@intentius/chant-lexicon-github 0.49.0 → 0.50.0

package/dist/components/generate-op-pipeline.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Generate mode — scheduled Op → GitHub Actions workflow YAML (#927).
+ *
+ * The Op counterpart to `./generate-pipeline.ts` (#891): that module
+ * synthesizes a `workflow_dispatch`-triggered pipeline from a deploy-time
+ * component graph, this one synthesizes a cron-triggered workflow per
+ * stateless Op — the CI-native alternative to a Temporal `TemporalSchedule`
+ * for downstream projects that don't run Temporal (`WorkflowAuditOp`,
+ * `PipelineAuditOp`, `ReconcileOp`, … all accept an optional `schedule`
+ * precisely for this).
+ *
+ * GitHub Actions' `on.schedule` is workflow-scoped, not job-scoped, so unlike
+ * the component generator (one combined pipeline for the whole graph) this
+ * emits one workflow file per `ScheduledOpSpec`. Each workflow:
+ *  - triggers on `schedule` (the Op's cron) and `workflow_dispatch` (manual
+ *    runs stay available for testing/dry-runs);
+ *  - declares only the `permissions:` its `findingMode` needs — `report`
+ *    stays read-only, `issue`/`pull-request` add the write scope the Op's own
+ *    activity uses (`gh issue create` / `gh pr create`, see
+ *    `@intentius/chant-lexicon-temporal`'s `reconcilePr` activity) — never a
+ *    blanket `write-all`;
+ *  - runs exactly one invocation, `chant run <name>` by default — never
+ *    inlined audit/reconcile logic. The finding-mode itself is already baked
+ *    into the Op's own activity args at build time by the composite that
+ *    created it; this workflow only supplies the token the mode needs to act.
+ */
+import type { ComponentPipelineOptions as GenerateGithubOpOptions, OpPipelineJob, OpPipelineResult as GenerateGithubOpResult, ScheduledOpSpec } from "@intentius/chant/lexicon";
+export type { GenerateGithubOpOptions, GenerateGithubOpResult };
+/**
+ * The structured pipeline document behind one generated file, before YAML
+ * emission — exposed so a GitHub-Actions dialect (the forgejo lexicon, #969)
+ * can reuse the exact trigger/concurrency/job structure and only apply its
+ * dialect transform + emit, rather than re-deriving it. Mirrors
+ * `./generate-pipeline.ts`'s `GithubPipelineDoc` split.
+ */
+export interface GithubOpPipelineDoc {
+    /** The `on:` trigger mapping (`schedule` + `workflow_dispatch`). */
+    on: Record<string, unknown>;
+    /** The `env:` mapping, when `options.variables` is set. */
+    env?: Record<string, unknown>;
+    /** The `concurrency:` mapping — one run at a time per Op. */
+    concurrency: Record<string, unknown>;
+    /**
+     * The `permissions:` mapping for this Op's finding-mode. GitHub-only:
+     * Forgejo Actions ignores `permissions:` entirely, so the forgejo dialect
+     * drops this section rather than translating it (see ../../forgejo/src/dialect.ts).
+     */
+    permissions: Record<string, unknown>;
+    /** The `jobs:` mapping — one entry, this Op's trigger job. */
+    jobsDoc: Record<string, unknown>;
+}
+/** One generated file: a suggested name plus its pipeline document, pre-emission. */
+export interface GithubOpPipelineFile {
+    /** Suggested file name (`<op-name>.yml`), relative to the provider's workflow directory. */
+    name: string;
+    doc: GithubOpPipelineDoc;
+}
+/**
+ * Build one `GithubOpPipelineDoc` per scheduled Op: cron trigger,
+ * least-privilege `permissions:` for its finding-mode, one job that runs
+ * `chant run <name>`. Throws nothing — every `ScheduledOpSpec` is independent,
+ * unlike the component generator there is no shared graph to resolve.
+ */
+export declare function buildGithubOpPipelineDocs(ops: ScheduledOpSpec[], options?: GenerateGithubOpOptions): {
+    files: GithubOpPipelineFile[];
+    jobs: OpPipelineJob[];
+};
+/**
+ * Emit a `GithubOpPipelineDoc`'s `on`/`env`/`concurrency`/`permissions`/`jobs`
+ * mappings as workflow YAML. Shared with the forgejo dialect (#969), which
+ * transforms the doc first (and drops `permissions`, which it ignores).
+ */
+export declare function emitOpPipelineYAML(doc: GithubOpPipelineDoc): string;
+/**
+ * Synthesize one `.github/workflows/*.yml` per scheduled Op. Thin wrapper
+ * over {@link buildGithubOpPipelineDocs} + {@link emitOpPipelineYAML}. Wired
+ * into core's Op generate mode via the github lexicon plugin's
+ * `generateOpPipeline` (../plugin.ts).
+ */
+export declare function generateGithubOpPipeline(ops: ScheduledOpSpec[], options?: GenerateGithubOpOptions): GenerateGithubOpResult;
+//# sourceMappingURL=generate-op-pipeline.d.ts.map

