@intentius/chant-lexicon-github 0.41.20 → 0.44.1

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "0b3bb0157719f2a9b0901870b0a4473b72cd582827bab3aed286063b47610ede",
+    "manifest.json": "d17a3716b8c783b875c8f6a1780af015283baef3d177618faca76716ed3e6d2a",
     "meta.json": "798c5f5f37b0174756d2451299acfdc95c014f11d06d32b9153bbdfa9f3a580c",
     "types/index.d.ts": "39c0791f0e58025bcef82e0f7a92240508f899fc2771d5dd51b2369b4d330f13",
     "rules/deprecated-action-version.ts": "d41e6e532ab7f623af1bee4ac5279fcb2baada7defa1c5d022a5bc71983e8797",
@@ -67,5 +67,5 @@
     "skills/chant-github-patterns.md": "bb3abef289a8fdfcf07d6bb2d7289dcb2f38bc0cb0321ea320b78b45a6f548c0",
     "skills/chant-github-security.md": "aab111cb0871cad30281ce48d7da23663689619351029219e2be019a1a61e394"
   },
-  "composite": "e2451e4ba3d69dbf6966cd4ea316494a39103f921d1d64ec649e75bb6e334e67"
+  "composite": "ca61feaee9c33a0a8282bedfa8fafff2c335b8d827a52d37a4c10131b19d7a4d"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "github",
-  "version": "0.41.20",
+  "version": "0.44.1",
   "chantVersion": ">=0.1.0",
   "namespace": "GitHub",
   "intrinsics": [

