@intentius/chant-lexicon-gitlab 0.1.23 → 0.2.0

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "b4d7feeb0492db60bb09ef9a5ab36736e3f787d12a3ed3244aa54bc71679c980",
+    "manifest.json": "9bfe8386c57d5e1081398a3128f8c1ddde259e0ada0d4ec5e2ea4fafc3301eb1",
     "meta.json": "931fc3246a55645b1493080bbeb160e5d205e42349e8bdca96ca243adb5f0da3",
     "types/index.d.ts": "5cd2e99f135a929b72bdd822d00d780d39b1cd407ba0cfb3d511c7ac9d667b58",
     "rules/artifact-no-expiry.ts": "3f3cabf9792cbf8207e53a25f506715466b19ec25e9c3b4d0d77fed6b2eb4542",
@@ -27,10 +27,30 @@
     "rules/wgl026.ts": "b7d9f075aa8fc9623e28745b68c2368c223c2899641cbb7796952018717dcee5",
     "rules/wgl027.ts": "1ff29b9101a268c58756593b0d86396b557a79527b5dc390c190ae224c12597a",
     "rules/wgl028.ts": "f1c64eda25e2ad8da634d64a397f877a46ae8327713db5cf3193882bb9b96453",
-    "rules/yaml-helpers.ts": "f2322530a7fd812e482c5a7df05d0d05787b207574b67b811776786e00fd3e18",
+    "rules/wgl029.ts": "f06d36689d5e5649ae4465ea3b45e6e5e797223f246c45b7cb4dab7bef09ab05",
+    "rules/wgl030.ts": "6acd43eadebde694676257de0a1b1b8477f3acd8f4db3380a987fafb8d65b68f",
+    "rules/wgl031.ts": "b59221bec34c2f17c83db1a552e9acbd843d9710cc71aff1f13137f373d864dd",
+    "rules/wgl032.ts": "9cbb16c5fde4d5bc6161e3db5b8523272f069fd703e11530db46670ac8805e1d",
+    "rules/wgl033.ts": "74e23b9582d0431320b81b23686ffd0aa07a9b23831acd55764b4695d1a68fb2",
+    "rules/wgl034.ts": "a973179ae0f2e665e08a4b482a9388482f454ce5480c725cc640fe39c738ef60",
+    "rules/wgl035.ts": "3ecf8185d857046435f6a1a33e69061c27ab2aad1758673c28f591a6eca2b08a",
+    "rules/wgl036.ts": "fea9314e973434e17ce6459dda537e3138703f461a7f5cfe81290a83ed038e0b",
+    "rules/wgl037.ts": "83c14f97f9df2ade526a13be17a2f7c39429d23d426b5a7a9735d67d00f1d137",
+    "rules/wgl038.ts": "947599eb5ed9d505b23b4fe6dc0e9ec006e325dc34da9b3e1a3caf716a9e327c",
+    "rules/wgl039.ts": "5464a00d61aced70e9b5b35d642b9cb3704c46cd045f20d3e5da7e02176b704e",
+    "rules/wgl040.ts": "05b6c18488b1c48cba26e709ef5e0b97a6416b6f2d95d7a54e53951156258778",
+    "rules/wgl041.ts": "feb34fccd401fea58441123367701e7bd3acc84e9c36b72cd50fe812f33f6bea",
+    "rules/wgl042.ts": "0af844881fea0011442f6d5f8677cefffbc24c0482a0e7328eb756d08e094758",
+    "rules/wgl043.ts": "0191bd9e93ff6ad3176177cfca2431bff47c166f2f5588b12a4c4115ff531954",
+    "rules/wgl044.ts": "d8c28f461e936d87c26f7bab819093715b170afa56dea22990acfe3447814d11",
+    "rules/wgl045.ts": "7eb13fe8d263a3f65e5b80c1dffe74e09eac7155e4c2d21df552a6b169099da0",
+    "rules/wgl046.ts": "bbd8f5075aa390db546f5e787ce542f31a9d5eb031578780480e770cd86f9b5b",
+    "rules/wgl047.ts": "e6dba6a0c6c042e90a200859e52a0da28c56ce52705e147760eca0a0a37c3255",
+    "rules/wgl048.ts": "810590da4e7eaf70a6332ae247dbd34e000e2af57c89d3bd5a19bb2a923fcbb1",
+    "rules/yaml-helpers.ts": "5835982d5d088eb4788ebad8160b181bfdb6fc94d546eabee90a4c278a913988",
     "skills/chant-gitlab.md": "1e26a0c50ea891423479bd7fec3bc133f9185727c4a3eaadd525d7e7436056b6",
-    "skills/chant-gitlab-migrate.md": "9402ed4fcfd25971cf72f8f02a93c43aadfed3b83876081b92711562ce1bdc34",
+    "skills/chant-gitlab-migrate.md": "4853d04980560b379e5b0f7267dcb0a1e5d5879cb9e9931681ce76b2a5fe69d8",
     "skills/chant-gitlab-patterns.md": "cefda1b656f222293d16381dfbf452b2b376b545a69f62e55dc38907fe8aa7fa"
   },
-  "composite": "7a75ca0fe3e447809c10811c6bc8c80afa64ab238614c0a2ba53fad38048ff85"
+  "composite": "26728547d1b80d6bd7ac26734b9bc312b73971bc8a3238dcde789a85e1d83541"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gitlab",
-  "version": "0.1.23",
+  "version": "0.2.0",
   "chantVersion": ">=0.1.0",
   "namespace": "GitLab",
   "intrinsics": [

