@intentius/chant-lexicon-github 0.124.31 → 0.124.32

package/dist/lint/audit-catalog.js

@@ -0,0 +1,69 @@
+/**
+ * The github lexicon's chant audit catalog — metadata for its post-synth rules
+ * (GHA GitHub Actions rules). Contributed via githubPlugin.auditCatalog() (#687).
+ */
+import { auditRule, GH_INJECTION, GH_PWN, GH_SECRETS, GH_THIRD_PARTY, GH_TOKEN, SCORECARD_PINNED, SCORECARD_TOKEN, SCORECARD_VULN, applyLineage } from "@intentius/chant/audit/catalog";
+import { githubAuditLineage } from "./audit-lineage.js";
+export const githubAuditCatalog = {
+    GHA006: auditRule("GHA006", "report-only", "guidance", "Duplicate workflow name", "Give each workflow a unique `name:`.", { category: "correctness" }),
+    GHA009: auditRule("GHA009", "merge-worthy", "guidance", "Empty matrix dimension", "Remove the empty matrix axis or give it values; an empty axis produces zero jobs.", { category: "correctness" }),
+    GHA011: auditRule("GHA011", "merge-worthy", "guidance", "needs references a non-existent job", "Fix the `needs:` target to name a real job.", { category: "correctness" }),
+    GHA013: auditRule("GHA013", "merge-worthy", "guidance", "Missing job permissions on a sensitive trigger", "Add an explicit least-privilege `permissions:` block to jobs under `pull_request_target`/`workflow_dispatch`.", { authority: [SCORECARD_TOKEN, GH_TOKEN] }),
+    GHA017: auditRule("GHA017", "merge-worthy", "deterministic", "No explicit permissions block", "Add a top-level `permissions: { contents: read }` and widen only where a job needs it.", { authority: [SCORECARD_TOKEN, GH_TOKEN] }),
+    GHA018: auditRule("GHA018", "merge-worthy", "guidance", "pull_request_target checks out untrusted code", "Don't check out / run PR head code under `pull_request_target`; split into a privileged + unprivileged workflow.", { authority: [GH_PWN] }),
+    GHA019: auditRule("GHA019", "merge-worthy", "guidance", "Circular needs chain", "Break the cycle in the job dependency graph.", { category: "correctness" }),
+    GHA021: auditRule("GHA021", "merge-worthy", "deterministic", "actions/checkout not pinned to a SHA", "Pin `actions/checkout` to a full 40-char commit SHA.", { authority: [SCORECARD_PINNED, GH_THIRD_PARTY] }),
+    GHA022: auditRule("GHA022", "report-only", "guidance", "Job without timeout-minutes", "Add `timeout-minutes:` to bound runaway jobs.", { category: "best-practice" }),
+    GHA023: auditRule("GHA023", "report-only", "guidance", "Deprecated ::set-output", "Replace `::set-output` with `$GITHUB_OUTPUT`.", { category: "best-practice" }),
+    GHA024: auditRule("GHA024", "report-only", "guidance", "Missing concurrency block", "Add a `concurrency:` group to deploy workflows.", { category: "best-practice" }),
+    GHA025: auditRule("GHA025", "merge-worthy", "guidance", "Unrestricted pull_request_target", "Gate `pull_request_target` jobs and avoid running untrusted code with elevated scope.", { authority: [GH_PWN] }),
+    GHA026: auditRule("GHA026", "report-only", "guidance", "Secret used without environment protection", "Move secret-consuming jobs behind a protected `environment:`.", { category: "best-practice" }),
+    GHA027: auditRule("GHA027", "report-only", "guidance", "Cleanup step without if: always()", "Add `if: always()` to cleanup steps.", { category: "best-practice" }),
+    GHA028: auditRule("GHA028", "merge-worthy", "guidance", "Workflow with no triggers", "Add an `on:` trigger; the workflow never runs without one.", { category: "correctness" }),
+    GHA029: auditRule("GHA029", "merge-worthy", "deterministic", "Action not pinned to a commit SHA", "Pin the action to a full commit SHA instead of a tag/branch.", { authority: [SCORECARD_PINNED, GH_THIRD_PARTY] }),
+    GHA030: auditRule("GHA030", "merge-worthy", "deterministic", "Container image not pinned to a digest", "Pin the image to an immutable `@sha256:` digest.", { authority: [SCORECARD_PINNED] }),
+    GHA031: auditRule("GHA031", "merge-worthy", "guidance", "Possible action impersonation", "Verify the action owner/slug; it resembles a well-known action.", { authority: [SCORECARD_PINNED] }),
+    GHA032: auditRule("GHA032", "merge-worthy", "guidance", "Archived/abandoned or vulnerable action", "Replace the archived action or one with a disclosed security issue.", { category: "security" }),
+    GHA033: auditRule("GHA033", "merge-worthy", "deterministic", "Blanket write-all permissions", "Replace `write-all` with the specific scopes the jobs need (default `contents: read`).", { authority: [SCORECARD_TOKEN, GH_TOKEN] }),
+    GHA034: auditRule("GHA034", "merge-worthy", "guidance", "Write permissions granted workflow-wide", "Move write scopes to the single job that needs them; keep the workflow least-privilege.", { authority: [SCORECARD_TOKEN, GH_TOKEN] }),
+    GHA035: auditRule("GHA035", "merge-worthy", "guidance", "Elevated token on an untrusted-code trigger", "Drop the elevated `permissions:` on triggers that can run untrusted code.", { authority: [GH_PWN, SCORECARD_TOKEN] }),
+    GHA036: auditRule("GHA036", "merge-worthy", "guidance", "Untrusted input interpolated into run:", "Pass untrusted `${{ }}` values via an `env:` var and reference `\"$VAR\"`, never inline in the script.", { authority: [GH_INJECTION] }),
+    GHA037: auditRule("GHA037", "merge-worthy", "guidance", "Untrusted input written to GITHUB_ENV/GITHUB_PATH", "Don't write untrusted input to `$GITHUB_ENV`/`$GITHUB_PATH`; sanitize or avoid.", { authority: [GH_INJECTION] }),
+    GHA038: auditRule("GHA038", "merge-worthy", "guidance", "workflow_run checks out untrusted code in a privileged context", "Avoid checking out untrusted code under `workflow_run`; treat it as privileged.", { authority: [GH_PWN] }),
+    GHA039: auditRule("GHA039", "merge-worthy", "guidance", "Auth gate on a spoofable author field", "Gate on a non-spoofable identity, not a commit-author field.", { authority: [GH_PWN] }),
+    GHA040: auditRule("GHA040", "merge-worthy", "guidance", "Self-hosted runner on an untrusted-code trigger", "Don't run untrusted-code triggers on self-hosted runners.", { authority: [GH_PWN] }),
+    GHA041: auditRule("GHA041", "merge-worthy", "guidance", "Blanket secrets: inherit", "Pass only the specific secrets the reusable workflow needs.", { authority: [GH_SECRETS] }),
