIDC_CREDENTIAL_ACTIONS.get(parsed.slug.toLowerCase());
+  if (!staticInputs) return undefined;
+  const withInputs = step.with;
+  if (withInputs && typeof withInputs === "object" && !Array.isArray(withInputs)) {
+    const inputs = withInputs as Record<string, unknown>;
+    if (staticInputs.some((k) => inputs[k] !== undefined && inputs[k] !== null && inputs[k] !== "")) return undefined;
+  }
+  return parsed.slug;
+}
+
+function describeJobBlock(perms: PermissionsValue): string {
+  if (typeof perms === "string") return `\`permissions: ${perms}\``;
+  if (Object.keys(perms).length === 0) return "`permissions: {}`";
+  return "its own `permissions:` block";
+}
+
+export const gha069: PostSynthCheck = {
+  id: "GHA069",
+  description: "Job-level permissions block drops the workflow's id-token: write that an OIDC credential step needs",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+
+      const wf = extractWorkflowPermissions(yaml);
+      if (!wf || !grantsIdTokenWrite(wf)) continue;
+
+      const jobPermissions = extractJobPermissions(yaml);
+      if (jobPermissions.size === 0) continue;
+
+      const stepsByJob = extractStepsByJob(yaml);
+      for (const [job, perms] of jobPermissions) {
+        if (grantsIdTokenWrite(perms)) continue;
+
+        const actions = [
+          ...new Set((stepsByJob.get(job) ?? []).map(oidcActionOf).filter((a): a is string => a !== undefined)),
+        ];
+        if (actions.length === 0) continue;
+
+        diagnostics.push({
+          checkId: "GHA069",
+          severity: "warning",
+          message:
+            `Job "${job}" declares ${describeJobBlock(perms)}, which replaces the workflow-level block instead of merging with it, ` +
+            `so the workflow's \`id-token: write\` does not reach the job and ${actions.join(", ")} cannot request an OIDC token. ` +
+            `Add \`id-token: write\` to job "${job}"'s permissions block; keep the job block rather than removing it.`,
+          entity: job,
+          lexicon: "github",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/yaml-helpers.ts

@@ -37,66 +37,45 @@ export interface ParsedJob {
 
 /**
  * Extract jobs from a serialized GitHub Actions workflow YAML.
+ *
+ * Built on the structural parser ({@link jobEntries}), so every step of every
+ * job is read whatever key the step starts with, and `needs:` is read in all
+ * three forms (a scalar, a flow list, a block list). The line-based version
+ * this replaced stopped after the first line of a job's first step, so a step
+ * that starts with `name:` (the shape chant's serializer emits) had no `uses:`
+ * or `run:` and later steps were never seen (#3201).
+ *
+ * `run` is the whole script, block scalars included. `permissions` is not
+ * filled here; use {@link extractJobPermissions}.
  */
 export function extractJobs(yaml: string): Map<string, ParsedJob> {
   const jobs = new Map<string, ParsedJob>();
-
-  // Find the jobs: section — take everything after `jobs:\n`
-  const jobsIdx = yaml.search(/^jobs:\s*$/m);
-  if (jobsIdx === -1) return jobs;
-
-  // Content after the `jobs:` line. Stop at the next top-level key (non-indented) or EOF.
-  const afterJobs = yaml.slice(jobsIdx + yaml.slice(jobsIdx).indexOf("\n") + 1);
-  const endMatch = afterJobs.search(/^[a-z]/m);
-  const jobsContent = endMatch === -1 ? afterJobs : afterJobs.slice(0, endMatch);
-
-  // Split into individual jobs by finding lines with exactly 2 spaces of indent followed by a key
-  const jobSections = jobsContent.split(/\n(?=  [a-z][a-z0-9-]*:)/);
-
-  for (const section of jobSections) {
-    const nameMatch = section.match(/^\s{2}([a-z][a-z0-9-]*):/);
-    if (!nameMatch) continue;
-
-    const name = nameMatch[1];
+  for (const [name, jobObj] of jobEntries(yaml)) {
     const job: ParsedJob = { name };
 