package/dist/rules/wgl029.ts

@@ -0,0 +1,59 @@
+/**
+ * WGL029: Unpinned include:project / component Reference
+ *
+ * Flags an `include:project` or CI/CD `component:` resolved by a moving ref — a
+ * branch, no `ref:` at all (defaults to the project's default branch), or a
+ * floating component version — instead of a pinned tag or commit SHA. A
+ * repointed ref turns the included configuration into a supply-chain entry point.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractIncludes, isPinnedRef } from "./yaml-helpers";
+
+export const wgl029: PostSynthCheck = {
+  id: "WGL029",
+  description: "include:project / component resolved by a moving ref instead of a pinned tag or SHA",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const entry of extractIncludes(yaml)) {
+        if (entry.kind === "project") {
+          if (!entry.ref) {
+            diagnostics.push({
+              checkId: "WGL029",
+              severity: "warning",
+              message: `include:project "${entry.value}" has no ref: and resolves to the project's default branch (a moving target). Pin it to a tag or commit SHA.`,
+              entity: entry.value,
+              lexicon: "gitlab",
+            });
+          } else if (!isPinnedRef(entry.ref)) {
+            diagnostics.push({
+              checkId: "WGL029",
+              severity: "warning",
+              message: `include:project "${entry.value}" is pinned to the moving ref "${entry.ref}". Pin it to a tag or commit SHA.`,
+              entity: entry.value,
+              lexicon: "gitlab",
+            });
+          }
+        } else if (entry.kind === "component") {
+          const at = entry.value.lastIndexOf("@");
+          const version = at === -1 ? "" : entry.value.slice(at + 1);
+          if (!version || !isPinnedRef(version)) {
+            diagnostics.push({
+              checkId: "WGL029",
+              severity: "warning",
+              message: `component "${entry.value}" uses ${version ? `the moving version "${version}"` : "no pinned version"}. Pin it to a released version tag or commit SHA.`,
+              entity: entry.value,
+              lexicon: "gitlab",
+            });
+          }
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wgl030.ts

