@intentius/chant-lexicon-github 0.124.31 → 0.124.32

package/dist/lint/post-synth/gha065.js

@@ -0,0 +1,125 @@
+/**
+ * GHA065: Unbounded Matrix Fan-Out
+ *
+ * Flags a `strategy.matrix` that combines two or more dimensions into more
+ * jobs than a `max-parallel:` cap bounds. Two orthogonal axes each with a
+ * handful of values multiply, not add — `os` x `node` x `arch` can produce
+ * dozens of jobs from a config that reads like a short list. Unbounded, that
+ * is capacity spent on a combination nobody asked for, not a correctness or
+ * security issue (efficiency, #444).
+ *
+ * Parses the `matrix:` block by indentation, not the structural YAML parser
+ * — a flow list of bare words (`os: [ubuntu-latest, macos-latest]`, the
+ * overwhelmingly common hand-written form) is not one it round-trips, only
+ * a flow list of numbers. Mirrors GHA009's regex-based matrix handling for
+ * the same reason.
+ */
+import { getPrimaryOutput, extractJobs } from "./yaml-helpers.js";
+/** Above this many combinations, an uncapped matrix is flagged. */
+const FANOUT_THRESHOLD = 12;
+/** The raw text of one job's block within `jobs:`, or undefined if not found. */
+function jobSection(yaml, jobName) {
+    const jobsIdx = yaml.search(/^jobs:\s*$/m);
+    if (jobsIdx === -1)
+        return undefined;
+    const afterJobs = yaml.slice(jobsIdx + yaml.slice(jobsIdx).indexOf("\n") + 1);
+    const header = `  ${jobName}:\n`;
+    const start = afterJobs.indexOf(header);
+    if (start === -1)
+        return undefined;
+    const rest = afterJobs.slice(start + header.length);
+    const nextJobMatch = rest.search(/\n {2}\S/);
+    return nextJobMatch === -1 ? rest : rest.slice(0, nextJobMatch);
+}
+/** Parse a job section's `strategy.matrix` dimensions and whether max-parallel caps it. */
+function parseMatrix(section) {
+    const lines = section.split("\n");
+    const matrixLineIdx = lines.findIndex((l) => /^\s*matrix:\s*$/.test(l));
+    if (matrixLineIdx === -1)
+        return undefined;
+    const matrixIndent = lines[matrixLineIdx].search(/\S/);
+    const maxParallel = lines.some((l) => {
+        const m = l.match(/^(\s*)max-parallel:/);
+        return !!m && m[1].length === matrixIndent;
+    });
+    const dims = [];
+    let i = matrixLineIdx + 1;
+    while (i < lines.length) {
+        const line = lines[i];
+        if (line.trim() === "") {
+            i++;
+            continue;
+        }
+        const indent = line.search(/\S/);
+        if (indent <= matrixIndent)
+            break; // dedented out of the matrix: block
+        const kv = line.match(/^\s*([a-zA-Z0-9_-]+):\s*(.*)$/);
+        if (!kv) {
+            i++;
+            continue;
+        }
+        const [, key, rest] = kv;
+        const value = rest.trim();
+        if (value.startsWith("[")) {
+            const inner = value.replace(/^\[|\]\s*$/g, "").trim();
+            dims.push({ key, size: inner === "" ? 0 : inner.split(",").length });
+            i++;
+            continue;
+        }
+        if (value !== "") {
+            dims.push({ key, size: 1 }); // a bare scalar dimension
+            i++;
+            continue;
+        }
+        // Block-list value on subsequent, deeper-indented lines.
