@intentius/chant-lexicon-github 0.7.0 → 0.8.0

package/dist/lint/post-synth/gha033.d.ts

@@ -0,0 +1,10 @@
+/**
+ * GHA033: Blanket `write-all` Token Permissions
+ *
+ * Flags a `permissions: write-all` grant at the workflow or job level. It hands
+ * the `GITHUB_TOKEN` every write scope regardless of what the job uses, so any
+ * compromised or injected step becomes a write-capable actor across the repo.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha033: PostSynthCheck;
+//# sourceMappingURL=gha033.d.ts.map

package/dist/lint/post-synth/gha033.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha033.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha033.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAmCpB,CAAC"}

package/dist/lint/post-synth/gha034.d.ts

@@ -0,0 +1,12 @@
+/**
+ * GHA034: Workflow-Wide Write Scope (Prefer Job-Scoped Permissions)
+ *
+ * Flags individual write scopes granted at the workflow level. A workflow-wide
+ * grant gives every job that scope even when only one needs it. Least privilege
+ * prefers declaring the write scope on the single job that uses it.
+ *
+ * The `write-all` blanket preset is handled by GHA033 and skipped here.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha034: PostSynthCheck;
+//# sourceMappingURL=gha034.d.ts.map

package/dist/lint/post-synth/gha034.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha034.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha034.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cA2BpB,CAAC"}

package/dist/lint/post-synth/gha035.d.ts

@@ -0,0 +1,13 @@
+/**
+ * GHA035: Elevated Token Scope on an Untrusted-Code Trigger
+ *
+ * Raises the stakes of GHA033/GHA034: when a workflow can run untrusted code
+ * (`pull_request_target`, `workflow_run`) and also grants the token write
+ * access, an injected step runs with standing write credentials. This is the
+ * combination behind most CI privilege-escalation incidents, so it is an error.
+ *
+ * Cross-references the trust-boundary checks (GHA018 / GHA025 / GHA038).
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha035: PostSynthCheck;
+//# sourceMappingURL=gha035.d.ts.map

package/dist/lint/post-synth/gha035.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha035.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha035.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAgB9G,eAAO,MAAM,MAAM,EAAE,cAsCpB,CAAC"}

package/dist/lint/post-synth/gha036.d.ts

@@ -0,0 +1,12 @@
+/**
+ * GHA036: Untrusted Input Interpolated into a Shell Command
+ *
+ * Flags attacker-controllable expression contexts (PR titles, branch names,
+ * issue/comment bodies, commit messages) interpolated directly into a `run:`
+ * script. The value is expanded into the shell before the script runs, so a
+ * crafted payload becomes command execution. Pass untrusted input through an
+ * `env:` variable and reference it quoted instead.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha036: PostSynthCheck;
+//# sourceMappingURL=gha036.d.ts.map

package/dist/lint/post-synth/gha036.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha036.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha036.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAI9G,eAAO,MAAM,MAAM,EAAE,cA2BpB,CAAC"}

package/dist/lint/post-synth/gha037.d.ts

@@ -0,0 +1,12 @@
+/**
+ * GHA037: Untrusted Input Written to GITHUB_ENV / GITHUB_PATH
+ *
+ * Flags a `run:` step that writes attacker-controllable input into the
+ * `$GITHUB_ENV` or `$GITHUB_PATH` files. Those files set environment variables
+ * and PATH entries for *later* steps, so injecting into them escalates a data
+ * value into influence over subsequent privileged steps (a known path to
+ * `LD_PRELOAD`/`NODE_OPTIONS`-style takeover).
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha037: PostSynthCheck;
+//# sourceMappingURL=gha037.d.ts.map

package/dist/lint/post-synth/gha037.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha037.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha037.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAM9G,eAAO,MAAM,MAAM,EAAE,cA6BpB,CAAC"}

package/dist/lint/post-synth/gha038.d.ts

@@ -0,0 +1,11 @@
+/**
+ * GHA038: Privileged `workflow_run` Trigger Checking Out Untrusted Code
+ *
+ * Generalizes GHA018 (pull_request_target + checkout) to the other privileged
+ * trigger that runs in the base-repo context: `workflow_run`. A `workflow_run`
+ * workflow has repo write scope and secrets, and checking out the artifact/head
+ * of the triggering run pulls untrusted code into that privileged context.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha038: PostSynthCheck;
+//# sourceMappingURL=gha038.d.ts.map

package/dist/lint/post-synth/gha038.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha038.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha038.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cA4BpB,CAAC"}