@@ -0,0 +1,48 @@
+/**
+ * WGL030: Mutable or Insecure include:remote
+ *
+ * Flags `include:remote` URLs that are fetched over HTTP (no transport
+ * integrity) or over HTTPS but inherently mutable (a raw URL can be repointed
+ * at any time). Prefer `include:project` pinned to a tag/SHA, or a pinned
+ * component, over a remote URL. Generalizes WGL017 (non-HTTPS) to includes.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractIncludes } from "./yaml-helpers";
+
+export const wgl030: PostSynthCheck = {
+  id: "WGL030",
+  description: "include:remote is insecure (HTTP) or mutable",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const entry of extractIncludes(yaml)) {
+        const isRemote = entry.kind === "remote" || (entry.kind === "string" && /^https?:\/\//.test(entry.value));
+        if (!isRemote) continue;
+
+        if (/^http:\/\//.test(entry.value)) {
+          diagnostics.push({
+            checkId: "WGL030",
+            severity: "error",
+            message: `include:remote "${entry.value}" is fetched over HTTP — an attacker on the network can swap the included config. Use HTTPS, and prefer a pinned include:project or component.`,
+            entity: entry.value,
+            lexicon: "gitlab",
+          });
+        } else {
+          diagnostics.push({
+            checkId: "WGL030",
+            severity: "warning",
+            message: `include:remote "${entry.value}" is a mutable URL — its contents can change after review. Prefer include:project pinned to a tag/SHA, or a pinned component.`,
+            entity: entry.value,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wgl031.ts

@@ -0,0 +1,37 @@
+/**
+ * WGL031: Container Image Without an Immutable Digest
+ *
+ * Flags `image:` and `services:` references that are not pinned to an immutable
+ * `@sha256:` digest. A mutable tag can be repointed to a different image after
+ * review. Images built from a variable (e.g. `$CI_REGISTRY_IMAGE:tag`) are
+ * skipped — their concrete reference is not knowable from the static config.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractImageRefs } from "./yaml-helpers";
+
+export const wgl031: PostSynthCheck = {
+  id: "WGL031",
+  description: "Container image not pinned to an immutable digest",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const { job, image, source } of extractImageRefs(yaml)) {
+        if (image.includes("@sha256:")) continue;
+        if (image.includes("$")) continue; // variable-based reference — not statically knowable
+        diagnostics.push({
+          checkId: "WGL031",
+          severity: "warning",
+          message: `Job "${job}" ${source === "service" ? "service image" : "image"} "${image}" is not pinned to a digest — reference it by @sha256:... so the image cannot change after review.`,
+          entity: job,
+          lexicon: "gitlab",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wgl032.ts

@@ -0,0 +1,68 @@
+/**
+ * WGL032: Include/Component Source Resembling a Well-Known Project
+ *
+ * Flags an `include:project` path or `component:` source that is a near-miss
+ * (edit distance 1–2) of a well-known GitLab CI source but not an exact match —
+ * a likely typo or an impersonation of the trusted project. Advisory; backed by
+ * a vendored reference list.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractIncludes } from "./yaml-helpers";
+import { KNOWN_INCLUDE_SOURCES, editDistance } from "../rules/data/known-include-sources";
+
+const KNOWN = new Set(KNOWN_INCLUDE_SOURCES);
+
+/** Reduce a component address (`host/group/name@ver`) or project path to its group/name path. */
+function sourcePath(value: string, kind: string): string {
+  let v = value;
+  if (kind === "component") {
+    const at = v.lastIndexOf("@");
+    if (at !== -1) v = v.slice(0, at);
+    const slash = v.indexOf("/");
+    if (slash !== -1 && v.slice(0, slash).includes(".")) v = v.slice(slash + 1); // drop host
+  }
+  return v;
+}
+
+export function nearestKnownSource(path: string): string | undefined {
+  if (KNOWN.has(path)) return undefined;
+  let best: string | undefined;
+  let bestDist = 3;
+  for (const known of KNOWN) {
+    const d = editDistance(path, known, 2);
+    if (d >= 1 && d <= 2 && d < bestDist) {
+      best = known;
+      bestDist = d;
+    }
+  }
+  return best;
+}
+
+export const wgl032: PostSynthCheck = {
+  id: "WGL032",
+  description: "Include/component source resembles a well-known project (possible impersonation)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const entry of extractIncludes(yaml)) {
+        if (entry.kind !== "project" && entry.kind !== "component") continue;
+        const path = sourcePath(entry.value, entry.kind);
+        const lookAlike = nearestKnownSource(path);
+        if (!lookAlike) continue;
+        diagnostics.push({
+          checkId: "WGL032",
+          severity: "warning",
+          message: `Include source "${path}" closely resembles the well-known "${lookAlike}". Confirm the source is who you intend — this may be a typo or impersonation.`,
+          entity: entry.value,
+          lexicon: "gitlab",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wgl033.ts