package/dist/okf/index.md

@@ -0,0 +1,70 @@
+---
+okf_version: '0.2'
+---
+
+# Resource types
+
+* [Job](/types/Job.md) - GitHub::Actions::Job
+* [ReusableWorkflowCallJob](/types/ReusableWorkflowCallJob.md) - GitHub::Actions::ReusableWorkflowCallJob
+* [Workflow](/types/Workflow.md) - GitHub::Actions::Workflow
+
+# Rules
+
+* [GHA001](/rules/GHA001.md) - Use Typed Action Composites
+* [GHA002](/rules/GHA002.md) - Use Condition Builders
+* [GHA003](/rules/GHA003.md) - No Hardcoded Secrets
+* [GHA004](/rules/GHA004.md) - Use Matrix Builder
+* [GHA005](/rules/GHA005.md) - Extract Inline Structs
+* [GHA006](/rules/GHA006.md) - Multiple workflows share the same name
+* [GHA007](/rules/GHA007.md) - File Job Limit
+* [GHA008](/rules/GHA008.md) - No Raw Expressions
+* [GHA009](/rules/GHA009.md) - Matrix dimension has empty values array
+* [GHA010](/rules/GHA010.md) - Missing Recommended Inputs
+* [GHA011](/rules/GHA011.md) - Job needs: references non-existent job
+* [GHA012](/rules/GHA012.md) - Deprecated Action Version
+* [GHA013](/rules/GHA013.md) - Missing job-level permissions for sensitive triggers
+* [GHA014](/rules/GHA014.md) - Job Timeout
+* [GHA015](/rules/GHA015.md) - Suggest Cache
+* [GHA016](/rules/GHA016.md) - Validate Concurrency
+* [GHA017](/rules/GHA017.md) - Workflow without explicit permissions block
+* [GHA018](/rules/GHA018.md) - pull_request_target with checkout action is a security risk
+* [GHA019](/rules/GHA019.md) - Circular needs: chain — cycle in job dependency graph
+* [GHA020](/rules/GHA020.md) - Detect Secrets
+* [GHA021](/rules/GHA021.md) - actions/checkout used without pinned SHA
+* [GHA022](/rules/GHA022.md) - Job without timeout-minutes
+* [GHA023](/rules/GHA023.md) - Deprecated ::set-output command usage
+* [GHA024](/rules/GHA024.md) - Missing concurrency block for deploy workflow
+* [GHA025](/rules/GHA025.md) - Using pull_request_target without restrictions
+* [GHA026](/rules/GHA026.md) - Secret passed to action without environment protection
+* [GHA027](/rules/GHA027.md) - Missing `if: always()` on cleanup steps
+* [GHA028](/rules/GHA028.md) - Workflow with no `on` triggers
+* [GHA029](/rules/GHA029.md) - Action or reusable workflow not pinned to a commit SHA
+* [GHA030](/rules/GHA030.md) - Container image not pinned to an immutable digest
+* [GHA031](/rules/GHA031.md) - Action reference resembles a well-known action (possible impersonation)
+* [GHA032](/rules/GHA032.md) - Action is archived/abandoned or has a disclosed security issue
+* [GHA033](/rules/GHA033.md) - Blanket write-all token permissions
+* [GHA034](/rules/GHA034.md) - Write permissions granted workflow-wide instead of per-job
+* [GHA035](/rules/GHA035.md) - Elevated token scope on a trigger that can run untrusted code
+* [GHA036](/rules/GHA036.md) - Untrusted input interpolated into a run: shell command
+* [GHA037](/rules/GHA037.md) - Untrusted input written to GITHUB_ENV / GITHUB_PATH
+* [GHA038](/rules/GHA038.md) - workflow_run trigger with checkout runs untrusted code in a privileged context
+* [GHA039](/rules/GHA039.md) - Authorization gate on a spoofable commit-author identity field
+* [GHA040](/rules/GHA040.md) - Self-hosted runner on a trigger that can run untrusted code
+* [GHA041](/rules/GHA041.md) - Blanket secrets: inherit into a reusable workflow
+* [GHA042](/rules/GHA042.md) - Entire secrets context passed where specific secrets would do
+* [GHA043](/rules/GHA043.md) - Secret consumed in a job without an environment gate
+* [GHA044](/rules/GHA044.md) - Hardcoded registry/container credential
+* [GHA045](/rules/GHA045.md) - Secret interpolated directly into a run: shell command
+* [GHA046](/rules/GHA046.md) - Logically unsound (constant) guard condition
+* [GHA047](/rules/GHA047.md) - Ineffective contains() guard with reversed arguments
+* [GHA048](/rules/GHA048.md) - Obfuscated guard condition (operand built by indirection)
+* [GHA049](/rules/GHA049.md) - Persisted checkout credentials reachable by an uploaded artifact
+* [GHA050](/rules/GHA050.md) - Cache populated in a privileged context (poisoning risk)
+* [GHA051](/rules/GHA051.md) - Publish/release step using a long-lived token instead of OIDC
+* [GHA052](/rules/GHA052.md) - Software fetched and piped to a shell without verification
+* [GHA053](/rules/GHA053.md) - Re-enables unsafe set-env / add-path workflow commands
+* [GHA054](/rules/GHA054.md) - Use of a feature with a known security footgun
+* [GHA055](/rules/GHA055.md) - Runtime install of a tool already present on the runner
+* [GHA056](/rules/GHA056.md) - Workflow without a name
+* [GHA057](/rules/GHA057.md) - Dependency update allows executing untrusted external code
+* [GHA058](/rules/GHA058.md) - Dependency update has no cooldown window

package/dist/okf/rules/GHA001.md

@@ -0,0 +1,11 @@
+---
+type: lint-rule
+title: GHA001
+description: Use Typed Action Composites
+id: GHA001
+severity: warning
+category: style
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Use Typed Action Composites

package/dist/okf/rules/GHA002.md

@@ -0,0 +1,15 @@
+---
+type: lint-rule
+title: GHA002
+description: Use Condition Builders
+id: GHA002
+severity: warning
+category: style
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Use Condition Builders
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA003.md

@@ -0,0 +1,11 @@
+---
+type: lint-rule
+title: GHA003
+description: No Hardcoded Secrets
+id: GHA003
+severity: error
+category: security
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+No Hardcoded Secrets

package/dist/okf/rules/GHA004.md

@@ -0,0 +1,11 @@
+---
+type: lint-rule
+title: GHA004
+description: Use Matrix Builder
+id: GHA004
+severity: info
+category: style
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Use Matrix Builder

package/dist/okf/rules/GHA005.md

@@ -0,0 +1,17 @@
+---
+type: lint-rule
+title: GHA005
+description: Extract Inline Structs
+id: GHA005
+severity: info
+category: style
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Extract Inline Structs
+
+## Applies to
+
+- [Job](/types/Job.md)
+- [ReusableWorkflowCallJob](/types/ReusableWorkflowCallJob.md)
+- [Workflow](/types/Workflow.md)