package/dist/lint/post-synth/gha039.d.ts

@@ -0,0 +1,12 @@
+/**
+ * GHA039: Spoofable Identity Used as an Authorization Gate
+ *
+ * Flags an `if:` condition that gates execution on a commit-author identity
+ * field (`...author.name` / `...author.email`). Those values come straight from
+ * git metadata the committer sets freely, so an attacker can forge them to pass
+ * the gate. Use a trustworthy signal — environment protection rules, CODEOWNERS,
+ * or membership checks against a verified actor.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha039: PostSynthCheck;
+//# sourceMappingURL=gha039.d.ts.map

package/dist/lint/post-synth/gha039.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha039.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha039.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAM9G,eAAO,MAAM,MAAM,EAAE,cAwBpB,CAAC"}

package/dist/lint/post-synth/gha040.d.ts

@@ -0,0 +1,11 @@
+/**
+ * GHA040: Self-Hosted Runner on a Trigger That Can Run Untrusted Code
+ *
+ * Flags a job that runs on a self-hosted runner under a trigger reachable by a
+ * fork or outside contributor (`pull_request`, `pull_request_target`,
+ * `workflow_run`). Self-hosted runners are non-ephemeral by default and share a
+ * host, so untrusted code can persist on the runner and compromise later jobs.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha040: PostSynthCheck;
+//# sourceMappingURL=gha040.d.ts.map

package/dist/lint/post-synth/gha040.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha040.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha040.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cA4BpB,CAAC"}

package/dist/lint/post-synth/gha041.d.ts

@@ -0,0 +1,10 @@
+/**
+ * GHA041: Blanket `secrets: inherit` into a Reusable Workflow
+ *
+ * Flags a reusable-workflow call that passes `secrets: inherit`. Inheritance
+ * hands the called workflow every secret the caller can see, regardless of what
+ * it needs. Pass through only the specific secrets the reusable workflow uses.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha041: PostSynthCheck;
+//# sourceMappingURL=gha041.d.ts.map

package/dist/lint/post-synth/gha041.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha041.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha041.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cA0BpB,CAAC"}

package/dist/lint/post-synth/gha042.d.ts

@@ -0,0 +1,10 @@
+/**
+ * GHA042: Whole Secrets Context Passed Where Specific Secrets Would Do
+ *
+ * Flags `toJSON(secrets)` (serializing the entire secrets context) passed into
+ * a step's `with:`/`env:` or to a reusable workflow. It hands the consumer every
+ * secret instead of the one or two it needs. Reference specific secrets.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha042: PostSynthCheck;
+//# sourceMappingURL=gha042.d.ts.map

package/dist/lint/post-synth/gha042.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha042.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha042.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cA0BpB,CAAC"}

package/dist/lint/post-synth/gha043.d.ts

@@ -0,0 +1,12 @@
+/**
+ * GHA043: Secret Consumed in a Job Without an Environment Gate
+ *
+ * Extends GHA026 (which fires only when a workflow uses secrets and defines no
+ * environment at all). When a workflow *does* gate some jobs with an
+ * `environment:`, this flags the specific jobs that consume secrets without one
+ * — the inconsistent-gating case, where a secret-using job skips the approval
+ * and scoping the author applied elsewhere.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha043: PostSynthCheck;
+//# sourceMappingURL=gha043.d.ts.map

package/dist/lint/post-synth/gha043.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha043.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha043.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cA2BpB,CAAC"}

package/dist/lint/post-synth/gha044.d.ts

@@ -0,0 +1,10 @@
+/**
+ * GHA044: Hardcoded Registry / Container Credential
+ *
+ * Flags a `password:` / `token:` / `registry-password:` value that is a literal
+ * rather than a `${{ secrets.* }}` reference — e.g. a registry login or service
+ * credential inlined in plain text. Move it into a secret.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha044: PostSynthCheck;
+//# sourceMappingURL=gha044.d.ts.map

package/dist/lint/post-synth/gha044.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha044.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha044.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cA2BpB,CAAC"}

package/dist/lint/post-synth/gha045.d.ts

@@ -0,0 +1,12 @@
+/**
+ * GHA045: Secret Interpolated Directly into a Shell Command
+ *
+ * Flags `${{ secrets.* }}` expanded straight into a `run:` script. The value is
+ * substituted into the command line before the shell runs, where a transform
+ * (base64, reversing, splitting) can defeat GitHub's log masking and leak it,
+ * and the raw value is exposed to argument-injection. Pass secrets through an
+ * `env:` variable and reference "$VAR" quoted instead.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha045: PostSynthCheck;
+//# sourceMappingURL=gha045.d.ts.map