+        let size = 0;
+        i++;
+        while (i < lines.length) {
+            const l2 = lines[i];
+            if (l2.trim() === "") {
+                i++;
+                continue;
+            }
+            const ind2 = l2.search(/\S/);
+            if (ind2 <= indent)
+                break;
+            if (/^\s*-\s/.test(l2))
+                size++;
+            i++;
+        }
+        dims.push({ key, size });
+    }
+    return { dims, maxParallel };
+}
+export const gha065 = {
+    id: "GHA065",
+    description: "Matrix combines dimensions into an uncapped, large fan-out",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const [jobName] of extractJobs(yaml)) {
+                const section = jobSection(yaml, jobName);
+                if (!section)
+                    continue;
+                const matrix = parseMatrix(section);
+                if (!matrix)
+                    continue;
+                const dims = matrix.dims.filter((d) => d.key !== "include" && d.key !== "exclude" && d.size > 0);
+                if (dims.length < 2)
+                    continue; // a single axis isn't "combined" fan-out
+                const combos = dims.reduce((a, d) => a * d.size, 1);
+                if (combos <= FANOUT_THRESHOLD || matrix.maxParallel)
+                    continue;
+                diagnostics.push({
+                    checkId: "GHA065",
+                    severity: "info",
+                    message: `Job "${jobName}"'s matrix combines ${dims.length} dimensions (${dims.map((d) => d.key).join(" x ")}) into ${combos} jobs with no \`max-parallel:\` cap. Confirm the full cross-product is intended, trim it with \`include\`/\`exclude\`, or add \`max-parallel:\`.`,
+                    entity: jobName,
+                    lexicon: "github",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha066.js

@@ -0,0 +1,40 @@
+/**
+ * GHA066: Unbounded Artifact Retention
+ *
+ * Flags an `actions/upload-artifact` step with no `retention-days`, which
+ * falls back to the repository's default (up to 90 days). Build logs, test
+ * output, and intermediate artifacts rarely need to outlive the PR they came
+ * from; an unset retention silently accumulates storage. Efficiency (#444),
+ * not a correctness or security issue.
+ */
+import { getPrimaryOutput, jobEntries, parseActionUses } from "./yaml-helpers.js";
+export const gha066 = {
+    id: "GHA066",
+    description: "Uploaded artifact has no explicit retention-days",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const [jobName, jobObj] of jobEntries(yaml)) {
+                const steps = Array.isArray(jobObj.steps) ? jobObj.steps : [];
+                for (const step of steps) {
+                    const uses = typeof step.uses === "string" ? step.uses : undefined;
+                    if (!uses || parseActionUses(uses)?.slug !== "actions/upload-artifact")
+                        continue;
+                    const withBlock = step.with;
+                    if (withBlock && withBlock["retention-days"] !== undefined)
+                        continue;
+                    const name = typeof withBlock?.name === "string" ? withBlock.name : undefined;
+                    diagnostics.push({
+                        checkId: "GHA066",
+                        severity: "info",
+                        message: `Job "${jobName}" uploads${name ? ` artifact "${name}"` : " an artifact"} with no \`retention-days\` — it falls back to the repository's default (up to 90 days). Set a \`retention-days\` sized to how long the artifact is actually needed.`,
+                        entity: jobName,
+                        lexicon: "github",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha067.js

@@ -0,0 +1,75 @@
+/**
+ * GHA067: Unconditional Heavy Step With No Path Filter
+ *
+ * Flags a `docker build`/`docker buildx build` step that has no `if:` guard,
+ * in a workflow that triggers on `push`/`pull_request` with no `paths:` or
+ * `paths-ignore:` filter. A docs-only or unrelated change still pays for a
+ * full image build because nothing scopes the trigger or guards the step.
+ * Efficiency (#444), not a correctness or security issue.
