@intentius/chant-lexicon-github 0.124.31 → 0.124.32

package/dist/lint/rules/data/secret-patterns.js

@@ -0,0 +1,30 @@
+/**
+ * Regex patterns for detecting hardcoded secrets in source code.
+ */
+export const secretPatterns = [
+    { pattern: /AKIA[0-9A-Z]{16}/, description: "AWS Access Key ID" },
+    { pattern: /-----BEGIN (RSA |EC |DSA )?PRIVATE KEY-----/, description: "Private Key" },
+    { pattern: /sk_live_[a-zA-Z0-9]{20,}/, description: "Stripe Live Secret Key" },
+    { pattern: /xox[bpors]-[a-zA-Z0-9-]{10,}/, description: "Slack Token" },
+    { pattern: /AIza[0-9A-Za-z_-]{35}/, description: "Google API Key" },
+    { pattern: /AC[a-z0-9]{32}/, description: "Twilio Account SID" },
+    { pattern: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/, description: "SendGrid API Key" },
+    { pattern: /key-[a-zA-Z0-9]{32}/, description: "Mailgun API Key" },
+    { pattern: /npm_[a-zA-Z0-9]{36}/, description: "NPM Token" },
+    { pattern: /pypi-[a-zA-Z0-9_-]{50,}/, description: "PyPI Token" },
+    { pattern: /eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}/, description: "JWT Token" },
+    { pattern: /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/, description: "Heroku API Key (UUID)" },
+    { pattern: /dop_v1_[a-f0-9]{64}/, description: "DigitalOcean Personal Access Token" },
+    { pattern: /ghp_[a-zA-Z0-9]{36}/, description: "GitHub Personal Access Token" },
+    { pattern: /ghs_[a-zA-Z0-9]{36}/, description: "GitHub Server-to-Server Token" },
+    { pattern: /ghu_[a-zA-Z0-9]{36}/, description: "GitHub User-to-Server Token" },
+    { pattern: /ghr_[a-zA-Z0-9]{36}/, description: "GitHub Refresh Token" },
+    { pattern: /gho_[a-zA-Z0-9]{36}/, description: "GitHub OAuth Token" },
+    { pattern: /github_pat_[a-zA-Z0-9_]{22,}/, description: "GitHub Fine-grained PAT" },
+    { pattern: /glpat-[a-zA-Z0-9_-]{20,}/, description: "GitLab Personal Access Token" },
+    { pattern: /sk-[a-zA-Z0-9]{48}/, description: "OpenAI API Key" },
+    { pattern: /r8_[a-zA-Z0-9]{37}/, description: "Replicate API Token" },
+    { pattern: /sq0atp-[a-zA-Z0-9_-]{22}/, description: "Square Access Token" },
+    { pattern: /shpat_[a-fA-F0-9]{32}/, description: "Shopify Admin API Token" },
+    { pattern: /shr[a-z]{2}_[a-f0-9]{32}/, description: "Shopify Shared Secret" },
+];

package/dist/lint/rules/data/trusted-action-owners.js

@@ -0,0 +1,12 @@
+/**
+ * Allowlist of trusted action owners (GitHub orgs) whose `uses:` references are
+ * exempt from the SHA-pinning check (GHA029).
+ *
+ * Ships EMPTY by default: chant recommends pinning every external reference to a
+ * full commit SHA, including first-party ones. Populate this set to silence the
+ * pinning check for orgs you have decided to trust by tag (e.g. your own org).
+ *
+ * This is a vendored, code-level allowlist — `PostSynthContext` carries no
+ * per-check runtime config channel today. Refresh it by editing this file.
+ */
+export const TRUSTED_ACTION_OWNERS = new Set([]);