package/dist/lint/post-synth/gha045.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha045.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha045.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAwBpB,CAAC"}

package/dist/lint/post-synth/gha046.d.ts

@@ -0,0 +1,13 @@
+/**
+ * GHA046: Logically Unsound Guard Condition
+ *
+ * Flags an `if:` condition that reads like a security/flow gate but evaluates to
+ * a constant — `true`/`false` literals, an `X == X` tautology, or an expression
+ * that collapses via `|| true` / `&& false`. These pass review by looking like a
+ * control while gating nothing (or everything).
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+/** Classify a condition as a constant guard, returning a reason or undefined. */
+export declare function unsoundReason(expr: string): string | undefined;
+export declare const gha046: PostSynthCheck;
+//# sourceMappingURL=gha046.d.ts.map

package/dist/lint/post-synth/gha046.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha046.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha046.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAQ9G,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAW9D;AAED,eAAO,MAAM,MAAM,EAAE,cAwBpB,CAAC"}

package/dist/lint/post-synth/gha047.d.ts

@@ -0,0 +1,12 @@
+/**
+ * GHA047: Ineffective `contains()` Guard (Reversed Arguments)
+ *
+ * Flags `contains('literal', <dynamic>)` — a string literal as the haystack and
+ * a dynamic value as the needle. `contains(search, item)` checks whether `item`
+ * is in `search`, so a constant first argument makes the result depend on a
+ * fixed string rather than the runtime value the author intended to test. The
+ * usual fix is to swap the arguments.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha047: PostSynthCheck;
+//# sourceMappingURL=gha047.d.ts.map

package/dist/lint/post-synth/gha047.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha047.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha047.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAW9G,eAAO,MAAM,MAAM,EAAE,cA6BpB,CAAC"}

package/dist/lint/post-synth/gha048.d.ts

@@ -0,0 +1,12 @@
+/**
+ * GHA048: Obfuscated Guard Condition
+ *
+ * Flags an `if:` condition that builds its compared value through string
+ * indirection — `format()`, `join()`, or `fromJSON()` feeding a comparison.
+ * Constructing the operand at evaluation time hides what the gate actually
+ * checks, which is how an unsound condition (GHA046/GHA047) is disguised to pass
+ * review. Write the comparison against the value directly.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha048: PostSynthCheck;
+//# sourceMappingURL=gha048.d.ts.map

package/dist/lint/post-synth/gha048.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha048.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha048.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAM9G,eAAO,MAAM,MAAM,EAAE,cAwBpB,CAAC"}

package/dist/lint/post-synth/gha049.d.ts

@@ -0,0 +1,12 @@
+/**
+ * GHA049: Persisted Checkout Credentials Reachable by an Uploaded Artifact
+ *
+ * `actions/checkout` writes the job token into `.git/config` by default
+ * (`persist-credentials: true`). A job that also uploads an artifact can sweep
+ * that `.git` directory into the artifact, leaking the token to anyone who can
+ * download it. Set `persist-credentials: false` on the checkout when the job
+ * uploads artifacts.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha049: PostSynthCheck;
+//# sourceMappingURL=gha049.d.ts.map

package/dist/lint/post-synth/gha049.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha049.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha049.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cA4BpB,CAAC"}

package/dist/lint/post-synth/gha050.d.ts

@@ -0,0 +1,12 @@
+/**
+ * GHA050: Cache Populated in a Privileged Context (Poisoning Risk)
+ *
+ * Flags `actions/cache` use under a privileged trigger (`pull_request_target`,
+ * `workflow_run`) that runs in the base-repo context. Cache entries written from
+ * code influenced by a fork can later be restored by a trusted run and executed,
+ * a cache-poisoning path. Restrict caching to trusted triggers or scope keys so
+ * untrusted runs cannot write entries a privileged run will restore.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha050: PostSynthCheck;
+//# sourceMappingURL=gha050.d.ts.map

package/dist/lint/post-synth/gha050.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha050.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha050.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cA4BpB,CAAC"}

