@intentius/chant-lexicon-github 0.124.31 → 0.124.32

package/dist/lint/post-synth/gha056.js

@@ -0,0 +1,32 @@
+/**
+ * GHA056: Workflow Without a `name:`
+ *
+ * Flags an emitted workflow with no top-level `name:`. Without one, GitHub falls
+ * back to the file path in the Actions UI and audit logs, making runs harder to
+ * identify and review. A clear name improves observability and audit output.
+ */
+import { getPrimaryOutput, extractWorkflowName } from "./yaml-helpers.js";
+export const gha056 = {
+    id: "GHA056",
+    description: "Workflow without a name",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [lexicon, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            // Only inspect things that look like workflows (have a jobs: block).
+            if (!/^jobs:\s*$/m.test(yaml))
+                continue;
+            const name = extractWorkflowName(yaml);
+            if (!name) {
+                diagnostics.push({
+                    checkId: "GHA056",
+                    severity: "info",
+                    message: `Workflow "${lexicon}" has no top-level name: — add one so runs are identifiable in the Actions UI and audit logs.`,
+                    entity: "workflow",
+                    lexicon: "github",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha057.js

@@ -0,0 +1,35 @@
+/**
+ * GHA057: Dependency Update Executing Untrusted External Code
+ *
+ * Flags a dependabot `updates:` entry with
+ * `insecure-external-code-execution: allow`. That setting lets a freshly-pulled
+ * dependency run lifecycle scripts (e.g. npm `postinstall`) during the update
+ * itself — a compromised release executes in the update job before any review.
+ * Set it to `deny`, or isolate the ecosystem.
+ */
+import { getDependabotYaml, extractDependabotUpdates } from "./yaml-helpers.js";
+export const gha057 = {
+    id: "GHA057",
+    description: "Dependency update allows executing untrusted external code",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const dependabot = getDependabotYaml(output);
+            if (!dependabot)
+                continue;
+            for (const update of extractDependabotUpdates(dependabot)) {
+                if (update["insecure-external-code-execution"] === "allow") {
+                    const eco = String(update["package-ecosystem"] ?? "?");
+                    diagnostics.push({
+                        checkId: "GHA057",
+                        severity: "error",
+                        message: `Dependabot update for "${eco}" sets insecure-external-code-execution: allow, running dependency lifecycle scripts during the update. Set it to deny.`,
+                        entity: eco,
+                        lexicon: "github",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha058.js

@@ -0,0 +1,42 @@
+/**
+ * GHA058: Dependency Update Without a Cooldown
+ *
+ * Flags a dependabot `updates:` entry with no cooldown (or an all-zero one). A
+ * version published seconds ago — including a compromised one — is adopted
+ * immediately, with no window for the ecosystem to yank it or for anyone to
+ * react. Configure a `cooldown:` so freshly-published versions wait before they
+ * are proposed.
+ */
+import { getDependabotYaml, extractDependabotUpdates } from "./yaml-helpers.js";
+const COOLDOWN_DAY_KEYS = ["default-days", "semver-major-days", "semver-minor-days", "semver-patch-days"];
+function hasEffectiveCooldown(cooldown) {
+    if (!cooldown || typeof cooldown !== "object")
+        return false;
+    const c = cooldown;
+    return COOLDOWN_DAY_KEYS.some((k) => typeof c[k] === "number" && c[k] > 0);
+}
+export const gha058 = {
+    id: "GHA058",
+    description: "Dependency update has no cooldown window",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const dependabot = getDependabotYaml(output);
+            if (!dependabot)
+                continue;
+            for (const update of extractDependabotUpdates(dependabot)) {
+                if (!hasEffectiveCooldown(update.cooldown)) {
+                    const eco = String(update["package-ecosystem"] ?? "?");
+                    diagnostics.push({
+                        checkId: "GHA058",
+                        severity: "warning",
+                        message: `Dependabot update for "${eco}" has no cooldown — a version published moments ago is adopted immediately. Add a cooldown window so fresh (possibly compromised) releases wait before they are proposed.`,
+                        entity: eco,
+                        lexicon: "github",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha059.js

@@ -0,0 +1,119 @@
+/**
+ * GHA059: Stale or Missing Pin Annotation
+ *
+ * A ref pinned to a commit SHA is only as trustworthy as the label a reviewer
+ * reads next to it — `uses: actions/setup-node@1a2b…9a0b # v4.0.2` lets a
+ * reviewer sanity-check the digest without resolving it themselves. This check
+ * flags two ways that label goes stale:
+ *
+ *  1. Missing — a SHA-pinned ref with no trailing version comment at all.
