@intentius/chant-lexicon-github 0.7.0 → 0.8.0

package/dist/lint/rules/data/flagged-actions.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Vendored snapshot of action `owner/repo` slugs that are archived/abandoned or
+ * carry a disclosed security issue. Used by GHA032.
+ *
+ * Advisory only, and necessarily incomplete. Refresh source: GitHub Security
+ * Advisories (GHSA), CVE feeds, and upstream "archived" repo status. Accept
+ * staleness — regenerate periodically by editing this map. A missing entry only
+ * means a known-bad upstream goes unflagged; it never blocks a build.
+ *
+ * Keep entries factual and dated so the advice stays actionable.
+ */
+export interface FlaggedAction {
+    /** Why the upstream is flagged. */
+    reason: string;
+    /** What to do instead. */
+    remediation: string;
+}
+export declare const FLAGGED_ACTIONS: Readonly<Record<string, FlaggedAction>>;
+//# sourceMappingURL=flagged-actions.d.ts.map

package/dist/lint/rules/data/flagged-actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flagged-actions.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/data/flagged-actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC5B,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,0BAA0B;IAC1B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAiBnE,CAAC"}

package/dist/lint/rules/data/known-action-slugs.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Vendored snapshot of widely-used GitHub Action `owner/repo` slugs.
+ *
+ * Used by the look-alike check (GHA031) as the reference set: a `uses:` slug
+ * that is a near-miss (edit distance 1–2) of one of these — but not an exact
+ * match — is likely a typo or an impersonation of the popular action.
+ *
+ * Advisory only. Refresh source: the GitHub Marketplace "most-used" actions and
+ * the actions/* org. Accept staleness — regenerate periodically by editing this
+ * list; a stale entry only weakens look-alike detection, it never blocks a build.
+ */
+export declare const KNOWN_ACTION_SLUGS: readonly string[];
+//# sourceMappingURL=known-action-slugs.d.ts.map

package/dist/lint/rules/data/known-action-slugs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"known-action-slugs.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/data/known-action-slugs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EA0B/C,CAAC"}

package/dist/lint/rules/data/known-actions.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Registry of well-known GitHub Actions and their typed composite wrappers.
+ */
+export declare const knownActions: Record<string, {
+    composite: string;
+    importPath: string;
+}>;
+//# sourceMappingURL=known-actions.d.ts.map

package/dist/lint/rules/data/known-actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"known-actions.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/data/known-actions.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAQlF,CAAC"}

package/dist/lint/rules/data/preinstalled-tools.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Vendored snapshot of tools already present on GitHub-hosted runner images,
+ * used by GHA056 to flag redundant runtime installs that add third-party
+ * surface for no benefit.
+ *
+ * Advisory. Refresh source: the runner-images repository's installed-software
+ * manifests. Conservative on purpose — only tools that are reliably present
+ * across the common ubuntu/macos/windows images are listed.
+ */
+export declare const PREINSTALLED_TOOLS: readonly string[];
+//# sourceMappingURL=preinstalled-tools.d.ts.map

package/dist/lint/rules/data/preinstalled-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preinstalled-tools.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/data/preinstalled-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EA0B/C,CAAC"}

package/dist/lint/rules/data/recommended-inputs.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Recommended inputs for setup action composites.
+ * If a setup action is used without any of the listed inputs, a warning is raised.
+ */
+export declare const recommendedInputs: Record<string, string[]>;
+//# sourceMappingURL=recommended-inputs.d.ts.map

package/dist/lint/rules/data/recommended-inputs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recommended-inputs.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/data/recommended-inputs.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAItD,CAAC"}

package/dist/lint/rules/data/risky-features.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Vendored snapshot of GitHub Actions features with a known security or
+ * safety footgun, matched against emitted workflow YAML by GHA054.
+ *
+ * Advisory and necessarily incomplete. Refresh source: GitHub changelog
+ * deprecations and security hardening guidance. Editing this list is the
+ * refresh mechanism; a stale entry only weakens detection, never blocks a build.
+ */
+export interface RiskyFeature {
+    /** Pattern matched against the emitted YAML. */
+    pattern: RegExp;
+    /** Short label for the footgun. */
+    label: string;
+    /** What to do instead. */
+    advice: string;
+}
+export declare const RISKY_FEATURES: readonly RiskyFeature[];
+//# sourceMappingURL=risky-features.d.ts.map