+ */
+import { getPrimaryOutput, parseDoc, jobEntries } from "./yaml-helpers.js";
+const DOCKER_BUILD_RE = /\bdocker(\s+buildx)?\s+build\b/i;
+function triggerObject(on, key) {
+    if (!on || typeof on !== "object" || Array.isArray(on))
+        return undefined;
+    const trig = on[key];
+    return trig && typeof trig === "object" && !Array.isArray(trig) ? trig : undefined;
+}
+function hasPushOrPRTrigger(on) {
+    if (typeof on === "string")
+        return on === "push" || on === "pull_request";
+    if (Array.isArray(on))
+        return on.includes("push") || on.includes("pull_request");
+    if (on && typeof on === "object") {
+        const keys = Object.keys(on);
+        return keys.includes("push") || keys.includes("pull_request");
+    }
+    return false;
+}
+function hasPathFilter(on) {
+    for (const key of ["push", "pull_request"]) {
+        const trig = triggerObject(on, key);
+        if (!trig)
+            continue;
+        if (Array.isArray(trig.paths) && trig.paths.length > 0)
+            return true;
+        if (Array.isArray(trig["paths-ignore"]) && trig["paths-ignore"].length > 0)
+            return true;
+    }
+    return false;
+}
+export const gha067 = {
+    id: "GHA067",
+    description: "Unconditional docker build with no path filter or guard",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            const doc = parseDoc(yaml);
+            if (!doc)
+                continue;
+            if (!hasPushOrPRTrigger(doc.on))
+                continue;
+            if (hasPathFilter(doc.on))
+                continue;
+            for (const [jobName, jobObj] of jobEntries(yaml)) {
+                const steps = Array.isArray(jobObj.steps) ? jobObj.steps : [];
+                for (const step of steps) {
+                    const run = typeof step.run === "string" ? step.run : undefined;
+                    if (!run || !DOCKER_BUILD_RE.test(run))
+                        continue;
+                    if (step.if !== undefined)
+                        continue; // already guarded
+                    diagnostics.push({
+                        checkId: "GHA067",
+                        severity: "info",
+                        message: `Job "${jobName}" runs a Docker build on every push/pull_request with no \`paths:\`/\`paths-ignore:\` filter and no \`if:\` guard — unrelated changes (docs, etc.) still pay for a full image build. Scope the trigger's paths or add a guard.`,
+                        entity: jobName,
+                        lexicon: "github",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha068.js

@@ -0,0 +1,47 @@
+/**
+ * GHA068: Pull-Request Workflow Missing a Concurrency Group
+ *
+ * Flags a workflow triggered on `pull_request` with no top-level
+ * `concurrency:` block. Without one, a superseded push keeps its old run
+ * going instead of cancelling it, so every commit on a PR pays for the full
+ * pipeline instead of just the latest. Deploy workflows are left to GHA024,
+ * which already covers them (overlapping-deployment risk, not capacity).
+ * Efficiency (#444), not a correctness or security issue.
+ */
+import { getPrimaryOutput, parseDoc, extractJobs, extractWorkflowName } from "./yaml-helpers.js";
+function hasPullRequestTrigger(on) {
+    if (typeof on === "string")
+        return on === "pull_request";
+    if (Array.isArray(on))
+        return on.includes("pull_request");
+    if (on && typeof on === "object")
+        return "pull_request" in on;
+    return false;
+}
+export const gha068 = {
+    id: "GHA068",
+    description: "Pull-request workflow missing a concurrency group",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            const doc = parseDoc(yaml);
+            if (!doc || !hasPullRequestTrigger(doc.on))
+                continue;
+            const workflowName = extractWorkflowName(yaml) ?? "";
+            const jobNames = [...extractJobs(yaml).keys()];
+            const isDeployWorkflow = /deploy/i.test(workflowName) || jobNames.some((n) => /deploy/i.test(n));
+            if (isDeployWorkflow)
+                continue; // GHA024 already covers deploy workflows
+            if (!/^\s*concurrency:/m.test(yaml)) {
+                diagnostics.push({
+                    checkId: "GHA068",
+                    severity: "info",
+                    message: `Workflow${workflowName ? ` "${workflowName}"` : ""} triggers on pull_request with no \`concurrency:\` group — a new push doesn't cancel the superseded run, so every commit on the PR consumes a full run's worth of runner capacity. Add a \`concurrency:\` group with \`cancel-in-progress: true\`.`,
+                    lexicon: "github",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha069.js

@@ -0,0 +1,99 @@
+/**
+ * GHA069: Job-Level Permissions Block Drops the Workflow's `id-token: write`
+ *
+ * A job-level `permissions:` block replaces the workflow-level one; GitHub
+ * does not merge the two. A workflow that grants `id-token: write` at the top
+ * and then gives a job its own block without that scope leaves the job with
+ * no OIDC token, and the job's cloud-credential action fails with an error
+ * that names neither the scope nor the job block (#2273).
