@intentius/chant-lexicon-github 0.124.31 → 0.124.32

package/dist/lint/post-synth/gha039.js

@@ -0,0 +1,34 @@
+/**
+ * GHA039: Spoofable Identity Used as an Authorization Gate
+ *
+ * Flags an `if:` condition that gates execution on a commit-author identity
+ * field (`...author.name` / `...author.email`). Those values come straight from
+ * git metadata the committer sets freely, so an attacker can forge them to pass
+ * the gate. Use a trustworthy signal — environment protection rules, CODEOWNERS,
+ * or membership checks against a verified actor.
+ */
+import { getPrimaryOutput, extractIfConditions } from "./yaml-helpers.js";
+const SPOOFABLE_FIELD_RE = /\.author\.(name|email)\b/;
+const COMPARISON_RE = /==|!=|contains\s*\(/;
+export const gha039 = {
+    id: "GHA039",
+    description: "Authorization gate on a spoofable commit-author identity field",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const { job, expr } of extractIfConditions(yaml)) {
+                if (SPOOFABLE_FIELD_RE.test(expr) && COMPARISON_RE.test(expr)) {
+                    diagnostics.push({
+                        checkId: "GHA039",
+                        severity: "warning",
+                        message: `Job "${job}" gates on a commit-author identity field in an if: condition (${expr}). Author name/email are attacker-controlled and can be spoofed — gate on a verified signal (environment protection, CODEOWNERS, verified actor) instead.`,
+                        entity: job,
+                        lexicon: "github",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha040.js

@@ -0,0 +1,36 @@
+/**
+ * GHA040: Self-Hosted Runner on a Trigger That Can Run Untrusted Code
+ *
+ * Flags a job that runs on a self-hosted runner under a trigger reachable by a
+ * fork or outside contributor (`pull_request`, `pull_request_target`,
+ * `workflow_run`). Self-hosted runners are non-ephemeral by default and share a
+ * host, so untrusted code can persist on the runner and compromise later jobs.
+ */
+import { getPrimaryOutput, extractTriggers, extractRunsOnByJob } from "./yaml-helpers.js";
+const UNTRUSTED_TRIGGERS = ["pull_request", "pull_request_target", "workflow_run"];
+export const gha040 = {
+    id: "GHA040",
+    description: "Self-hosted runner on a trigger that can run untrusted code",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            const triggers = extractTriggers(yaml);
+            const untrusted = UNTRUSTED_TRIGGERS.filter((t) => triggers[t]);
+            if (untrusted.length === 0)
+                continue;
+            for (const [job, labels] of extractRunsOnByJob(yaml)) {
+                if (labels.some((l) => l === "self-hosted")) {
+                    diagnostics.push({
+                        checkId: "GHA040",
+                        severity: "warning",
+                        message: `Job "${job}" runs on a self-hosted runner under the ${untrusted.join("/")} trigger, which a fork can reach. Use ephemeral GitHub-hosted runners for untrusted code, or require approval before the job runs.`,
+                        entity: job,
+                        lexicon: "github",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha041.js

@@ -0,0 +1,32 @@
+/**
+ * GHA041: Blanket `secrets: inherit` into a Reusable Workflow
+ *
+ * Flags a reusable-workflow call that passes `secrets: inherit`. Inheritance
+ * hands the called workflow every secret the caller can see, regardless of what
+ * it needs. Pass through only the specific secrets the reusable workflow uses.
+ */
+import { getPrimaryOutput, jobLines } from "./yaml-helpers.js";
+export const gha041 = {
+    id: "GHA041",
+    description: "Blanket secrets: inherit into a reusable workflow",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            const seen = new Set();
+            for (const { job, line } of jobLines(yaml)) {
+                if (/^\s+secrets:\s*inherit\s*$/.test(line) && !seen.has(job)) {
+                    seen.add(job);
+                    diagnostics.push({
+                        checkId: "GHA041",
+                        severity: "warning",
+                        message: `Job "${job}" calls a reusable workflow with secrets: inherit, passing every caller secret. Pass through only the specific secrets it needs.`,
+                        entity: job,
+                        lexicon: "github",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha042.js