+ *  2. Mismatched — inferred without any network call, from internal
+ *     inconsistency in the workflow itself: the same action is pinned to the
+ *     same commit SHA in one place and a *different* label in another, or the
+ *     same label is attached to two *different* commit SHAs. Either shape
+ *     proves at least one of the labels is wrong — a real digest has exactly
+ *     one correct human-readable name.
+ *
+ * Cross-referencing a label against the actual git history (to catch a lone,
+ * internally-consistent but still-wrong annotation) needs a network call and
+ * is out of scope here — see GHA062 for the feed-based advisory check, which
+ * takes the same "no network in the rule itself" stance via an injected feed.
+ */
+import { getPrimaryOutput, extractActionRefs, extractUsesComment, parseActionUses, usesLineComments } from "./yaml-helpers.js";
+const SHA_RE = /^[0-9a-f]{40}$/;
+/**
+ * Find every SHA-pinned `uses:` with a missing or internally-inconsistent
+ * version annotation. Scoped to one workflow document — cross-file
+ * consistency isn't attempted since two independent workflows pinning the
+ * same action differently isn't evidence of drift.
+ */
+export function findStalePinAnnotations(yaml) {
+    const refs = extractActionRefs(yaml)
+        .map(({ job, ref }) => ({ job, ref, parsed: parseActionUses(ref) }))
+        .filter((r) => !!r.parsed && SHA_RE.test(r.parsed.gitRef));
+    const findings = [];
+    // First pass: missing annotations.
+    // The parsed value carries no comment, so match each ref to its `uses:`
+    // line, in document order, to read the label.
+    const lines = usesLineComments(yaml);
+    const commentFor = (ref) => {
+        const k = lines.findIndex((l) => l.ref === ref);
+        if (k === -1)
+            return extractUsesComment(ref);
+        return lines.splice(k, 1)[0].comment;
+    };
+    const withComment = [];
+    for (const { job, ref, parsed } of refs) {
+        const comment = commentFor(ref);
+        if (!comment) {
+            findings.push({ job, ref, slug: parsed.slug, sha: parsed.gitRef, kind: "missing" });
+        }
+        else {
+            withComment.push({ job, ref, slug: parsed.slug, sha: parsed.gitRef, comment });
+        }
+    }
+    // Second pass: internal mismatch. Group by slug — the same action's
+    // commit-SHA↔label mapping must be one-to-one across the whole file.
+    const bySlug = new Map();
+    for (const entry of withComment) {
+        const list = bySlug.get(entry.slug) ?? [];
+        list.push(entry);
+        bySlug.set(entry.slug, list);
+    }
+    for (const [, entries] of bySlug) {
+        const shaToComments = new Map();
+        const commentToShas = new Map();
+        for (const e of entries) {
+            (shaToComments.get(e.sha) ?? shaToComments.set(e.sha, new Set()).get(e.sha)).add(e.comment);
+            (commentToShas.get(e.comment) ?? commentToShas.set(e.comment, new Set()).get(e.comment)).add(e.sha);
+        }
+        for (const e of entries) {
+            const otherComments = [...(shaToComments.get(e.sha) ?? [])].filter((c) => c !== e.comment);
+            const otherShas = [...(commentToShas.get(e.comment) ?? [])].filter((s) => s !== e.sha);
+            if (otherComments.length > 0) {
+                findings.push({
+                    job: e.job,
+                    ref: e.ref,
+                    slug: e.slug,
+                    sha: e.sha,
+                    kind: "mismatched",
+                    conflict: `commit ${e.sha} is also annotated "# ${otherComments[0]}" elsewhere`,
+                });
+            }
+            else if (otherShas.length > 0) {
+                findings.push({
+                    job: e.job,
+                    ref: e.ref,
+                    slug: e.slug,
+                    sha: e.sha,
+                    kind: "mismatched",
+                    conflict: `label "# ${e.comment}" is also attached to commit ${otherShas[0]} elsewhere`,
+                });
+            }
+        }
+    }
+    return findings;
+}
+export const gha059 = {
+    id: "GHA059",
+    description: "SHA-pinned action reference has a missing or internally-inconsistent version annotation",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const finding of findStalePinAnnotations(yaml)) {
+                const message = finding.kind === "missing"
+                    ? `Job "${finding.job}" pins ${finding.ref} to a commit SHA with no trailing version comment (e.g. "# v4.0.2") — add one so reviewers can sanity-check the digest.`
+                    : `Job "${finding.job}" pins ${finding.ref} whose annotation is internally inconsistent (${finding.conflict}) — one of these labels no longer matches the digest it's attached to.`;
+                diagnostics.push({
+                    checkId: "GHA059",
+                    severity: "warning",
+                    message,
+                    entity: finding.job,
+                    lexicon: "github",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha060.js

@@ -0,0 +1,129 @@
+/**
+ * GHA060: Over-Scoped Generated Token
+ *
+ * Flags a GitHub App installation token minted with a `permission-<scope>:
+ * write`/`admin` input broader than what the job's consuming steps evidence.