package/dist/okf/rules/GHA006.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA006
+description: Multiple workflows share the same name
+id: GHA006
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Multiple workflows share the same name
+
+## Applies to
+
+- [Workflow](/types/Workflow.md)

package/dist/okf/rules/GHA007.md

@@ -0,0 +1,16 @@
+---
+type: lint-rule
+title: GHA007
+description: File Job Limit
+id: GHA007
+severity: warning
+category: style
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+File Job Limit
+
+## Applies to
+
+- [Job](/types/Job.md)
+- [ReusableWorkflowCallJob](/types/ReusableWorkflowCallJob.md)

package/dist/okf/rules/GHA008.md

@@ -0,0 +1,11 @@
+---
+type: lint-rule
+title: GHA008
+description: No Raw Expressions
+id: GHA008
+severity: info
+category: style
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+No Raw Expressions

package/dist/okf/rules/GHA009.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: GHA009
+description: Matrix dimension has empty values array
+id: GHA009
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Matrix dimension has empty values array

package/dist/okf/rules/GHA010.md

@@ -0,0 +1,11 @@
+---
+type: lint-rule
+title: GHA010
+description: Missing Recommended Inputs
+id: GHA010
+severity: warning
+category: correctness
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Missing Recommended Inputs

package/dist/okf/rules/GHA011.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA011
+description: 'Job needs: references non-existent job'
+id: GHA011
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Job needs: references non-existent job
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA012.md

@@ -0,0 +1,11 @@
+---
+type: lint-rule
+title: GHA012
+description: Deprecated Action Version
+id: GHA012
+severity: warning
+category: correctness
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Deprecated Action Version

package/dist/okf/rules/GHA013.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA013
+description: Missing job-level permissions for sensitive triggers
+id: GHA013
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Missing job-level permissions for sensitive triggers
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA014.md

@@ -0,0 +1,15 @@
+---
+type: lint-rule
+title: GHA014
+description: Job Timeout
+id: GHA014
+severity: warning
+category: correctness
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Job Timeout
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA015.md

@@ -0,0 +1,11 @@
+---
+type: lint-rule
+title: GHA015
+description: Suggest Cache
+id: GHA015
+severity: warning
+category: performance
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Suggest Cache

package/dist/okf/rules/GHA016.md

@@ -0,0 +1,11 @@
+---
+type: lint-rule
+title: GHA016
+description: Validate Concurrency
+id: GHA016
+severity: warning
+category: correctness
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Validate Concurrency

package/dist/okf/rules/GHA017.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA017
+description: Workflow without explicit permissions block
+id: GHA017
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Workflow without explicit permissions block
+
+## Applies to
+
+- [Workflow](/types/Workflow.md)

package/dist/okf/rules/GHA018.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA018
+description: pull_request_target with checkout action is a security risk
+id: GHA018
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+pull_request_target with checkout action is a security risk
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA019.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: GHA019
+description: 'Circular needs: chain — cycle in job dependency graph'
+id: GHA019
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Circular needs: chain — cycle in job dependency graph

package/dist/okf/rules/GHA020.md

@@ -0,0 +1,11 @@
+---
+type: lint-rule
+title: GHA020
+description: Detect Secrets
+id: GHA020
+severity: error
+category: security
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Detect Secrets

package/dist/okf/rules/GHA021.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA021
+description: actions/checkout used without pinned SHA
+id: GHA021
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+actions/checkout used without pinned SHA
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA022.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA022
+description: Job without timeout-minutes
+id: GHA022
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Job without timeout-minutes
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA023.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA023
+description: Deprecated ::set-output command usage
+id: GHA023
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Deprecated ::set-output command usage
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA024.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: GHA024
+description: Missing concurrency block for deploy workflow
+id: GHA024
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Missing concurrency block for deploy workflow

package/dist/okf/rules/GHA025.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA025
+description: Using pull_request_target without restrictions
+id: GHA025
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Using pull_request_target without restrictions
+
+## Applies to
+
+- [Workflow](/types/Workflow.md)

package/dist/okf/rules/GHA026.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA026
+description: Secret passed to action without environment protection
+id: GHA026
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Secret passed to action without environment protection
+
+## Applies to
+
+- [Workflow](/types/Workflow.md)