@@ -0,0 +1,33 @@
+/**
+ * GHA042: Whole Secrets Context Passed Where Specific Secrets Would Do
+ *
+ * Flags `toJSON(secrets)` (serializing the entire secrets context) passed into
+ * a step's `with:`/`env:` or to a reusable workflow. It hands the consumer every
+ * secret instead of the one or two it needs. Reference specific secrets.
+ */
+import { getPrimaryOutput, jobLines } from "./yaml-helpers.js";
+const TO_JSON_SECRETS = /to_?json\s*\(\s*secrets\s*\)/i;
+export const gha042 = {
+    id: "GHA042",
+    description: "Entire secrets context passed where specific secrets would do",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            const seen = new Set();
+            for (const { job, line } of jobLines(yaml)) {
+                if (TO_JSON_SECRETS.test(line) && !seen.has(job)) {
+                    seen.add(job);
+                    diagnostics.push({
+                        checkId: "GHA042",
+                        severity: "warning",
+                        message: `Job "${job}" passes the entire secrets context via toJSON(secrets). Reference only the specific secrets the consumer needs.`,
+                        entity: job,
+                        lexicon: "github",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha043.js

@@ -0,0 +1,35 @@
+/**
+ * GHA043: Secret Consumed in a Job Without an Environment Gate
+ *
+ * Extends GHA026 (which fires only when a workflow uses secrets and defines no
+ * environment at all). When a workflow *does* gate some jobs with an
+ * `environment:`, this flags the specific jobs that consume secrets without one
+ * — the inconsistent-gating case, where a secret-using job skips the approval
+ * and scoping the author applied elsewhere.
+ */
+import { getPrimaryOutput, jobsReferencingSecrets, extractJobEnvironments } from "./yaml-helpers.js";
+export const gha043 = {
+    id: "GHA043",
+    description: "Secret consumed in a job without an environment gate",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            const gated = extractJobEnvironments(yaml);
+            if (gated.size === 0)
+                continue; // no environments used anywhere — GHA026 territory
+            for (const job of jobsReferencingSecrets(yaml)) {
+                if (!gated.has(job)) {
+                    diagnostics.push({
+                        checkId: "GHA043",
+                        severity: "warning",
+                        message: `Job "${job}" consumes a secret but declares no environment:, while other jobs in this workflow are environment-gated. Gate this job too, or confirm it should bypass the approval/scoping the others use.`,
+                        entity: job,
+                        lexicon: "github",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha044.js

@@ -0,0 +1,36 @@
+/**
+ * GHA044: Hardcoded Registry / Container Credential
+ *
+ * Flags a `password:` / `token:` / `registry-password:` value that is a literal
+ * rather than a `${{ secrets.* }}` reference — e.g. a registry login or service
+ * credential inlined in plain text. Move it into a secret.
+ */
+import { getPrimaryOutput, jobLines } from "./yaml-helpers.js";
+const CRED_KEY_RE = /^\s+(?:- )?(password|token|registry-password):\s*(.+)$/;
+export const gha044 = {
+    id: "GHA044",
+    description: "Hardcoded registry/container credential",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const { job, line } of jobLines(yaml)) {
+                const m = line.match(CRED_KEY_RE);
+                if (!m)
+                    continue;
+                const key = m[1];
+                const value = m[2].trim().replace(/^['"]|['"]$/g, "");
+                if (value === "" || value.includes("${{"))
+                    continue; // empty or a proper expression
+                diagnostics.push({
+                    checkId: "GHA044",
+                    severity: "error",
+                    message: `Job "${job}" sets ${key}: to a hardcoded literal. Reference a secret (\${{ secrets.NAME }}) instead of inlining the credential.`,
+                    entity: job,
+                    lexicon: "github",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha045.js