+ * Targets the well-known GitHub App token actions (`actions/create-github-app-
+ * token`, `tibdex/github-app-token`, `getsentry/action-github-app-token`),
+ * which take `permission-<resource>: read|write|admin` inputs and hand back
+ * the minted token as a step output.
+ *
+ * Two ways a generated token is over-scoped:
+ *  1. Unused — the token's output (`steps.<id>.outputs.token`) is never
+ *     referenced by any other step in the job, so every write/admin scope
+ *     granted is pure waste.
+ *  2. No signal — the token IS consumed, but no other step in the job shows
+ *     any evidence (a `gh`/`git` invocation, an API path, a keyword) of
+ *     exercising a scope granted `write`/`admin`.
+ *
+ * "No signal" is a heuristic, not a proof — a step could exercise a scope
+ * through machinery this doesn't recognize (a custom script calling `octokit`
+ * directly, say). It reports `guidance`, not a `deterministic` fix, for
+ * exactly that reason: a human confirms before narrowing the grant.
+ */
+import { getPrimaryOutput, extractStepsByJob, parseActionUses } from "./yaml-helpers.js";
+const APP_TOKEN_SLUGS = new Set([
+    "actions/create-github-app-token",
+    "tibdex/github-app-token",
+    "getsentry/action-github-app-token",
+]);
+const WRITE_LEVELS = new Set(["write", "admin"]);
+/** Textual evidence that a step exercises a given permission scope. Not exhaustive — a fallback covers unlisted scopes. */
+const SCOPE_SIGNALS = {
+    contents: /git\s+push|gh\s+release|\/(?:git\/)?contents\b/i,
+    issues: /gh\s+issue|\/issues\b/i,
+    "pull-requests": /gh\s+pr\b|\/pulls\b/i,
+    packages: /npm\s+publish|docker\s+push|\/packages\b/i,
+    administration: /\/admin\b|administration/i,
+    actions: /\/actions\/runs|gh\s+run\b/i,
+    checks: /check-runs|\bchecks\b/i,
+    deployments: /\/deployments\b/i,
+    statuses: /\/statuses\b/i,
+    workflows: /\.github\/workflows/i,
+    environments: /\/environments\b/i,
+};
+function scopeSignalMatches(scope, text) {
+    const signal = SCOPE_SIGNALS[scope];
+    if (signal)
+        return signal.test(text);
+    return new RegExp(scope.replace(/-/g, "[-_ ]?"), "i").test(text);
+}
+function stepText(step) {
+    const parts = [];
+    if (typeof step.run === "string")
+        parts.push(step.run);
+    if (step.with && typeof step.with === "object")
+        parts.push(JSON.stringify(step.with));
+    if (step.env && typeof step.env === "object")
+        parts.push(JSON.stringify(step.env));
+    if (typeof step.uses === "string")
+        parts.push(step.uses);
+    return parts.join("\n");
+}
+/** Find every generated GitHub App token whose granted write/admin scopes exceed what the job's other steps evidence. */
+export function findOverScopedTokens(yaml) {
+    const findings = [];
+    for (const [job, steps] of extractStepsByJob(yaml)) {
+        steps.forEach((step, idx) => {
+            const uses = typeof step.uses === "string" ? step.uses : undefined;
+            if (!uses)
+                return;
+            const parsed = parseActionUses(uses);
+            if (!parsed || !APP_TOKEN_SLUGS.has(parsed.slug))
+                return;
+            const withBlock = step.with && typeof step.with === "object" ? step.with : {};
+            const stepId = typeof step.id === "string" ? step.id : `#${idx}`;
+            const writeScopes = [];
+            for (const [key, value] of Object.entries(withBlock)) {
+                const m = /^permission-([a-z-]+)$/i.exec(key);
+                if (!m)
+                    continue;
+                if (WRITE_LEVELS.has(String(value).toLowerCase()))
+                    writeScopes.push(m[1]);
+            }
+            if (writeScopes.length === 0)
+                return;
+            // Evidence comes only from OTHER steps — the minting step's own `with:`
+            // block names the scopes being granted, so it can't also count as
+            // evidence they're used.