package/dist/components/generate-op-pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EAEnD,aAAa,EACb,gBAAgB,IAAI,sBAAsB,EAC1C,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,oEAAoE;IACpE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,qFAAqF;AACrF,MAAM,WAAW,oBAAoB;IACnC,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,mBAAmB,CAAC;CAC1B;AA4BD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC;IAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAAC,IAAI,EAAE,aAAa,EAAE,CAAA;CAAE,CA8C1D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAQnE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CAMxB"}

package/dist/integrity.json

@@ -1,9 +1,9 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "f13c6d5badc99a05feb6c2f1172e984576192151b1a62a157d770efa5b1c541c",
-    "meta.json": "798c5f5f37b0174756d2451299acfdc95c014f11d06d32b9153bbdfa9f3a580c",
-    "types/index.d.ts": "39c0791f0e58025bcef82e0f7a92240508f899fc2771d5dd51b2369b4d330f13",
+    "manifest.json": "dd3f2642674d5dd1332b56eba93ee6c55c403fd39aff3c532890ef1b67d47e54",
+    "meta.json": "e891b1214d530fd676172e3f7e0734995b9f839b7659eb2d53f43ffc97dcd21b",
+    "types/index.d.ts": "7eab3c62c76bff65d68765609e9b6151844a1f581b0c648d0eda779b4252adaf",
     "rules/deprecated-action-version.ts": "d41e6e532ab7f623af1bee4ac5279fcb2baada7defa1c5d022a5bc71983e8797",
     "rules/detect-secrets.ts": "5829832eb7b43993424971041ed386b196850183bffd34bddd6439f99061e4ae",
     "rules/extract-inline-structs.ts": "8f8147c200de8ffd0620dfdcca2e2cea76a520303ce431479ebecad6aa26aab5",
@@ -62,10 +62,20 @@
     "rules/gha056.ts": "73fa2eea80504522cb53db1e48b36e97ede0eeb7b60ed531a476d2f43d3746ae",
     "rules/gha057.ts": "78e896232d6f5c3e4c1bab873eae97960dbb8a0c108f1546f32d943aafc41a91",
     "rules/gha058.ts": "cdcb60916e3ce091b0e6c73295f24b77fca1480fb0a5907ae6d1fc5b1805f794",
-    "rules/yaml-helpers.ts": "40eaa2ed1c8d823dd33cc3355382f09875eb848363b2e5a7269ec50a0ea913b9",
+    "rules/gha059.ts": "93644805955abb54e8efc567b606f233806ce9f80406df81195d5047a957c35e",
+    "rules/gha060.ts": "8049e27b6aa0ab3fa71db8f400bb7bdfe9eab3bc9a69c6f917266cae606718a8",
+    "rules/gha061.ts": "6e4da64dce2f26cd3ffece0a79c99d15bb9e7cb0504979db018e73c39074fe9a",
+    "rules/gha062.ts": "7cfcdc7728db31b52c0d150f091f0cfae127729975fad156dc93049adb99265a",
+    "rules/gha063.ts": "97ab181e987b02be4c3afb03ba7afb8a9ac27702c42ec0f863121b64d371fee5",
+    "rules/gha064.ts": "a978ee4f05c178ac182a2498f7da986159588e7e72facfd69c6b390a11ea49d5",
+    "rules/gha065.ts": "506c43f5b0f81dc8b56d629e470c7263009d9b3786fb3589189ca94219346e8e",
+    "rules/gha066.ts": "89b2c0aa127b1d5d6054fc118390662af2ec4e8d3552afe0ea1e75533cc178c0",
+    "rules/gha067.ts": "6a9ad2208759f8e7146a8af35227a9362d6aa6b16ee7bb9f7167d3d567524099",
+    "rules/gha068.ts": "e23210bc762641de044380677016afb601721a133322544733fd058bb84930ad",
+    "rules/yaml-helpers.ts": "228b4ac9384444acfc711932b5711c299eda6716472b3edd8c52635f37e6b429",
     "skills/chant-github.md": "f3707f09634be4bbb45a6be279f17bb27f275b98e6d3337cc8872c1623ba050f",
     "skills/chant-github-patterns.md": "bb3abef289a8fdfcf07d6bb2d7289dcb2f38bc0cb0321ea320b78b45a6f548c0",
     "skills/chant-github-security.md": "aab111cb0871cad30281ce48d7da23663689619351029219e2be019a1a61e394"
   },
-  "composite": "b77a589c318cd23862c320a4e9ba5459696b8192700a8f9a23ff49519149d90b"
+  "composite": "688d3295fb3d0fb8f6e232665247680c6799b9cb5d5fabb5cbe8cb19351074f4"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAA4G,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAEzK,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA8CvD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAA4H,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAEzL,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA6DvD,CAAC"}