+    GHA042: auditRule("GHA042", "merge-worthy", "guidance", "Entire secrets context passed", "Pass named secrets instead of the whole `secrets` context.", { authority: [GH_SECRETS] }),
+    GHA043: auditRule("GHA043", "merge-worthy", "guidance", "Secret consumed without an environment gate", "Put secret-consuming jobs behind a protected environment.", { authority: [GH_SECRETS] }),
+    GHA044: auditRule("GHA044", "merge-worthy", "guidance", "Hardcoded registry/container credential", "Remove the hardcoded credential, move it to a secret, and rotate it (responsible disclosure first).", { authority: [GH_SECRETS] }),
+    GHA045: auditRule("GHA045", "merge-worthy", "guidance", "Secret interpolated into run:", "Reference secrets via `env:`, not inline in the shell command.", { authority: [GH_INJECTION, GH_SECRETS] }),
+    GHA046: auditRule("GHA046", "merge-worthy", "guidance", "Constant/unsound guard condition", "Fix the always-true/false `if:` — it may neutralize a security gate.", { category: "correctness" }),
+    GHA047: auditRule("GHA047", "merge-worthy", "guidance", "Ineffective contains() guard (reversed args)", "Swap the `contains()` arguments so the guard actually filters.", { category: "correctness" }),
+    GHA048: auditRule("GHA048", "merge-worthy", "guidance", "Obfuscated guard condition", "Simplify the indirect `if:` so its effect is reviewable.", { category: "correctness" }),
+    GHA049: auditRule("GHA049", "merge-worthy", "guidance", "Persisted checkout credentials reachable by an artifact", "Use `persist-credentials: false` or exclude `.git` from uploaded artifacts.", { authority: [GH_SECRETS] }),
+    GHA050: auditRule("GHA050", "merge-worthy", "guidance", "Cache populated in a privileged context", "Don't populate caches from untrusted code paths (poisoning risk).", { authority: [GH_PWN] }),
+    GHA051: auditRule("GHA051", "report-only", "guidance", "Long-lived token instead of OIDC", "Migrate publish/release to OIDC short-lived credentials.", { category: "best-practice" }),
+    GHA052: auditRule("GHA052", "merge-worthy", "guidance", "Software piped to a shell without verification", "Verify a checksum/signature before executing fetched scripts.", { authority: [SCORECARD_PINNED] }),
+    GHA053: auditRule("GHA053", "merge-worthy", "guidance", "Re-enables unsafe set-env/add-path", "Remove `ACTIONS_ALLOW_UNSECURE_COMMANDS`; use `$GITHUB_ENV`/`$GITHUB_PATH`.", { authority: [GH_INJECTION] }),
+    GHA054: auditRule("GHA054", "merge-worthy", "guidance", "Feature with a known security footgun", "Replace the flagged feature with the safe alternative.", { category: "security" }),
+    GHA055: auditRule("GHA055", "report-only", "guidance", "Runtime install of a tool already on the runner", "Drop the redundant install to save time.", { category: "best-practice" }),
+    GHA056: auditRule("GHA056", "report-only", "guidance", "Workflow without a name", "Add a `name:` to the workflow.", { category: "best-practice" }),
+    GHA057: auditRule("GHA057", "merge-worthy", "guidance", "Dependency update can execute untrusted code", "Disable the option that lets dependency updates run external code.", { authority: [GH_PWN] }),
+    GHA058: auditRule("GHA058", "report-only", "guidance", "Dependency update has no cooldown window", "Add a cooldown so new releases aren't merged instantly.", { category: "best-practice" }),
+    // Supply-chain and token-scoping expansion (#445).
+    GHA059: auditRule("GHA059", "merge-worthy", "guidance", "Stale or missing pin annotation", "Add or correct the trailing version comment on the SHA-pinned reference so it matches the digest.", { authority: [SCORECARD_PINNED, GH_THIRD_PARTY] }),
+    GHA060: auditRule("GHA060", "merge-worthy", "guidance", "Over-scoped generated token", "Narrow the GitHub App token's permission-* inputs to the scopes its consuming steps actually use, or remove the unused ones.", { authority: [SCORECARD_TOKEN, GH_TOKEN] }),
+    GHA061: auditRule("GHA061", "merge-worthy", "guidance", "Action reference outside the configured usage policy", "Replace the reference with one from the approved allowlist, or get it added if it should be trusted.", { category: "security" }),
+    GHA062: auditRule("GHA062", "merge-worthy", "guidance", "Pinned reference matches a known-vulnerability advisory", "Bump the reference to a patched ref/commit named by the advisory.", { authority: [SCORECARD_VULN] }),
+    // Efficiency (#444) — waste, not a safety/correctness issue. Always
+    // report-only: none of these warrant a merge on their own.
+    GHA063: auditRule("GHA063", "report-only", "guidance", "Dependency setup action without caching enabled", "Enable the setup action's `cache:` option or add an actions/cache step.", { category: "efficiency" }),
+    GHA064: auditRule("GHA064", "report-only", "guidance", "Expensive runner without justification", "Confirm the job needs that OS, or move it to a Linux runner.", { category: "efficiency" }),
+    GHA065: auditRule("GHA065", "report-only", "guidance", "Unbounded matrix fan-out", "Trim the matrix with include/exclude, or cap it with max-parallel.", { category: "efficiency" }),
+    GHA066: auditRule("GHA066", "report-only", "guidance", "Unbounded artifact retention", "Set a retention-days sized to how long the artifact is actually needed.", { category: "efficiency" }),
+    GHA067: auditRule("GHA067", "report-only", "guidance", "Unconditional heavy step with no path filter", "Scope the trigger's paths, or add an if: guard to the step.", { category: "efficiency" }),
+    GHA068: auditRule("GHA068", "report-only", "guidance", "Pull-request workflow missing a concurrency group", "Add a concurrency group with cancel-in-progress: true.", { category: "efficiency" }),
+    GHA069: auditRule("GHA069", "merge-worthy", "guidance", "Job permissions block drops the workflow's id-token: write", "Add `id-token: write` to the job's `permissions:` block; keep the job block rather than removing it.", { category: "correctness" }),
+};
+// Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
+applyLineage(githubAuditCatalog, githubAuditLineage);