@@ -0,0 +1,33 @@
+/**
+ * GHA045: Secret Interpolated Directly into a Shell Command
+ *
+ * Flags `${{ secrets.* }}` expanded straight into a `run:` script. The value is
+ * substituted into the command line before the shell runs, where a transform
+ * (base64, reversing, splitting) can defeat GitHub's log masking and leak it,
+ * and the raw value is exposed to argument-injection. Pass secrets through an
+ * `env:` variable and reference "$VAR" quoted instead.
+ */
+import { getPrimaryOutput, extractRunBlocks, extractExpressions } from "./yaml-helpers.js";
+export const gha045 = {
+    id: "GHA045",
+    description: "Secret interpolated directly into a run: shell command",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const { job, run } of extractRunBlocks(yaml)) {
+                const leaked = extractExpressions(run).some((e) => /\bsecrets\./.test(e));
+                if (!leaked)
+                    continue;
+                diagnostics.push({
+                    checkId: "GHA045",
+                    severity: "warning",
+                    message: `Job "${job}" interpolates a secret directly into a run: script, where a transform can defeat log masking. Pass it through an env: variable and reference "$VAR" quoted instead.`,
+                    entity: job,
+                    lexicon: "github",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha046.js

@@ -0,0 +1,55 @@
+/**
+ * GHA046: Logically Unsound Guard Condition
+ *
+ * Flags an `if:` condition that reads like a security/flow gate but evaluates to
+ * a constant — `true`/`false` literals, an `X == X` tautology, or an expression
+ * that collapses via `|| true` / `&& false`. These pass review by looking like a
+ * control while gating nothing (or everything).
+ */
+import { getPrimaryOutput, extractIfConditions } from "./yaml-helpers.js";
+/** Strip a leading `${{` / trailing `}}` wrapper from an expression. */
+function inner(expr) {
+    return expr.replace(/^\$\{\{/, "").replace(/\}\}$/, "").trim();
+}
+/** Classify a condition as a constant guard, returning a reason or undefined. */
+export function unsoundReason(expr) {
+    const e = inner(expr);
+    if (e === "true")
+        return "always true (true literal)";
+    if (e === "false")
+        return "always false (false literal)";
+    if (/\|\|\s*true\b/.test(e))
+        return "always true (|| true collapses the condition)";
+    if (/&&\s*false\b/.test(e))
+        return "always false (&& false collapses the condition)";
+    const eq = e.match(/^([\w.$'"[\]-]+)\s*==\s*([\w.$'"[\]-]+)$/);
+    if (eq && eq[1] === eq[2])
+        return "always true (both sides of == are identical)";
+    const ne = e.match(/^([\w.$'"[\]-]+)\s*!=\s*([\w.$'"[\]-]+)$/);
+    if (ne && ne[1] === ne[2])
+        return "always false (both sides of != are identical)";
+    return undefined;
+}
+export const gha046 = {
+    id: "GHA046",
+    description: "Logically unsound (constant) guard condition",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const { job, expr } of extractIfConditions(yaml)) {
+                const reason = unsoundReason(expr);
+                if (!reason)
+                    continue;
+                diagnostics.push({
+                    checkId: "GHA046",
+                    severity: "warning",
+                    message: `Job "${job}" has an if: condition that is ${reason}: "${expr}". A gate that does not constrain anything is misleading — remove it or write the real condition.`,
+                    entity: job,
+                    lexicon: "github",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha047.js

@@ -0,0 +1,44 @@
+/**
+ * GHA047: Ineffective `contains()` Guard (Reversed Arguments)
+ *
+ * Flags `contains('literal', <dynamic>)` — a string literal as the haystack and
+ * a dynamic value as the needle. `contains(search, item)` checks whether `item`
+ * is in `search`, so a constant first argument makes the result depend on a
+ * fixed string rather than the runtime value the author intended to test. The
+ * usual fix is to swap the arguments.
+ */
+import { getPrimaryOutput, extractIfConditions } from "./yaml-helpers.js";
+// contains( 'literal' | "literal" , <something that is not a literal> )
+const REVERSED_CONTAINS = /contains\(\s*(['"][^'"]*['"])\s*,\s*([^)]+)\)/g;
+function isLiteral(arg) {
+    const t = arg.trim();
+    return (t.startsWith("'") && t.endsWith("'")) || (t.startsWith('"') && t.endsWith('"'));
+}
+export const gha047 = {
+    id: "GHA047",
+    description: "Ineffective contains() guard with reversed arguments",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const { job, expr } of extractIfConditions(yaml)) {
+                let m;
+                REVERSED_CONTAINS.lastIndex = 0;
+                while ((m = REVERSED_CONTAINS.exec(expr)) !== null) {
+                    // First arg is a literal; flag only when the second arg is dynamic.
+                    if (isLiteral(m[2]))
+                        continue;
+                    diagnostics.push({
+                        checkId: "GHA047",
+                        severity: "warning",
+                        message: `Job "${job}" calls contains() with a string-literal haystack and a dynamic needle: "${m[0]}". contains(search, item) tests whether item is in search — swap the arguments so the dynamic value is searched.`,
+                        entity: job,
+                        lexicon: "github",
+                    });
+                    break;
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha048.js