package/dist/okf/rules/GHA027.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: GHA027
+description: 'Missing `if: always()` on cleanup steps'
+id: GHA027
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Missing `if: always()` on cleanup steps

package/dist/okf/rules/GHA028.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA028
+description: Workflow with no `on` triggers
+id: GHA028
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Workflow with no `on` triggers
+
+## Applies to
+
+- [Workflow](/types/Workflow.md)

package/dist/okf/rules/GHA029.md

@@ -0,0 +1,16 @@
+---
+type: post-synth-check
+title: GHA029
+description: Action or reusable workflow not pinned to a commit SHA
+id: GHA029
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Action or reusable workflow not pinned to a commit SHA
+
+## Applies to
+
+- [Job](/types/Job.md)
+- [Workflow](/types/Workflow.md)

package/dist/okf/rules/GHA030.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA030
+description: Container image not pinned to an immutable digest
+id: GHA030
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Container image not pinned to an immutable digest
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA031.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA031
+description: Action reference resembles a well-known action (possible impersonation)
+id: GHA031
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Action reference resembles a well-known action (possible impersonation)
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA032.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA032
+description: Action is archived/abandoned or has a disclosed security issue
+id: GHA032
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Action is archived/abandoned or has a disclosed security issue
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA033.md

@@ -0,0 +1,16 @@
+---
+type: post-synth-check
+title: GHA033
+description: Blanket write-all token permissions
+id: GHA033
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Blanket write-all token permissions
+
+## Applies to
+
+- [Job](/types/Job.md)
+- [Workflow](/types/Workflow.md)

package/dist/okf/rules/GHA034.md

@@ -0,0 +1,16 @@
+---
+type: post-synth-check
+title: GHA034
+description: Write permissions granted workflow-wide instead of per-job
+id: GHA034
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Write permissions granted workflow-wide instead of per-job
+
+## Applies to
+
+- [Job](/types/Job.md)
+- [Workflow](/types/Workflow.md)

package/dist/okf/rules/GHA035.md

@@ -0,0 +1,16 @@
+---
+type: post-synth-check
+title: GHA035
+description: Elevated token scope on a trigger that can run untrusted code
+id: GHA035
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Elevated token scope on a trigger that can run untrusted code
+
+## Applies to
+
+- [Job](/types/Job.md)
+- [Workflow](/types/Workflow.md)

package/dist/okf/rules/GHA036.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA036
+description: 'Untrusted input interpolated into a run: shell command'
+id: GHA036
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Untrusted input interpolated into a run: shell command
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA037.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA037
+description: Untrusted input written to GITHUB_ENV / GITHUB_PATH
+id: GHA037
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Untrusted input written to GITHUB_ENV / GITHUB_PATH
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA038.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA038
+description: workflow_run trigger with checkout runs untrusted code in a privileged context
+id: GHA038
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+workflow_run trigger with checkout runs untrusted code in a privileged context
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA039.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA039
+description: Authorization gate on a spoofable commit-author identity field
+id: GHA039
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Authorization gate on a spoofable commit-author identity field
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA040.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA040
+description: Self-hosted runner on a trigger that can run untrusted code
+id: GHA040
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Self-hosted runner on a trigger that can run untrusted code
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA041.md

@@ -0,0 +1,16 @@
+---
+type: post-synth-check
+title: GHA041
+description: 'Blanket secrets: inherit into a reusable workflow'
+id: GHA041
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Blanket secrets: inherit into a reusable workflow
+
+## Applies to
+
+- [Job](/types/Job.md)
+- [Workflow](/types/Workflow.md)

package/dist/okf/rules/GHA042.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA042
+description: Entire secrets context passed where specific secrets would do
+id: GHA042
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Entire secrets context passed where specific secrets would do
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA043.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA043
+description: Secret consumed in a job without an environment gate
+id: GHA043
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Secret consumed in a job without an environment gate
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA044.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA044
+description: Hardcoded registry/container credential
+id: GHA044
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Hardcoded registry/container credential
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA045.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA045
+description: 'Secret interpolated directly into a run: shell command'
+id: GHA045
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Secret interpolated directly into a run: shell command
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA046.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA046
+description: Logically unsound (constant) guard condition
+id: GHA046
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Logically unsound (constant) guard condition
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA047.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA047
+description: Ineffective contains() guard with reversed arguments
+id: GHA047
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Ineffective contains() guard with reversed arguments
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA048.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA048
+description: Obfuscated guard condition (operand built by indirection)
+id: GHA048
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Obfuscated guard condition (operand built by indirection)
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA049.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA049
+description: Persisted checkout credentials reachable by an uploaded artifact
+id: GHA049
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Persisted checkout credentials reachable by an uploaded artifact
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA050.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA050
+description: Cache populated in a privileged context (poisoning risk)
+id: GHA050
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Cache populated in a privileged context (poisoning risk)
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA051.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA051
+description: Publish/release step using a long-lived token instead of OIDC
+id: GHA051
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Publish/release step using a long-lived token instead of OIDC
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA052.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA052
+description: Software fetched and piped to a shell without verification
+id: GHA052
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Software fetched and piped to a shell without verification
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA053.md

