@intentius/chant-lexicon-gitlab 0.1.22 → 0.2.0

package/src/codegen/docs.ts

@@ -435,6 +435,136 @@ Flags jobs whose \`extends:\` references a template or hidden job not defined in
 
 Detects cycles in the \`needs:\` dependency graph. If job A needs B and B needs A (directly or transitively), GitLab rejects the pipeline. Reports the full cycle chain in the diagnostic message.
 
+### WGL029 — Unpinned include:project / component
+
+**Severity:** warning
+
+Flags an \`include:project\` or CI/CD \`component:\` resolved by a moving ref — a branch, a missing \`ref:\` (defaults to the default branch), or a floating component version — instead of a pinned tag or commit SHA.
+
+### WGL030 — Mutable or insecure include:remote
+
+**Severity:** error (HTTP) / warning (HTTPS)
+
+Flags \`include:remote\` URLs fetched over HTTP (no transport integrity) or over HTTPS but inherently mutable. Prefer a pinned \`include:project\` or component. Generalizes WGL017 to includes.
+
+### WGL031 — Container image without a digest
+
+**Severity:** warning
+
+Flags \`image:\` and \`services:\` references not pinned to an immutable \`@sha256:\` digest. Variable-based references (e.g. \`$CI_REGISTRY_IMAGE:tag\`) are skipped.
+
+### WGL032 — Look-alike include/component source
+
+**Severity:** warning
+
+Flags an \`include:project\` / \`component:\` source that is a near-miss (edit distance 1–2) of a well-known GitLab CI source but not an exact match — a likely typo or impersonation. Backed by a vendored reference list.
+
+### WGL033 — OIDC id_token without a scoped audience
+
+**Severity:** warning
+
+Flags an \`id_tokens:\` declaration with no \`aud:\` or a wildcard audience. The audience binds the minted OIDC token to a relying party; without it a leaked token is accepted anywhere.
+
+### WGL034 — OIDC id_token mintable from a merge-request pipeline
+
+**Severity:** warning
+
+Flags a job that declares \`id_tokens:\` and is reachable from merge-request pipelines, which outside contributors can trigger. Restrict OIDC jobs to protected refs or require approval.
+
+> The project-level \`CI_JOB_TOKEN\` allowlist and a variable's protected status are project settings, not emitted pipeline YAML, so they are out of scope for these post-synth checks (see issue #298's caveat).
+
+### WGL035 — Untrusted CI variable in a script
+
+**Severity:** warning
+
+Flags an attacker-controllable predefined variable (branch/tag name, commit or MR title/description, author) referenced in a \`script:\` command, where a crafted value can inject shell commands. Quote it and avoid using it in sensitive commands.
+
+### WGL036 — Privileged DinD reachable from merge requests
+
+**Severity:** warning
+
+Flags a Docker-in-Docker (privileged) job reachable from merge-request pipelines, which outside contributors can trigger. Restrict privileged services to protected refs. Complements WGL026.
+
+### WGL037 — Regex gate on an untrusted ref
+
+**Severity:** warning
+
+Flags a \`rules:if\` that gates on a regex match (\`=~\`) over an attacker-controllable ref variable — a crafted branch/tag name can satisfy the pattern. Match the full ref with \`==\` or gate on a protected condition.
+
+### WGL038 — Secret reachable from a merge-request pipeline
+
+**Severity:** warning
+
+Flags a user-defined secret-like variable read by a job reachable from merge-request pipelines, which can run untrusted code. Gate the job to protected refs or mark the variable protected. (Built-in \`CI_*\` variables are excluded.)