@@ -0,0 +1,38 @@
+/**
+ * WGL033: OIDC id_token Without a Scoped Audience
+ *
+ * Flags an `id_tokens:` declaration with no `aud:` or a wildcard audience. The
+ * audience binds the minted OIDC token to a specific relying party; without it
+ * (or with `*`), a leaked token is accepted anywhere, defeating the point of
+ * short-lived federated identity. Set `aud:` to the exact audience(s) needed.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractIdTokens } from "./yaml-helpers";
+
+export const wgl033: PostSynthCheck = {
+  id: "WGL033",
+  description: "OIDC id_token without a scoped audience",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const { job, name, aud } of extractIdTokens(yaml)) {
+        const broad = aud.length === 0 || aud.some((a) => a === "*" || a === "" || a.includes("*"));
+        if (broad) {
+          diagnostics.push({
+            checkId: "WGL033",
+            severity: "warning",
+            message: `Job "${job}" id_token "${name}" has ${aud.length === 0 ? "no aud:" : "a wildcard audience"}. Scope it to the exact audience the relying party expects so a leaked token cannot be used elsewhere.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wgl034.ts

@@ -0,0 +1,42 @@
+/**
+ * WGL034: OIDC id_token Mintable from a Merge-Request Pipeline
+ *
+ * Flags a job that declares an `id_tokens:` (OIDC) and is reachable from
+ * merge-request pipelines. MR pipelines can be triggered by outside
+ * contributors, so a job that mints a cloud-federated token there hands fork
+ * code a path to your cloud roles. Gate OIDC jobs to protected refs, or require
+ * approval before they run.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractIdTokens, extractJobSection, isMergeRequestReachable } from "./yaml-helpers";
+
+export const wgl034: PostSynthCheck = {
+  id: "WGL034",
+  description: "OIDC id_token mintable from a merge-request pipeline",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      const seen = new Set<string>();
+      for (const { job } of extractIdTokens(yaml)) {
+        if (seen.has(job)) continue;
+        const section = extractJobSection(yaml, job);
+        if (section && isMergeRequestReachable(section)) {
+          seen.add(job);
+          diagnostics.push({
+            checkId: "WGL034",
+            severity: "warning",
+            message: `Job "${job}" mints an OIDC id_token and is reachable from merge-request pipelines, which outside contributors can trigger. Restrict it to protected refs or require approval before it runs.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wgl035.ts

@@ -0,0 +1,44 @@
+/**
+ * WGL035: Untrusted CI Variable Interpolated into a Script
+ *
+ * Flags an attacker-controllable predefined variable (branch/tag name, commit or
+ * merge-request title/description, author) referenced in a `script:` command. A
+ * crafted branch name or commit title containing shell metacharacters can break
+ * out of the command. Quote the reference and avoid using it in sensitive
+ * commands, or sanitize it first.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractScriptCommands } from "./yaml-helpers";
+import { UNTRUSTED_CI_VARIABLES, variableReferenced } from "../rules/data/untrusted-variables";
+
+export const wgl035: PostSynthCheck = {
+  id: "WGL035",
+  description: "Untrusted CI variable interpolated into a script command",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      const seen = new Set<string>();
+      for (const { job, command } of extractScriptCommands(yaml)) {
+        for (const name of UNTRUSTED_CI_VARIABLES) {
+          if (!variableReferenced(command, name)) continue;
+          const key = `${job}:${name}`;
+          if (seen.has(key)) continue;
+          seen.add(key);
+          diagnostics.push({
+            checkId: "WGL035",
+            severity: "warning",
+            message: `Job "${job}" uses the attacker-controllable variable $${name} in a script command. A crafted value can inject shell commands — quote it ("$${name}") and avoid using it in sensitive commands, or sanitize it first.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wgl036.ts