@@ -0,0 +1,34 @@
+/**
+ * GHA048: Obfuscated Guard Condition
+ *
+ * Flags an `if:` condition that builds its compared value through string
+ * indirection — `format()`, `join()`, or `fromJSON()` feeding a comparison.
+ * Constructing the operand at evaluation time hides what the gate actually
+ * checks, which is how an unsound condition (GHA046/GHA047) is disguised to pass
+ * review. Write the comparison against the value directly.
+ */
+import { getPrimaryOutput, extractIfConditions } from "./yaml-helpers.js";
+const INDIRECTION = /\b(format|join|fromJSON)\s*\(/i;
+const COMPARISON = /==|!=|&&|\|\||contains\(|startsWith\(|endsWith\(/;
+export const gha048 = {
+    id: "GHA048",
+    description: "Obfuscated guard condition (operand built by indirection)",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const { job, expr } of extractIfConditions(yaml)) {
+                if (INDIRECTION.test(expr) && COMPARISON.test(expr)) {
+                    diagnostics.push({
+                        checkId: "GHA048",
+                        severity: "warning",
+                        message: `Job "${job}" builds its if: gate through string indirection (format/join/fromJSON) feeding a comparison: "${expr}". Compare against the value directly so the condition is auditable.`,
+                        entity: job,
+                        lexicon: "github",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha049.js

@@ -0,0 +1,36 @@
+/**
+ * GHA049: Persisted Checkout Credentials Reachable by an Uploaded Artifact
+ *
+ * `actions/checkout` writes the job token into `.git/config` by default
+ * (`persist-credentials: true`). A job that also uploads an artifact can sweep
+ * that `.git` directory into the artifact, leaking the token to anyone who can
+ * download it. Set `persist-credentials: false` on the checkout when the job
+ * uploads artifacts.
+ */
+import { getPrimaryOutput, linesByJob } from "./yaml-helpers.js";
+export const gha049 = {
+    id: "GHA049",
+    description: "Persisted checkout credentials reachable by an uploaded artifact",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const [job, lines] of linesByJob(yaml)) {
+                const text = lines.join("\n");
+                const hasCheckout = /uses:\s*actions\/checkout/.test(text);
+                const persistDisabled = /persist-credentials:\s*false/.test(text);
+                const uploadsArtifact = /uses:\s*actions\/upload-artifact/.test(text);
+                if (hasCheckout && uploadsArtifact && !persistDisabled) {
+                    diagnostics.push({
+                        checkId: "GHA049",
+                        severity: "warning",
+                        message: `Job "${job}" checks out with persisted credentials (default) and uploads an artifact — the token in .git/config can leak into the artifact. Set persist-credentials: false on the checkout.`,
+                        entity: job,
+                        lexicon: "github",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha050.js

@@ -0,0 +1,37 @@
+/**
+ * GHA050: Cache Populated in a Privileged Context (Poisoning Risk)
+ *
+ * Flags `actions/cache` use under a privileged trigger (`pull_request_target`,
+ * `workflow_run`) that runs in the base-repo context. Cache entries written from
+ * code influenced by a fork can later be restored by a trusted run and executed,
+ * a cache-poisoning path. Restrict caching to trusted triggers or scope keys so
+ * untrusted runs cannot write entries a privileged run will restore.
+ */
+import { getPrimaryOutput, extractTriggers, linesByJob } from "./yaml-helpers.js";
+const PRIVILEGED_TRIGGERS = ["pull_request_target", "workflow_run"];
+export const gha050 = {
+    id: "GHA050",
+    description: "Cache populated in a privileged context (poisoning risk)",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            const triggers = extractTriggers(yaml);
+            const privileged = PRIVILEGED_TRIGGERS.filter((t) => triggers[t]);
+            if (privileged.length === 0)
+                continue;
+            for (const [job, lines] of linesByJob(yaml)) {
+                if (lines.some((l) => /uses:\s*actions\/cache/.test(l))) {
+                    diagnostics.push({
+                        checkId: "GHA050",
+                        severity: "warning",
+                        message: `Job "${job}" populates a cache under the ${privileged.join("/")} trigger, which runs in the privileged base context. A poisoned cache entry could be restored and executed by a trusted run — restrict caching to trusted triggers.`,
+                        entity: job,
+                        lexicon: "github",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha051.js

