@intentius/chant-lexicon-github 0.124.31 → 0.124.32

package/dist/lint/post-synth/yaml-helpers.js

@@ -0,0 +1,465 @@
+/**
+ * Helpers for parsing serialized GitHub Actions YAML in post-synth checks.
+ */
+import { parseYAML } from "@intentius/chant/yaml";
+export { getPrimaryOutput } from "@intentius/chant/lint/post-synth";
+/**
+ * Return the emitted `.github/dependabot.yml` content from a serializer output,
+ * if present (it rides as an additional file alongside the workflow output).
+ */
+export function getDependabotYaml(output) {
+    if (typeof output === "string")
+        return undefined;
+    return output.files?.["dependabot.yml"];
+}
+/** Parse the `updates:` array from a dependabot.yml document. */
+export function extractDependabotUpdates(dependabotYaml) {
+    let doc;
+    try {
+        doc = parseYAML(dependabotYaml);
+    }
+    catch {
+        return [];
+    }
+    const updates = doc.updates;
+    return Array.isArray(updates) ? updates : [];
+}
+/**
+ * Extract jobs from a serialized GitHub Actions workflow YAML.
+ *
+ * Built on the structural parser ({@link jobEntries}), so every step of every
+ * job is read whatever key the step starts with, and `needs:` is read in all
+ * three forms (a scalar, a flow list, a block list). The line-based version
+ * this replaced stopped after the first line of a job's first step, so a step
+ * that starts with `name:` (the shape chant's serializer emits) had no `uses:`
+ * or `run:` and later steps were never seen (#3201).
+ *
+ * `run` is the whole script, block scalars included. `permissions` is not
+ * filled here; use {@link extractJobPermissions}.
+ */
+export function extractJobs(yaml) {
+    const jobs = new Map();
+    for (const [name, jobObj] of jobEntries(yaml)) {
+        const job = { name };
+        const needs = jobObj.needs;
+        if (typeof needs === "string") {
+            job.needs = [needs];
+        }
+        else if (Array.isArray(needs)) {
+            job.needs = needs.filter((n) => typeof n === "string" || typeof n === "number").map(String);
+        }
+        const steps = jobObj.steps;
+        if (Array.isArray(steps)) {
+            job.steps = [];
+            for (const raw of steps) {
+                if (!raw || typeof raw !== "object" || Array.isArray(raw))
+                    continue;
+                const step = raw;
+                job.steps.push({
+                    uses: typeof step.uses === "string" ? stripUsesComment(step.uses) : undefined,
+                    run: typeof step.run === "string" ? step.run : undefined,
+                    name: typeof step.name === "string" ? step.name : undefined,
+                });
+            }
+        }
+        jobs.set(name, job);
+    }
+    return jobs;
+}
+/**
+ * Extract trigger events from the YAML.
+ */
+export function extractTriggers(yaml) {
+    const onMatch = yaml.match(/^on:\n([\s\S]*?)(?=\n[a-z]|$)/m);
+    if (!onMatch)
+        return {};
+    const triggers = {};
+    const lines = onMatch[1].split("\n");
+    for (const line of lines) {
+        const triggerMatch = line.match(/^\s{2}([a-z_]+):/);
+        if (triggerMatch) {
+            triggers[triggerMatch[1]] = true;
+        }
+    }
+    return triggers;
+}
+/**
+ * Check if any step in the list uses a checkout action.
+ */
+export function hasCheckoutAction(steps) {
+    return steps.some((s) => s.uses?.startsWith("actions/checkout"));
+}
+/**
+ * Build a needs dependency graph from the YAML.
+ */
+export function buildNeedsGraph(yaml) {
+    const jobs = extractJobs(yaml);
+    const graph = new Map();
+    for (const [name, job] of jobs) {
+        graph.set(name, job.needs ?? []);
+    }
+    return graph;
+}
+/**
+ * Extract the workflow name from the YAML.
+ */
+export function extractWorkflowName(yaml) {
+    const match = yaml.match(/^name:\s+(.+)$/m);
+    return match?.[1]?.trim().replace(/^'|'$/g, "");
+}
+/**
+ * Check if the YAML has an explicit permissions block.
+ */
+export function hasPermissions(yaml) {
+    return /^permissions:/m.test(yaml);
+}
+/** Parse a workflow YAML into a structured document, tolerant of parse errors. */
+export function parseDoc(yaml) {
+    try {