package/dist/lint/audit-lineage.js

@@ -0,0 +1,168 @@
+export const githubAuditLineage = {
+    GHA009: [
+        { tool: "actionlint", rule: "Unexpected empty mappings", url: "https://github.com/rhysd/actionlint/blob/main/docs/checks.md#unexpected-empty-mappings", relation: "overlaps" },
+    ],
+    GHA011: [
+        { tool: "actionlint", rule: "Job dependencies validation", url: "https://github.com/rhysd/actionlint/blob/main/docs/checks.md#job-dependencies-validation", relation: "equivalent" },
+    ],
+    GHA013: [
+        { tool: "poutine", rule: "default_permissions_on_risky_events", url: "https://boostsecurityio.github.io/poutine/rules/default_permissions_on_risky_events/", relation: "overlaps" },
+        { tool: "zizmor", rule: "excessive-permissions", url: "https://docs.zizmor.sh/audits/#excessive-permissions", relation: "overlaps" },
+        { tool: "scorecard", rule: "Token-Permissions", url: "https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions", relation: "overlaps" },
+    ],
+    GHA017: [
+        { tool: "zizmor", rule: "excessive-permissions", url: "https://docs.zizmor.sh/audits/#excessive-permissions", relation: "overlaps" },
+        { tool: "scorecard", rule: "Token-Permissions", url: "https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions", relation: "overlaps" },
+    ],
+    GHA018: [
+        { tool: "scorecard", rule: "Dangerous-Workflow", url: "https://github.com/ossf/scorecard/blob/main/docs/checks.md#dangerous-workflow", relation: "overlaps" },
+        { tool: "octoscan", rule: "dangerous-checkout", url: "https://github.com/synacktiv/octoscan#dangerous-checkout", relation: "overlaps" },
+        { tool: "poutine", rule: "untrusted_checkout_exec", url: "https://boostsecurityio.github.io/poutine/rules/untrusted_checkout_exec/", relation: "overlaps" },
+    ],
+    GHA019: [
+        { tool: "actionlint", rule: "Job dependencies validation", url: "https://github.com/rhysd/actionlint/blob/main/docs/checks.md#job-dependencies-validation", relation: "equivalent" },
+    ],
+    GHA021: [
+        { tool: "zizmor", rule: "unpinned-uses", url: "https://docs.zizmor.sh/audits/#unpinned-uses", relation: "overlaps" },
+        { tool: "scorecard", rule: "Pinned-Dependencies", url: "https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies", relation: "overlaps" },
+    ],
+    GHA023: [
+        { tool: "actionlint", rule: "Check deprecated workflow commands", url: "https://github.com/rhysd/actionlint/blob/main/docs/checks.md#check-deprecated-workflow-commands", relation: "overlaps" },
+    ],
+    GHA024: [
+        { tool: "zizmor", rule: "concurrency-limits", url: "https://docs.zizmor.sh/audits/#concurrency-limits", relation: "overlaps" },
+    ],
+    GHA025: [
+        { tool: "zizmor", rule: "dangerous-triggers", url: "https://docs.zizmor.sh/audits/#dangerous-triggers", relation: "overlaps" },
+    ],
+    GHA026: [
+        { tool: "zizmor", rule: "secrets-outside-env", url: "https://docs.zizmor.sh/audits/#secrets-outside-env", relation: "equivalent" },
+    ],
+    GHA028: [
+        { tool: "actionlint", rule: "Missing required keys and key duplicates", url: "https://github.com/rhysd/actionlint/blob/main/docs/checks.md#missing-required-keys-and-key-duplicates", relation: "overlaps" },
+    ],
+    GHA029: [
+        { tool: "zizmor", rule: "unpinned-uses", url: "https://docs.zizmor.sh/audits/#unpinned-uses", relation: "overlaps" },
+        { tool: "scorecard", rule: "Pinned-Dependencies", url: "https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies", relation: "overlaps" },
+    ],
+    GHA030: [
+        { tool: "zizmor", rule: "unpinned-images", url: "https://docs.zizmor.sh/audits/#unpinned-images", relation: "overlaps" },
+    ],
+    GHA031: [
+        { tool: "zizmor", rule: "typosquat-uses", url: "https://docs.zizmor.sh/audits/#typosquat-uses", relation: "equivalent" },
+    ],
+    GHA032: [
+        { tool: "zizmor", rule: "archived-uses", url: "https://docs.zizmor.sh/audits/#archived-uses", relation: "overlaps" },
+        { tool: "zizmor", rule: "known-vulnerable-actions", url: "https://docs.zizmor.sh/audits/#known-vulnerable-actions", relation: "overlaps" },