@@ -0,0 +1,38 @@
+/**
+ * GHA051: Publish/Release Step Using a Long-Lived Token Instead of OIDC
+ *
+ * Flags a job that publishes a release/package using a long-lived token secret
+ * (`*_TOKEN`, `*_PASSWORD`, `*_API_KEY`) while the workflow requests no
+ * `id-token: write` permission. Registries that support OIDC let a workflow mint
+ * a short-lived, audience-scoped credential per run instead of holding a
+ * standing secret. Advisory — not every registry supports OIDC.
+ */
+import { getPrimaryOutput, linesByJob } from "./yaml-helpers.js";
+const PUBLISH_RE = /npm publish|yarn publish|pnpm publish|twine upload|poetry publish|cargo publish|gh release create|docker push|gh-action-pypi-publish|npm-publish/;
+const LONG_LIVED_SECRET_RE = /secrets\.(?!GITHUB_TOKEN\b)\w*(TOKEN|PASSWORD|API_KEY|APIKEY)/i;
+export const gha051 = {
+    id: "GHA051",
+    description: "Publish/release step using a long-lived token instead of OIDC",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            const requestsOidc = /id-token:\s*write/.test(yaml);
+            if (requestsOidc)
+                continue;
+            for (const [job, lines] of linesByJob(yaml)) {
+                const text = lines.join("\n");
+                if (PUBLISH_RE.test(text) && LONG_LIVED_SECRET_RE.test(text)) {
+                    diagnostics.push({
+                        checkId: "GHA051",
+                        severity: "info",
+                        message: `Job "${job}" publishes using a long-lived token secret and requests no id-token: write. If the registry supports OIDC, mint a short-lived federated credential (permissions: id-token: write) instead of holding a standing token.`,
+                        entity: job,
+                        lexicon: "github",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha052.js

@@ -0,0 +1,35 @@
+/**
+ * GHA052: Software Fetched and Executed at Runtime Without Verification
+ *
+ * Flags a `run:` step that pipes a network download straight into a shell
+ * (`curl ... | bash`, `wget ... | sh`, `iwr ... | iex`). The fetched script is
+ * unpinned and unverified, so whoever controls the URL controls what executes
+ * in the job. Download to a file, verify a checksum/signature, then run it.
+ */
+import { getPrimaryOutput, extractRunBlocks } from "./yaml-helpers.js";
+const PIPE_TO_SHELL = [
+    /\b(curl|wget)\b[^\n|]*\|\s*(sudo\s+)?(ba)?sh\b/i,
+    /\b(iwr|invoke-webrequest|irm|invoke-restmethod)\b[^\n|]*\|\s*(iex|invoke-expression)\b/i,
+];
+export const gha052 = {
+    id: "GHA052",
+    description: "Software fetched and piped to a shell without verification",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const { job, run } of extractRunBlocks(yaml)) {
+                if (PIPE_TO_SHELL.some((re) => re.test(run))) {
+                    diagnostics.push({
+                        checkId: "GHA052",
+                        severity: "warning",
+                        message: `Job "${job}" pipes a network download directly into a shell — the fetched code is unpinned and unverified. Download to a file, verify a checksum or signature, then execute it.`,
+                        entity: job,
+                        lexicon: "github",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha053.js