+        return parseYAML(yaml);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Every job in the workflow as `[name, rawJobObject]`, via the structural parser. */
+export function jobEntries(yaml) {
+    const doc = parseDoc(yaml);
+    const jobs = doc?.jobs;
+    if (!jobs || typeof jobs !== "object")
+        return [];
+    const out = [];
+    for (const [name, val] of Object.entries(jobs)) {
+        if (val && typeof val === "object" && !Array.isArray(val)) {
+            out.push([name, val]);
+        }
+    }
+    return out;
+}
+/**
+ * Every step object (raw, as parsed from YAML — `uses`, `with`, `id`, `run`,
+ * `env`, etc.) grouped by owning job. Unlike {@link extractJobs} (which only
+ * lifts `uses`/`run`/`name`), this hands back each step's full object so a
+ * check can read arbitrary keys (`with:` inputs, `id:`) without growing a new
+ * bespoke regex extractor per key. See GHA060.
+ */
+export function extractStepsByJob(yaml) {
+    const out = new Map();
+    for (const [job, jobObj] of jobEntries(yaml)) {
+        const steps = jobObj.steps;
+        if (!Array.isArray(steps))
+            continue;
+        out.set(job, steps.filter((s) => !!s && typeof s === "object" && !Array.isArray(s)));
+    }
+    return out;
+}
+/**
+ * Extract every `uses:` reference from the workflow — both step-level actions
+ * and job-level reusable-workflow calls. Uses the structural YAML parser so
+ * nested jobs/steps are handled reliably.
+ */
+export function extractActionRefs(yaml) {
+    const refs = [];
+    for (const [job, jobObj] of jobEntries(yaml)) {
+        if (typeof jobObj.uses === "string") {
+            refs.push({ job, ref: jobObj.uses, level: "job" });
+        }
+        const steps = jobObj.steps;
+        if (Array.isArray(steps)) {
+            for (const step of steps) {
+                if (step && typeof step === "object" && typeof step.uses === "string") {
+                    refs.push({ job, ref: step.uses, level: "step" });
+                }
+            }
+        }
+    }
+    return refs;
+}
+/**
+ * Extract every container/service/`docker://` image reference from the workflow.
+ */
+export function extractImageRefs(yaml) {
+    const refs = [];
+    for (const [job, jobObj] of jobEntries(yaml)) {
+        const container = jobObj.container;
+        if (typeof container === "string") {
+            refs.push({ job, image: container, source: "container" });
+        }
+        else if (container && typeof container === "object" && typeof container.image === "string") {
+            refs.push({ job, image: container.image, source: "container" });
+        }
+        const services = jobObj.services;
+        if (services && typeof services === "object" && !Array.isArray(services)) {
+            for (const svc of Object.values(services)) {
+                if (typeof svc === "string") {
+                    refs.push({ job, image: svc, source: "service" });
+                }
+                else if (svc && typeof svc === "object" && typeof svc.image === "string") {
+                    refs.push({ job, image: svc.image, source: "service" });
+                }
+            }
+        }
+        const steps = jobObj.steps;
+        if (Array.isArray(steps)) {
+            for (const step of steps) {
+                const uses = step && typeof step === "object" ? step.uses : undefined;
+                if (typeof uses === "string" && uses.startsWith("docker://")) {
+                    refs.push({ job, image: uses.slice("docker://".length), source: "step" });
+                }
+            }
+        }
+    }
+    return refs;
+}
+/**
+ * Walk the `jobs:` block line-by-line, tracking the current job. Robust to `|`
+ * block scalars (which the structural parser does not handle), so it is the
+ * right tool for scanning `run:`/`if:`/`runs-on:` content.
+ */
+function scanJobLines(yaml, onLine) {
+    const lines = yaml.split("\n");
+    let inJobs = false;
+    let currentJob = "";
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (/^jobs:\s*$/.test(line)) {
+            inJobs = true;
+            continue;
+        }
+        if (!inJobs)
+            continue;
+        if (/^\S/.test(line)) {
+            inJobs = false;