+    ],
+    GHA033: [
+        { tool: "zizmor", rule: "excessive-permissions", url: "https://docs.zizmor.sh/audits/#excessive-permissions", relation: "overlaps" },
+        { tool: "scorecard", rule: "Token-Permissions", url: "https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions", relation: "overlaps" },
+    ],
+    GHA034: [
+        { tool: "zizmor", rule: "excessive-permissions", url: "https://docs.zizmor.sh/audits/#excessive-permissions", relation: "overlaps" },
+        { tool: "scorecard", rule: "Token-Permissions", url: "https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions", relation: "overlaps" },
+    ],
+    GHA036: [
+        { tool: "zizmor", rule: "template-injection", url: "https://docs.zizmor.sh/audits/#template-injection", relation: "equivalent" },
+        { tool: "poutine", rule: "injection", url: "https://boostsecurityio.github.io/poutine/rules/injection/", relation: "equivalent" },
+        { tool: "actionlint", rule: "Script injection by potentially untrusted inputs", url: "https://github.com/rhysd/actionlint/blob/main/docs/checks.md#script-injection-by-potentially-untrusted-inputs", relation: "equivalent" },
+        { tool: "octoscan", rule: "expression-injection", url: "https://github.com/synacktiv/octoscan#expression-injection", relation: "equivalent" },
+        { tool: "scorecard", rule: "Dangerous-Workflow", url: "https://github.com/ossf/scorecard/blob/main/docs/checks.md#dangerous-workflow", relation: "overlaps" },
+    ],
+    GHA037: [
+        { tool: "zizmor", rule: "github-env", url: "https://docs.zizmor.sh/audits/#github-env", relation: "equivalent" },
+        { tool: "octoscan", rule: "dangerous-write", url: "https://github.com/synacktiv/octoscan#dangerous-write", relation: "overlaps" },
+    ],
+    GHA038: [
+        { tool: "scorecard", rule: "Dangerous-Workflow", url: "https://github.com/ossf/scorecard/blob/main/docs/checks.md#dangerous-workflow", relation: "overlaps" },
+        { tool: "octoscan", rule: "dangerous-checkout", url: "https://github.com/synacktiv/octoscan#dangerous-checkout", relation: "overlaps" },
+    ],
+    GHA039: [
+        { tool: "zizmor", rule: "bot-conditions", url: "https://docs.zizmor.sh/audits/#bot-conditions", relation: "overlaps" },
+        { tool: "octoscan", rule: "bot-check", url: "https://github.com/synacktiv/octoscan#bot-check", relation: "overlaps" },
+        { tool: "poutine", rule: "confused_deputy_auto_merge", url: "https://boostsecurityio.github.io/poutine/rules/confused_deputy_auto_merge/", relation: "overlaps" },
+    ],
+    GHA040: [
+        { tool: "poutine", rule: "pr_runs_on_self_hosted", url: "https://boostsecurityio.github.io/poutine/rules/pr_runs_on_self_hosted/", relation: "equivalent" },
+        { tool: "zizmor", rule: "self-hosted-runner", url: "https://docs.zizmor.sh/audits/#self-hosted-runner", relation: "overlaps" },
+        { tool: "octoscan", rule: "runner-label", url: "https://github.com/synacktiv/octoscan#runner-label", relation: "overlaps" },
+    ],
+    GHA041: [
+        { tool: "zizmor", rule: "secrets-inherit", url: "https://docs.zizmor.sh/audits/#secrets-inherit", relation: "equivalent" },
+    ],
+    GHA042: [
+        { tool: "zizmor", rule: "overprovisioned-secrets", url: "https://docs.zizmor.sh/audits/#overprovisioned-secrets", relation: "equivalent" },
+        { tool: "poutine", rule: "job_all_secrets", url: "https://boostsecurityio.github.io/poutine/rules/job_all_secrets/", relation: "equivalent" },
+    ],
+    GHA043: [
+        { tool: "zizmor", rule: "secrets-outside-env", url: "https://docs.zizmor.sh/audits/#secrets-outside-env", relation: "equivalent" },
+    ],
+    GHA044: [
+        { tool: "zizmor", rule: "hardcoded-container-credentials", url: "https://docs.zizmor.sh/audits/#hardcoded-container-credentials", relation: "equivalent" },
+        { tool: "actionlint", rule: "Hardcoded credentials", url: "https://github.com/rhysd/actionlint/blob/main/docs/checks.md#hardcoded-credentials", relation: "equivalent" },
+        { tool: "octoscan", rule: "credentials", url: "https://github.com/synacktiv/octoscan#credentials", relation: "equivalent" },