package/dist/lint/post-synth/gha059.d.ts

@@ -0,0 +1,40 @@
+/**
+ * GHA059: Stale or Missing Pin Annotation
+ *
+ * A ref pinned to a commit SHA is only as trustworthy as the label a reviewer
+ * reads next to it — `uses: actions/setup-node@1a2b…9a0b # v4.0.2` lets a
+ * reviewer sanity-check the digest without resolving it themselves. This check
+ * flags two ways that label goes stale:
+ *
+ *  1. Missing — a SHA-pinned ref with no trailing version comment at all.
+ *  2. Mismatched — inferred without any network call, from internal
+ *     inconsistency in the workflow itself: the same action is pinned to the
+ *     same commit SHA in one place and a *different* label in another, or the
+ *     same label is attached to two *different* commit SHAs. Either shape
+ *     proves at least one of the labels is wrong — a real digest has exactly
+ *     one correct human-readable name.
+ *
+ * Cross-referencing a label against the actual git history (to catch a lone,
+ * internally-consistent but still-wrong annotation) needs a network call and
+ * is out of scope here — see GHA062 for the feed-based advisory check, which
+ * takes the same "no network in the rule itself" stance via an injected feed.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export interface StalePinFinding {
+    job: string;
+    ref: string;
+    slug: string;
+    sha: string;
+    kind: "missing" | "mismatched";
+    /** For "mismatched": the other label/SHA this one conflicts with. */
+    conflict?: string;
+}
+/**
+ * Find every SHA-pinned `uses:` with a missing or internally-inconsistent
+ * version annotation. Scoped to one workflow document — cross-file
+ * consistency isn't attempted since two independent workflows pinning the
+ * same action differently isn't evidence of drift.
+ */
+export declare function findStalePinAnnotations(yaml: string): StalePinFinding[];
+export declare const gha059: PostSynthCheck;
+//# sourceMappingURL=gha059.d.ts.map

package/dist/lint/post-synth/gha059.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha059.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha059.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,SAAS,GAAG,YAAY,CAAC;IAC/B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,EAAE,CA4DvE;AAED,eAAO,MAAM,MAAM,EAAE,cA0BpB,CAAC"}