+
+### WGL039 — Secret echoed to job logs
+
+**Severity:** warning
+
+Flags a \`script:\` command that prints a secret-like variable (\`echo\`/\`printf\`/\`cat\`). Logs are broadly readable and masking can be defeated by transforms.
+
+### WGL040 — Hardcoded registry credential
+
+**Severity:** error
+
+Flags a \`docker login\` (or compatible) passing a literal password via \`-p\`/\`--password\` instead of a variable or \`--password-stdin\`. Extends WGL016 to scripts.
+
+> Variable *masking* and *protected* status are GitLab project/CI-settings, not emitted YAML — WGL016 already nudges toward masked variables; this group covers the exposure paths visible in the pipeline.
+
+### WGL041 — Unsound rules:if condition
+
+**Severity:** warning
+
+Flags a tautological \`rules:if\` where both sides of \`==\`/\`!=\` are identical, so the condition is always true or always false. Generalizes WGL011 to conditions presented as gates.
+
+### WGL042 — Unreachable rules after an unconditional match
+
+**Severity:** warning
+
+Flags rules listed after an unconditional rule (no \`if:\`, not \`when: never\`). GitLab takes the first matching rule, so a catch-all makes everything after it dead. Put specific rules first.
+
+### WGL043 — Match-anything regex gate
+
+**Severity:** warning
+
+Flags a \`rules:if\` whose \`=~\` regex matches every value (empty, dot-star, anchored dot-star) — a filter that admits everything. Tighten the pattern or remove the gate.
+
+> The auto-fix acceptance item is N/A at the post-synth layer (PostSynthDiagnostic has no fix channel); it belongs to the declarative source-lint rules.
+
+### WGL044 — Public artifacts
+
+**Severity:** warning
+
+Flags \`artifacts:public: true\`, which makes build output downloadable by anyone. Keep artifacts private unless they are meant to be world-readable.
+
+### WGL045 — Credential-bearing artifact path
+
+**Severity:** error
+
+Flags an \`artifacts:paths:\` entry that looks like a credential or sensitive file (\`.env\`, \`*.pem\`, \`id_rsa\`, \`*.key\`, \`.npmrc\`, \`.netrc\`, \`credentials\`). Artifacts flow downstream and are downloadable — exclude the file.
+
+### WGL046 — Cache poisoning from a merge-request pipeline
+
+**Severity:** warning
+
+Flags a job that writes a cache (push policy) and is reachable from merge-request pipelines. An MR can poison the cache for a later protected run that restores the same key. Restrict cache writes to protected refs or scope the key.
+
+> Artifact / \`dependencies:\` flow across a *protected* boundary depends on a ref's protected status, a project setting not present in emitted YAML — out of scope here.
+
+### WGL047 — Software fetched and piped to a shell
+
+**Severity:** warning
+
+Flags a \`script:\` command that pipes a network download straight into a shell (\`curl ... | bash\`). The fetched code is unpinned and unverified — download to a file, verify a checksum/signature, then run it.
+
+### WGL048 — Pipeline without a name
+
+**Severity:** info
+
+Flags a pipeline that defines a \`workflow:\` block but no \`workflow:name\`. A pipeline name aids identification in the GitLab UI and audit output.
+
+> Two #304 items stay out of scope: a broad privileged-service / DinD check (already covered by WGL026 for DinD-TLS and WGL036 for MR-reachable DinD; a runner's privileged isolation is not in emitted YAML) and an optional include/component allowlist policy (configuration, overlapping WGL032's vendored source list).
+
 ## Running lint
 