@@ -0,0 +1,44 @@
+/**
+ * WGL036: Privileged Service / Docker-in-Docker Reachable from Merge Requests
+ *
+ * Flags a job that uses Docker-in-Docker (a privileged service) and is reachable
+ * from merge-request pipelines. MR pipelines can run code from an outside
+ * contributor; a privileged DinD service shares the host daemon socket and can
+ * be used to escape the build and reach the runner. Restrict privileged services
+ * to protected refs, or require approval before such jobs run.
+ *
+ * Complements WGL026 (DinD without TLS) by adding the trust-boundary dimension.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs, extractJobSection, isMergeRequestReachable } from "./yaml-helpers";
+
+const DIND_RE = /docker:[\w.-]*dind|dind|privileged:\s*true/;
+
+export const wgl036: PostSynthCheck = {
+  id: "WGL036",
+  description: "Privileged service / DinD reachable from merge-request pipelines",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const [job] of extractJobs(yaml)) {
+        const section = extractJobSection(yaml, job);
+        if (!section) continue;
+        if (DIND_RE.test(section) && isMergeRequestReachable(section)) {
+          diagnostics.push({
+            checkId: "WGL036",
+            severity: "warning",
+            message: `Job "${job}" runs a privileged Docker-in-Docker service and is reachable from merge-request pipelines, which outside contributors can trigger. Restrict privileged services to protected refs or require approval.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wgl037.ts

@@ -0,0 +1,47 @@
+/**
+ * WGL037: Security Gate on a Regex Match of an Untrusted Ref
+ *
+ * Flags a `rules:if` that gates execution on a regex match (`=~`) over an
+ * attacker-controllable ref variable (e.g. `$CI_COMMIT_REF_NAME =~ /^release/`).
+ * An outside contributor can craft a branch name that satisfies the pattern
+ * (`release-evil`), passing a gate meant for trusted refs. Match the full ref
+ * with `==`, or gate on a protected condition instead.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs, extractJobSection } from "./yaml-helpers";
+import { UNTRUSTED_CI_VARIABLES } from "../rules/data/untrusted-variables";
+
+const REF_VARS = ["CI_COMMIT_REF_NAME", "CI_COMMIT_REF_SLUG", "CI_COMMIT_BRANCH", "CI_COMMIT_TAG", "CI_MERGE_REQUEST_SOURCE_BRANCH_NAME"]
+  .filter((v) => UNTRUSTED_CI_VARIABLES.includes(v));
+
+export const wgl037: PostSynthCheck = {
+  id: "WGL037",
+  description: "Security gate on a regex match of an untrusted ref variable",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const [job] of extractJobs(yaml)) {
+        const section = extractJobSection(yaml, job);
+        if (!section) continue;
+        // Look at `if:` lines that use a regex match against an untrusted ref var.
+        const ifLines = section.split("\n").filter((l) => /if:\s/.test(l));
+        const flagged = ifLines.some((l) => /=~/.test(l) && REF_VARS.some((v) => l.includes(`$${v}`)));
+        if (flagged) {
+          diagnostics.push({
+            checkId: "WGL037",
+            severity: "warning",
+            message: `Job "${job}" gates on a regex match (=~) of an attacker-controllable ref variable. A crafted branch/tag name can satisfy the pattern — match the full ref with == or gate on a protected condition.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wgl038.ts

