@intentius/chant-lexicon-github 0.46.0 → 0.50.0

package/src/lint/post-synth/gha062.ts

@@ -0,0 +1,68 @@
+/**
+ * GHA062: Pinned Reference Matches a Known-Vulnerability Advisory
+ *
+ * Cross-references every pinned `uses:` (commit SHA or tag/branch) against a
+ * caller-supplied advisory feed and flags a match. Unlike GHA031/032's
+ * vendored, committed reference lists, a vulnerability feed is meant to be
+ * refreshed continuously — so this rule takes it as data, not code: the pure
+ * core never fetches (epic #350's design spine), and an absent/empty feed
+ * degrades to "no findings," never an error or a thrown exception. That is
+ * what "unreachable" means for a rule that makes no network call of its own:
+ * whatever couldn't reach the feed already failed upstream of this function,
+ * and this function's job is to not compound that with a crash.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractActionRefs, parseActionUses } from "./yaml-helpers";
+import { DEFAULT_ADVISORY_FEED, type AdvisoryFeed, type AdvisoryEntry } from "../rules/data/advisory-feed";
+
+export type { AdvisoryFeed, AdvisoryEntry } from "../rules/data/advisory-feed";
+
+function matchesEntry(entry: AdvisoryEntry, slug: string, gitRef: string): boolean {
+  if (entry.slug !== slug) return false;
+  if (entry.shas?.includes(gitRef)) return true;
+  if (entry.refs?.includes(gitRef)) return true;
+  return false;
+}
+
+/**
+ * Check a workflow's pinned action references against an advisory feed. Pure
+ * and total: a missing/empty feed (`entries.length === 0`, including the
+ * `undefined` default) always yields `[]`, never a throw.
+ */
+export function checkAdvisories(yaml: string, feed: AdvisoryFeed | undefined = DEFAULT_ADVISORY_FEED): PostSynthDiagnostic[] {
+  if (!feed || !feed.entries || feed.entries.length === 0) return [];
+
+  const diagnostics: PostSynthDiagnostic[] = [];
+  for (const { job, ref } of extractActionRefs(yaml)) {
+    const parsed = parseActionUses(ref);
+    if (!parsed) continue;
+    for (const entry of feed.entries) {
+      if (!matchesEntry(entry, parsed.slug, parsed.gitRef)) continue;
+      const patch = entry.patchedRef ? ` A patched ref is available: ${entry.patchedRef}.` : "";
+      const link = entry.url ? ` (${entry.url})` : "";
+      diagnostics.push({
+        checkId: "GHA062",
+        severity: "error",
+        message: `Job "${job}" uses "${parsed.slug}@${parsed.gitRef}", which matches disclosed advisory ${entry.id}${link}: ${entry.summary}.${patch}`,
+        entity: job,
+        lexicon: "github",
+      });
+    }
+  }
+  return diagnostics;
+}
+
+export const gha062: PostSynthCheck = {
+  id: "GHA062",
+  description: "Pinned action reference matches a known-vulnerability advisory (feed-driven)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      diagnostics.push(...checkAdvisories(yaml, DEFAULT_ADVISORY_FEED));
+    }
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/gha063.test.ts

@@ -0,0 +1,86 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { gha063 } from "./gha063";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["github", yaml]]),
+    entities: new Map(),
+    buildResult: { outputs: new Map([["github", yaml]]), entities: new Map(), warnings: [], errors: [], sourceFileCount: 1 },
+  };
+}
+
+describe("GHA063: dependency setup without caching", () => {
+  test("flags setup-node with no cache option and no cache step", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+      - run: npm ci
+`;
+    const diags = gha063.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("GHA063");
+    expect(diags[0].entity).toBe("build");
+  });
+
+  test("does not flag setup-node with cache enabled", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+      - run: npm ci
+`;
+    expect(gha063.check(makeCtx(yaml))).toHaveLength(0);
+  });
+
+  test("does not flag setup-node when a separate actions/cache step covers it", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+      - uses: actions/cache@v4
+        with:
+          path: ~/.npm
+          key: npm-\${{ hashFiles('package-lock.json') }}
+      - run: npm ci
+`;
+    expect(gha063.check(makeCtx(yaml))).toHaveLength(0);
+  });
+
+  test("does not flag a job with no setup action at all", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: make build
+`;
+    expect(gha063.check(makeCtx(yaml))).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/gha063.ts