@@ -0,0 +1,16 @@
+---
+type: post-synth-check
+title: GHA053
+description: Re-enables unsafe set-env / add-path workflow commands
+id: GHA053
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Re-enables unsafe set-env / add-path workflow commands
+
+## Applies to
+
+- [Job](/types/Job.md)
+- [Workflow](/types/Workflow.md)

package/dist/okf/rules/GHA054.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA054
+description: Use of a feature with a known security footgun
+id: GHA054
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Use of a feature with a known security footgun
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA055.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA055
+description: Runtime install of a tool already present on the runner
+id: GHA055
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Runtime install of a tool already present on the runner
+
+## Applies to
+
+- [Job](/types/Job.md)

package/dist/okf/rules/GHA056.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: GHA056
+description: Workflow without a name
+id: GHA056
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Workflow without a name
+
+## Applies to
+
+- [Workflow](/types/Workflow.md)

package/dist/okf/rules/GHA057.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: GHA057
+description: Dependency update allows executing untrusted external code
+id: GHA057
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Dependency update allows executing untrusted external code

package/dist/okf/rules/GHA058.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: GHA058
+description: Dependency update has no cooldown window
+id: GHA058
+severity: error
+category: post-synth
+lexicon: github
+docs: https://intentius.io/chant/lexicons/github/rules/
+---
+Dependency update has no cooldown window