package/dist/lint/post-synth/gha051.d.ts

@@ -0,0 +1,12 @@
+/**
+ * GHA051: Publish/Release Step Using a Long-Lived Token Instead of OIDC
+ *
+ * Flags a job that publishes a release/package using a long-lived token secret
+ * (`*_TOKEN`, `*_PASSWORD`, `*_API_KEY`) while the workflow requests no
+ * `id-token: write` permission. Registries that support OIDC let a workflow mint
+ * a short-lived, audience-scoped credential per run instead of holding a
+ * standing secret. Advisory — not every registry supports OIDC.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha051: PostSynthCheck;
+//# sourceMappingURL=gha051.d.ts.map

package/dist/lint/post-synth/gha051.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha051.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha051.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAM9G,eAAO,MAAM,MAAM,EAAE,cA4BpB,CAAC"}

package/dist/lint/post-synth/gha052.d.ts

@@ -0,0 +1,11 @@
+/**
+ * GHA052: Software Fetched and Executed at Runtime Without Verification
+ *
+ * Flags a `run:` step that pipes a network download straight into a shell
+ * (`curl ... | bash`, `wget ... | sh`, `iwr ... | iex`). The fetched script is
+ * unpinned and unverified, so whoever controls the URL controls what executes
+ * in the job. Download to a file, verify a checksum/signature, then run it.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha052: PostSynthCheck;
+//# sourceMappingURL=gha052.d.ts.map

package/dist/lint/post-synth/gha052.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha052.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha052.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAQ9G,eAAO,MAAM,MAAM,EAAE,cAwBpB,CAAC"}

package/dist/lint/post-synth/gha053.d.ts

@@ -0,0 +1,11 @@
+/**
+ * GHA053: Re-enabling Unsafe Workflow-Command Processing
+ *
+ * Flags opt-ins that reintroduce the `set-env` / `add-path` workflow commands
+ * removed for security (CVE-2020-15228) — `ACTIONS_ALLOW_UNSECURE_COMMANDS` and
+ * direct `::set-env::` / `::add-path::` emission. These let a logged string set
+ * arbitrary environment/PATH state for later steps, a code-execution path.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha053: PostSynthCheck;
+//# sourceMappingURL=gha053.d.ts.map

package/dist/lint/post-synth/gha053.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha053.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha053.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cA0BpB,CAAC"}

package/dist/lint/post-synth/gha054.d.ts

@@ -0,0 +1,11 @@
+/**
+ * GHA054: Use of a Feature with a Known Security Footgun
+ *
+ * Catch-all, data-driven check: flags emitted workflow content matching a
+ * vendored snapshot of known-risky GitHub Actions features (deprecated workflow
+ * commands, unsafe runtime opt-ins, masking footguns). Advisory; the dataset is
+ * necessarily incomplete.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha054: PostSynthCheck;
+//# sourceMappingURL=gha054.d.ts.map

package/dist/lint/post-synth/gha054.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha054.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha054.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAI9G,eAAO,MAAM,MAAM,EAAE,cA2BpB,CAAC"}

package/dist/lint/post-synth/gha055.d.ts

@@ -0,0 +1,11 @@
+/**
+ * GHA055: Runtime Install of a Tool Already on the Runner
+ *
+ * Flags a `run:` step that installs (apt/brew/apk/choco) a tool that GitHub-
+ * hosted runners already ship. The redundant install adds a third-party
+ * download and supply-chain surface for no benefit and slows the job. Advisory;
+ * irrelevant on self-hosted runners that may lack the tool.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha055: PostSynthCheck;
+//# sourceMappingURL=gha055.d.ts.map

package/dist/lint/post-synth/gha055.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha055.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha055.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAM9G,eAAO,MAAM,MAAM,EAAE,cAkCpB,CAAC"}

package/dist/lint/post-synth/gha056.d.ts

@@ -0,0 +1,10 @@
+/**
+ * GHA056: Workflow Without a `name:`
+ *
+ * Flags an emitted workflow with no top-level `name:`. Without one, GitHub falls
+ * back to the file path in the Actions UI and audit logs, making runs harder to
+ * identify and review. A clear name improves observability and audit output.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha056: PostSynthCheck;
+//# sourceMappingURL=gha056.d.ts.map

package/dist/lint/post-synth/gha056.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha056.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha056.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cAyBpB,CAAC"}

package/dist/lint/post-synth/gha057.d.ts

@@ -0,0 +1,12 @@
+/**
+ * GHA057: Dependency Update Executing Untrusted External Code
+ *
+ * Flags a dependabot `updates:` entry with
+ * `insecure-external-code-execution: allow`. That setting lets a freshly-pulled
+ * dependency run lifecycle scripts (e.g. npm `postinstall`) during the update
+ * itself — a compromised release executes in the update job before any review.
+ * Set it to `deny`, or isolate the ecosystem.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha057: PostSynthCheck;
+//# sourceMappingURL=gha057.d.ts.map