package/dist/lint/post-synth/gha060.d.ts

@@ -0,0 +1,34 @@
+/**
+ * GHA060: Over-Scoped Generated Token
+ *
+ * Flags a GitHub App installation token minted with a `permission-<scope>:
+ * write`/`admin` input broader than what the job's consuming steps evidence.
+ * Targets the well-known GitHub App token actions (`actions/create-github-app-
+ * token`, `tibdex/github-app-token`, `getsentry/action-github-app-token`),
+ * which take `permission-<resource>: read|write|admin` inputs and hand back
+ * the minted token as a step output.
+ *
+ * Two ways a generated token is over-scoped:
+ *  1. Unused — the token's output (`steps.<id>.outputs.token`) is never
+ *     referenced by any other step in the job, so every write/admin scope
+ *     granted is pure waste.
+ *  2. No signal — the token IS consumed, but no other step in the job shows
+ *     any evidence (a `gh`/`git` invocation, an API path, a keyword) of
+ *     exercising a scope granted `write`/`admin`.
+ *
+ * "No signal" is a heuristic, not a proof — a step could exercise a scope
+ * through machinery this doesn't recognize (a custom script calling `octokit`
+ * directly, say). It reports `guidance`, not a `deterministic` fix, for
+ * exactly that reason: a human confirms before narrowing the grant.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export interface OverScopedTokenFinding {
+    job: string;
+    stepId: string;
+    scopes: string[];
+    reason: "unused" | "no-signal";
+}
+/** Find every generated GitHub App token whose granted write/admin scopes exceed what the job's other steps evidence. */
+export declare function findOverScopedTokens(yaml: string): OverScopedTokenFinding[];
+export declare const gha060: PostSynthCheck;
+//# sourceMappingURL=gha060.d.ts.map

package/dist/lint/post-synth/gha060.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha060.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha060.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAyC9G,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,QAAQ,GAAG,WAAW,CAAC;CAChC;AAED,yHAAyH;AACzH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,sBAAsB,EAAE,CA2C3E;AAED,eAAO,MAAM,MAAM,EAAE,cA2BpB,CAAC"}

package/dist/lint/post-synth/gha061.d.ts

@@ -0,0 +1,27 @@
+/**
+ * GHA061: Action Reference Outside the Configured Usage Policy
+ *
+ * An opt-in allow/deny check over third-party `uses:` references, for
+ * environments that constrain which external components may run at all —
+ * distinct from GHA029/031/032, which judge a reference on its own pinning/
+ * naming/health, not against an organizational decision about who is trusted.
+ *
+ * Ships silent: `DEFAULT_ACTION_USAGE_POLICY` (../rules/data/action-usage-
+ * policy.ts) is empty, and {@link evaluateUsagePolicy} returns no findings
+ * for an empty policy — see that module's doc for why (`PostSynthContext`
+ * carries no per-check runtime config channel) and how a project actually
+ * opts in: author a `lint.policies` entry that calls `evaluateUsagePolicy`
+ * with its own policy, wrapped in a `PostSynthCheck`.
+ */
+import type { PostSynthCheck, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { type ActionUsagePolicy } from "../rules/data/action-usage-policy.js";
+export type { ActionUsagePolicy } from "../rules/data/action-usage-policy.js";
+/**
+ * Evaluate a workflow's `uses:` references against a usage policy. Pure: no
+ * fs, no network, no default policy baked in — an empty/unset policy (no
+ * `allow` and no `deny`) always yields no findings, which is what makes this
+ * genuinely opt-in rather than "opt-in by omission of one flag."
+ */
+export declare function evaluateUsagePolicy(yaml: string, policy: ActionUsagePolicy): PostSynthDiagnostic[];
+export declare const gha061: PostSynthCheck;
+//# sourceMappingURL=gha061.d.ts.map

package/dist/lint/post-synth/gha061.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha061.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha061.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAoB,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE9G,OAAO,EAA+B,KAAK,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAExG,YAAY,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAa3E;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,GAAG,mBAAmB,EAAE,CA+BlG;AAED,eAAO,MAAM,MAAM,EAAE,cAYpB,CAAC"}