@@ -0,0 +1,60 @@
+/**
+ * GHA063: Dependency Setup Without Caching
+ *
+ * Flags a `actions/setup-{node,python,java,ruby,dotnet}` step that leaves its
+ * built-in `cache:` option unset, with no adjacent `actions/cache` step to
+ * cover the gap. Every run re-downloads the same dependencies from the
+ * registry from a cold cache — pure wasted time and bandwidth, not a
+ * correctness or security issue (efficiency, #444).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, jobEntries, parseActionUses } from "./yaml-helpers";
+
+/** Setup actions whose `with.cache` option enables built-in dependency caching. */
+const CACHEABLE_SETUP_ACTIONS = new Set(["actions/setup-node", "actions/setup-python", "actions/setup-java", "actions/setup-ruby", "actions/setup-dotnet"]);
+
+function cacheEnabled(withBlock: unknown): boolean {
+  if (!withBlock || typeof withBlock !== "object") return false;
+  const cache = (withBlock as Record<string, unknown>).cache;
+  if (typeof cache === "boolean") return cache;
+  if (typeof cache === "string") return cache.trim().length > 0 && cache.trim() !== "false";
+  return false;
+}
+
+export const gha063: PostSynthCheck = {
+  id: "GHA063",
+  description: "Dependency setup action without caching enabled",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+
+      for (const [jobName, jobObj] of jobEntries(yaml)) {
+        const steps = Array.isArray(jobObj.steps) ? (jobObj.steps as Array<Record<string, unknown>>) : [];
+        const hasGenericCacheStep = steps.some((s) => parseActionUses(String(s.uses ?? ""))?.slug === "actions/cache");
+        if (hasGenericCacheStep) continue;
+
+        for (const step of steps) {
+          const uses = typeof step.uses === "string" ? step.uses : undefined;
+          if (!uses) continue;
+          const parsed = parseActionUses(uses);
+          if (!parsed || !CACHEABLE_SETUP_ACTIONS.has(parsed.slug)) continue;
+          if (cacheEnabled(step.with)) continue;
+
+          diagnostics.push({
+            checkId: "GHA063",
+            severity: "info",
+            message: `Job "${jobName}" uses ${parsed.slug} without enabling its \`cache:\` option, and no separate actions/cache step covers it — dependencies are re-fetched from a cold cache on every run. Set \`with.cache\` (e.g. \`cache: npm\`) or add an actions/cache step.`,
+            entity: jobName,
+            lexicon: "github",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/gha064.test.ts

@@ -0,0 +1,73 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { gha064 } from "./gha064";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["github", yaml]]),
+    entities: new Map(),
+    buildResult: { outputs: new Map([["github", yaml]]), entities: new Map(), warnings: [], errors: [], sourceFileCount: 1 },
+  };
+}
+
+describe("GHA064: expensive runner without justification", () => {
+  test("flags a macOS runner with no macOS-specific step", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm test
+`;
+    const diags = gha064.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("GHA064");
+    expect(diags[0].entity).toBe("build");
+  });
+
+  test("does not flag macOS when a step is Xcode-specific", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: xcodebuild -scheme App build
+`;
+    expect(gha064.check(makeCtx(yaml))).toHaveLength(0);
+  });
+
+  test("does not flag runs-on driven by a matrix expression", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: \${{ matrix.os }}
+    steps:
+      - run: npm test
+`;
+    expect(gha064.check(makeCtx(yaml))).toHaveLength(0);
+  });
+
+  test("does not flag a Linux runner", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - run: npm test
+`;
+    expect(gha064.check(makeCtx(yaml))).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/gha064.ts