package/dist/lint/post-synth/gha057.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha057.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha057.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cA0BpB,CAAC"}

package/dist/lint/post-synth/gha058.d.ts

@@ -0,0 +1,12 @@
+/**
+ * GHA058: Dependency Update Without a Cooldown
+ *
+ * Flags a dependabot `updates:` entry with no cooldown (or an all-zero one). A
+ * version published seconds ago — including a compromised one — is adopted
+ * immediately, with no window for the ecosystem to yank it or for anyone to
+ * react. Configure a `cooldown:` so freshly-published versions wait before they
+ * are proposed.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const gha058: PostSynthCheck;
+//# sourceMappingURL=gha058.d.ts.map

package/dist/lint/post-synth/gha058.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gha058.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/gha058.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAW9G,eAAO,MAAM,MAAM,EAAE,cA0BpB,CAAC"}

package/dist/lint/post-synth/index.d.ts

@@ -0,0 +1,3 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const postSynthChecks: PostSynthCheck[];
+//# sourceMappingURL=index.d.ts.map

package/dist/lint/post-synth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AA+CvE,eAAO,MAAM,eAAe,EAAE,cAAc,EA8C3C,CAAC"}

package/dist/lint/post-synth/yaml-helpers.d.ts

@@ -0,0 +1,143 @@
+/**
+ * Helpers for parsing serialized GitHub Actions YAML in post-synth checks.
+ */
+import type { SerializerResult } from "@intentius/chant/serializer";
+export { getPrimaryOutput } from "@intentius/chant/lint/post-synth";
+/**
+ * Return the emitted `.github/dependabot.yml` content from a serializer output,
+ * if present (it rides as an additional file alongside the workflow output).
+ */
+export declare function getDependabotYaml(output: string | SerializerResult): string | undefined;
+/** Parse the `updates:` array from a dependabot.yml document. */
+export declare function extractDependabotUpdates(dependabotYaml: string): Array<Record<string, unknown>>;
+export interface ParsedJob {
+    name: string;
+    needs?: string[];
+    steps?: Array<{
+        uses?: string;
+        run?: string;
+        name?: string;
+    }>;
+    permissions?: Record<string, string>;
+}
+/**
+ * Extract jobs from a serialized GitHub Actions workflow YAML.
+ */
+export declare function extractJobs(yaml: string): Map<string, ParsedJob>;
+/**
+ * Extract trigger events from the YAML.
+ */
+export declare function extractTriggers(yaml: string): Record<string, unknown>;
+/**
+ * Check if any step in the list uses a checkout action.
+ */
+export declare function hasCheckoutAction(steps: Array<{
+    uses?: string;
+}>): boolean;
+/**
+ * Build a needs dependency graph from the YAML.
+ */
+export declare function buildNeedsGraph(yaml: string): Map<string, string[]>;
+/**
+ * Extract the workflow name from the YAML.
+ */
+export declare function extractWorkflowName(yaml: string): string | undefined;
+/**
+ * Check if the YAML has an explicit permissions block.
+ */
+export declare function hasPermissions(yaml: string): boolean;
+/** A single `uses:` reference found in a workflow. */
+export interface ActionRef {
+    /** Owning job name. */
+    job: string;
+    /** The raw `uses:` value (e.g. `actions/setup-node@v4`). */
+    ref: string;
+    /** Whether it is a step-level action or a job-level reusable workflow. */
+    level: "step" | "job";
+}
+/** A container/service/docker image reference found in a workflow. */
+export interface ImageRef {
+    /** Owning job name. */
+    job: string;
+    /** The raw image reference (e.g. `node:20`). */
+    image: string;
+    /** Where the image was declared. */
+    source: "container" | "service" | "step";
+}
+/**
+ * Extract every `uses:` reference from the workflow — both step-level actions
+ * and job-level reusable-workflow calls. Uses the structural YAML parser so
+ * nested jobs/steps are handled reliably.
+ */
+export declare function extractActionRefs(yaml: string): ActionRef[];
+/**
+ * Extract every container/service/`docker://` image reference from the workflow.
+ */
+export declare function extractImageRefs(yaml: string): ImageRef[];
+/** A `run:` script block with its owning job. */
+export interface RunBlock {
+    job: string;
+    run: string;
+}
+/**
+ * Extract every `run:` script (inline and `|`/`>` block scalars) with its
+ * owning job.
+ */
+export declare function extractRunBlocks(yaml: string): RunBlock[];
+/** An `if:` condition with its owning job. */
+export interface IfCondition {
+    job: string;
+    expr: string;
+}
+/** Extract every `if:` condition (job-level and step-level) with its job. */
+export declare function extractIfConditions(yaml: string): IfCondition[];
+/** Extract each job's `runs-on:` value(s) as a flat list of labels. */
+export declare function extractRunsOnByJob(yaml: string): Map<string, string[]>;
+/** Pull every `${{ ... }}` expression body out of a string. */
+export declare function extractExpressions(text: string): string[];
+/** Every line inside the `jobs:` block paired with its owning job name. */
+export declare function jobLines(yaml: string): Array<{
+    job: string;
+    line: string;
+}>;
+/** All lines inside the `jobs:` block grouped by owning job. */
+export declare function linesByJob(yaml: string): Map<string, string[]>;
+/** Set of jobs that declare an `environment:`. */
+export declare function extractJobEnvironments(yaml: string): Set<string>;
+/** Set of jobs whose body references a `secrets.` context. */
+export declare function jobsReferencingSecrets(yaml: string): Set<string>;
+/** A permissions value as it appears in YAML: a string preset or a scope map. */
+export type PermissionsValue = string | Record<string, string>;
+/** The workflow-level `permissions:` value, if present. */
+export declare function extractWorkflowPermissions(yaml: string): PermissionsValue | undefined;
+/** Per-job `permissions:` values, keyed by job name. Only jobs that declare one. */
+export declare function extractJobPermissions(yaml: string): Map<string, PermissionsValue>;
+/**
+ * Classify a permissions value's write surface.
+ * `writeAll` is the `write-all` blanket preset; `scopes` lists the individual
+ * scopes granted `write` in map form.
+ */
+export declare function writeSurface(perms: PermissionsValue): {
+    writeAll: boolean;
+    scopes: string[];
+};
+/** True if the permissions value grants any write access (blanket or scoped). */
+export declare function grantsWrite(perms: PermissionsValue): boolean;
+/**
+ * Split an action `uses:` value into its `owner/repo` slug and git ref.
+ * Returns undefined for local (`./`, `../`) and `docker://` references, which
+ * are not GitHub action repository references.
+ */
+/**
+ * Strip a trailing inline YAML comment from a `uses:` value. A `uses` ref
+ * cannot contain whitespace, so `<ref> # v1.2.3` (the recommended SHA-pin
+ * style) is safe to trim back to `<ref>`.
+ */
+export declare function stripUsesComment(uses: string): string;
+export declare function parseActionUses(rawUses: string): {
+    owner: string;
+    repo: string;
+    slug: string;
+    gitRef: string;
+} | undefined;
+//# sourceMappingURL=yaml-helpers.d.ts.map