package/dist/lint/rules/data/untrusted-contexts.js

@@ -0,0 +1,44 @@
+/**
+ * Vendored snapshot of GitHub Actions expression contexts that are
+ * attacker-controllable — their values come from event payloads a fork or an
+ * outside contributor can set. Interpolating them into a shell (`run:`), into
+ * `GITHUB_ENV`/`GITHUB_PATH`, or into another execution sink turns data into
+ * code (script injection).
+ *
+ * Source: GitHub's "Security hardening for GitHub Actions — understanding the
+ * risk of script injections" plus the commonly-cited untrusted-context list.
+ * Advisory and necessarily incomplete; refresh by editing this list.
+ */
+export const UNTRUSTED_CONTEXTS = [
+    "github.event.issue.title",
+    "github.event.issue.body",
+    "github.event.pull_request.title",
+    "github.event.pull_request.body",
+    "github.event.pull_request.head.ref",
+    "github.event.pull_request.head.label",
+    "github.event.pull_request.head.repo.default_branch",
+    "github.event.comment.body",
+    "github.event.review.body",
+    "github.event.review_comment.body",
+    "github.event.discussion.title",
+    "github.event.discussion.body",
+    "github.event.head_commit.message",
+    "github.event.head_commit.author.email",
+    "github.event.head_commit.author.name",
+    "github.event.commits", // .*.message / .*.author.* (array — matched by prefix)
+    "github.event.pages", // .*.page_name
+    "github.head_ref",
+];
+/**
+ * Return the first untrusted context referenced inside an expression body, or
+ * undefined. Matches by substring so array element accesses
+ * (`github.event.commits[0].message`) are caught via their prefix.
+ */
+export function matchUntrustedContext(exprBody) {
+    const normalized = exprBody.replace(/\s+/g, "");
+    for (const ctx of UNTRUSTED_CONTEXTS) {
+        if (normalized.includes(ctx.replace(/\s+/g, "")))
+            return ctx;
+    }
+    return undefined;
+}

package/dist/lint/rules/deprecated-action-version.js

@@ -0,0 +1,44 @@
+/**
+ * GHA012: Deprecated Action Version
+ *
+ * Flags `uses:` strings referencing deprecated action versions.
+ */
+import { ts } from "@intentius/chant/lint/typescript";
+import { deprecatedVersions } from "./data/deprecated-versions.js";
+export const deprecatedActionVersionRule = {
+    id: "GHA012",
+    severity: "warning",
+    category: "correctness",
+    description: "Action version is deprecated — upgrade to the recommended version",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function visit(node) {
+            if (ts.isStringLiteral(node)) {
+                const text = node.text;
+                const atIndex = text.indexOf("@");
+                if (atIndex === -1) {
+                    ts.forEachChild(node, visit);
+                    return;
+                }
+                const actionName = text.slice(0, atIndex);
+                const version = text.slice(atIndex + 1);
+                const info = deprecatedVersions[actionName];
+                if (info && info.deprecated.includes(version)) {
+                    const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                    diagnostics.push({
+                        file: sourceFile.fileName,
+                        line: line + 1,
+                        column: character + 1,
+                        ruleId: "GHA012",
+                        severity: "warning",
+                        message: `"${text}" uses deprecated version ${version}. Upgrade to ${actionName}@${info.recommended}.`,
+                    });
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/detect-secrets.js

@@ -0,0 +1,45 @@
+/**
+ * GHA020: Detect Secrets
+ *
+ * Scans string literals for patterns matching known secret formats.
+ * Skips strings containing "secrets." (proper usage).
+ */
+import { ts } from "@intentius/chant/lint/typescript";
+import { secretPatterns } from "./data/secret-patterns.js";
+export const detectSecretsRule = {
+    id: "GHA020",
+    severity: "error",
+    category: "security",
+    description: "Potential secret detected in source code",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function visit(node) {
+            if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) {
+                const text = node.text;
+                // Skip strings that reference secrets properly
+                if (text.includes("secrets.")) {
+                    ts.forEachChild(node, visit);
+                    return;
+                }
+                for (const { pattern, description } of secretPatterns) {
+                    if (pattern.test(text)) {
+                        const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                        diagnostics.push({
+                            file: sourceFile.fileName,
+                            line: line + 1,
+                            column: character + 1,
+                            ruleId: "GHA020",
+                            severity: "error",
+                            message: `Potential ${description} detected. Use secrets() to reference secrets securely.`,
+                        });
+                        break; // One diagnostic per string
+                    }
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/extract-inline-structs.js