package/dist/okf/types/Job.md

@@ -0,0 +1,69 @@
+---
+type: resource-type
+title: Job
+description: github resource type GitHub::Actions::Job
+name: Job
+lexicon: github
+resource_type: GitHub::Actions::Job
+---
+`GitHub::Actions::Job`, a resource type of the github lexicon.
+
+## Properties
+
+- `runs-on` (`string | string[]`, required): The type of machine to run the job on. The machine can be either a GitHub-hosted runner, or a self-hosted runner.
+- `concurrency` (`Concurrency | string`, optional): Concurrency ensures that only a single job or workflow using the same concurrency group will run at a time. A concurrency group can be any string or expression. The expression can use any context except for the secrets context. You can also specify concurrency at the workflow level. When a concurrent job or workflow is queued, if another job or workflow using the same concurrency group in the repository is in progress, the queued job or workflow will be pending. By default any previously pending job or workflow in the concurrency group will be canceled; this behavior can be changed with `queue`. To also cancel any currently running job or workflow in the same concurrency group, specify cancel-in-progress: true.
+- `container` (`Container | string`, optional): A container to run any steps in a job that don't already specify a container. If you have steps that use both script and container actions, the container actions will run as sibling containers on the same network with the same volume mounts. If you do not set a container, all steps will run directly on the host specified by runs-on unless a step refers to an action configured to run in a container.
+- `continue-on-error` (`boolean`, optional): Prevents a workflow run from failing when a job fails. Set to true to allow a workflow run to pass when this job fails.
+- `defaults` (`Defaults`, optional): A map of default settings that will apply to all steps in the job.
+- `env` (`Record<string, string>`, optional): A map of environment variables that are available to all steps in the job.
+- `environment` (`Environment | string`, optional): The environment that the job references.
+- `if` (`string`, optional): You can use the if conditional to prevent a job from running unless a condition is met. You can use any supported context and expression to create a conditional. Expressions in an if conditional do not require the ${{ }} syntax. For more information, see https://help.github.com/en/articles/contexts-and-expression-syntax-for-github-actions.
+- `name` (`string`, optional): The name of the job displayed on GitHub.
+- `needs` (`string[]`, optional)
+- `outputs` (`Record<string, string>`, optional): A map of outputs for a job. Job outputs are available to all downstream jobs that depend on this job.
+- `permissions` (`Permissions | string`, optional)
+- `services` (`Record<string, Service>`, optional): Additional containers to host services for a job in a workflow. These are useful for creating databases or cache services like redis. The runner on the virtual machine will automatically create a network and manage the life cycle of the service containers. When you use a service container for a job or your step uses container actions, you don't need to set port information to access the service. Docker automatically exposes all ports between containers on the same network. When both the job and the action run in a container, you can directly reference the container by its hostname. The hostname is automatically mapped to the service name. When a step does not use a container action, you must access the service using localhost and bind the ports.
+- `snapshot` (`any`, optional)
+- `steps` (`Step[]`, optional): A job contains a sequence of tasks called steps. Steps can run commands, run setup tasks, or run an action in your repository, a public repository, or an action published in a Docker registry. Not all steps run actions, but all actions run as a step. Each step runs in its own process in the virtual environment and has access to the workspace and filesystem. Because steps run in their own process, changes to environment variables are not preserved between steps. GitHub provides built-in steps to set up and complete a job. Must contain either `uses` or `run`
+- `strategy` (`Strategy`, optional): A strategy creates a build matrix for your jobs. You can define different variations of an environment to run each job in.
+- `timeout-minutes` (`number`, optional): The maximum number of minutes to let a workflow run before GitHub automatically cancels it. Default: 360
+
+## Governed by
+
+- [GHA002](/rules/GHA002.md): Use Condition Builders
+- [GHA005](/rules/GHA005.md): Extract Inline Structs
+- [GHA007](/rules/GHA007.md): File Job Limit
+- [GHA011](/rules/GHA011.md): Job needs: references non-existent job
+- [GHA013](/rules/GHA013.md): Missing job-level permissions for sensitive triggers
+- [GHA014](/rules/GHA014.md): Job Timeout
+- [GHA018](/rules/GHA018.md): pull_request_target with checkout action is a security risk
+- [GHA021](/rules/GHA021.md): actions/checkout used without pinned SHA
+- [GHA022](/rules/GHA022.md): Job without timeout-minutes
+- [GHA023](/rules/GHA023.md): Deprecated ::set-output command usage
+- [GHA029](/rules/GHA029.md): Action or reusable workflow not pinned to a commit SHA
+- [GHA030](/rules/GHA030.md): Container image not pinned to an immutable digest
+- [GHA031](/rules/GHA031.md): Action reference resembles a well-known action (possible impersonation)
+- [GHA032](/rules/GHA032.md): Action is archived/abandoned or has a disclosed security issue
+- [GHA033](/rules/GHA033.md): Blanket write-all token permissions
+- [GHA034](/rules/GHA034.md): Write permissions granted workflow-wide instead of per-job
+- [GHA035](/rules/GHA035.md): Elevated token scope on a trigger that can run untrusted code
+- [GHA036](/rules/GHA036.md): Untrusted input interpolated into a run: shell command
+- [GHA037](/rules/GHA037.md): Untrusted input written to GITHUB_ENV / GITHUB_PATH
+- [GHA038](/rules/GHA038.md): workflow_run trigger with checkout runs untrusted code in a privileged context
+- [GHA039](/rules/GHA039.md): Authorization gate on a spoofable commit-author identity field
+- [GHA040](/rules/GHA040.md): Self-hosted runner on a trigger that can run untrusted code
+- [GHA041](/rules/GHA041.md): Blanket secrets: inherit into a reusable workflow
+- [GHA042](/rules/GHA042.md): Entire secrets context passed where specific secrets would do
+- [GHA043](/rules/GHA043.md): Secret consumed in a job without an environment gate
+- [GHA044](/rules/GHA044.md): Hardcoded registry/container credential
+- [GHA045](/rules/GHA045.md): Secret interpolated directly into a run: shell command
+- [GHA046](/rules/GHA046.md): Logically unsound (constant) guard condition
+- [GHA047](/rules/GHA047.md): Ineffective contains() guard with reversed arguments
+- [GHA048](/rules/GHA048.md): Obfuscated guard condition (operand built by indirection)
+- [GHA049](/rules/GHA049.md): Persisted checkout credentials reachable by an uploaded artifact
+- [GHA050](/rules/GHA050.md): Cache populated in a privileged context (poisoning risk)
+- [GHA051](/rules/GHA051.md): Publish/release step using a long-lived token instead of OIDC
+- [GHA052](/rules/GHA052.md): Software fetched and piped to a shell without verification
+- [GHA053](/rules/GHA053.md): Re-enables unsafe set-env / add-path workflow commands
+- [GHA054](/rules/GHA054.md): Use of a feature with a known security footgun
+- [GHA055](/rules/GHA055.md): Runtime install of a tool already present on the runner