+            continue;
+        } // dedented to a new top-level key
+        const jobHeader = line.match(/^ {2}([A-Za-z0-9_-]+):\s*$/);
+        if (jobHeader) {
+            currentJob = jobHeader[1];
+            continue;
+        }
+        if (!currentJob)
+            continue;
+        const indent = line.search(/\S/);
+        if (indent < 0)
+            continue;
+        onLine(currentJob, line, indent, i, lines);
+    }
+}
+/**
+ * Extract every `run:` script (inline and `|`/`>` block scalars) with its
+ * owning job.
+ */
+export function extractRunBlocks(yaml) {
+    const out = [];
+    const consumed = new Set();
+    scanJobLines(yaml, (job, line, _indent, lineNo, lines) => {
+        if (consumed.has(lineNo))
+            return;
+        const m = line.match(/^(\s*)(- )?run:\s*(.*)$/);
+        if (!m)
+            return;
+        const keyIndent = m[1].length + (m[2] ? 2 : 0); // column where `run:` begins
+        const value = m[3].trim();
+        if (value === "|" || value === "|-" || value === ">" || value === ">-" || value === "|+" || value === ">+") {
+            const blockLines = [];
+            for (let j = lineNo + 1; j < lines.length; j++) {
+                const bl = lines[j];
+                if (bl.trim() === "") {
+                    blockLines.push("");
+                    consumed.add(j);
+                    continue;
+                }
+                const bi = bl.search(/\S/);
+                if (bi <= keyIndent)
+                    break;
+                blockLines.push(bl.trimStart());
+                consumed.add(j);
+            }
+            out.push({ job, run: blockLines.join("\n") });
+        }
+        else {
+            out.push({ job, run: value.replace(/^['"]|['"]$/g, "") });
+        }
+    });
+    return out;
+}
+/** Extract every `if:` condition (job-level and step-level) with its job. */
+export function extractIfConditions(yaml) {
+    const out = [];
+    scanJobLines(yaml, (job, line) => {
+        const m = line.match(/^\s+(?:- )?if:\s*(.+)$/);
+        if (m)
+            out.push({ job, expr: m[1].trim().replace(/^['"]|['"]$/g, "") });
+    });
+    return out;
+}
+/** Extract each job's `runs-on:` value(s) as a flat list of labels. */
+export function extractRunsOnByJob(yaml) {
+    const out = new Map();
+    scanJobLines(yaml, (job, line, indent, lineNo, lines) => {
+        const m = line.match(/^\s+runs-on:\s*(.*)$/);
+        if (!m)
+            return;
+        const value = m[1].trim();
+        const labels = [];
+        if (value === "") {
+            for (let j = lineNo + 1; j < lines.length; j++) {
+                const item = lines[j].match(/^\s+- (.+)$/);
+                if (!item)
+                    break;
+                labels.push(item[1].trim().replace(/^['"]|['"]$/g, ""));
+            }
+        }
+        else if (value.startsWith("[")) {
+            for (const part of value.replace(/^\[|\]$/g, "").split(",")) {
+                const t = part.trim().replace(/^['"]|['"]$/g, "");
+                if (t)
+                    labels.push(t);
+            }
+        }
+        else {
+            labels.push(value.replace(/^['"]|['"]$/g, ""));
+        }
+        out.set(job, labels);
+    });
+    return out;
+}
+/** Pull every `${{ ... }}` expression body out of a string. */
+export function extractExpressions(text) {
+    const out = [];
+    const re = /\$\{\{(.+?)\}\}/g;
+    let m;
+    while ((m = re.exec(text)) !== null) {
+        out.push(m[1].trim());
+    }
+    return out;
+}
+/** Every line inside the `jobs:` block paired with its owning job name. */
+export function jobLines(yaml) {
+    const out = [];
+    scanJobLines(yaml, (job, line) => out.push({ job, line }));
+    return out;
+}
+/** All lines inside the `jobs:` block grouped by owning job. */
+export function linesByJob(yaml) {
+    const out = new Map();
+    scanJobLines(yaml, (job, line) => {
+        const arr = out.get(job) ?? [];
+        arr.push(line);
+        out.set(job, arr);
+    });
+    return out;
+}
+/** Set of jobs that declare an `environment:`. */
+export function extractJobEnvironments(yaml) {
+    const set = new Set();
+    scanJobLines(yaml, (job, line) => {