@@ -0,0 +1,48 @@
+/**
+ * WGL038: Secret Reachable from a Merge-Request Pipeline
+ *
+ * Flags a user-defined secret-like variable (`*_PASSWORD`, `*_SECRET`,
+ * `*_TOKEN`, `*_API_KEY`, …) referenced in a job reachable from merge-request
+ * pipelines. Those pipelines can run an outside contributor's code, so a secret
+ * they can read is a secret they can exfiltrate. Gate secret-using jobs to
+ * protected refs, or make the variable protected so MR pipelines can't see it.
+ *
+ * Built-in `CI_*` variables are project-managed and excluded.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs, extractJobSection, isMergeRequestReachable } from "./yaml-helpers";
+
+const SECRET_VAR = /\$\{?((?!CI_)[A-Z][A-Z0-9_]*(?:PASSWORD|SECRET|TOKEN|API[_-]?KEY|PRIVATE[_-]?KEY|CREDENTIALS?))\}?/g;
+
+export const wgl038: PostSynthCheck = {
+  id: "WGL038",
+  description: "Secret-like variable reachable from a merge-request pipeline",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const [job] of extractJobs(yaml)) {
+        const section = extractJobSection(yaml, job);
+        if (!section || !isMergeRequestReachable(section)) continue;
+        const found = new Set<string>();
+        let m: RegExpExecArray | null;
+        SECRET_VAR.lastIndex = 0;
+        while ((m = SECRET_VAR.exec(section)) !== null) found.add(m[1]);
+        if (found.size > 0) {
+          diagnostics.push({
+            checkId: "WGL038",
+            severity: "warning",
+            message: `Job "${job}" reads secret-like variable(s) ${[...found].map((v) => `$${v}`).join(", ")} and is reachable from merge-request pipelines, which can run untrusted code. Gate it to protected refs or mark the variable protected.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wgl039.ts

@@ -0,0 +1,41 @@
+/**
+ * WGL039: Secret Echoed to Job Logs
+ *
+ * Flags a `script:` command that prints a secret-like variable (`echo`,
+ * `printf`, `print`, `cat`) — even masked variables leak when transformed
+ * (base64, reversed) before printing, and job logs are broadly readable.
+ * Remove the debug print or pipe the value where it is needed without echoing it.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractScriptCommands } from "./yaml-helpers";
+
+const PRINT_SECRET = /\b(echo|printf|print|cat)\b[^\n]*\$\{?[A-Z][A-Z0-9_]*(?:PASSWORD|SECRET|TOKEN|API[_-]?KEY|PRIVATE[_-]?KEY|CREDENTIALS?)\}?/i;
+
+export const wgl039: PostSynthCheck = {
+  id: "WGL039",
+  description: "Secret-like variable printed to job logs",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      const seen = new Set<string>();
+      for (const { job, command } of extractScriptCommands(yaml)) {
+        if (PRINT_SECRET.test(command) && !seen.has(job)) {
+          seen.add(job);
+          diagnostics.push({
+            checkId: "WGL039",
+            severity: "warning",
+            message: `Job "${job}" prints a secret-like variable to the job log. Logs are broadly readable and masking can be defeated by transforms — remove the print.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wgl040.ts

@@ -0,0 +1,42 @@
+/**
+ * WGL040: Hardcoded Credential in a Registry Login
+ *
+ * Flags a `docker login` (or compatible) in a `script:` that passes a literal
+ * password via `-p` / `--password` instead of a variable or `--password-stdin`.
+ * An inlined credential sits in the committed pipeline and the job log. Use a
+ * masked CI/CD variable and `--password-stdin`. Extends WGL016 to scripts.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractScriptCommands } from "./yaml-helpers";
+
+// docker/podman/buildah/helm login with -p/--password followed by a non-variable literal
+const LITERAL_LOGIN = /\b(?:docker|podman|buildah|helm|crane|skopeo)\b[^\n]*\blogin\b[^\n]*(?:-p|--password)[=\s]+(?!["']?\$)["']?[^\s"']+/i;
+
+export const wgl040: PostSynthCheck = {
+  id: "WGL040",
+  description: "Hardcoded credential in a registry login command",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      const seen = new Set<string>();
+      for (const { job, command } of extractScriptCommands(yaml)) {
+        if (LITERAL_LOGIN.test(command) && !seen.has(job)) {
+          seen.add(job);
+          diagnostics.push({
+            checkId: "WGL040",
+            severity: "error",
+            message: `Job "${job}" passes a hardcoded password to a registry login. Use a masked CI/CD variable with --password-stdin instead of inlining the credential.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};