package/dist/lint/rules/data/risky-features.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risky-features.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/data/risky-features.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,cAAc,EAAE,SAAS,YAAY,EAqBjD,CAAC"}

package/dist/lint/rules/data/secret-patterns.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Regex patterns for detecting hardcoded secrets in source code.
+ */
+export declare const secretPatterns: Array<{
+    pattern: RegExp;
+    description: string;
+}>;
+//# sourceMappingURL=secret-patterns.d.ts.map

package/dist/lint/rules/data/secret-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-patterns.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/data/secret-patterns.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,eAAO,MAAM,cAAc,EAAE,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CA0B1E,CAAC"}

package/dist/lint/rules/data/trusted-action-owners.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Allowlist of trusted action owners (GitHub orgs) whose `uses:` references are
+ * exempt from the SHA-pinning check (GHA029).
+ *
+ * Ships EMPTY by default: chant recommends pinning every external reference to a
+ * full commit SHA, including first-party ones. Populate this set to silence the
+ * pinning check for orgs you have decided to trust by tag (e.g. your own org).
+ *
+ * This is a vendored, code-level allowlist — `PostSynthContext` carries no
+ * per-check runtime config channel today. Refresh it by editing this file.
+ */
+export declare const TRUSTED_ACTION_OWNERS: ReadonlySet<string>;
+//# sourceMappingURL=trusted-action-owners.d.ts.map

package/dist/lint/rules/data/trusted-action-owners.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-action-owners.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/data/trusted-action-owners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CAAuB,CAAC"}

package/dist/lint/rules/data/untrusted-contexts.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Vendored snapshot of GitHub Actions expression contexts that are
+ * attacker-controllable — their values come from event payloads a fork or an
+ * outside contributor can set. Interpolating them into a shell (`run:`), into
+ * `GITHUB_ENV`/`GITHUB_PATH`, or into another execution sink turns data into
+ * code (script injection).
+ *
+ * Source: GitHub's "Security hardening for GitHub Actions — understanding the
+ * risk of script injections" plus the commonly-cited untrusted-context list.
+ * Advisory and necessarily incomplete; refresh by editing this list.
+ */
+export declare const UNTRUSTED_CONTEXTS: readonly string[];
+/**
+ * Return the first untrusted context referenced inside an expression body, or
+ * undefined. Matches by substring so array element accesses
+ * (`github.event.commits[0].message`) are caught via their prefix.
+ */
+export declare function matchUntrustedContext(exprBody: string): string | undefined;
+//# sourceMappingURL=untrusted-contexts.d.ts.map

package/dist/lint/rules/data/untrusted-contexts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"untrusted-contexts.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/data/untrusted-contexts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAmB/C,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAM1E"}

package/dist/lint/rules/deprecated-action-version.d.ts

@@ -0,0 +1,8 @@
+/**
+ * GHA012: Deprecated Action Version
+ *
+ * Flags `uses:` strings referencing deprecated action versions.
+ */
+import type { LintRule } from "@intentius/chant/lint/rule";
+export declare const deprecatedActionVersionRule: LintRule;
+//# sourceMappingURL=deprecated-action-version.d.ts.map

package/dist/lint/rules/deprecated-action-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deprecated-action-version.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/deprecated-action-version.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAIxF,eAAO,MAAM,2BAA2B,EAAE,QAsCzC,CAAC"}

package/dist/lint/rules/detect-secrets.d.ts

@@ -0,0 +1,9 @@
+/**
+ * GHA020: Detect Secrets
+ *
+ * Scans string literals for patterns matching known secret formats.
+ * Skips strings containing "secrets." (proper usage).
+ */
+import type { LintRule } from "@intentius/chant/lint/rule";
+export declare const detectSecretsRule: LintRule;
+//# sourceMappingURL=detect-secrets.d.ts.map