+        if (/^\s+environment:/.test(line))
+            set.add(job);
+    });
+    return set;
+}
+/** Set of jobs whose body references a `secrets.` context. */
+export function jobsReferencingSecrets(yaml) {
+    const set = new Set();
+    scanJobLines(yaml, (job, line) => {
+        if (/secrets\./.test(line))
+            set.add(job);
+    });
+    return set;
+}
+/** The workflow-level `permissions:` value, if present. */
+export function extractWorkflowPermissions(yaml) {
+    const doc = parseDoc(yaml);
+    const perms = doc?.permissions;
+    if (typeof perms === "string")
+        return perms;
+    if (perms && typeof perms === "object" && !Array.isArray(perms))
+        return perms;
+    return undefined;
+}
+/** Per-job `permissions:` values, keyed by job name. Only jobs that declare one. */
+export function extractJobPermissions(yaml) {
+    const out = new Map();
+    for (const [job, jobObj] of jobEntries(yaml)) {
+        const perms = jobObj.permissions;
+        if (typeof perms === "string")
+            out.set(job, perms);
+        else if (perms && typeof perms === "object" && !Array.isArray(perms))
+            out.set(job, perms);
+    }
+    return out;
+}
+/**
+ * Classify a permissions value's write surface.
+ * `writeAll` is the `write-all` blanket preset; `scopes` lists the individual
+ * scopes granted `write` in map form.
+ */
+export function writeSurface(perms) {
+    if (typeof perms === "string") {
+        return { writeAll: perms === "write-all", scopes: [] };
+    }
+    const scopes = [];
+    for (const [scope, level] of Object.entries(perms)) {
+        if (level === "write")
+            scopes.push(scope);
+    }
+    return { writeAll: false, scopes };
+}
+/** True if the permissions value grants any write access (blanket or scoped). */
+export function grantsWrite(perms) {
+    const { writeAll, scopes } = writeSurface(perms);
+    return writeAll || scopes.length > 0;
+}
+/**
+ * Split an action `uses:` value into its `owner/repo` slug and git ref.
+ * Returns undefined for local (`./`, `../`) and `docker://` references, which
+ * are not GitHub action repository references.
+ */
+/**
+ * Strip a trailing inline YAML comment from a `uses:` value. A `uses` ref
+ * cannot contain whitespace, so `<ref> # v1.2.3` (the recommended SHA-pin
+ * style) is safe to trim back to `<ref>`.
+ */
+export function stripUsesComment(uses) {
+    return uses.replace(/\s+#.*$/, "").trim();
+}
+/**
+ * Extract a `uses:` value's trailing inline comment, if any — the
+ * human-readable version label reviewers rely on when a ref is pinned to an
+ * opaque commit SHA (e.g. `actions/setup-node@1a2b…9a0b # v4.0.2` → `v4.0.2`).
+ * Returns undefined for no comment or an empty (`# ` with nothing after it)
+ * one, since both mean "no annotation" to a reviewer. See GHA059.
+ */
+export function extractUsesComment(rawUses) {
+    const m = rawUses.match(/\s+#\s*(.*)$/);
+    const comment = m?.[1]?.trim();
+    return comment ? comment : undefined;
+}
+/**
+ * Every `uses:` line in the workflow text, in document order, with its
+ * trailing comment. The parsed document has no comments (core's parseYAML
+ * drops them, #3006), so a check that reads the pin label (GHA059) takes it
+ * from here.
+ */
+export function usesLineComments(yaml) {
+    const out = [];
+    for (const line of yaml.split(/\r?\n/)) {
+        const m = line.match(/^\s*(?:-\s+)?uses:\s*(["']?)([^\s"'#]+)\1(\s+#.*)?\s*$/);
+        if (m)
+            out.push({ ref: m[2], comment: m[3] ? extractUsesComment(m[3]) : undefined });
+    }
+    return out;
+}
+export function parseActionUses(rawUses) {
+    const uses = stripUsesComment(rawUses);
+    if (uses.startsWith("./") || uses.startsWith("../") || uses.startsWith("docker://"))
+        return undefined;
+    const at = uses.lastIndexOf("@");
+    const path = at === -1 ? uses : uses.slice(0, at);
+    const gitRef = at === -1 ? "" : uses.slice(at + 1);
+    const segments = path.split("/");
+    if (segments.length < 2 || !segments[0] || !segments[1])
+        return undefined;
+    return { owner: segments[0], repo: segments[1], slug: `${segments[0]}/${segments[1]}`, gitRef };
+}