@@ -0,0 +1,55 @@
+/**
+ * GHA064: Expensive Runner Without Justification
+ *
+ * Flags a job hardcoded onto a pricier macOS/Windows runner (billed at a
+ * multiple of Linux minutes) when none of its `run:` steps show any sign the
+ * job actually needs that OS. A matrix-driven `runs-on: ${{ matrix.os }}`
+ * (intentional cross-platform testing) is never flagged — only a literal,
+ * hardcoded label. Efficiency (#444), not a correctness/security issue.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractRunsOnByJob, extractRunBlocks } from "./yaml-helpers";
+
+const OS_JUSTIFICATION: Array<{ prefix: string; label: string; keywords: RegExp }> = [
+  { prefix: "macos-", label: "macOS", keywords: /xcodebuild|xcode-select|\.xcodeproj|\.xcworkspace|carthage|fastlane|cocoapods|pod install|swiftpm|codesign|notarize/i },
+  { prefix: "windows-", label: "Windows", keywords: /msbuild|\.sln\b|\.ps1\b|vcvarsall|nuget\s|choco\s|Set-ItemProperty|Get-ChildItem/i },
+];
+
+export const gha064: PostSynthCheck = {
+  id: "GHA064",
+  description: "Job hardcoded onto an expensive runner with no sign it needs that OS",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      const runsOnByJob = extractRunsOnByJob(yaml);
+      const runBlocks = extractRunBlocks(yaml);
+
+      for (const [jobName, labels] of runsOnByJob) {
+        if (labels.some((l) => l.includes("${{"))) continue; // matrix/expression-driven — intentional
+
+        for (const { prefix, label, keywords } of OS_JUSTIFICATION) {
+          const matched = labels.find((l) => l.toLowerCase().startsWith(prefix));
+          if (!matched) continue;
+
+          const justified = runBlocks.some((r) => r.job === jobName && keywords.test(r.run));
+          if (justified) break;
+
+          diagnostics.push({
+            checkId: "GHA064",
+            severity: "info",
+            message: `Job "${jobName}" runs on "${matched}" (a pricier ${label} runner) but no step looks ${label}-specific. Confirm it needs ${label}, or move it to a Linux runner.`,
+            entity: jobName,
+            lexicon: "github",
+          });
+          break;
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/gha065.test.ts

@@ -0,0 +1,85 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { gha065 } from "./gha065";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["github", yaml]]),
+    entities: new Map(),
+    buildResult: { outputs: new Map([["github", yaml]]), entities: new Map(), warnings: [], errors: [], sourceFileCount: 1 },
+  };
+}
+
+describe("GHA065: unbounded matrix fan-out", () => {
+  test("flags a large multi-dimension matrix with no max-parallel", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        node: [14, 16, 18, 20, 22]
+    runs-on: \${{ matrix.os }}
+    steps:
+      - run: npm test
+`;
+    const diags = gha065.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("GHA065");
+    expect(diags[0].entity).toBe("build");
+    expect(diags[0].message).toContain("15 jobs");
+  });
+
+  test("does not flag when max-parallel caps the fan-out", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    strategy:
+      max-parallel: 4
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        node: [14, 16, 18, 20, 22]
+    runs-on: \${{ matrix.os }}
+    steps:
+      - run: npm test
+`;
+    expect(gha065.check(makeCtx(yaml))).toHaveLength(0);
+  });
+
+  test("does not flag a small matrix under the threshold", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+        node: [18, 20]
+    runs-on: \${{ matrix.os }}
+    steps:
+      - run: npm test
+`;
+    expect(gha065.check(makeCtx(yaml))).toHaveLength(0);
+  });
+
+  test("does not flag a single-dimension matrix", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    strategy:
+      matrix:
+        node: [16, 18, 20, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22]
+    runs-on: ubuntu-latest
+    steps:
+      - run: npm test
+`;
+    expect(gha065.check(makeCtx(yaml))).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/gha065.ts