+            const otherStepsText = steps
+                .filter((_, i) => i !== idx)
+                .map(stepText)
+                .join("\n");
+            const outputRef = `steps.${stepId}.outputs.token`;
+            if (!otherStepsText.includes(outputRef)) {
+                findings.push({ job, stepId, scopes: writeScopes, reason: "unused" });
+                return;
+            }
+            const unsignaled = writeScopes.filter((scope) => !scopeSignalMatches(scope, otherStepsText));
+            if (unsignaled.length > 0) {
+                findings.push({ job, stepId, scopes: unsignaled, reason: "no-signal" });
+            }
+        });
+    }
+    return findings;
+}
+export const gha060 = {
+    id: "GHA060",
+    description: "Generated GitHub App token granted broader scope than its consuming steps evidence",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const finding of findOverScopedTokens(yaml)) {
+                const scopeList = finding.scopes.map((s) => `permission-${s}`).join(", ");
+                const message = finding.reason === "unused"
+                    ? `Job "${finding.job}" step "${finding.stepId}" mints a GitHub App token with ${scopeList} but no other step references its output — remove the unused scope(s) or the token step entirely.`
+                    : `Job "${finding.job}" step "${finding.stepId}" mints a GitHub App token with ${scopeList}, but no consuming step shows evidence of exercising that scope — narrow the token to the scopes actually used.`;
+                diagnostics.push({
+                    checkId: "GHA060",
+                    severity: "warning",
+                    message,
+                    entity: finding.job,
+                    lexicon: "github",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha061.js

@@ -0,0 +1,78 @@
+/**
+ * GHA061: Action Reference Outside the Configured Usage Policy
+ *
+ * An opt-in allow/deny check over third-party `uses:` references, for
+ * environments that constrain which external components may run at all —
+ * distinct from GHA029/031/032, which judge a reference on its own pinning/
+ * naming/health, not against an organizational decision about who is trusted.
+ *
+ * Ships silent: `DEFAULT_ACTION_USAGE_POLICY` (../rules/data/action-usage-
+ * policy.ts) is empty, and {@link evaluateUsagePolicy} returns no findings
+ * for an empty policy — see that module's doc for why (`PostSynthContext`
+ * carries no per-check runtime config channel) and how a project actually
+ * opts in: author a `lint.policies` entry that calls `evaluateUsagePolicy`
+ * with its own policy, wrapped in a `PostSynthCheck`.
+ */
+import { getPrimaryOutput, extractActionRefs, parseActionUses } from "./yaml-helpers.js";
+import { DEFAULT_ACTION_USAGE_POLICY } from "../rules/data/action-usage-policy.js";
+function matches(entry, owner, slug) {
+    if (entry === slug)
+        return true;
+    if (entry === owner)
+        return true;
+    if (entry.endsWith("/*") && entry.slice(0, -2) === owner)
+        return true;
+    return false;
+}
+function matchesAny(entries, owner, slug) {
+    return (entries ?? []).some((e) => matches(e, owner, slug));
+}
+/**
+ * Evaluate a workflow's `uses:` references against a usage policy. Pure: no
+ * fs, no network, no default policy baked in — an empty/unset policy (no
+ * `allow` and no `deny`) always yields no findings, which is what makes this
+ * genuinely opt-in rather than "opt-in by omission of one flag."