-    // Extract needs
-    const needsInline = section.match(/^\s{4}needs:\s+\[(.+)\]$/m);
-    if (needsInline) {
-      job.needs = needsInline[1].split(",").map((s) => s.trim().replace(/^'|'$/g, "").replace(/^"|"$/g, ""));
-    } else {
-      const needsList = section.match(/^\s{4}needs:\n((?:\s{6}- .+\n?)+)/m);
-      if (needsList) {
-        job.needs = [];
-        for (const line of needsList[1].split("\n")) {
-          const item = line.match(/^\s{6}- (.+)$/);
-          if (item) job.needs.push(item[1].trim().replace(/^'|'$/g, "").replace(/^"|"$/g, ""));
-        }
-      }
+    const needs = jobObj.needs;
+    if (typeof needs === "string") {
+      job.needs = [needs];
+    } else if (Array.isArray(needs)) {
+      job.needs = needs.filter((n) => typeof n === "string" || typeof n === "number").map(String);
     }
 
-    // Extract steps with uses:
-    const stepsMatch = section.match(/^\s{4}steps:\n([\s\S]*?)(?=\n\s{4}[a-z]|\n\s{2}[a-z]|$)/m);
-    if (stepsMatch) {
+    const steps = jobObj.steps;
+    if (Array.isArray(steps)) {
       job.steps = [];
-      const stepEntries = stepsMatch[1].split(/\n(?=\s{6}- )/);
-      for (const stepEntry of stepEntries) {
-        const usesMatch = stepEntry.match(/uses:\s+(.+)$/m);
-        const runMatch = stepEntry.match(/run:\s+(.+)$/m);
-        const stepNameMatch = stepEntry.match(/name:\s+(.+)$/m);
-        if (usesMatch || runMatch) {
-          job.steps.push({
-            uses: usesMatch?.[1] ? stripUsesComment(usesMatch[1].trim().replace(/^'|'$/g, "")) : undefined,
-            run: runMatch?.[1]?.trim(),
-            name: stepNameMatch?.[1]?.trim().replace(/^'|'$/g, ""),
-          });
-        }
+      for (const raw of steps) {
+        if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
+        const step = raw as Record<string, unknown>;
+        job.steps.push({
+          uses: typeof step.uses === "string" ? stripUsesComment(step.uses) : undefined,
+          run: typeof step.run === "string" ? step.run : undefined,
+          name: typeof step.name === "string" ? step.name : undefined,
+        });
       }
     }
 
     jobs.set(name, job);
   }
-
   return jobs;
 }
 
@@ -497,6 +476,21 @@ export function extractUsesComment(rawUses: string): string | undefined {
   return comment ? comment : undefined;
 }
 
+/**
+ * Every `uses:` line in the workflow text, in document order, with its
+ * trailing comment. The parsed document has no comments (core's parseYAML
+ * drops them, #3006), so a check that reads the pin label (GHA059) takes it
+ * from here.
+ */
+export function usesLineComments(yaml: string): Array<{ ref: string; comment: string | undefined }> {
+  const out: Array<{ ref: string; comment: string | undefined }> = [];
+  for (const line of yaml.split(/\r?\n/)) {
+    const m = line.match(/^\s*(?:-\s+)?uses:\s*(["']?)([^\s"'#]+)\1(\s+#.*)?\s*$/);
+    if (m) out.push({ ref: m[2], comment: m[3] ? extractUsesComment(m[3]) : undefined });
+  }
+  return out;
+}
+
 export function parseActionUses(rawUses: string): { owner: string; repo: string; slug: string; gitRef: string } | undefined {
   const uses = stripUsesComment(rawUses);
   if (uses.startsWith("./") || uses.startsWith("../") || uses.startsWith("docker://")) return undefined;

package/dist/variables.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"variables.d.ts","sourceRoot":"","sources":["../src/variables.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BT,CAAC;AAEX,eAAO,MAAM,MAAM;;;;;;CAMT,CAAC"}
+{"version":3,"file":"variables.d.ts","sourceRoot":"","sources":["../src/variables.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,eAAO,MAAM,MAAM;aACjB,GAAG;aACH,OAAO;aACP,OAAO;aACP,GAAG;aACH,KAAK;aACL,eAAe;aACf,UAAU;aACV,eAAe;aACf,SAAS;aACT,KAAK;aACL,KAAK;aACL,SAAS;aACT,UAAU;aACV,QAAQ;aACR,WAAW;aACX,SAAS;aACT,KAAK;aACL,GAAG;aACH,OAAO;aACP,OAAO;aACP,SAAS;aACT,MAAM;aACN,UAAU;aACV,MAAM;aACN,UAAU;CACF,CAAC;AAEX,eAAO,MAAM,MAAM;aACjB,EAAE;aACF,IAAI;aACJ,IAAI;aACJ,IAAI;aACJ,SAAS;CACD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-github",
-  "version": "0.101.0",
+  "version": "0.104.0",
   "description": "GitHub Actions lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -54,14 +54,14 @@
     "validate": "tsx src/validate-cli.ts",
     "docs": "tsx src/codegen/docs-cli.ts",
     "prepack": "npm run generate && npm run bundle && npm run validate && npm run build",
-    "build": "tsc -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete"
+    "build": "../../scripts/tsc7.sh -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete"
   },
   "devDependencies": {
     "@intentius/chant": "*",
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.101.0",
+    "@intentius/chant": "^0.104.0",
     "typescript": "^5.9.3"
   }
 }