@@ -0,0 +1,55 @@
+/**
+ * GHA005: Extract Inline Structs
+ *
+ * Flags object literal nesting depth > 2 inside resource constructors.
+ */
+import { ts } from "@intentius/chant/lint/typescript";
+const RESOURCE_NAMES = new Set(["Job", "Workflow", "ReusableWorkflowCallJob"]);
+const MAX_DEPTH = 2;
+export const extractInlineStructsRule = {
+    id: "GHA005",
+    severity: "info",
+    category: "style",
+    description: "Extract deeply nested inline objects to named constants",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function isResourceConstructor(node) {
+            if (ts.isIdentifier(node.expression))
+                return RESOURCE_NAMES.has(node.expression.text);
+            if (ts.isPropertyAccessExpression(node.expression))
+                return RESOURCE_NAMES.has(node.expression.name.text);
+            return false;
+        }
+        function checkDepth(node, depth) {
+            if (depth > MAX_DEPTH) {
+                const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                diagnostics.push({
+                    file: sourceFile.fileName,
+                    line: line + 1,
+                    column: character + 1,
+                    ruleId: "GHA005",
+                    severity: "info",
+                    message: `Object nesting depth ${depth} exceeds ${MAX_DEPTH}. Consider extracting to a named constant.`,
+                });
+                return;
+            }
+            for (const prop of node.properties) {
+                if (ts.isPropertyAssignment(prop) && ts.isObjectLiteralExpression(prop.initializer)) {
+                    checkDepth(prop.initializer, depth + 1);
+                }
+            }
+        }
+        function visit(node) {
+            if (ts.isNewExpression(node) && isResourceConstructor(node) && node.arguments?.[0]) {
+                const arg = node.arguments[0];
+                if (ts.isObjectLiteralExpression(arg)) {
+                    checkDepth(arg, 1);
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/file-job-limit.js

@@ -0,0 +1,43 @@
+/**
+ * GHA007: File Job Limit
+ *
+ * Flags files with more than 10 Job/ReusableWorkflowCallJob constructors.
+ */
+import { ts } from "@intentius/chant/lint/typescript";
+const JOB_NAMES = new Set(["Job", "ReusableWorkflowCallJob"]);
+const MAX_JOBS = 10;
+export const fileJobLimitRule = {
+    id: "GHA007",
+    severity: "warning",
+    category: "style",
+    description: "Too many jobs in a single file",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        let jobCount = 0;
+        function visit(node) {
+            if (ts.isNewExpression(node)) {
+                let isJob = false;
+                if (ts.isIdentifier(node.expression))
+                    isJob = JOB_NAMES.has(node.expression.text);
+                if (ts.isPropertyAccessExpression(node.expression))
+                    isJob = JOB_NAMES.has(node.expression.name.text);
+                if (isJob)
+                    jobCount++;
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        if (jobCount > MAX_JOBS) {
+            diagnostics.push({
+                file: sourceFile.fileName,
+                line: 1,
+                column: 1,
+                ruleId: "GHA007",
+                severity: "warning",
+                message: `File has ${jobCount} job constructors (limit: ${MAX_JOBS}). Consider splitting into multiple files.`,
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/rules/index.js

@@ -0,0 +1,16 @@
+/**
+ * GitHub Actions lint rules
+ */
+export { useTypedActionsRule } from "./use-typed-actions.js";
+export { useConditionBuildersRule } from "./use-condition-builders.js";
+export { noHardcodedSecretsRule } from "./no-hardcoded-secrets.js";
+export { useMatrixBuilderRule } from "./use-matrix-builder.js";
+export { extractInlineStructsRule } from "./extract-inline-structs.js";
+export { fileJobLimitRule } from "./file-job-limit.js";
+export { noRawExpressionsRule } from "./no-raw-expressions.js";
+export { missingRecommendedInputsRule } from "./missing-recommended-inputs.js";
+export { deprecatedActionVersionRule } from "./deprecated-action-version.js";
+export { jobTimeoutRule } from "./job-timeout.js";
+export { suggestCacheRule } from "./suggest-cache.js";
+export { validateConcurrencyRule } from "./validate-concurrency.js";
+export { detectSecretsRule } from "./detect-secrets.js";