package/dist/lint/post-synth/yaml-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml-helpers.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/yaml-helpers.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEpE;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAGvF;AAED,iEAAiE;AACjE,wBAAgB,wBAAwB,CAAC,cAAc,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAS/F;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CA4DhE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAarE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,OAAO,CAE1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAOnE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGpE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,sDAAsD;AACtD,MAAM,WAAW,SAAS;IACxB,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;CACvB;AAED,sEAAsE;AACtE,MAAM,WAAW,QAAQ;IACvB,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;CAC1C;AAuBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,CAgB3D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAgCzD;AAyBD,iDAAiD;AACjD,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAyBzD;AAED,8CAA8C;AAC9C,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAO/D;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAwBtE;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAQzD;AAED,2EAA2E;AAC3E,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAI3E;AAED,gEAAgE;AAChE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAQ9D;AAED,kDAAkD;AAClD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAMhE;AAED,8DAA8D;AAC9D,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAMhE;AAED,iFAAiF;AACjF,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE/D,2DAA2D;AAC3D,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAMrF;AAED,oFAAoF;AACpF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAQjF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,gBAAgB,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAS7F;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAG5D;AAED;;;;GAIG;AACH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAS1H"}

package/dist/lint/rules/data/deprecated-versions.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Deprecated action versions and recommended replacements.
+ */
+export declare const deprecatedVersions: Record<string, {
+    deprecated: string[];
+    recommended: string;
+}>;
+//# sourceMappingURL=deprecated-versions.d.ts.map

package/dist/lint/rules/data/deprecated-versions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deprecated-versions.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/data/deprecated-versions.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAQ5F,CAAC"}