package/dist/lint/rules/detect-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-secrets.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/detect-secrets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAIxF,eAAO,MAAM,iBAAiB,EAAE,QAyC/B,CAAC"}

package/dist/lint/rules/extract-inline-structs.d.ts

@@ -0,0 +1,8 @@
+/**
+ * GHA005: Extract Inline Structs
+ *
+ * Flags object literal nesting depth > 2 inside resource constructors.
+ */
+import type { LintRule } from "@intentius/chant/lint/rule";
+export declare const extractInlineStructsRule: LintRule;
+//# sourceMappingURL=extract-inline-structs.d.ts.map

package/dist/lint/rules/extract-inline-structs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-inline-structs.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/extract-inline-structs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAMxF,eAAO,MAAM,wBAAwB,EAAE,QAiDtC,CAAC"}

package/dist/lint/rules/file-job-limit.d.ts

@@ -0,0 +1,8 @@
+/**
+ * GHA007: File Job Limit
+ *
+ * Flags files with more than 10 Job/ReusableWorkflowCallJob constructors.
+ */
+import type { LintRule } from "@intentius/chant/lint/rule";
+export declare const fileJobLimitRule: LintRule;
+//# sourceMappingURL=file-job-limit.d.ts.map

package/dist/lint/rules/file-job-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-job-limit.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/file-job-limit.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAMxF,eAAO,MAAM,gBAAgB,EAAE,QAoC9B,CAAC"}

package/dist/lint/rules/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * GitHub Actions lint rules
+ */
+export { useTypedActionsRule } from "./use-typed-actions.js";
+export { useConditionBuildersRule } from "./use-condition-builders.js";
+export { noHardcodedSecretsRule } from "./no-hardcoded-secrets.js";
+export { useMatrixBuilderRule } from "./use-matrix-builder.js";
+export { extractInlineStructsRule } from "./extract-inline-structs.js";
+export { fileJobLimitRule } from "./file-job-limit.js";
+export { noRawExpressionsRule } from "./no-raw-expressions.js";
+export { missingRecommendedInputsRule } from "./missing-recommended-inputs.js";
+export { deprecatedActionVersionRule } from "./deprecated-action-version.js";
+export { jobTimeoutRule } from "./job-timeout.js";
+export { suggestCacheRule } from "./suggest-cache.js";
+export { validateConcurrencyRule } from "./validate-concurrency.js";
+export { detectSecretsRule } from "./detect-secrets.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/lint/rules/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/lint/rules/job-timeout.d.ts

@@ -0,0 +1,8 @@
+/**
+ * GHA014: Job Timeout
+ *
+ * Flags `new Job({...})` without `timeoutMinutes` property.
+ */
+import type { LintRule } from "@intentius/chant/lint/rule";
+export declare const jobTimeoutRule: LintRule;
+//# sourceMappingURL=job-timeout.d.ts.map

package/dist/lint/rules/job-timeout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-timeout.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/job-timeout.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAGxF,eAAO,MAAM,cAAc,EAAE,QAiD5B,CAAC"}

package/dist/lint/rules/missing-recommended-inputs.d.ts

@@ -0,0 +1,8 @@
+/**
+ * GHA010: Missing Recommended Inputs
+ *
+ * Flags setup action composites without version-related inputs.
+ */
+import type { LintRule } from "@intentius/chant/lint/rule";
+export declare const missingRecommendedInputsRule: LintRule;
+//# sourceMappingURL=missing-recommended-inputs.d.ts.map

package/dist/lint/rules/missing-recommended-inputs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"missing-recommended-inputs.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/missing-recommended-inputs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAMxF,eAAO,MAAM,4BAA4B,EAAE,QAgD1C,CAAC"}

