@intentius/chant-lexicon-github 0.4.0 → 0.6.0

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "38ccfb873ff6b369d7e4bf2cff293c244468bc00a0c5d6f5016422ef00d7b3a7",
+    "manifest.json": "85e0a642e2b07b9f68c5722e64a0bd04d777c2e4995cb672a6f5cf82f44eb88f",
     "meta.json": "798c5f5f37b0174756d2451299acfdc95c014f11d06d32b9153bbdfa9f3a580c",
     "types/index.d.ts": "39c0791f0e58025bcef82e0f7a92240508f899fc2771d5dd51b2369b4d330f13",
     "rules/deprecated-action-version.ts": "d41e6e532ab7f623af1bee4ac5279fcb2baada7defa1c5d022a5bc71983e8797",
@@ -62,10 +62,10 @@
     "rules/gha056.ts": "73fa2eea80504522cb53db1e48b36e97ede0eeb7b60ed531a476d2f43d3746ae",
     "rules/gha057.ts": "78e896232d6f5c3e4c1bab873eae97960dbb8a0c108f1546f32d943aafc41a91",
     "rules/gha058.ts": "cdcb60916e3ce091b0e6c73295f24b77fca1480fb0a5907ae6d1fc5b1805f794",
-    "rules/yaml-helpers.ts": "74b430ec4810135be1e5dcd198b907c2cd179a9cc5a339041b6dab31edb4d2a0",
+    "rules/yaml-helpers.ts": "40eaa2ed1c8d823dd33cc3355382f09875eb848363b2e5a7269ec50a0ea913b9",
     "skills/chant-github.md": "f3707f09634be4bbb45a6be279f17bb27f275b98e6d3337cc8872c1623ba050f",
     "skills/chant-github-patterns.md": "bb3abef289a8fdfcf07d6bb2d7289dcb2f38bc0cb0321ea320b78b45a6f548c0",
     "skills/chant-github-security.md": "aab111cb0871cad30281ce48d7da23663689619351029219e2be019a1a61e394"
   },
-  "composite": "4df50ecc6ef70b761aaaae2acf70169357ae9a2351cf0a881c75ea817a3df94a"
+  "composite": "30253c030baa3042b1eb50cb53d0d1e86d2549e9808cd2476ab4b4ddf966c831"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "github",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "chantVersion": ">=0.1.0",
   "namespace": "GitHub",
   "intrinsics": [

package/dist/rules/yaml-helpers.ts

@@ -86,7 +86,7 @@ export function extractJobs(yaml: string): Map<string, ParsedJob> {
         const stepNameMatch = stepEntry.match(/name:\s+(.+)$/m);
         if (usesMatch || runMatch) {
           job.steps.push({
-            uses: usesMatch?.[1]?.trim().replace(/^'|'$/g, ""),
+            uses: usesMatch?.[1] ? stripUsesComment(usesMatch[1].trim().replace(/^'|'$/g, "")) : undefined,
             run: runMatch?.[1]?.trim(),
             name: stepNameMatch?.[1]?.trim().replace(/^'|'$/g, ""),
           });
@@ -453,7 +453,17 @@ export function grantsWrite(perms: PermissionsValue): boolean {
  * Returns undefined for local (`./`, `../`) and `docker://` references, which
  * are not GitHub action repository references.
  */
-export function parseActionUses(uses: string): { owner: string; repo: string; slug: string; gitRef: string } | undefined {
+/**
+ * Strip a trailing inline YAML comment from a `uses:` value. A `uses` ref
+ * cannot contain whitespace, so `<ref> # v1.2.3` (the recommended SHA-pin
+ * style) is safe to trim back to `<ref>`.
+ */
+export function stripUsesComment(uses: string): string {
+  return uses.replace(/\s+#.*$/, "").trim();
+}
+
+export function parseActionUses(rawUses: string): { owner: string; repo: string; slug: string; gitRef: string } | undefined {
+  const uses = stripUsesComment(rawUses);
   if (uses.startsWith("./") || uses.startsWith("../") || uses.startsWith("docker://")) return undefined;
   const at = uses.lastIndexOf("@");
   const path = at === -1 ? uses : uses.slice(0, at);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-github",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "GitHub Actions lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/lint/post-synth/gha021.test.ts

@@ -50,6 +50,21 @@ jobs:
     expect(diags).toHaveLength(0);
   });
 
+  test("does not flag a SHA pin with a trailing version comment", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - run: echo test
+`;
+    const diags = gha021.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+
   test("does not flag non-checkout actions", () => {
     const yaml = `name: CI
 on:

package/src/lint/post-synth/gha029.test.ts

@@ -64,6 +64,21 @@ jobs:
     expect(diags).toHaveLength(0);
   });
 
+  test("does not flag a SHA pin with a trailing version comment", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/setup-node@1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b # v4.0.2
+      - run: echo build
+`;
+    const diags = gha029.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+
   test("does not flag actions/checkout (owned by GHA021)", () => {
     const yaml = `name: CI
 on:

package/src/lint/post-synth/yaml-helpers.ts

@@ -86,7 +86,7 @@ export function extractJobs(yaml: string): Map<string, ParsedJob> {
         const stepNameMatch = stepEntry.match(/name:\s+(.+)$/m);
         if (usesMatch || runMatch) {
           job.steps.push({
-            uses: usesMatch?.[1]?.trim().replace(/^'|'$/g, ""),
+            uses: usesMatch?.[1] ? stripUsesComment(usesMatch[1].trim().replace(/^'|'$/g, "")) : undefined,
             run: runMatch?.[1]?.trim(),
             name: stepNameMatch?.[1]?.trim().replace(/^'|'$/g, ""),
           });
@@ -453,7 +453,17 @@ export function grantsWrite(perms: PermissionsValue): boolean {
  * Returns undefined for local (`./`, `../`) and `docker://` references, which
  * are not GitHub action repository references.
  */
-export function parseActionUses(uses: string): { owner: string; repo: string; slug: string; gitRef: string } | undefined {
+/**
+ * Strip a trailing inline YAML comment from a `uses:` value. A `uses` ref
+ * cannot contain whitespace, so `<ref> # v1.2.3` (the recommended SHA-pin
+ * style) is safe to trim back to `<ref>`.
+ */
+export function stripUsesComment(uses: string): string {
+  return uses.replace(/\s+#.*$/, "").trim();
+}
+
+export function parseActionUses(rawUses: string): { owner: string; repo: string; slug: string; gitRef: string } | undefined {
+  const uses = stripUsesComment(rawUses);
   if (uses.startsWith("./") || uses.startsWith("../") || uses.startsWith("docker://")) return undefined;
   const at = uses.lastIndexOf("@");
   const path = at === -1 ? uses : uses.slice(0, at);