@@ -0,0 +1,129 @@
+/**
+ * GHA065: Unbounded Matrix Fan-Out
+ *
+ * Flags a `strategy.matrix` that combines two or more dimensions into more
+ * jobs than a `max-parallel:` cap bounds. Two orthogonal axes each with a
+ * handful of values multiply, not add — `os` x `node` x `arch` can produce
+ * dozens of jobs from a config that reads like a short list. Unbounded, that
+ * is capacity spent on a combination nobody asked for, not a correctness or
+ * security issue (efficiency, #444).
+ *
+ * Parses the `matrix:` block by indentation, not the structural YAML parser
+ * — a flow list of bare words (`os: [ubuntu-latest, macos-latest]`, the
+ * overwhelmingly common hand-written form) is not one it round-trips, only
+ * a flow list of numbers. Mirrors GHA009's regex-based matrix handling for
+ * the same reason.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs } from "./yaml-helpers";
+
+/** Above this many combinations, an uncapped matrix is flagged. */
+const FANOUT_THRESHOLD = 12;
+
+/** The raw text of one job's block within `jobs:`, or undefined if not found. */
+function jobSection(yaml: string, jobName: string): string | undefined {
+  const jobsIdx = yaml.search(/^jobs:\s*$/m);
+  if (jobsIdx === -1) return undefined;
+  const afterJobs = yaml.slice(jobsIdx + yaml.slice(jobsIdx).indexOf("\n") + 1);
+  const header = `  ${jobName}:\n`;
+  const start = afterJobs.indexOf(header);
+  if (start === -1) return undefined;
+  const rest = afterJobs.slice(start + header.length);
+  const nextJobMatch = rest.search(/\n {2}\S/);
+  return nextJobMatch === -1 ? rest : rest.slice(0, nextJobMatch);
+}
+
+interface MatrixInfo {
+  dims: Array<{ key: string; size: number }>;
+  maxParallel: boolean;
+}
+
+/** Parse a job section's `strategy.matrix` dimensions and whether max-parallel caps it. */
+function parseMatrix(section: string): MatrixInfo | undefined {
+  const lines = section.split("\n");
+  const matrixLineIdx = lines.findIndex((l) => /^\s*matrix:\s*$/.test(l));
+  if (matrixLineIdx === -1) return undefined;
+  const matrixIndent = lines[matrixLineIdx].search(/\S/);
+
+  const maxParallel = lines.some((l) => {
+    const m = l.match(/^(\s*)max-parallel:/);
+    return !!m && m[1].length === matrixIndent;
+  });
+
+  const dims: Array<{ key: string; size: number }> = [];
+  let i = matrixLineIdx + 1;
+  while (i < lines.length) {
+    const line = lines[i];
+    if (line.trim() === "") { i++; continue; }
+    const indent = line.search(/\S/);
+    if (indent <= matrixIndent) break; // dedented out of the matrix: block
+
+    const kv = line.match(/^\s*([a-zA-Z0-9_-]+):\s*(.*)$/);
+    if (!kv) { i++; continue; }
+    const [, key, rest] = kv;
+    const value = rest.trim();
+
+    if (value.startsWith("[")) {
+      const inner = value.replace(/^\[|\]\s*$/g, "").trim();
+      dims.push({ key, size: inner === "" ? 0 : inner.split(",").length });
+      i++;
+      continue;
+    }
+    if (value !== "") {
+      dims.push({ key, size: 1 }); // a bare scalar dimension
+      i++;
+      continue;
+    }
+    // Block-list value on subsequent, deeper-indented lines.
+    let size = 0;
+    i++;
+    while (i < lines.length) {
+      const l2 = lines[i];
+      if (l2.trim() === "") { i++; continue; }
+      const ind2 = l2.search(/\S/);
+      if (ind2 <= indent) break;
+      if (/^\s*-\s/.test(l2)) size++;
+      i++;
+    }
+    dims.push({ key, size });
+  }
+
+  return { dims, maxParallel };
+}
+
+export const gha065: PostSynthCheck = {
+  id: "GHA065",
+  description: "Matrix combines dimensions into an uncapped, large fan-out",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+
+      for (const [jobName] of extractJobs(yaml)) {
+        const section = jobSection(yaml, jobName);
+        if (!section) continue;
+        const matrix = parseMatrix(section);
+        if (!matrix) continue;
+
+        const dims = matrix.dims.filter((d) => d.key !== "include" && d.key !== "exclude" && d.size > 0);
+        if (dims.length < 2) continue; // a single axis isn't "combined" fan-out
+
+        const combos = dims.reduce((a, d) => a * d.size, 1);
+        if (combos <= FANOUT_THRESHOLD || matrix.maxParallel) continue;
+
+        diagnostics.push({
+          checkId: "GHA065",
+          severity: "info",
+          message: `Job "${jobName}"'s matrix combines ${dims.length} dimensions (${dims.map((d) => d.key).join(" x ")}) into ${combos} jobs with no \`max-parallel:\` cap. Confirm the full cross-product is intended, trim it with \`include\`/\`exclude\`, or add \`max-parallel:\`.`,
+          entity: jobName,
+          lexicon: "github",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/gha066.test.ts