package/dist/lint/post-synth/gha062.d.ts

@@ -0,0 +1,24 @@
+/**
+ * GHA062: Pinned Reference Matches a Known-Vulnerability Advisory
+ *
+ * Cross-references every pinned `uses:` (commit SHA or tag/branch) against a
+ * caller-supplied advisory feed and flags a match. Unlike GHA031/032's
+ * vendored, committed reference lists, a vulnerability feed is meant to be
+ * refreshed continuously — so this rule takes it as data, not code: the pure
+ * core never fetches (epic #350's design spine), and an absent/empty feed
+ * degrades to "no findings," never an error or a thrown exception. That is
+ * what "unreachable" means for a rule that makes no network call of its own:
+ * whatever couldn't reach the feed already failed upstream of this function,
+ * and this function's job is to not compound that with a crash.
+ */
+import type { PostSynthCheck, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { type AdvisoryFeed } from "../rules/data/advisory-feed.js";
+export type { AdvisoryFeed, AdvisoryEntry } from "../rules/data/advisory-feed.js";
+/**
+ * Check a workflow's pinned action references against an advisory feed. Pure
+ * and total: a missing/empty feed (`entries.length === 0`, including the
+ * `undefined` default) always yields `[]`, never a throw.
+ */
+export declare function checkAdvisories(yaml: string, feed?: AdvisoryFeed | undefined): PostSynthDiagnostic[];
+export declare const gha062: PostSynthCheck;
+//# sourceMappingURL=gha062.d.ts.map

package/dist/lint/post-synth/gha062.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha062.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha062.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAoB,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE9G,OAAO,EAAyB,KAAK,YAAY,EAAsB,MAAM,6BAA6B,CAAC;AAE3G,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAS/E;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,YAAY,GAAG,SAAiC,GAAG,mBAAmB,EAAE,CAqB3H;AAED,eAAO,MAAM,MAAM,EAAE,cAYpB,CAAC"}

package/dist/lint/post-synth/gha063.d.ts

@@ -0,0 +1,12 @@
+/**
+ * GHA063: Dependency Setup Without Caching
+ *
+ * Flags a `actions/setup-{node,python,java,ruby,dotnet}` step that leaves its
+ * built-in `cache:` option unset, with no adjacent `actions/cache` step to
+ * cover the gap. Every run re-downloads the same dependencies from the
+ * registry from a cold cache — pure wasted time and bandwidth, not a
+ * correctness or security issue (efficiency, #444).
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha063: PostSynthCheck;
+//# sourceMappingURL=gha063.d.ts.map

package/dist/lint/post-synth/gha063.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha063.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha063.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAc9G,eAAO,MAAM,MAAM,EAAE,cAmCpB,CAAC"}

package/dist/lint/post-synth/gha064.d.ts

@@ -0,0 +1,12 @@
+/**
+ * GHA064: Expensive Runner Without Justification
+ *
+ * Flags a job hardcoded onto a pricier macOS/Windows runner (billed at a
+ * multiple of Linux minutes) when none of its `run:` steps show any sign the
+ * job actually needs that OS. A matrix-driven `runs-on: ${{ matrix.os }}`
+ * (intentional cross-platform testing) is never flagged — only a literal,
+ * hardcoded label. Efficiency (#444), not a correctness/security issue.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha064: PostSynthCheck;
+//# sourceMappingURL=gha064.d.ts.map

package/dist/lint/post-synth/gha064.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha064.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha064.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAQ9G,eAAO,MAAM,MAAM,EAAE,cAoCpB,CAAC"}