package/dist/lint/rules/data/action-usage-policy.js

@@ -0,0 +1,16 @@
+/**
+ * Default action-usage policy for GHA061 — opt-in, so it ships with an empty
+ * allow/deny list: with nothing configured, GHA061 reports nothing (#445
+ * acceptance criteria: "silent when unconfigured").
+ *
+ * `PostSynthContext` carries no per-check runtime config channel today (see
+ * `trusted-action-owners.ts`'s doc for the same constraint), so — like that
+ * file — this is a vendored, code-level default. A project that wants a real
+ * policy doesn't edit this file: it authors a `lint.policies` entry
+ * (`chant.config.ts`'s `lint.policies`, see `packages/core/src/lint/config.ts`)
+ * that imports `evaluateUsagePolicy` from `../../post-synth/gha061` and calls
+ * it with its own `ActionUsagePolicy`, wrapped in a `PostSynthCheck`. That is
+ * the supported opt-in path; this default only documents the "nothing
+ * configured" shape and is what the shipped GHA061 check itself passes.
+ */
+export const DEFAULT_ACTION_USAGE_POLICY = {};

package/dist/lint/rules/data/advisory-feed.js

@@ -0,0 +1,15 @@
+/**
+ * Default advisory feed for GHA062 — ships empty, so the check degrades to
+ * "no findings" rather than erroring when nothing is supplied (#445
+ * acceptance criteria: "degrades gracefully when the feed is unreachable").
+ *
+ * Per epic #350's design spine, the pure core never fetches: a live feed is
+ * the CALLER's concern (a `chant audit` CLI flag reading a local JSON file,
+ * a pre-fetched structure a hosted service passes in) — never a `fetch()`
+ * inside a rule. This module documents the "nothing supplied" shape and is
+ * what the shipped GHA062 check itself passes; a caller with a real feed
+ * calls `checkAdvisories` (`../../post-synth/gha062`) directly with its own
+ * `AdvisoryFeed`, the same way a `lint.policies` entry supplies GHA061 its
+ * own `ActionUsagePolicy` (see `action-usage-policy.ts`).
+ */
+export const DEFAULT_ADVISORY_FEED = { entries: [] };

package/dist/lint/rules/data/deprecated-versions.js

@@ -0,0 +1,14 @@
+/**
+ * Deprecated action versions and recommended replacements.
+ */
+import { ACTION_PINS } from "../../../action-pins.js";
+export const deprecatedVersions = {
+    // v4 runs on Node 20, which GitHub has deprecated for actions.
+    "actions/checkout": { deprecated: ["v1", "v2", "v3", "v4"], recommended: ACTION_PINS["actions/checkout"].major },
+    "actions/setup-node": { deprecated: ["v1", "v2", "v3", "v4"], recommended: ACTION_PINS["actions/setup-node"].major },
+    "actions/setup-go": { deprecated: ["v1", "v2", "v3", "v4"], recommended: "v5" },
+    "actions/setup-python": { deprecated: ["v1", "v2", "v3", "v4"], recommended: "v5" },
+    "actions/cache": { deprecated: ["v1", "v2", "v3"], recommended: "v4" },
+    "actions/upload-artifact": { deprecated: ["v1", "v2", "v3"], recommended: "v4" },
+    "actions/download-artifact": { deprecated: ["v1", "v2", "v3"], recommended: "v4" },
+};

package/dist/lint/rules/data/flagged-actions.js

@@ -0,0 +1,18 @@
+export const FLAGGED_ACTIONS = {
+    "tj-actions/changed-files": {
+        reason: "supply-chain compromise disclosed March 2025 (CVE-2025-30066) — tags were repointed to leak CI secrets",
+        remediation: "pin to a vetted commit SHA from before the compromise, or migrate to an audited alternative",
+    },
+    "actions/setup-ruby": {
+        reason: "archived and unmaintained",
+        remediation: "use ruby/setup-ruby",
+    },
+    "actions/create-release": {
+        reason: "archived and unmaintained",
+        remediation: "use softprops/action-gh-release or the gh CLI",
+    },
+    "actions/upload-release-asset": {
+        reason: "archived and unmaintained",
+        remediation: "use softprops/action-gh-release or the gh CLI",
+    },
+};