 \`\`\`bash

package/src/lint/post-synth/wgl029.test.ts

@@ -0,0 +1,77 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl029 } from "./wgl029";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["gitlab", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WGL029: unpinned include:project / component", () => {
+  test("flags include:project on a branch ref", () => {
+    const yaml = `include:
+  - project: my-group/ci-templates
+    ref: main
+    file: /templates/build.yml
+
+stages:
+  - build
+`;
+    const diags = wgl029.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL029");
+    expect(diags[0].message).toContain("main");
+  });
+
+  test("flags include:project with no ref", () => {
+    const yaml = `include:
+  - project: my-group/ci-templates
+    file: /templates/build.yml
+
+stages:
+  - build
+`;
+    const diags = wgl029.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("default branch");
+  });
+
+  test("does not flag a pinned tag ref", () => {
+    const yaml = `include:
+  - project: my-group/ci-templates
+    ref: v1.2.3
+    file: /templates/build.yml
+
+stages:
+  - build
+`;
+    const diags = wgl029.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+
+  test("flags a floating component version and not a pinned one", () => {
+    const floating = `include:
+  - component: gitlab.example.com/my-group/my-comp@main
+
+stages:
+  - build
+`;
+    const pinned = `include:
+  - component: gitlab.example.com/my-group/my-comp@1.0.0
+
+stages:
+  - build
+`;
+    expect(wgl029.check(makeCtx(floating))).toHaveLength(1);
+    expect(wgl029.check(makeCtx(pinned))).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl029.ts

@@ -0,0 +1,59 @@
+/**
+ * WGL029: Unpinned include:project / component Reference
+ *
+ * Flags an `include:project` or CI/CD `component:` resolved by a moving ref — a
+ * branch, no `ref:` at all (defaults to the project's default branch), or a
+ * floating component version — instead of a pinned tag or commit SHA. A
+ * repointed ref turns the included configuration into a supply-chain entry point.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractIncludes, isPinnedRef } from "./yaml-helpers";
+
+export const wgl029: PostSynthCheck = {
+  id: "WGL029",
+  description: "include:project / component resolved by a moving ref instead of a pinned tag or SHA",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const entry of extractIncludes(yaml)) {
+        if (entry.kind === "project") {
+          if (!entry.ref) {
+            diagnostics.push({
+              checkId: "WGL029",
+              severity: "warning",
+              message: `include:project "${entry.value}" has no ref: and resolves to the project's default branch (a moving target). Pin it to a tag or commit SHA.`,
+              entity: entry.value,
+              lexicon: "gitlab",
+            });
+          } else if (!isPinnedRef(entry.ref)) {
+            diagnostics.push({
+              checkId: "WGL029",
+              severity: "warning",
+              message: `include:project "${entry.value}" is pinned to the moving ref "${entry.ref}". Pin it to a tag or commit SHA.`,
+              entity: entry.value,
+              lexicon: "gitlab",
+            });
+          }
+        } else if (entry.kind === "component") {
+          const at = entry.value.lastIndexOf("@");
+          const version = at === -1 ? "" : entry.value.slice(at + 1);
+          if (!version || !isPinnedRef(version)) {
+            diagnostics.push({
+              checkId: "WGL029",
+              severity: "warning",
+              message: `component "${entry.value}" uses ${version ? `the moving version "${version}"` : "no pinned version"}. Pin it to a released version tag or commit SHA.`,
+              entity: entry.value,
+              lexicon: "gitlab",
+            });
+          }
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgl030.test.ts

@@ -0,0 +1,57 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl030 } from "./wgl030";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["gitlab", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WGL030: mutable or insecure include:remote", () => {
+  test("errors on an HTTP remote include", () => {
+    const yaml = `include:
+  - remote: http://example.com/ci.yml
+
+stages:
+  - build
+`;
+    const diags = wgl030.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL030");
+    expect(diags[0].severity).toBe("error");
+  });
+
+  test("warns on an HTTPS remote include", () => {
+    const yaml = `include:
+  - remote: https://example.com/ci.yml
+
+stages:
+  - build
+`;
+    const diags = wgl030.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].severity).toBe("warning");
+  });
+
+  test("does not flag a project include", () => {
+    const yaml = `include:
+  - project: my-group/ci-templates
+    ref: v1.0.0
+    file: /x.yml
+
+stages:
+  - build
+`;
+    const diags = wgl030.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl030.ts