package/src/action-pins.test.ts

@@ -0,0 +1,87 @@
+import { describe, test, expect } from "vitest";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { Workflow, Job } from "./generated/index";
+import { Checkout } from "./composites/checkout";
+import { SetupNode } from "./composites/setup-node";
+import { githubSerializer } from "./serializer";
+import { ACTION_PINS, actionRef } from "./action-pins";
+import { gha021 } from "./lint/post-synth/gha021";
+import { gha029 } from "./lint/post-synth/gha029";
+import { gha059 } from "./lint/post-synth/gha059";
+
+// #2510: the composites emit a current major by default, `pin: "sha"` emits
+// the pinned commit, and the pinning checks agree with both.
+
+function workflowYaml(pin?: "tag" | "sha"): string {
+  const entities = new Map<string, unknown>([
+    ["ci", new Workflow({ name: "CI", on: { push: {} } })],
+    [
+      "test",
+      new Job({
+        "runs-on": "ubuntu-latest",
+        steps: [Checkout({ pin }).step, SetupNode({ nodeVersion: "22.x", cache: "npm", pin }).step],
+      }),
+    ],
+  ]);
+  return githubSerializer.serialize(entities as never) as string;
+}
+
+function ctx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["github", yaml]]),
+    entities: new Map(),
+    buildResult: { outputs: new Map([["github", yaml]]), entities: new Map(), warnings: [], errors: [], sourceFileCount: 1 },
+  };
+}
+
+const pinningFindings = (yaml: string) =>
+  [gha021, gha029, gha059].flatMap((check) => check.check(ctx(yaml)));
+
+describe("action pins (#2510)", () => {
+  test("every pin is a 40-character commit SHA on the major the composites emit", () => {
+    for (const pin of Object.values(ACTION_PINS)) {
+      expect(pin.sha).toMatch(/^[0-9a-f]{40}$/);
+      expect(pin.version.startsWith(`${pin.major}.`)).toBe(true);
+    }
+  });
+
+  test("Checkout and SetupNode default to the current major, not v4", () => {
+    expect((Checkout({}).step.props as { uses?: string }).uses).toBe("actions/checkout@v7");
+    expect((SetupNode({}).step.props as { uses?: string }).uses).toBe("actions/setup-node@v7");
+  });
+
+  test("pin: \"sha\" writes the SHA as the ref and the version as a YAML comment", () => {
+    const yaml = workflowYaml("sha");
+    expect(yaml).toContain(`uses: actions/checkout@${ACTION_PINS["actions/checkout"].sha} # v7.0.1\n`);
+    expect(yaml).toContain(`uses: actions/setup-node@${ACTION_PINS["actions/setup-node"].sha} # v7.0.0\n`);
+    expect(yaml).not.toMatch(/uses: '/);
+  });
+
+  test("a SHA-pinned workflow passes GHA021, GHA029 and GHA059", () => {
+    expect(pinningFindings(workflowYaml("sha"))).toEqual([]);
+  });
+
+  test("the default tag warning names the exact fix", () => {
+    const messages = pinningFindings(workflowYaml()).map((d) => d.message);
+    expect(messages).toHaveLength(2);
+    expect(messages[0]).toContain(`\`uses: ${actionRef("actions/checkout", "sha")}\``);
+    expect(messages[0]).toContain(`Checkout({ pin: "sha" })`);
+    expect(messages[1]).toContain(`\`uses: ${actionRef("actions/setup-node", "sha")}\``);
+    expect(messages[1]).toContain(`SetupNode({ pin: "sha" })`);
+  });
+
+  test("an action outside the pin table gets no fix hint", () => {
+    const yaml = "jobs:\n  a:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: acme/deploy@v1\n";
+    const [finding] = gha029.check(ctx(yaml));
+    expect(finding.message).toMatch(/security\.$/);
+  });
+
+  test("the github-pr-preview example's literal pins match the table", () => {
+    // The example writes its pins as literals so the project still folds.
+    const source = readFileSync(join(__dirname, "../../../examples/github-pr-preview/src/ci/setup.ts"), "utf8");
+    expect(source).toContain(`"${actionRef("actions/checkout", "sha")}"`);
+    expect(source).toContain(`"${actionRef("actions/setup-node", "sha")}"`);
+  });
+});