+    ],
+    GHA046: [
+        { tool: "actionlint", rule: "Constant conditions at `if:`", url: "https://github.com/rhysd/actionlint/blob/main/docs/checks.md#constant-conditions-at-if", relation: "equivalent" },
+        { tool: "zizmor", rule: "unsound-condition", url: "https://docs.zizmor.sh/audits/#unsound-condition", relation: "overlaps" },
+        { tool: "poutine", rule: "if_always_true", url: "https://boostsecurityio.github.io/poutine/rules/if_always_true/", relation: "overlaps" },
+    ],
+    GHA047: [
+        { tool: "zizmor", rule: "unsound-contains", url: "https://docs.zizmor.sh/audits/#unsound-contains", relation: "equivalent" },
+    ],
+    GHA048: [
+        { tool: "zizmor", rule: "obfuscation", url: "https://docs.zizmor.sh/audits/#obfuscation", relation: "overlaps" },
+    ],
+    GHA049: [
+        { tool: "zizmor", rule: "artipacked", url: "https://docs.zizmor.sh/audits/#artipacked", relation: "equivalent" },
+        { tool: "octoscan", rule: "dangerous-artefact", url: "https://github.com/synacktiv/octoscan#dangerous-artefact", relation: "overlaps" },
+    ],
+    GHA050: [
+        { tool: "zizmor", rule: "cache-poisoning", url: "https://docs.zizmor.sh/audits/#cache-poisoning", relation: "overlaps" },
+    ],
+    GHA051: [
+        { tool: "zizmor", rule: "use-trusted-publishing", url: "https://docs.zizmor.sh/audits/#use-trusted-publishing", relation: "overlaps" },
+    ],
+    GHA052: [
+        { tool: "poutine", rule: "unverified_script_exec", url: "https://boostsecurityio.github.io/poutine/rules/unverified_script_exec/", relation: "equivalent" },
+        { tool: "scorecard", rule: "Pinned-Dependencies", url: "https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies", relation: "overlaps" },
+    ],
+    GHA053: [
+        { tool: "zizmor", rule: "insecure-commands", url: "https://docs.zizmor.sh/audits/#insecure-commands", relation: "equivalent" },
+        { tool: "octoscan", rule: "unsecure-commands", url: "https://github.com/synacktiv/octoscan#unsecure-commands", relation: "equivalent" },
+    ],
+    GHA054: [
+        { tool: "zizmor", rule: "misfeature", url: "https://docs.zizmor.sh/audits/#misfeature", relation: "overlaps" },
+    ],
+    GHA055: [
+        { tool: "zizmor", rule: "superfluous-actions", url: "https://docs.zizmor.sh/audits/#superfluous-actions", relation: "overlaps" },
+    ],
+    GHA056: [
+        { tool: "zizmor", rule: "anonymous-definition", url: "https://docs.zizmor.sh/audits/#anonymous-definition", relation: "overlaps" },
+    ],
+    GHA057: [
+        { tool: "zizmor", rule: "dependabot-execution", url: "https://docs.zizmor.sh/audits/#dependabot-execution", relation: "equivalent" },
+    ],
+    GHA058: [
+        { tool: "zizmor", rule: "dependabot-cooldown", url: "https://docs.zizmor.sh/audits/#dependabot-cooldown", relation: "equivalent" },
+    ],
+    GHA059: [
+        { tool: "zizmor", rule: "ref-version-mismatch", url: "https://docs.zizmor.sh/audits/#ref-version-mismatch", relation: "equivalent" },
+    ],
+    GHA060: [
+        { tool: "zizmor", rule: "github-app", url: "https://docs.zizmor.sh/audits/#github-app", relation: "overlaps" },
+    ],
+    GHA061: [
+        { tool: "zizmor", rule: "forbidden-uses", url: "https://docs.zizmor.sh/audits/#forbidden-uses", relation: "equivalent" },
+    ],
+    GHA062: [
+        { tool: "zizmor", rule: "known-vulnerable-actions", url: "https://docs.zizmor.sh/audits/#known-vulnerable-actions", relation: "equivalent" },
+        { tool: "poutine", rule: "known_vulnerability_in_build_component", url: "https://boostsecurityio.github.io/poutine/rules/known_vulnerability_in_build_component/", relation: "equivalent" },
+        { tool: "octoscan", rule: "known-vulnerability", url: "https://github.com/synacktiv/octoscan#known-vulnerability", relation: "equivalent" },
+        { tool: "scorecard", rule: "Vulnerabilities", url: "https://github.com/ossf/scorecard/blob/main/docs/checks.md#vulnerabilities", relation: "overlaps" },
+    ],
+    GHA068: [
+        { tool: "zizmor", rule: "concurrency-limits", url: "https://docs.zizmor.sh/audits/#concurrency-limits", relation: "overlaps" },
+    ],
+};