@@ -0,0 +1,34 @@
+/**
+ * GHA053: Re-enabling Unsafe Workflow-Command Processing
+ *
+ * Flags opt-ins that reintroduce the `set-env` / `add-path` workflow commands
+ * removed for security (CVE-2020-15228) — `ACTIONS_ALLOW_UNSECURE_COMMANDS` and
+ * direct `::set-env::` / `::add-path::` emission. These let a logged string set
+ * arbitrary environment/PATH state for later steps, a code-execution path.
+ */
+import { getPrimaryOutput, linesByJob } from "./yaml-helpers.js";
+const UNSAFE_COMMANDS = /ACTIONS_ALLOW_UNSECURE_COMMANDS|::set-env\s|::add-path\s/;
+export const gha053 = {
+    id: "GHA053",
+    description: "Re-enables unsafe set-env / add-path workflow commands",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            const seen = new Set();
+            for (const [job, lines] of linesByJob(yaml)) {
+                if (lines.some((l) => UNSAFE_COMMANDS.test(l)) && !seen.has(job)) {
+                    seen.add(job);
+                    diagnostics.push({
+                        checkId: "GHA053",
+                        severity: "error",
+                        message: `Job "${job}" re-enables the unsafe set-env/add-path workflow commands (ACTIONS_ALLOW_UNSECURE_COMMANDS or ::set-env::/::add-path::). Use $GITHUB_ENV / $GITHUB_PATH files instead — the legacy commands were removed for security.`,
+                        entity: job,
+                        lexicon: "github",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha054.js

@@ -0,0 +1,35 @@
+/**
+ * GHA054: Use of a Feature with a Known Security Footgun
+ *
+ * Catch-all, data-driven check: flags emitted workflow content matching a
+ * vendored snapshot of known-risky GitHub Actions features (deprecated workflow
+ * commands, unsafe runtime opt-ins, masking footguns). Advisory; the dataset is
+ * necessarily incomplete.
+ */
+import { getPrimaryOutput, linesByJob } from "./yaml-helpers.js";
+import { RISKY_FEATURES } from "../rules/data/risky-features.js";
+export const gha054 = {
+    id: "GHA054",
+    description: "Use of a feature with a known security footgun",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const [job, lines] of linesByJob(yaml)) {
+                const text = lines.join("\n");
+                for (const feature of RISKY_FEATURES) {
+                    if (feature.pattern.test(text)) {
+                        diagnostics.push({
+                            checkId: "GHA054",
+                            severity: "warning",
+                            message: `Job "${job}" uses ${feature.label} — ${feature.advice}.`,
+                            entity: job,
+                            lexicon: "github",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha055.js

@@ -0,0 +1,44 @@
+/**
+ * GHA055: Runtime Install of a Tool Already on the Runner
+ *
+ * Flags a `run:` step that installs (apt/brew/apk/choco) a tool that GitHub-
+ * hosted runners already ship. The redundant install adds a third-party
+ * download and supply-chain surface for no benefit and slows the job. Advisory;
+ * irrelevant on self-hosted runners that may lack the tool.
+ */
+import { getPrimaryOutput, extractRunBlocks } from "./yaml-helpers.js";
+import { PREINSTALLED_TOOLS } from "../rules/data/preinstalled-tools.js";
+const INSTALL_RE = /\b(?:apt(?:-get)?\s+install|brew\s+install|apk\s+add|choco\s+install)\b([^\n]*)/g;
+export const gha055 = {
+    id: "GHA055",
+    description: "Runtime install of a tool already present on the runner",
+    check(ctx) {
+        const diagnostics = [];
+        const preinstalled = new Set(PREINSTALLED_TOOLS);
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const { job, run } of extractRunBlocks(yaml)) {
+                const redundant = new Set();
+                let m;
+                INSTALL_RE.lastIndex = 0;
+                while ((m = INSTALL_RE.exec(run)) !== null) {
+                    for (const tok of m[1].split(/\s+/)) {
+                        const name = tok.replace(/[^\w.+-]/g, "");
+                        if (name && preinstalled.has(name))
+                            redundant.add(name);
+                    }
+                }
+                if (redundant.size > 0) {
+                    diagnostics.push({
+                        checkId: "GHA055",
+                        severity: "info",
+                        message: `Job "${job}" installs ${[...redundant].join(", ")} at runtime, but GitHub-hosted runners already ship ${redundant.size > 1 ? "these tools" : "this tool"}. Drop the redundant install (or rely on the preinstalled version) to reduce supply-chain surface.`,
+                        entity: job,
+                        lexicon: "github",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};