@@ -0,0 +1,66 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { gha066 } from "./gha066";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["github", yaml]]),
+    entities: new Map(),
+    buildResult: { outputs: new Map([["github", yaml]]), entities: new Map(), warnings: [], errors: [], sourceFileCount: 1 },
+  };
+}
+
+describe("GHA066: unbounded artifact retention", () => {
+  test("flags upload-artifact with no retention-days", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/upload-artifact@v4
+        with:
+          name: build-output
+          path: dist/
+`;
+    const diags = gha066.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("GHA066");
+    expect(diags[0].entity).toBe("build");
+    expect(diags[0].message).toContain("build-output");
+  });
+
+  test("does not flag upload-artifact with retention-days set", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/upload-artifact@v4
+        with:
+          name: build-output
+          path: dist/
+          retention-days: 7
+`;
+    expect(gha066.check(makeCtx(yaml))).toHaveLength(0);
+  });
+
+  test("does not flag a job with no artifact upload", () => {
+    const yaml = `name: CI
+on:
+  push:
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm test
+`;
+    expect(gha066.check(makeCtx(yaml))).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/gha066.ts

@@ -0,0 +1,47 @@
+/**
+ * GHA066: Unbounded Artifact Retention
+ *
+ * Flags an `actions/upload-artifact` step with no `retention-days`, which
+ * falls back to the repository's default (up to 90 days). Build logs, test
+ * output, and intermediate artifacts rarely need to outlive the PR they came
+ * from; an unset retention silently accumulates storage. Efficiency (#444),
+ * not a correctness or security issue.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, jobEntries, parseActionUses } from "./yaml-helpers";
+
+export const gha066: PostSynthCheck = {
+  id: "GHA066",
+  description: "Uploaded artifact has no explicit retention-days",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+
+      for (const [jobName, jobObj] of jobEntries(yaml)) {
+        const steps = Array.isArray(jobObj.steps) ? (jobObj.steps as Array<Record<string, unknown>>) : [];
+        for (const step of steps) {
+          const uses = typeof step.uses === "string" ? step.uses : undefined;
+          if (!uses || parseActionUses(uses)?.slug !== "actions/upload-artifact") continue;
+
+          const withBlock = step.with as Record<string, unknown> | undefined;
+          if (withBlock && withBlock["retention-days"] !== undefined) continue;
+
+          const name = typeof withBlock?.name === "string" ? withBlock.name : undefined;
+          diagnostics.push({
+            checkId: "GHA066",
+            severity: "info",
+            message: `Job "${jobName}" uploads${name ? ` artifact "${name}"` : " an artifact"} with no \`retention-days\` — it falls back to the repository's default (up to 90 days). Set a \`retention-days\` sized to how long the artifact is actually needed.`,
+            entity: jobName,
+            lexicon: "github",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};