package/dist/lint/post-synth/gha006.js

@@ -0,0 +1,50 @@
+/**
+ * GHA006: Duplicate Workflow Name
+ *
+ * Detects multiple workflows sharing the same `name:` value.
+ */
+import { extractWorkflowName } from "./yaml-helpers.js";
+export const gha006 = {
+    id: "GHA006",
+    description: "Multiple workflows share the same name",
+    check(ctx) {
+        const diagnostics = [];
+        const nameMap = new Map();
+        for (const [outputName, output] of ctx.outputs) {
+            const yaml = typeof output === "string" ? output : output.primary;
+            // Check if this is a multi-file output
+            if (typeof output === "object" && "files" in output) {
+                const result = output;
+                if (result.files) {
+                    for (const [fileName, fileContent] of Object.entries(result.files)) {
+                        const name = extractWorkflowName(fileContent);
+                        if (name) {
+                            const existing = nameMap.get(name) ?? [];
+                            existing.push(fileName);
+                            nameMap.set(name, existing);
+                        }
+                    }
+                }
+            }
+            else {
+                const name = extractWorkflowName(yaml);
+                if (name) {
+                    const existing = nameMap.get(name) ?? [];
+                    existing.push(outputName);
+                    nameMap.set(name, existing);
+                }
+            }
+        }
+        for (const [name, files] of nameMap) {
+            if (files.length > 1) {
+                diagnostics.push({
+                    checkId: "GHA006",
+                    severity: "error",
+                    message: `Duplicate workflow name "${name}" found in: ${files.join(", ")}`,
+                    lexicon: "github",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha009.js

@@ -0,0 +1,35 @@
+/**
+ * GHA009: Empty Matrix Dimension
+ *
+ * Detects matrix dimensions with empty values arrays.
+ */
+import { getPrimaryOutput } from "./yaml-helpers.js";
+export const gha009 = {
+    id: "GHA009",
+    description: "Matrix dimension has empty values array",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            // Find matrix sections and check for empty arrays
+            const matrixMatch = yaml.match(/matrix:\n([\s\S]*?)(?=\n\s{4}[a-z]|\n\s{2}[a-z]|\n[a-z]|$)/gm);
+            if (!matrixMatch)
+                continue;
+            for (const section of matrixMatch) {
+                const lines = section.split("\n");
+                for (let i = 0; i < lines.length; i++) {
+                    const keyMatch = lines[i].match(/^\s+([a-z][a-z0-9_-]*):\s*\[\s*\]\s*$/);
+                    if (keyMatch) {
+                        diagnostics.push({
+                            checkId: "GHA009",
+                            severity: "error",
+                            message: `Matrix dimension "${keyMatch[1]}" has an empty values array.`,
+                            lexicon: "github",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha011.js