package/dist/lint/rules/job-timeout.js

@@ -0,0 +1,53 @@
+/**
+ * GHA014: Job Timeout
+ *
+ * Flags `new Job({...})` without `timeoutMinutes` property.
+ */
+import { ts } from "@intentius/chant/lint/typescript";
+export const jobTimeoutRule = {
+    id: "GHA014",
+    severity: "warning",
+    category: "correctness",
+    description: "Job should specify a timeout-minutes value",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function visit(node) {
+            if (ts.isNewExpression(node)) {
+                let isJob = false;
+                if (ts.isIdentifier(node.expression) && node.expression.text === "Job")
+                    isJob = true;
+                if (ts.isPropertyAccessExpression(node.expression) && node.expression.name.text === "Job")
+                    isJob = true;
+                if (isJob && node.arguments?.length) {
+                    const arg = node.arguments[0];
+                    if (ts.isObjectLiteralExpression(arg)) {
+                        const hasTimeout = arg.properties.some((prop) => {
+                            if (ts.isPropertyAssignment(prop)) {
+                                const name = ts.isIdentifier(prop.name) ? prop.name.text
+                                    : ts.isStringLiteral(prop.name) ? prop.name.text
+                                        : "";
+                                return name === "timeoutMinutes" || name === "timeout-minutes";
+                            }
+                            return false;
+                        });
+                        if (!hasTimeout) {
+                            const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                            diagnostics.push({
+                                file: sourceFile.fileName,
+                                line: line + 1,
+                                column: character + 1,
+                                ruleId: "GHA014",
+                                severity: "warning",
+                                message: "Job should specify timeoutMinutes. Default is 360 (6 hours), which may be excessive.",
+                            });
+                        }
+                    }
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/missing-recommended-inputs.js

@@ -0,0 +1,51 @@
+/**
+ * GHA010: Missing Recommended Inputs
+ *
+ * Flags setup action composites without version-related inputs.
+ */
+import { ts } from "@intentius/chant/lint/typescript";
+import { recommendedInputs } from "./data/recommended-inputs.js";
+const SETUP_ACTIONS = new Set(Object.keys(recommendedInputs));
+export const missingRecommendedInputsRule = {
+    id: "GHA010",
+    severity: "warning",
+    category: "correctness",
+    description: "Setup action composite should specify a version input",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function visit(node) {
+            // Match: SetupNode({...}), SetupGo({...}), SetupPython({...})
+            if (ts.isCallExpression(node)) {
+                let actionName = null;
+                if (ts.isIdentifier(node.expression) && SETUP_ACTIONS.has(node.expression.text)) {
+                    actionName = node.expression.text;
+                }
+                if (actionName && node.arguments.length > 0) {
+                    const arg = node.arguments[0];
+                    if (ts.isObjectLiteralExpression(arg)) {
+                        const required = recommendedInputs[actionName] ?? [];
+                        const propNames = arg.properties
+                            .filter(ts.isPropertyAssignment)
+                            .map((p) => (ts.isIdentifier(p.name) ? p.name.text : ""));
+                        const hasAny = required.some((r) => propNames.includes(r));
+                        if (!hasAny) {
+                            const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                            diagnostics.push({
+                                file: sourceFile.fileName,
+                                line: line + 1,
+                                column: character + 1,
+                                ruleId: "GHA010",
+                                severity: "warning",
+                                message: `${actionName}() should specify a version input (${required.join(" or ")}).`,
+                            });
+                        }
+                    }
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/no-hardcoded-secrets.js