@@ -0,0 +1,48 @@
+/**
+ * WGL030: Mutable or Insecure include:remote
+ *
+ * Flags `include:remote` URLs that are fetched over HTTP (no transport
+ * integrity) or over HTTPS but inherently mutable (a raw URL can be repointed
+ * at any time). Prefer `include:project` pinned to a tag/SHA, or a pinned
+ * component, over a remote URL. Generalizes WGL017 (non-HTTPS) to includes.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractIncludes } from "./yaml-helpers";
+
+export const wgl030: PostSynthCheck = {
+  id: "WGL030",
+  description: "include:remote is insecure (HTTP) or mutable",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const entry of extractIncludes(yaml)) {
+        const isRemote = entry.kind === "remote" || (entry.kind === "string" && /^https?:\/\//.test(entry.value));
+        if (!isRemote) continue;
+
+        if (/^http:\/\//.test(entry.value)) {
+          diagnostics.push({
+            checkId: "WGL030",
+            severity: "error",
+            message: `include:remote "${entry.value}" is fetched over HTTP — an attacker on the network can swap the included config. Use HTTPS, and prefer a pinned include:project or component.`,
+            entity: entry.value,
+            lexicon: "gitlab",
+          });
+        } else {
+          diagnostics.push({
+            checkId: "WGL030",
+            severity: "warning",
+            message: `include:remote "${entry.value}" is a mutable URL — its contents can change after review. Prefer include:project pinned to a tag/SHA, or a pinned component.`,
+            entity: entry.value,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgl031.test.ts

@@ -0,0 +1,66 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl031 } from "./wgl031";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["gitlab", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WGL031: container image without digest", () => {
+  test("flags an image pinned to a tag", () => {
+    const yaml = `build-job:
+  image:
+    name: node:20
+  script:
+    - echo build
+`;
+    const diags = wgl031.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL031");
+    expect(diags[0].message).toContain("node:20");
+  });
+
+  test("flags a service image pinned to a tag", () => {
+    const yaml = `build-job:
+  services:
+    - name: postgres:16
+  script:
+    - echo build
+`;
+    const diags = wgl031.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("postgres:16");
+  });
+
+  test("does not flag an image pinned to a digest", () => {
+    const yaml = `build-job:
+  image:
+    name: node@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
+  script:
+    - echo build
+`;
+    const diags = wgl031.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+
+  test("does not flag a variable-based image reference", () => {
+    const yaml = `build-job:
+  image:
+    name: $CI_REGISTRY_IMAGE:latest
+  script:
+    - echo build
+`;
+    const diags = wgl031.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl031.ts

@@ -0,0 +1,37 @@
+/**
+ * WGL031: Container Image Without an Immutable Digest
+ *
+ * Flags `image:` and `services:` references that are not pinned to an immutable
+ * `@sha256:` digest. A mutable tag can be repointed to a different image after
+ * review. Images built from a variable (e.g. `$CI_REGISTRY_IMAGE:tag`) are
+ * skipped — their concrete reference is not knowable from the static config.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractImageRefs } from "./yaml-helpers";
+
+export const wgl031: PostSynthCheck = {
+  id: "WGL031",
+  description: "Container image not pinned to an immutable digest",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const { job, image, source } of extractImageRefs(yaml)) {
+        if (image.includes("@sha256:")) continue;
+        if (image.includes("$")) continue; // variable-based reference — not statically knowable
+        diagnostics.push({
+          checkId: "WGL031",
+          severity: "warning",
+          message: `Job "${job}" ${source === "service" ? "service image" : "image"} "${image}" is not pinned to a digest — reference it by @sha256:... so the image cannot change after review.`,
+          entity: job,
+          lexicon: "gitlab",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgl032.test.ts