@@ -0,0 +1,34 @@
+/**
+ * GHA011: Invalid Needs Reference
+ *
+ * Detects `needs:` references to non-existent job IDs.
+ */
+import { getPrimaryOutput, extractJobs } from "./yaml-helpers.js";
+export const gha011 = {
+    id: "GHA011",
+    description: "Job needs: references non-existent job",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            const jobs = extractJobs(yaml);
+            const jobNames = new Set(jobs.keys());
+            for (const [jobName, job] of jobs) {
+                if (!job.needs)
+                    continue;
+                for (const need of job.needs) {
+                    if (!jobNames.has(need)) {
+                        diagnostics.push({
+                            checkId: "GHA011",
+                            severity: "error",
+                            message: `Job "${jobName}" needs "${need}", but no such job exists.`,
+                            entity: jobName,
+                            lexicon: "github",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha013.js

@@ -0,0 +1,40 @@
+/**
+ * GHA013: Missing Job-Level Permissions for Sensitive Triggers
+ *
+ * Flags jobs without explicit `permissions:` when the workflow uses
+ * `pull_request_target` or `workflow_dispatch` triggers.
+ */
+import { getPrimaryOutput, extractJobs, extractTriggers, extractJobPermissions } from "./yaml-helpers.js";
+export const gha013 = {
+    id: "GHA013",
+    description: "Missing job-level permissions for sensitive triggers",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            const triggers = extractTriggers(yaml);
+            if (!triggers["pull_request_target"] && !triggers["workflow_dispatch"])
+                continue;
+            // chant #1544 — `extractJobs`' `ParsedJob.permissions` field is never
+            // populated (its regex-based per-job scan only fills `needs`/`steps`),
+            // so this rule read `job.permissions` as always undefined and warned
+            // on every job regardless of whether it declared one. `extractJobPermissions`
+            // (below) is the structural, `parseYAML`-backed extractor that other
+            // permissions-aware checks already use — it actually sees the block.
+            const jobs = extractJobs(yaml);
+            const jobPermissions = extractJobPermissions(yaml);
+            for (const [jobName] of jobs) {
+                if (!jobPermissions.has(jobName)) {
+                    diagnostics.push({
+                        checkId: "GHA013",
+                        severity: "warning",
+                        message: `Job "${jobName}" lacks explicit permissions but workflow uses a sensitive trigger. Add job-level permissions for least-privilege security.`,
+                        entity: jobName,
+                        lexicon: "github",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha017.js

@@ -0,0 +1,25 @@
+/**
+ * GHA017: Missing Permissions
+ *
+ * Flags workflows without an explicit `permissions:` block.
+ */
+import { getPrimaryOutput, hasPermissions } from "./yaml-helpers.js";
+export const gha017 = {
+    id: "GHA017",
+    description: "Workflow without explicit permissions block",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            if (!hasPermissions(yaml)) {
+                diagnostics.push({
+                    checkId: "GHA017",
+                    severity: "info",
+                    message: "Workflow does not specify permissions. Consider adding explicit permissions for least-privilege security.",
+                    lexicon: "github",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha018.js

@@ -0,0 +1,33 @@
+/**
+ * GHA018: Pull Request Target + Checkout Security Risk
+ *
+ * Flags workflows using `pull_request_target` trigger with a checkout action
+ * in steps — this is a known security anti-pattern.
+ */
+import { getPrimaryOutput, extractJobs, extractTriggers, hasCheckoutAction } from "./yaml-helpers.js";
+export const gha018 = {
+    id: "GHA018",
+    description: "pull_request_target with checkout action is a security risk",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            const triggers = extractTriggers(yaml);
+            if (!triggers["pull_request_target"])
+                continue;
+            const jobs = extractJobs(yaml);
+            for (const [jobName, job] of jobs) {
+                if (job.steps && hasCheckoutAction(job.steps)) {
+                    diagnostics.push({
+                        checkId: "GHA018",
+                        severity: "warning",
+                        message: `Job "${jobName}" uses checkout with pull_request_target trigger. This runs untrusted PR code with write permissions — a security risk.`,
+                        entity: jobName,
+                        lexicon: "github",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha019.js