@@ -0,0 +1,39 @@
+/**
+ * GHA003: No Hardcoded Secrets
+ *
+ * Flags string literals matching GitHub token prefixes.
+ */
+import { ts } from "@intentius/chant/lint/typescript";
+const TOKEN_PREFIXES = ["ghp_", "ghs_", "ghu_", "ghr_", "gho_", "github_pat_"];
+export const noHardcodedSecretsRule = {
+    id: "GHA003",
+    severity: "error",
+    category: "security",
+    description: "No hardcoded GitHub tokens in source code",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function visit(node) {
+            if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) {
+                const text = node.text;
+                for (const prefix of TOKEN_PREFIXES) {
+                    if (text.includes(prefix)) {
+                        const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                        diagnostics.push({
+                            file: sourceFile.fileName,
+                            line: line + 1,
+                            column: character + 1,
+                            ruleId: "GHA003",
+                            severity: "error",
+                            message: `Hardcoded GitHub token detected (prefix: ${prefix}). Use secrets() instead.`,
+                        });
+                        break;
+                    }
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/no-raw-expressions.js

@@ -0,0 +1,44 @@
+/**
+ * GHA008: No Raw Expressions
+ *
+ * Flags `${{` strings outside valid context paths.
+ */
+import { ts } from "@intentius/chant/lint/typescript";
+const VALID_CONTEXTS = ["github.", "secrets.", "matrix.", "steps.", "needs.", "inputs.", "env.", "vars.", "runner.", "always()", "failure()", "success()", "cancelled()", "contains(", "startsWith(", "endsWith(", "format(", "join(", "toJSON(", "fromJSON(", "hashFiles("];
+export const noRawExpressionsRule = {
+    id: "GHA008",
+    severity: "info",
+    category: "style",
+    description: "Avoid raw ${{ }} expression strings — use typed Expression helpers",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function visit(node) {
+            if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) {
+                const text = node.text;
+                if (text.includes("${{")) {
+                    // Extract the expression content
+                    const match = text.match(/\$\{\{\s*(.+?)\s*\}\}/);
+                    if (match) {
+                        const expr = match[1];
+                        const isValid = VALID_CONTEXTS.some((ctx) => expr.startsWith(ctx));
+                        if (!isValid) {
+                            const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                            diagnostics.push({
+                                file: sourceFile.fileName,
+                                line: line + 1,
+                                column: character + 1,
+                                ruleId: "GHA008",
+                                severity: "info",
+                                message: `Raw expression "$\{{ ${expr} }}" doesn't match a known context. Use typed Expression helpers.`,
+                            });
+                        }
+                    }
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/suggest-cache.js

@@ -0,0 +1,60 @@
+/**
+ * GHA015: Suggest Cache
+ *
+ * Flags setup action composites in steps without a corresponding Cache composite.
+ */
+import { ts } from "@intentius/chant/lint/typescript";
+const setupActionsNeedingCache = new Set(["SetupNode", "SetupGo", "SetupPython"]);
+export const suggestCacheRule = {
+    id: "GHA015",
+    severity: "warning",
+    category: "performance",
+    description: "Setup action should be paired with a Cache composite for faster builds",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function visit(node) {
+            // Look for steps array with setup actions but no Cache
+            if (ts.isPropertyAssignment(node) &&
+                ts.isIdentifier(node.name) &&
+                node.name.text === "steps" &&
+                ts.isArrayLiteralExpression(node.initializer)) {
+                const elements = node.initializer.elements;
+                let hasSetup = false;
+                let setupName = "";
+                let hasCache = false;
+                for (const el of elements) {
+                    if (ts.isCallExpression(el)) {
+                        const name = ts.isIdentifier(el.expression) ? el.expression.text : "";
+                        if (setupActionsNeedingCache.has(name)) {
+                            hasSetup = true;
+                            setupName = name;
+                            // Check if the setup action already has cache in its props
+                            if (el.arguments.length > 0 && ts.isObjectLiteralExpression(el.arguments[0])) {
+                                const hasCacheProp = el.arguments[0].properties.some((p) => ts.isPropertyAssignment(p) && ts.isIdentifier(p.name) && p.name.text === "cache");
+                                if (hasCacheProp)
+                                    hasCache = true;
+                            }
+                        }
+                        if (name === "Cache")
+                            hasCache = true;
+                    }
+                }
+                if (hasSetup && !hasCache) {
+                    const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                    diagnostics.push({
+                        file: sourceFile.fileName,
+                        line: line + 1,
+                        column: character + 1,
+                        ruleId: "GHA015",
+                        severity: "warning",
+                        message: `${setupName}() found without Cache. Add a Cache() step or use the built-in cache option for faster builds.`,
+                    });
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/use-condition-builders.js