package/dist/lint/rules/no-hardcoded-secrets.d.ts

@@ -0,0 +1,8 @@
+/**
+ * GHA003: No Hardcoded Secrets
+ *
+ * Flags string literals matching GitHub token prefixes.
+ */
+import type { LintRule } from "@intentius/chant/lint/rule";
+export declare const noHardcodedSecretsRule: LintRule;
+//# sourceMappingURL=no-hardcoded-secrets.d.ts.map

package/dist/lint/rules/no-hardcoded-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-hardcoded-secrets.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/no-hardcoded-secrets.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAKxF,eAAO,MAAM,sBAAsB,EAAE,QAkCpC,CAAC"}

package/dist/lint/rules/no-raw-expressions.d.ts

@@ -0,0 +1,8 @@
+/**
+ * GHA008: No Raw Expressions
+ *
+ * Flags `${{` strings outside valid context paths.
+ */
+import type { LintRule } from "@intentius/chant/lint/rule";
+export declare const noRawExpressionsRule: LintRule;
+//# sourceMappingURL=no-raw-expressions.d.ts.map

package/dist/lint/rules/no-raw-expressions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-raw-expressions.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/no-raw-expressions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAKxF,eAAO,MAAM,oBAAoB,EAAE,QAuClC,CAAC"}

package/dist/lint/rules/suggest-cache.d.ts

@@ -0,0 +1,8 @@
+/**
+ * GHA015: Suggest Cache
+ *
+ * Flags setup action composites in steps without a corresponding Cache composite.
+ */
+import type { LintRule } from "@intentius/chant/lint/rule";
+export declare const suggestCacheRule: LintRule;
+//# sourceMappingURL=suggest-cache.d.ts.map

package/dist/lint/rules/suggest-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suggest-cache.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/suggest-cache.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAKxF,eAAO,MAAM,gBAAgB,EAAE,QA2D9B,CAAC"}

package/dist/lint/rules/use-condition-builders.d.ts

@@ -0,0 +1,9 @@
+/**
+ * GHA002: Use Condition Builders
+ *
+ * Flags string literals containing `${{` in `if` property assignments
+ * inside Job/Step constructors. Suggests using Expression helpers.
+ */
+import type { LintRule } from "@intentius/chant/lint/rule";
+export declare const useConditionBuildersRule: LintRule;
+//# sourceMappingURL=use-condition-builders.d.ts.map

package/dist/lint/rules/use-condition-builders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-condition-builders.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/use-condition-builders.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAGxF,eAAO,MAAM,wBAAwB,EAAE,QAkCtC,CAAC"}

package/dist/lint/rules/use-matrix-builder.d.ts

@@ -0,0 +1,9 @@
+/**
+ * GHA004: Use Matrix Builder
+ *
+ * Flags inline object literals in `matrix` property. Suggests extracting
+ * to a named const for reusability and clarity.
+ */
+import type { LintRule } from "@intentius/chant/lint/rule";
+export declare const useMatrixBuilderRule: LintRule;
+//# sourceMappingURL=use-matrix-builder.d.ts.map

package/dist/lint/rules/use-matrix-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-matrix-builder.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/use-matrix-builder.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAGxF,eAAO,MAAM,oBAAoB,EAAE,QAiClC,CAAC"}

package/dist/lint/rules/use-typed-actions.d.ts

@@ -0,0 +1,8 @@
+/**
+ * GHA001: Use Typed Action Composites
+ *
+ * Flags raw `uses:` string literals when a matching typed composite exists.
+ */
+import type { LintRule } from "@intentius/chant/lint/rule";
+export declare const useTypedActionsRule: LintRule;
+//# sourceMappingURL=use-typed-actions.d.ts.map

package/dist/lint/rules/use-typed-actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-typed-actions.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/use-typed-actions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAIxF,eAAO,MAAM,mBAAmB,EAAE,QAoCjC,CAAC"}

package/dist/lint/rules/validate-concurrency.d.ts

@@ -0,0 +1,8 @@
+/**
+ * GHA016: Validate Concurrency
+ *
+ * Flags `new Concurrency({cancelInProgress: true})` without `group`.
+ */
+import type { LintRule } from "@intentius/chant/lint/rule";
+export declare const validateConcurrencyRule: LintRule;
+//# sourceMappingURL=validate-concurrency.d.ts.map