+ */
+export function evaluateUsagePolicy(yaml, policy) {
+    const { allow, deny } = policy;
+    if ((!allow || allow.length === 0) && (!deny || deny.length === 0))
+        return [];
+    const diagnostics = [];
+    for (const { job, ref } of extractActionRefs(yaml)) {
+        const parsed = parseActionUses(ref);
+        if (!parsed)
+            continue; // local or docker:// reference — not a registry policy carries slugs for
+        if (matchesAny(deny, parsed.owner, parsed.slug)) {
+            diagnostics.push({
+                checkId: "GHA061",
+                severity: "error",
+                message: `Job "${job}" uses "${parsed.slug}", which is denied by the configured action-usage policy.`,
+                entity: job,
+                lexicon: "github",
+            });
+            continue;
+        }
+        if (allow && allow.length > 0 && !matchesAny(allow, parsed.owner, parsed.slug)) {
+            diagnostics.push({
+                checkId: "GHA061",
+                severity: "warning",
+                message: `Job "${job}" uses "${parsed.slug}", which is not in the configured action-usage allowlist.`,
+                entity: job,
+                lexicon: "github",
+            });
+        }
+    }
+    return diagnostics;
+}
+export const gha061 = {
+    id: "GHA061",
+    description: "Action reference outside the configured usage policy (opt-in)",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            diagnostics.push(...evaluateUsagePolicy(yaml, DEFAULT_ACTION_USAGE_POLICY));
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha062.js

@@ -0,0 +1,65 @@
+/**
+ * GHA062: Pinned Reference Matches a Known-Vulnerability Advisory
+ *
+ * Cross-references every pinned `uses:` (commit SHA or tag/branch) against a
+ * caller-supplied advisory feed and flags a match. Unlike GHA031/032's
+ * vendored, committed reference lists, a vulnerability feed is meant to be
+ * refreshed continuously — so this rule takes it as data, not code: the pure
+ * core never fetches (epic #350's design spine), and an absent/empty feed
+ * degrades to "no findings," never an error or a thrown exception. That is
+ * what "unreachable" means for a rule that makes no network call of its own:
+ * whatever couldn't reach the feed already failed upstream of this function,
+ * and this function's job is to not compound that with a crash.
+ */
+import { getPrimaryOutput, extractActionRefs, parseActionUses } from "./yaml-helpers.js";
+import { DEFAULT_ADVISORY_FEED } from "../rules/data/advisory-feed.js";
+function matchesEntry(entry, slug, gitRef) {
+    if (entry.slug !== slug)
+        return false;
+    if (entry.shas?.includes(gitRef))
+        return true;
+    if (entry.refs?.includes(gitRef))
+        return true;
+    return false;
+}
+/**
+ * Check a workflow's pinned action references against an advisory feed. Pure
+ * and total: a missing/empty feed (`entries.length === 0`, including the
+ * `undefined` default) always yields `[]`, never a throw.
+ */
+export function checkAdvisories(yaml, feed = DEFAULT_ADVISORY_FEED) {
+    if (!feed || !feed.entries || feed.entries.length === 0)
+        return [];
+    const diagnostics = [];
+    for (const { job, ref } of extractActionRefs(yaml)) {
+        const parsed = parseActionUses(ref);
+        if (!parsed)
+            continue;
+        for (const entry of feed.entries) {
+            if (!matchesEntry(entry, parsed.slug, parsed.gitRef))
+                continue;
+            const patch = entry.patchedRef ? ` A patched ref is available: ${entry.patchedRef}.` : "";
+            const link = entry.url ? ` (${entry.url})` : "";
+            diagnostics.push({
+                checkId: "GHA062",
+                severity: "error",
+                message: `Job "${job}" uses "${parsed.slug}@${parsed.gitRef}", which matches disclosed advisory ${entry.id}${link}: ${entry.summary}.${patch}`,
+                entity: job,
+                lexicon: "github",
+            });
+        }
+    }
+    return diagnostics;
+}
+export const gha062 = {
+    id: "GHA062",
+    description: "Pinned action reference matches a known-vulnerability advisory (feed-driven)",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            diagnostics.push(...checkAdvisories(yaml, DEFAULT_ADVISORY_FEED));
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha063.js

@@ -0,0 +1,56 @@
+/**
+ * GHA063: Dependency Setup Without Caching
+ *
+ * Flags a `actions/setup-{node,python,java,ruby,dotnet}` step that leaves its
+ * built-in `cache:` option unset, with no adjacent `actions/cache` step to
+ * cover the gap. Every run re-downloads the same dependencies from the
+ * registry from a cold cache — pure wasted time and bandwidth, not a
+ * correctness or security issue (efficiency, #444).