package/src/action-pins.ts

@@ -0,0 +1,75 @@
+/**
+ * The action versions the github lexicon emits, and the commit each release
+ * tag points at.
+ *
+ * Composites emit `<slug>@<major>` by default. With `pin: "sha"` they emit
+ * `<slug>@<sha> # <version>`, the form GHA021 and GHA029 accept and GHA059
+ * reads the version label from. The serializer writes the `# <version>` part
+ * as a YAML comment, so GitHub sees only the SHA.
+ *
+ * Refresh a row by resolving the release tag to its commit:
+ *
+ *   gh api repos/actions/checkout/commits/v7.0.1 --jq .sha
+ *
+ * Keep `major` on a version whose action runs on a Node runtime GitHub still
+ * supports.
+ */
+
+export interface ActionPin {
+  /** The major tag composites emit by default, such as `v7`. */
+  major: string;
+  /** The release the SHA belongs to, written as the pin's comment. */
+  version: string;
+  /** The full commit SHA of `version`. */
+  sha: string;
+}
+
+export const ACTION_PINS = {
+  "actions/checkout": {
+    major: "v7",
+    version: "v7.0.1",
+    sha: "3d3c42e5aac5ba805825da76410c181273ba90b1",
+  },
+  "actions/setup-node": {
+    major: "v7",
+    version: "v7.0.0",
+    sha: "820762786026740c76f36085b0efc47a31fe5020",
+  },
+} as const satisfies Record<string, ActionPin>;
+
+export type PinnedAction = keyof typeof ACTION_PINS;
+
+/**
+ * How a composite refers to its action: `"tag"` emits the major tag
+ * (`actions/checkout@v7`), `"sha"` emits the pinned commit with its version
+ * as a comment (`actions/checkout@3d3c…90b1 # v7.0.1`).
+ */
+export type ActionPinMode = "tag" | "sha";
+
+/** The `uses:` value for a pinned action. */
+export function actionRef(slug: PinnedAction, pin: ActionPinMode = "tag"): string {
+  const entry: ActionPin = ACTION_PINS[slug];
+  return pin === "sha" ? `${slug}@${entry.sha} # ${entry.version}` : `${slug}@${entry.major}`;
+}
+
+/** The pin table entry for an action slug, if the lexicon maintains one. */
+export function actionPin(slug: string): ActionPin | undefined {
+  return Object.prototype.hasOwnProperty.call(ACTION_PINS, slug)
+    ? ACTION_PINS[slug as PinnedAction]
+    : undefined;
+}
+
+const COMPOSITE_FOR: Record<PinnedAction, string> = {
+  "actions/checkout": "Checkout",
+  "actions/setup-node": "SetupNode",
+};
+
+/**
+ * The exact fix a pinning warning names for an action in the pin table, or
+ * an empty string for any other action.
+ */
+export function pinFixHint(slug: string): string {
+  if (!actionPin(slug)) return "";
+  const pinned = slug as PinnedAction;
+  return ` Use \`uses: ${actionRef(pinned, "sha")}\`, which ${COMPOSITE_FOR[pinned]}({ pin: "sha" }) emits.`;
+}

package/src/codegen/docs.ts

@@ -55,7 +55,7 @@ The generated file includes:
 | \`export const buildApp = new Job({...})\` | \`jobs: build-app:\` | Export name → kebab-case job key |
 | \`"runs-on": "ubuntu-latest"\` | \`runs-on: ubuntu-latest\` | Property names match GitHub spec |
 | \`timeoutMinutes: 15\` | \`timeout-minutes: 15\` | camelCase → kebab-case for job properties |
-| \`new Step({ uses: "actions/checkout@v4" })\` | \`- uses: actions/checkout@v4\` | Steps serialize as sequence entries |
+| \`new Step({ uses: "actions/checkout@v7" })\` | \`- uses: actions/checkout@v7\` | Steps serialize as sequence entries |
 
 ## Validating locally