package/dist/okf/types/ReusableWorkflowCallJob.md

@@ -0,0 +1,26 @@
+---
+type: resource-type
+title: ReusableWorkflowCallJob
+description: github resource type GitHub::Actions::ReusableWorkflowCallJob
+name: ReusableWorkflowCallJob
+lexicon: github
+resource_type: GitHub::Actions::ReusableWorkflowCallJob
+---
+`GitHub::Actions::ReusableWorkflowCallJob`, a resource type of the github lexicon.
+
+## Properties
+
+- `uses` (`string`, required): The location and version of a reusable workflow file to run as a job, of the form './{path/to}/{localfile}.yml' or '{owner}/{repo}/{path}/{filename}@{ref}'. {ref} can be a SHA, a release tag, or a branch name. Using the commit SHA is the safest for stability and security.
+- `concurrency` (`string | Record<string, any>`, optional): Concurrency ensures that only a single job or workflow using the same concurrency group will run at a time. A concurrency group can be any string or expression. The expression can use any context except for the secrets context. You can also specify concurrency at the workflow level. When a concurrent job or workflow is queued, if another job or workflow using the same concurrency group in the repository is in progress, the queued job or workflow will be pending. By default any previously pending job or workflow in the concurrency group will be canceled; this behavior can be changed with `queue`. To also cancel any currently running job or workflow in the same concurrency group, specify cancel-in-progress: true.
+- `if` (`boolean`, optional): You can use the if conditional to prevent a job from running unless a condition is met. You can use any supported context and expression to create a conditional. Expressions in an if conditional do not require the ${{ }} syntax. For more information, see https://help.github.com/en/articles/contexts-and-expression-syntax-for-github-actions.
+- `name` (`string`, optional): The name of the job displayed on GitHub.
+- `needs` (`any`, optional)
+- `permissions` (`any`, optional)
+- `secrets` (`"inherit"`, optional): When a job is used to call a reusable workflow, you can use 'secrets' to provide a map of secrets that are passed to the called workflow. Any secrets that you pass must match the names defined in the called workflow.
+- `strategy` (`Record<string, unknown>`, optional): A strategy creates a build matrix for your jobs. You can define different variations of an environment to run each job in.
+- `with` (`any`, optional): A map of inputs that are passed to the called workflow. Any inputs that you pass must match the input specifications defined in the called workflow. Unlike 'jobs.<job_id>.steps[*].with', the inputs you pass with 'jobs.<job_id>.with' are not be available as environment variables in the called workflow. Instead, you can reference the inputs by using the inputs context.
+
+## Governed by
+
+- [GHA005](/rules/GHA005.md): Extract Inline Structs
+- [GHA007](/rules/GHA007.md): File Job Limit