package/dist/lint/post-synth/gha065.d.ts

@@ -0,0 +1,19 @@
+/**
+ * GHA065: Unbounded Matrix Fan-Out
+ *
+ * Flags a `strategy.matrix` that combines two or more dimensions into more
+ * jobs than a `max-parallel:` cap bounds. Two orthogonal axes each with a
+ * handful of values multiply, not add — `os` x `node` x `arch` can produce
+ * dozens of jobs from a config that reads like a short list. Unbounded, that
+ * is capacity spent on a combination nobody asked for, not a correctness or
+ * security issue (efficiency, #444).
+ *
+ * Parses the `matrix:` block by indentation, not the structural YAML parser
+ * — a flow list of bare words (`os: [ubuntu-latest, macos-latest]`, the
+ * overwhelmingly common hand-written form) is not one it round-trips, only
+ * a flow list of numbers. Mirrors GHA009's regex-based matrix handling for
+ * the same reason.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha065: PostSynthCheck;
+//# sourceMappingURL=gha065.d.ts.map

package/dist/lint/post-synth/gha065.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha065.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha065.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AA6E9G,eAAO,MAAM,MAAM,EAAE,cAkCpB,CAAC"}

package/dist/lint/post-synth/gha066.d.ts

@@ -0,0 +1,12 @@
+/**
+ * GHA066: Unbounded Artifact Retention
+ *
+ * Flags an `actions/upload-artifact` step with no `retention-days`, which
+ * falls back to the repository's default (up to 90 days). Build logs, test
+ * output, and intermediate artifacts rarely need to outlive the PR they came
+ * from; an unset retention silently accumulates storage. Efficiency (#444),
+ * not a correctness or security issue.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha066: PostSynthCheck;
+//# sourceMappingURL=gha066.d.ts.map

package/dist/lint/post-synth/gha066.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha066.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha066.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAiCpB,CAAC"}

package/dist/lint/post-synth/gha067.d.ts

@@ -0,0 +1,12 @@
+/**
+ * GHA067: Unconditional Heavy Step With No Path Filter
+ *
+ * Flags a `docker build`/`docker buildx build` step that has no `if:` guard,
+ * in a workflow that triggers on `push`/`pull_request` with no `paths:` or
+ * `paths-ignore:` filter. A docs-only or unrelated change still pays for a
+ * full image build because nothing scopes the trigger or guards the step.
+ * Efficiency (#444), not a correctness or security issue.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha067: PostSynthCheck;
+//# sourceMappingURL=gha067.d.ts.map

package/dist/lint/post-synth/gha067.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha067.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha067.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AA+B9G,eAAO,MAAM,MAAM,EAAE,cAkCpB,CAAC"}

package/dist/lint/post-synth/gha068.d.ts

@@ -0,0 +1,13 @@
+/**
+ * GHA068: Pull-Request Workflow Missing a Concurrency Group
+ *
+ * Flags a workflow triggered on `pull_request` with no top-level
+ * `concurrency:` block. Without one, a superseded push keeps its old run
+ * going instead of cancelling it, so every commit on a PR pays for the full
+ * pipeline instead of just the latest. Deploy workflows are left to GHA024,
+ * which already covers them (overlapping-deployment risk, not capacity).
+ * Efficiency (#444), not a correctness or security issue.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha068: PostSynthCheck;
+//# sourceMappingURL=gha068.d.ts.map

package/dist/lint/post-synth/gha068.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha068.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha068.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAU9G,eAAO,MAAM,MAAM,EAAE,cA6BpB,CAAC"}

package/dist/lint/post-synth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AA+CvE,eAAO,MAAM,eAAe,EAAE,cAAc,EA8C3C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAyDvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAwD3C,CAAC"}