package/dist/lint/rules/validate-concurrency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-concurrency.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/validate-concurrency.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAGxF,eAAO,MAAM,uBAAuB,EAAE,QAwDrC,CAAC"}

package/dist/lsp/completions.d.ts

@@ -0,0 +1,6 @@
+import type { CompletionContext, CompletionItem } from "@intentius/chant/lsp/types";
+/**
+ * Provide GitHub Actions completions based on context.
+ */
+export declare function githubCompletions(ctx: CompletionContext): CompletionItem[];
+//# sourceMappingURL=completions.d.ts.map

package/dist/lsp/completions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"completions.d.ts","sourceRoot":"","sources":["../../src/lsp/completions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAapF;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAE1E"}

package/dist/lsp/hover.d.ts

@@ -0,0 +1,6 @@
+import type { HoverContext, HoverInfo } from "@intentius/chant/lsp/types";
+/**
+ * Provide hover information for GitHub Actions entity types.
+ */
+export declare function githubHover(ctx: HoverContext): HoverInfo | undefined;
+//# sourceMappingURL=hover.d.ts.map

package/dist/lsp/hover.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAa1E;;GAEG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAEpE"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "github",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "chantVersion": ">=0.1.0",
   "namespace": "GitHub",
   "intrinsics": [

package/dist/mcp/context-tools.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Read-only MCP tools that expose what `chant build` already computes about a
+ * GitHub Actions workflow — its jobs and run order, what it pulls in from
+ * outside (actions, images), and its security findings — so an agent can ask
+ * about a change *before it runs or merges* (#327).
+ *
+ * The GitHub counterpart to the GitLab context tools. Every tool builds from
+ * source and returns data. None of them touch the live GitHub instance, read
+ * run history, or write anything — that boundary is what keeps chant a context
+ * producer and not a copy of the live tooling.
+ */
+import type { McpToolContribution } from "@intentius/chant/mcp/types";
+/** Is a `uses:` ref pinned to a full commit SHA (the only immutable form)? */
+export declare function actionPinned(ref: string): boolean;
+/** Jobs that would re-run because they depend (transitively) on `job`. */
+export declare function downstreamJobs(yaml: string, job: string): string[];
+/** The read-only context tools for the GitHub lexicon. */
+export declare function githubContextTools(): McpToolContribution[];
+//# sourceMappingURL=context-tools.d.ts.map

package/dist/mcp/context-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-tools.d.ts","sourceRoot":"","sources":["../../src/mcp/context-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAsBtE,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGjD;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAuBlE;AASD,0DAA0D;AAC1D,wBAAgB,kBAAkB,IAAI,mBAAmB,EAAE,CA2F1D"}

package/dist/package-cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env tsx
+export {};
+//# sourceMappingURL=package-cli.d.ts.map

package/dist/package-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-cli.d.ts","sourceRoot":"","sources":["../src/package-cli.ts"],"names":[],"mappings":""}

package/dist/plugin.d.ts

@@ -0,0 +1,9 @@
+/**
+ * GitHub Actions lexicon plugin.
+ *
+ * Provides serializer, template detection, and code generation
+ * for GitHub Actions workflows.
+ */
+import type { LexiconPlugin } from "@intentius/chant/lexicon";
+export declare const githubPlugin: LexiconPlugin;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AA0B7F,eAAO,MAAM,YAAY,EAAE,aA4S1B,CAAC"}

package/dist/serializer.d.ts

@@ -0,0 +1,13 @@
+/**
+ * GitHub Actions YAML serializer.
+ *
+ * Converts Chant declarables to .github/workflows/*.yml YAML output.
+ * Uses kebab-case keys for job properties and snake_case for trigger
+ * event names.
+ */
+import type { Serializer } from "@intentius/chant/serializer";
+/**
+ * GitHub Actions YAML serializer implementation.
+ */
+export declare const githubSerializer: Serializer;
+//# sourceMappingURL=serializer.d.ts.map