@@ -0,0 +1,58 @@
+/**
+ * GHA019: Circular Needs Chain
+ *
+ * DFS-based cycle detection on the job `needs:` dependency graph.
+ */
+import { getPrimaryOutput, buildNeedsGraph } from "./yaml-helpers.js";
+export function checkCircularNeeds(ctx) {
+    const diagnostics = [];
+    for (const [, output] of ctx.outputs) {
+        const yaml = getPrimaryOutput(output);
+        const graph = buildNeedsGraph(yaml);
+        const visited = new Set();
+        const inStack = new Set();
+        const reportedInCycle = new Set();
+        function dfs(node, path) {
+            if (inStack.has(node)) {
+                const cycleStart = path.indexOf(node);
+                const cycle = path.slice(cycleStart);
+                cycle.push(node);
+                const cycleKey = [...cycle].sort().join(",");
+                if (!reportedInCycle.has(cycleKey)) {
+                    reportedInCycle.add(cycleKey);
+                    diagnostics.push({
+                        checkId: "GHA019",
+                        severity: "error",
+                        message: `Circular needs: chain detected: ${cycle.join(" → ")}`,
+                        entity: node,
+                        lexicon: "github",
+                    });
+                }
+                return;
+            }
+            if (visited.has(node))
+                return;
+            visited.add(node);
+            inStack.add(node);
+            for (const neighbor of graph.get(node) ?? []) {
+                if (graph.has(neighbor)) {
+                    dfs(neighbor, [...path, node]);
+                }
+            }
+            inStack.delete(node);
+        }
+        for (const jobName of graph.keys()) {
+            if (!visited.has(jobName)) {
+                dfs(jobName, []);
+            }
+        }
+    }
+    return diagnostics;
+}
+export const gha019 = {
+    id: "GHA019",
+    description: "Circular needs: chain — cycle in job dependency graph",
+    check(ctx) {
+        return checkCircularNeeds(ctx);
+    },
+};

package/dist/lint/post-synth/gha021.js

@@ -0,0 +1,42 @@
+/**
+ * GHA021: Checkout Action Without Pinned SHA
+ *
+ * Flags `actions/checkout` usage that references a tag (e.g. v4) instead of
+ * a pinned commit SHA.
+ */
+import { getPrimaryOutput, extractActionRefs, stripUsesComment } from "./yaml-helpers.js";
+import { pinFixHint } from "../../action-pins.js";
+export const gha021 = {
+    id: "GHA021",
+    description: "actions/checkout used without pinned SHA",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            // The structural parser sees every step. The line-based extractJobs
+            // only reads a step's first line, so it missed `uses:` whenever a step
+            // starts with `name:`, which is how every composite emits it.
+            for (const { job: jobName, ref: uses, level } of extractActionRefs(yaml)) {
+                if (level !== "step")
+                    continue;
+                // A pinned ref carries its version as a trailing comment
+                // (`actions/checkout@<sha> # v7.0.1`); only the ref is judged.
+                const match = stripUsesComment(uses).match(/^actions\/checkout@(.+)$/);
+                if (!match)
+                    continue;
+                const ref = match[1];
+                // A pinned SHA is 40 hex characters
+                if (/^[0-9a-f]{40}$/.test(ref))
+                    continue;
+                diagnostics.push({
+                    checkId: "GHA021",
+                    severity: "warning",
+                    message: `Job "${jobName}" uses actions/checkout@${ref} — pin to a full commit SHA for supply-chain security.${pinFixHint("actions/checkout")}`,
+                    entity: jobName,
+                    lexicon: "github",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/gha022.js

@@ -0,0 +1,44 @@
+/**
+ * GHA022: Job Without timeout-minutes
+ *
+ * Flags jobs that do not specify `timeout-minutes`, which can lead to
+ * hung workflows consuming runner minutes.
+ */
+import { getPrimaryOutput, extractJobs } from "./yaml-helpers.js";
+export const gha022 = {
+    id: "GHA022",
+    description: "Job without timeout-minutes",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            const jobs = extractJobs(yaml);
+            // Find job sections in the raw YAML to check for timeout-minutes
+            const jobsIdx = yaml.search(/^jobs:\s*$/m);
+            if (jobsIdx === -1)
+                continue;
+            const jobsContent = yaml.slice(jobsIdx + yaml.slice(jobsIdx).indexOf("\n") + 1);
+            for (const [jobName] of jobs) {
+                const jobHeader = `  ${jobName}:\n`;
+                const start = jobsContent.indexOf(jobHeader);
+                if (start === -1)
+                    continue;
+                // Slice from after the job header to find its content.
+                // Use literal \n  \w (no m flag) to locate the next sibling job at 2-space indent.
+                const rest = jobsContent.slice(start + jobHeader.length);
+                const nextJobMatch = rest.search(/\n  \w/);
+                const section = nextJobMatch === -1 ? rest : rest.slice(0, nextJobMatch);
+                if (!/timeout-minutes:/.test(section)) {
+                    diagnostics.push({
+                        checkId: "GHA022",
+                        severity: "info",
+                        message: `Job "${jobName}" does not specify timeout-minutes. Consider adding a timeout to prevent hung workflows.`,
+                        entity: jobName,
+                        lexicon: "github",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};