+ *
+ * Fires when all three hold:
+ * - the workflow-level block grants `id-token: write` (directly, or through
+ *   `write-all`);
+ * - a job declares its own block that does not (a map without
+ *   `id-token: write`, `{}`, `read-all`, or any other preset but `write-all`);
+ * - that job has a step using a known OIDC credential action, matched on the
+ *   action path whatever the ref (tag, major or full SHA), with no static
+ *   credential input that would make the step skip OIDC.
+ *
+ * Only `id-token` is checked. The reasoning for not generalising to every
+ * scope a job block narrows is recorded on #2273.
+ */
+import { getPrimaryOutput, extractWorkflowPermissions, extractJobPermissions, extractStepsByJob, parseActionUses, } from "./yaml-helpers.js";
+/**
+ * Actions that exchange the job's OIDC token for cloud credentials, keyed by
+ * lowercased `owner/repo`, each with the inputs that select a static
+ * credential instead (when one is set, the step does not need `id-token`).
+ */
+export const OIDC_CREDENTIAL_ACTIONS = new Map([
+    ["aws-actions/configure-aws-credentials", ["aws-access-key-id", "web-identity-token-file"]],
+    ["azure/login", ["creds"]],
+    ["google-github-actions/auth", ["credentials_json"]],
+]);
+/** True when the permissions value grants `id-token: write`. */
+export function grantsIdTokenWrite(perms) {
+    if (typeof perms === "string")
+        return perms.trim() === "write-all";
+    return perms["id-token"] === "write";
+}
+/** The OIDC credential action a step uses, as written, or undefined. */
+function oidcActionOf(step) {
+    if (typeof step.uses !== "string")
+        return undefined;
+    const parsed = parseActionUses(step.uses);
+    if (!parsed)
+        return undefined;
+    const staticInputs = OIDC_CREDENTIAL_ACTIONS.get(parsed.slug.toLowerCase());
+    if (!staticInputs)
+        return undefined;
+    const withInputs = step.with;
+    if (withInputs && typeof withInputs === "object" && !Array.isArray(withInputs)) {
+        const inputs = withInputs;
+        if (staticInputs.some((k) => inputs[k] !== undefined && inputs[k] !== null && inputs[k] !== ""))
+            return undefined;
+    }
+    return parsed.slug;
+}
+function describeJobBlock(perms) {
+    if (typeof perms === "string")
+        return `\`permissions: ${perms}\``;
+    if (Object.keys(perms).length === 0)
+        return "`permissions: {}`";
+    return "its own `permissions:` block";
+}
+export const gha069 = {
+    id: "GHA069",
+    description: "Job-level permissions block drops the workflow's id-token: write that an OIDC credential step needs",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            const wf = extractWorkflowPermissions(yaml);
+            if (!wf || !grantsIdTokenWrite(wf))
+                continue;
+            const jobPermissions = extractJobPermissions(yaml);
+            if (jobPermissions.size === 0)
+                continue;
+            const stepsByJob = extractStepsByJob(yaml);
+            for (const [job, perms] of jobPermissions) {
+                if (grantsIdTokenWrite(perms))
+                    continue;
+                const actions = [
+                    ...new Set((stepsByJob.get(job) ?? []).map(oidcActionOf).filter((a) => a !== undefined)),
+                ];
+                if (actions.length === 0)
+                    continue;
+                diagnostics.push({
+                    checkId: "GHA069",
+                    severity: "warning",