@@ -0,0 +1,37 @@
+/**
+ * GHA002: Use Condition Builders
+ *
+ * Flags string literals containing `${{` in `if` property assignments
+ * inside Job/Step constructors. Suggests using Expression helpers.
+ */
+import { ts } from "@intentius/chant/lint/typescript";
+export const useConditionBuildersRule = {
+    id: "GHA002",
+    severity: "warning",
+    category: "style",
+    description: "Use Expression helpers instead of raw ${{ }} strings in if conditions",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function visit(node) {
+            if (ts.isPropertyAssignment(node) &&
+                ts.isIdentifier(node.name) &&
+                node.name.text === "if" &&
+                ts.isStringLiteral(node.initializer) &&
+                node.initializer.text.includes("${{")) {
+                const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                diagnostics.push({
+                    file: sourceFile.fileName,
+                    line: line + 1,
+                    column: character + 1,
+                    ruleId: "GHA002",
+                    severity: "warning",
+                    message: "Use typed Expression helpers (e.g., github.ref.eq('refs/heads/main')) instead of raw ${{ }} strings.",
+                });
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/use-matrix-builder.js

@@ -0,0 +1,36 @@
+/**
+ * GHA004: Use Matrix Builder
+ *
+ * Flags inline object literals in `matrix` property. Suggests extracting
+ * to a named const for reusability and clarity.
+ */
+import { ts } from "@intentius/chant/lint/typescript";
+export const useMatrixBuilderRule = {
+    id: "GHA004",
+    severity: "info",
+    category: "style",
+    description: "Extract inline matrix objects to named constants",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function visit(node) {
+            if (ts.isPropertyAssignment(node) &&
+                ts.isIdentifier(node.name) &&
+                node.name.text === "matrix" &&
+                ts.isObjectLiteralExpression(node.initializer)) {
+                const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                diagnostics.push({
+                    file: sourceFile.fileName,
+                    line: line + 1,
+                    column: character + 1,
+                    ruleId: "GHA004",
+                    severity: "info",
+                    message: "Consider extracting inline matrix to a named constant for clarity.",
+                });
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/use-typed-actions.js

@@ -0,0 +1,41 @@
+/**
+ * GHA001: Use Typed Action Composites
+ *
+ * Flags raw `uses:` string literals when a matching typed composite exists.
+ */
+import { ts } from "@intentius/chant/lint/typescript";
+import { knownActions } from "./data/known-actions.js";
+export const useTypedActionsRule = {
+    id: "GHA001",
+    severity: "warning",
+    category: "style",
+    description: "Use typed action composite instead of raw uses: string",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function visit(node) {
+            if (ts.isPropertyAssignment(node) && ts.isIdentifier(node.name) && node.name.text === "uses") {
+                if (ts.isStringLiteral(node.initializer)) {
+                    const value = node.initializer.text;
+                    // Extract action name without version: "actions/checkout@v4" → "actions/checkout"
+                    const actionName = value.split("@")[0];
+                    const match = knownActions[actionName];
+                    if (match) {
+                        const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                        diagnostics.push({
+                            file: sourceFile.fileName,
+                            line: line + 1,
+                            column: character + 1,
+                            ruleId: "GHA001",
+                            severity: "warning",
+                            message: `Use the typed ${match.composite}() composite instead of raw "${value}" string.`,
+                        });
+                    }
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};