package/dist/lint/rules/data/known-action-slugs.js

@@ -0,0 +1,38 @@
+/**
+ * Vendored snapshot of widely-used GitHub Action `owner/repo` slugs.
+ *
+ * Used by the look-alike check (GHA031) as the reference set: a `uses:` slug
+ * that is a near-miss (edit distance 1–2) of one of these — but not an exact
+ * match — is likely a typo or an impersonation of the popular action.
+ *
+ * Advisory only. Refresh source: the GitHub Marketplace "most-used" actions and
+ * the actions/* org. Accept staleness — regenerate periodically by editing this
+ * list; a stale entry only weakens look-alike detection, it never blocks a build.
+ */
+export const KNOWN_ACTION_SLUGS = [
+    "actions/checkout",
+    "actions/setup-node",
+    "actions/setup-python",
+    "actions/setup-go",
+    "actions/setup-java",
+    "actions/setup-dotnet",
+    "actions/cache",
+    "actions/upload-artifact",
+    "actions/download-artifact",
+    "actions/github-script",
+    "actions/stale",
+    "actions/labeler",
+    "actions/dependency-review-action",
+    "docker/build-push-action",
+    "docker/login-action",
+    "docker/setup-buildx-action",
+    "docker/setup-qemu-action",
+    "docker/metadata-action",
+    "aws-actions/configure-aws-credentials",
+    "azure/login",
+    "google-github-actions/auth",
+    "hashicorp/setup-terraform",
+    "codecov/codecov-action",
+    "softprops/action-gh-release",
+    "peter-evans/create-pull-request",
+];

package/dist/lint/rules/data/known-actions.js

@@ -0,0 +1,12 @@
+/**
+ * Registry of well-known GitHub Actions and their typed composite wrappers.
+ */
+export const knownActions = {
+    "actions/checkout": { composite: "Checkout", importPath: "@intentius/chant-lexicon-github" },
+    "actions/setup-node": { composite: "SetupNode", importPath: "@intentius/chant-lexicon-github" },
+    "actions/setup-go": { composite: "SetupGo", importPath: "@intentius/chant-lexicon-github" },
+    "actions/setup-python": { composite: "SetupPython", importPath: "@intentius/chant-lexicon-github" },
+    "actions/cache": { composite: "Cache", importPath: "@intentius/chant-lexicon-github" },
+    "actions/upload-artifact": { composite: "UploadArtifact", importPath: "@intentius/chant-lexicon-github" },
+    "actions/download-artifact": { composite: "DownloadArtifact", importPath: "@intentius/chant-lexicon-github" },
+};

package/dist/lint/rules/data/preinstalled-tools.js

@@ -0,0 +1,36 @@
+/**
+ * Vendored snapshot of tools already present on GitHub-hosted runner images,
+ * used by GHA056 to flag redundant runtime installs that add third-party
+ * surface for no benefit.
+ *
+ * Advisory. Refresh source: the runner-images repository's installed-software
+ * manifests. Conservative on purpose — only tools that are reliably present
+ * across the common ubuntu/macos/windows images are listed.
+ */
+export const PREINSTALLED_TOOLS = [
+    "git",
+    "curl",
+    "wget",
+    "jq",
+    "make",
+    "gcc",
+    "g++",
+    "zip",
+    "unzip",
+    "tar",
+    "docker",
+    "docker-compose",
+    "python3",
+    "pip3",
+    "node",
+    "npm",
+    "yarn",
+    "go",
+    "gh",
+    "aws",
+    "az",
+    "gcloud",
+    "kubectl",
+    "helm",
+    "terraform",
+];

package/dist/lint/rules/data/recommended-inputs.js

@@ -0,0 +1,9 @@
+/**
+ * Recommended inputs for setup action composites.
+ * If a setup action is used without any of the listed inputs, a warning is raised.
+ */
+export const recommendedInputs = {
+    SetupNode: ["nodeVersion", "node-version"],
+    SetupGo: ["goVersion", "go-version"],
+    SetupPython: ["pythonVersion", "python-version"],
+};

package/dist/lint/rules/data/risky-features.js

@@ -0,0 +1,22 @@
+export const RISKY_FEATURES = [
+    {
+        pattern: /::set-output\s/,
+        label: "deprecated ::set-output:: workflow command",
+        advice: "write to $GITHUB_OUTPUT instead",
+    },
+    {
+        pattern: /::save-state\s/,
+        label: "deprecated ::save-state:: workflow command",
+        advice: "write to $GITHUB_STATE instead",
+    },
+    {
+        pattern: /ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION/,
+        label: "opt-in to an end-of-life Node.js runtime",
+        advice: "upgrade the action to a supported Node runtime instead of forcing the unsupported one",
+    },
+    {
+        pattern: /::add-mask::\$\{\{/,
+        label: "masking a dynamic value after it may have already been logged",
+        advice: "mask secrets at their source; ::add-mask:: on an interpolated value can leak before the mask applies",
+    },
+];