package/dist/lint/post-synth/yaml-helpers.d.ts

@@ -64,6 +64,18 @@ export interface ImageRef {
     /** Where the image was declared. */
     source: "container" | "service" | "step";
 }
+/** Parse a workflow YAML into a structured document, tolerant of parse errors. */
+export declare function parseDoc(yaml: string): Record<string, unknown> | undefined;
+/** Every job in the workflow as `[name, rawJobObject]`, via the structural parser. */
+export declare function jobEntries(yaml: string): Array<[string, Record<string, unknown>]>;
+/**
+ * Every step object (raw, as parsed from YAML — `uses`, `with`, `id`, `run`,
+ * `env`, etc.) grouped by owning job. Unlike {@link extractJobs} (which only
+ * lifts `uses`/`run`/`name`), this hands back each step's full object so a
+ * check can read arbitrary keys (`with:` inputs, `id:`) without growing a new
+ * bespoke regex extractor per key. See GHA060.
+ */
+export declare function extractStepsByJob(yaml: string): Map<string, Array<Record<string, unknown>>>;
 /**
  * Extract every `uses:` reference from the workflow — both step-level actions
  * and job-level reusable-workflow calls. Uses the structural YAML parser so
@@ -134,6 +146,14 @@ export declare function grantsWrite(perms: PermissionsValue): boolean;
  * style) is safe to trim back to `<ref>`.
  */
 export declare function stripUsesComment(uses: string): string;
+/**
+ * Extract a `uses:` value's trailing inline comment, if any — the
+ * human-readable version label reviewers rely on when a ref is pinned to an
+ * opaque commit SHA (e.g. `actions/setup-node@1a2b…9a0b # v4.0.2` → `v4.0.2`).
+ * Returns undefined for no comment or an empty (`# ` with nothing after it)
+ * one, since both mean "no annotation" to a reviewer. See GHA059.
+ */
+export declare function extractUsesComment(rawUses: string): string | undefined;
 export declare function parseActionUses(rawUses: string): {
     owner: string;
     repo: string;

package/dist/lint/post-synth/yaml-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"yaml-helpers.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/yaml-helpers.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEpE;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAGvF;AAED,iEAAiE;AACjE,wBAAgB,wBAAwB,CAAC,cAAc,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAS/F;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CA4DhE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAarE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,OAAO,CAE1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAOnE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGpE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,sDAAsD;AACtD,MAAM,WAAW,SAAS;IACxB,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;CACvB;AAED,sEAAsE;AACtE,MAAM,WAAW,QAAQ;IACvB,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;CAC1C;AAuBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,CAgB3D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAgCzD;AAyBD,iDAAiD;AACjD,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAyBzD;AAED,8CAA8C;AAC9C,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAO/D;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAwBtE;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAQzD;AAED,2EAA2E;AAC3E,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAI3E;AAED,gEAAgE;AAChE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAQ9D;AAED,kDAAkD;AAClD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAMhE;AAED,8DAA8D;AAC9D,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAMhE;AAED,iFAAiF;AACjF,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE/D,2DAA2D;AAC3D,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAMrF;AAED,oFAAoF;AACpF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAQjF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,gBAAgB,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAS7F;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAG5D;AAED;;;;GAIG;AACH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAS1H"}
+{"version":3,"file":"yaml-helpers.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/yaml-helpers.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEpE;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAGvF;AAED,iEAAiE;AACjE,wBAAgB,wBAAwB,CAAC,cAAc,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAS/F;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CA4DhE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAarE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,OAAO,CAE1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAOnE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGpE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,sDAAsD;AACtD,MAAM,WAAW,SAAS;IACxB,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;CACvB;AAED,sEAAsE;AACtE,MAAM,WAAW,QAAQ;IACvB,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;CAC1C;AAED,kFAAkF;AAClF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAM1E;AAED,sFAAsF;AACtF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAWjF;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAW3F;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,CAgB3D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAgCzD;AAyBD,iDAAiD;AACjD,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAyBzD;AAED,8CAA8C;AAC9C,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAO/D;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAwBtE;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAQzD;AAED,2EAA2E;AAC3E,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAI3E;AAED,gEAAgE;AAChE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAQ9D;AAED,kDAAkD;AAClD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAMhE;AAED,8DAA8D;AAC9D,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAMhE;AAED,iFAAiF;AACjF,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE/D,2DAA2D;AAC3D,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAMrF;AAED,oFAAoF;AACpF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAQjF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,gBAAgB,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAS7F;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAG5D;AAED;;;;GAIG;AACH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAItE;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAS1H"}