package/dist/serializer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,6BAA6B,CAAC;AA6MhF;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,UAwD9B,CAAC"}

package/dist/spec/fetch.d.ts

@@ -0,0 +1,26 @@
+/**
+ * GitHub Actions workflow schema fetching — downloads the JSON Schema
+ * and caches it locally.
+ */
+/**
+ * Get the cache file path for the workflow schema.
+ */
+export declare function getCachePath(): string;
+/**
+ * Fetch the GitHub Actions Workflow JSON Schema.
+ * Uses local file caching with 24-hour TTL.
+ */
+export declare function fetchWorkflowSchema(force?: boolean): Promise<Buffer>;
+/**
+ * Fetch the workflow schema as a Map<typeName, Buffer>
+ * compatible with the generatePipeline fetchSchemas callback.
+ *
+ * Single document keyed by "GitHub::Actions::Workflow" — the parse
+ * step will split it into multiple entities.
+ */
+export declare function fetchSchemas(force?: boolean): Promise<Map<string, Buffer>>;
+/**
+ * Clear the cached schema file.
+ */
+export declare function clearCache(): void;
+//# sourceMappingURL=fetch.d.ts.map

package/dist/spec/fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/spec/fetch.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH;;GAEG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ1E;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAKhF;AAED;;GAEG;AACH,wBAAgB,UAAU,IAAI,IAAI,CAEjC"}

package/dist/validate-cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env tsx
+export {};
+//# sourceMappingURL=validate-cli.d.ts.map

package/dist/validate-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-cli.d.ts","sourceRoot":"","sources":["../src/validate-cli.ts"],"names":[],"mappings":""}

package/dist/validate.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Validate generated lexicon-github artifacts.
+ */
+import { type ValidateResult } from "@intentius/chant/codegen/validate";
+export type { ValidateCheck, ValidateResult } from "@intentius/chant/codegen/validate";
+/**
+ * Validate the generated lexicon-github artifacts.
+ */
+export declare function validate(opts?: {
+    basePath?: string;
+}): Promise<ValidateResult>;
+//# sourceMappingURL=validate.d.ts.map

package/dist/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAElG,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAYvF;;GAEG;AACH,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAoBpF"}

package/dist/variables.d.ts

@@ -0,0 +1,42 @@
+/**
+ * GitHub Actions predefined context variable references.
+ *
+ * These provide type-safe access to GitHub and Runner context values
+ * that expand to `${{ context.property }}` expressions in YAML.
+ */
+import { Expression } from "./expression.js";
+export declare const GitHub: {
+    readonly Ref: Expression;
+    readonly RefName: Expression;
+    readonly RefType: Expression;
+    readonly Sha: Expression;
+    readonly Actor: Expression;
+    readonly TriggeringActor: Expression;
+    readonly Repository: Expression;
+    readonly RepositoryOwner: Expression;
+    readonly EventName: Expression;
+    readonly Event: Expression;
+    readonly RunId: Expression;
+    readonly RunNumber: Expression;
+    readonly RunAttempt: Expression;
+    readonly Workflow: Expression;
+    readonly WorkflowRef: Expression;
+    readonly Workspace: Expression;
+    readonly Token: Expression;
+    readonly Job: Expression;
+    readonly HeadRef: Expression;
+    readonly BaseRef: Expression;
+    readonly ServerUrl: Expression;
+    readonly ApiUrl: Expression;
+    readonly GraphqlUrl: Expression;
+    readonly Action: Expression;
+    readonly ActionPath: Expression;
+};
+export declare const Runner: {
+    readonly Os: Expression;
+    readonly Arch: Expression;
+    readonly Name: Expression;
+    readonly Temp: Expression;
+    readonly ToolCache: Expression;
+};
+//# sourceMappingURL=variables.d.ts.map

package/dist/variables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"variables.d.ts","sourceRoot":"","sources":["../src/variables.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BT,CAAC;AAEX,eAAO,MAAM,MAAM;;;;;;CAMT,CAAC"}