+ */
+import { getPrimaryOutput, jobEntries, parseActionUses } from "./yaml-helpers.js";
+/** Setup actions whose `with.cache` option enables built-in dependency caching. */
+const CACHEABLE_SETUP_ACTIONS = new Set(["actions/setup-node", "actions/setup-python", "actions/setup-java", "actions/setup-ruby", "actions/setup-dotnet"]);
+function cacheEnabled(withBlock) {
+    if (!withBlock || typeof withBlock !== "object")
+        return false;
+    const cache = withBlock.cache;
+    if (typeof cache === "boolean")
+        return cache;
+    if (typeof cache === "string")
+        return cache.trim().length > 0 && cache.trim() !== "false";
+    return false;
+}
+export const gha063 = {
+    id: "GHA063",
+    description: "Dependency setup action without caching enabled",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const [jobName, jobObj] of jobEntries(yaml)) {
+                const steps = Array.isArray(jobObj.steps) ? jobObj.steps : [];
+                const hasGenericCacheStep = steps.some((s) => parseActionUses(String(s.uses ?? ""))?.slug === "actions/cache");
+                if (hasGenericCacheStep)
+                    continue;
+                for (const step of steps) {
+                    const uses = typeof step.uses === "string" ? step.uses : undefined;
+                    if (!uses)
+                        continue;
+                    const parsed = parseActionUses(uses);
+                    if (!parsed || !CACHEABLE_SETUP_ACTIONS.has(parsed.slug))
+                        continue;
+                    if (cacheEnabled(step.with))
+                        continue;
+                    diagnostics.push({
+                        checkId: "GHA063",
+                        severity: "info",
+                        message: `Job "${jobName}" uses ${parsed.slug} without enabling its \`cache:\` option, and no separate actions/cache step covers it — dependencies are re-fetched from a cold cache on every run. Set \`with.cache\` (e.g. \`cache: npm\`) or add an actions/cache step.`,
+                        entity: jobName,
+                        lexicon: "github",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha064.js

@@ -0,0 +1,47 @@
+/**
+ * GHA064: Expensive Runner Without Justification
+ *
+ * Flags a job hardcoded onto a pricier macOS/Windows runner (billed at a
+ * multiple of Linux minutes) when none of its `run:` steps show any sign the
+ * job actually needs that OS. A matrix-driven `runs-on: ${{ matrix.os }}`
+ * (intentional cross-platform testing) is never flagged — only a literal,
+ * hardcoded label. Efficiency (#444), not a correctness/security issue.
+ */
+import { getPrimaryOutput, extractRunsOnByJob, extractRunBlocks } from "./yaml-helpers.js";
+const OS_JUSTIFICATION = [
+    { prefix: "macos-", label: "macOS", keywords: /xcodebuild|xcode-select|\.xcodeproj|\.xcworkspace|carthage|fastlane|cocoapods|pod install|swiftpm|codesign|notarize/i },
+    { prefix: "windows-", label: "Windows", keywords: /msbuild|\.sln\b|\.ps1\b|vcvarsall|nuget\s|choco\s|Set-ItemProperty|Get-ChildItem/i },
+];
+export const gha064 = {
+    id: "GHA064",
+    description: "Job hardcoded onto an expensive runner with no sign it needs that OS",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            const runsOnByJob = extractRunsOnByJob(yaml);
+            const runBlocks = extractRunBlocks(yaml);
+            for (const [jobName, labels] of runsOnByJob) {
+                if (labels.some((l) => l.includes("${{")))
+                    continue; // matrix/expression-driven — intentional
+                for (const { prefix, label, keywords } of OS_JUSTIFICATION) {
+                    const matched = labels.find((l) => l.toLowerCase().startsWith(prefix));
+                    if (!matched)
+                        continue;
+                    const justified = runBlocks.some((r) => r.job === jobName && keywords.test(r.run));
+                    if (justified)
+                        break;
+                    diagnostics.push({
+                        checkId: "GHA064",
+                        severity: "info",
+                        message: `Job "${jobName}" runs on "${matched}" (a pricier ${label} runner) but no step looks ${label}-specific. Confirm it needs ${label}, or move it to a Linux runner.`,
+                        entity: jobName,
+                        lexicon: "github",
+                    });
+                    break;
+                }
+            }
+        }
+        return diagnostics;
+    },
+};