+                    message: `Job "${job}" declares ${describeJobBlock(perms)}, which replaces the workflow-level block instead of merging with it, ` +
+                        `so the workflow's \`id-token: write\` does not reach the job and ${actions.join(", ")} cannot request an OIDC token. ` +
+                        `Add \`id-token: write\` to job "${job}"'s permissions block; keep the job block rather than removing it.`,
+                    entity: job,
+                    lexicon: "github",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/index.js

@@ -0,0 +1,114 @@
+import { gha006 } from "./gha006.js";
+import { gha009 } from "./gha009.js";
+import { gha011 } from "./gha011.js";
+import { gha013 } from "./gha013.js";
+import { gha017 } from "./gha017.js";
+import { gha018 } from "./gha018.js";
+import { gha019 } from "./gha019.js";
+import { gha021 } from "./gha021.js";
+import { gha022 } from "./gha022.js";
+import { gha023 } from "./gha023.js";
+import { gha024 } from "./gha024.js";
+import { gha025 } from "./gha025.js";
+import { gha026 } from "./gha026.js";
+import { gha027 } from "./gha027.js";
+import { gha028 } from "./gha028.js";
+import { gha029 } from "./gha029.js";
+import { gha030 } from "./gha030.js";
+import { gha031 } from "./gha031.js";
+import { gha032 } from "./gha032.js";
+import { gha033 } from "./gha033.js";
+import { gha034 } from "./gha034.js";
+import { gha035 } from "./gha035.js";
+import { gha036 } from "./gha036.js";
+import { gha037 } from "./gha037.js";
+import { gha038 } from "./gha038.js";
+import { gha039 } from "./gha039.js";
+import { gha040 } from "./gha040.js";
+import { gha041 } from "./gha041.js";
+import { gha042 } from "./gha042.js";
+import { gha043 } from "./gha043.js";
+import { gha044 } from "./gha044.js";
+import { gha045 } from "./gha045.js";
+import { gha046 } from "./gha046.js";
+import { gha047 } from "./gha047.js";
+import { gha048 } from "./gha048.js";
+import { gha049 } from "./gha049.js";
+import { gha050 } from "./gha050.js";
+import { gha051 } from "./gha051.js";
+import { gha052 } from "./gha052.js";
+import { gha053 } from "./gha053.js";
+import { gha054 } from "./gha054.js";
+import { gha055 } from "./gha055.js";
+import { gha056 } from "./gha056.js";
+import { gha057 } from "./gha057.js";
+import { gha058 } from "./gha058.js";
+import { gha059 } from "./gha059.js";
+import { gha060 } from "./gha060.js";
+import { gha061 } from "./gha061.js";
+import { gha062 } from "./gha062.js";
+import { gha063 } from "./gha063.js";
+import { gha064 } from "./gha064.js";
+import { gha065 } from "./gha065.js";
+import { gha066 } from "./gha066.js";
+import { gha067 } from "./gha067.js";
+import { gha068 } from "./gha068.js";
+import { gha069 } from "./gha069.js";
+export const postSynthChecks = [
+    gha006,
+    gha009,
+    gha011,
+    gha013,
+    gha017,
+    gha018,
+    gha019,
+    gha021,
+    gha022,
+    gha023,
+    gha024,
+    gha025,
+    gha026,
+    gha027,
+    gha028,
+    gha029,
+    gha030,
+    gha031,
+    gha032,
+    gha033,
+    gha034,
+    gha035,
+    gha036,
+    gha037,
+    gha038,
+    gha039,
+    gha040,
+    gha041,
+    gha042,
+    gha043,
+    gha044,
+    gha045,
+    gha046,
+    gha047,
+    gha048,
+    gha049,
+    gha050,
+    gha051,
+    gha052,
+    gha053,
+    gha054,
+    gha055,
+    gha056,
+    gha057,
+    gha058,
+    gha059,
+    gha060,
+    gha061,
+    gha062,
+    gha063,
+    gha064,
+    gha065,
+    gha066,
+    gha067,
+    gha068,
+    gha069,
+];