package/dist/lint/rules/data/action-usage-policy.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Default action-usage policy for GHA061 — opt-in, so it ships with an empty
+ * allow/deny list: with nothing configured, GHA061 reports nothing (#445
+ * acceptance criteria: "silent when unconfigured").
+ *
+ * `PostSynthContext` carries no per-check runtime config channel today (see
+ * `trusted-action-owners.ts`'s doc for the same constraint), so — like that
+ * file — this is a vendored, code-level default. A project that wants a real
+ * policy doesn't edit this file: it authors a `lint.policies` entry
+ * (`chant.config.ts`'s `lint.policies`, see `packages/core/src/lint/config.ts`)
+ * that imports `evaluateUsagePolicy` from `../../post-synth/gha061` and calls
+ * it with its own `ActionUsagePolicy`, wrapped in a `PostSynthCheck`. That is
+ * the supported opt-in path; this default only documents the "nothing
+ * configured" shape and is what the shipped GHA061 check itself passes.
+ */
+/**
+ * An opt-in allow/deny policy over third-party action references.
+ * Entries match an exact `owner/repo` slug, a bare `owner` (every repo under
+ * that owner), or an `owner/*` wildcard (equivalent to a bare owner, offered
+ * for readability). `deny` always wins over `allow` for an entry that somehow
+ * appears in both.
+ */
+export interface ActionUsagePolicy {
+    /** If set, any reference whose owner/slug isn't matched here is flagged. Unset = no allowlist restriction. */
+    allow?: string[];
+    /** Always flagged, regardless of `allow`. */
+    deny?: string[];
+}
+export declare const DEFAULT_ACTION_USAGE_POLICY: ActionUsagePolicy;
+//# sourceMappingURL=action-usage-policy.d.ts.map

package/dist/lint/rules/data/action-usage-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-usage-policy.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/data/action-usage-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,8GAA8G;IAC9G,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,eAAO,MAAM,2BAA2B,EAAE,iBAAsB,CAAC"}

package/dist/lint/rules/data/advisory-feed.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Default advisory feed for GHA062 — ships empty, so the check degrades to
+ * "no findings" rather than erroring when nothing is supplied (#445
+ * acceptance criteria: "degrades gracefully when the feed is unreachable").
+ *
+ * Per epic #350's design spine, the pure core never fetches: a live feed is
+ * the CALLER's concern (a `chant audit` CLI flag reading a local JSON file,
+ * a pre-fetched structure a hosted service passes in) — never a `fetch()`
+ * inside a rule. This module documents the "nothing supplied" shape and is
+ * what the shipped GHA062 check itself passes; a caller with a real feed
+ * calls `checkAdvisories` (`../../post-synth/gha062`) directly with its own
+ * `AdvisoryFeed`, the same way a `lint.policies` entry supplies GHA061 its
+ * own `ActionUsagePolicy` (see `action-usage-policy.ts`).
+ */
+/** One disclosed advisory affecting a pinned action reference. */
+export interface AdvisoryEntry {
+    /** `owner/repo` slug the advisory applies to. */
+    slug: string;
+    /** Affected commit SHA(s) — for SHA-pinned refs. */
+    shas?: string[];
+    /** Affected tag/branch ref(s) — for refs still pinned to a mutable tag. */
+    refs?: string[];
+    /** Advisory identifier (e.g. a GHSA id). */
+    id: string;
+    /** Human-readable summary of the issue. */
+    summary: string;
+    /** A ref/SHA known to be patched, if the feed carries one. */
+    patchedRef?: string;
+    /** Link to the advisory. */
+    url?: string;
+}
+export interface AdvisoryFeed {
+    entries: AdvisoryEntry[];
+}
+export declare const DEFAULT_ADVISORY_FEED: AdvisoryFeed;
+//# sourceMappingURL=advisory-feed.d.ts.map

package/dist/lint/rules/data/advisory-feed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"advisory-feed.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/data/advisory-feed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,4CAA4C;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED,eAAO,MAAM,qBAAqB,EAAE,YAA8B,CAAC"}