package/dist/okf/types/Workflow.md

@@ -0,0 +1,36 @@
+---
+type: resource-type
+title: Workflow
+description: github resource type GitHub::Actions::Workflow
+name: Workflow
+lexicon: github
+resource_type: GitHub::Actions::Workflow
+---
+`GitHub::Actions::Workflow`, a resource type of the github lexicon.
+
+## Properties
+
+- `jobs` (`Record<string, unknown>`, required): A workflow run is made up of one or more jobs. Jobs run in parallel by default. To run jobs sequentially, you can define dependencies on other jobs using the jobs.<job_id>.needs keyword. Each job runs in a fresh instance of the virtual environment specified by runs-on. You can run an unlimited number of jobs as long as you are within the workflow usage limits. For more information, see https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#usage-limits.
+- `on` (`Record<string, unknown>`, required): The name of the GitHub event that triggers the workflow. You can provide a single event string, array of events, array of event types, or an event configuration map that schedules a workflow or restricts the execution of a workflow to specific files, tags, or branch changes. For a list of available events, see https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows.
+- `concurrency` (`Concurrency | string`, optional): Concurrency ensures that only a single job or workflow using the same concurrency group will run at a time. A concurrency group can be any string or expression. The expression can use any context except for the secrets context. You can also specify concurrency at the workflow level. When a concurrent job or workflow is queued, if another job or workflow using the same concurrency group in the repository is in progress, the queued job or workflow will be pending. By default any previously pending job or workflow in the concurrency group will be canceled; this behavior can be changed with `queue`. To also cancel any currently running job or workflow in the same concurrency group, specify cancel-in-progress: true.
+- `defaults` (`Defaults`, optional): A map of default settings that will apply to all jobs in the workflow.
+- `env` (`Record<string, string>`, optional): A map of environment variables that are available to all jobs and steps in the workflow.
+- `name` (`string`, optional): The name of your workflow. GitHub displays the names of your workflows on your repository's actions page. If you omit this field, GitHub sets the name to the workflow's filename.
+- `permissions` (`Permissions | string`, optional)
+- `run-name` (`string`, optional): The name for workflow runs generated from the workflow. GitHub displays the workflow run name in the list of workflow runs on your repository's 'Actions' tab.
+
+## Governed by
+
+- [GHA005](/rules/GHA005.md): Extract Inline Structs
+- [GHA006](/rules/GHA006.md): Multiple workflows share the same name
+- [GHA017](/rules/GHA017.md): Workflow without explicit permissions block
+- [GHA025](/rules/GHA025.md): Using pull_request_target without restrictions
+- [GHA026](/rules/GHA026.md): Secret passed to action without environment protection
+- [GHA028](/rules/GHA028.md): Workflow with no `on` triggers
+- [GHA029](/rules/GHA029.md): Action or reusable workflow not pinned to a commit SHA
+- [GHA033](/rules/GHA033.md): Blanket write-all token permissions
+- [GHA034](/rules/GHA034.md): Write permissions granted workflow-wide instead of per-job
+- [GHA035](/rules/GHA035.md): Elevated token scope on a trigger that can run untrusted code
+- [GHA041](/rules/GHA041.md): Blanket secrets: inherit into a reusable workflow
+- [GHA053](/rules/GHA053.md): Re-enables unsafe set-env / add-path workflow commands
+- [GHA056](/rules/GHA056.md): Workflow without a name

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-github",
-  "version": "0.41.20",
+  "version": "0.44.1",
   "description": "GitHub Actions lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -61,7 +61,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.41.20",
+    "@intentius/chant": "^0.44.1",
     "typescript": "^5.9.3"
   }
 }

package/src/package-cli.ts

@@ -4,7 +4,7 @@
  */
 import { generate, writeGeneratedFiles } from "./codegen/generate";
 import { packageLexicon } from "./codegen/package";
-import { writeFileSync, mkdirSync } from "fs";
+import { writeBundleSpec } from "@intentius/chant/codegen/package";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 
@@ -19,24 +19,7 @@ console.error(`Generated ${genResult.resources} entities, ${genResult.properties
 const { spec, stats } = await packageLexicon({ verbose: true });
 
 const distDir = join(pkgDir, "dist");
-mkdirSync(join(distDir, "types"), { recursive: true });
-mkdirSync(join(distDir, "rules"), { recursive: true });
-mkdirSync(join(distDir, "skills"), { recursive: true });
-
-writeFileSync(join(distDir, "manifest.json"), JSON.stringify(spec.manifest, null, 2));
-writeFileSync(join(distDir, "meta.json"), spec.registry);
-writeFileSync(join(distDir, "types", "index.d.ts"), spec.typesDTS);
-
-for (const [name, content] of spec.rules) {
-  writeFileSync(join(distDir, "rules", name), content);
-}
-for (const [name, content] of spec.skills) {
-  writeFileSync(join(distDir, "skills", name), content);
-}
-
-if (spec.integrity) {
-  writeFileSync(join(distDir, "integrity.json"), JSON.stringify(spec.integrity, null, 2));
-}
+writeBundleSpec(spec, distDir);
 
 console.error(`Packaged ${stats.resources} entities, ${stats.ruleCount} rules, ${stats.skillCount} skills`);
 console.error(`dist/ written to ${distDir}`);