@@ -0,0 +1,53 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl032, nearestKnownSource } from "./wgl032";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["gitlab", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WGL032: look-alike include source", () => {
+  test("nearestKnownSource flags a near-miss", () => {
+    expect(nearestKnownSource("gitlab-org/gitlab")).toBeUndefined();
+    expect(nearestKnownSource("gitlab-org/gitlabb")).toBe("gitlab-org/gitlab");
+    expect(nearestKnownSource("totally/unrelated")).toBeUndefined();
+  });
+
+  test("flags a typo-squatted include:project", () => {
+    const yaml = `include:
+  - project: gitlab-org/gitlabb
+    ref: v1.0.0
+    file: /x.yml
+
+stages:
+  - build
+`;
+    const diags = wgl032.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL032");
+    expect(diags[0].message).toContain("gitlab-org/gitlab");
+  });
+
+  test("does not flag an exact known source", () => {
+    const yaml = `include:
+  - project: gitlab-org/gitlab
+    ref: v1.0.0
+    file: /x.yml
+
+stages:
+  - build
+`;
+    const diags = wgl032.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl032.ts

@@ -0,0 +1,68 @@
+/**
+ * WGL032: Include/Component Source Resembling a Well-Known Project
+ *
+ * Flags an `include:project` path or `component:` source that is a near-miss
+ * (edit distance 1–2) of a well-known GitLab CI source but not an exact match —
+ * a likely typo or an impersonation of the trusted project. Advisory; backed by
+ * a vendored reference list.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractIncludes } from "./yaml-helpers";
+import { KNOWN_INCLUDE_SOURCES, editDistance } from "../rules/data/known-include-sources";
+
+const KNOWN = new Set(KNOWN_INCLUDE_SOURCES);
+
+/** Reduce a component address (`host/group/name@ver`) or project path to its group/name path. */
+function sourcePath(value: string, kind: string): string {
+  let v = value;
+  if (kind === "component") {
+    const at = v.lastIndexOf("@");
+    if (at !== -1) v = v.slice(0, at);
+    const slash = v.indexOf("/");
+    if (slash !== -1 && v.slice(0, slash).includes(".")) v = v.slice(slash + 1); // drop host
+  }
+  return v;
+}
+
+export function nearestKnownSource(path: string): string | undefined {
+  if (KNOWN.has(path)) return undefined;
+  let best: string | undefined;
+  let bestDist = 3;
+  for (const known of KNOWN) {
+    const d = editDistance(path, known, 2);
+    if (d >= 1 && d <= 2 && d < bestDist) {
+      best = known;
+      bestDist = d;
+    }
+  }
+  return best;
+}
+
+export const wgl032: PostSynthCheck = {
+  id: "WGL032",
+  description: "Include/component source resembles a well-known project (possible impersonation)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const entry of extractIncludes(yaml)) {
+        if (entry.kind !== "project" && entry.kind !== "component") continue;
+        const path = sourcePath(entry.value, entry.kind);
+        const lookAlike = nearestKnownSource(path);
+        if (!lookAlike) continue;
+        diagnostics.push({
+          checkId: "WGL032",
+          severity: "warning",
+          message: `Include source "${path}" closely resembles the well-known "${lookAlike}". Confirm the source is who you intend — this may be a typo or impersonation.`,
+          entity: entry.value,
+          lexicon: "gitlab",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgl033.test.ts

@@ -0,0 +1,58 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl033 } from "./wgl033";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["gitlab", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WGL033: OIDC id_token audience scoping", () => {
+  test("flags a wildcard audience", () => {
+    const yaml = `deploy:
+  stage: deploy
+  id_tokens:
+    GCP_TOKEN:
+      aud: '*'
+  script:
+    - echo deploy
+`;
+    const diags = wgl033.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL033");
+    expect(diags[0].entity).toBe("deploy");
+  });
+
+  test("flags an empty audience", () => {
+    const yaml = `deploy:
+  id_tokens:
+    GCP_TOKEN:
+      aud: ''
+  script:
+    - echo deploy
+`;
+    const diags = wgl033.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+  });
+
+  test("does not flag a scoped audience", () => {
+    const yaml = `deploy:
+  id_tokens:
+    GCP_TOKEN:
+      aud: https://iam.googleapis.com
+  script:
+    - echo deploy
+`;
+    const diags = wgl033.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});