@intentius/chant-lexicon-gitlab 0.1.23 → 0.2.0

package/src/lint/post-synth/wgl033.ts

@@ -0,0 +1,38 @@
+/**
+ * WGL033: OIDC id_token Without a Scoped Audience
+ *
+ * Flags an `id_tokens:` declaration with no `aud:` or a wildcard audience. The
+ * audience binds the minted OIDC token to a specific relying party; without it
+ * (or with `*`), a leaked token is accepted anywhere, defeating the point of
+ * short-lived federated identity. Set `aud:` to the exact audience(s) needed.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractIdTokens } from "./yaml-helpers";
+
+export const wgl033: PostSynthCheck = {
+  id: "WGL033",
+  description: "OIDC id_token without a scoped audience",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const { job, name, aud } of extractIdTokens(yaml)) {
+        const broad = aud.length === 0 || aud.some((a) => a === "*" || a === "" || a.includes("*"));
+        if (broad) {
+          diagnostics.push({
+            checkId: "WGL033",
+            severity: "warning",
+            message: `Job "${job}" id_token "${name}" has ${aud.length === 0 ? "no aud:" : "a wildcard audience"}. Scope it to the exact audience the relying party expects so a leaked token cannot be used elsewhere.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgl034.test.ts

@@ -0,0 +1,60 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl034 } from "./wgl034";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["gitlab", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WGL034: OIDC token mintable from a merge-request pipeline", () => {
+  test("flags an OIDC job reachable from merge requests", () => {
+    const yaml = `deploy:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  id_tokens:
+    GCP_TOKEN:
+      aud: https://iam.googleapis.com
+  script:
+    - echo deploy
+`;
+    const diags = wgl034.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL034");
+    expect(diags[0].entity).toBe("deploy");
+  });
+
+  test("does not flag an OIDC job gated to a protected branch", () => {
+    const yaml = `deploy:
+  rules:
+    - if: $CI_COMMIT_BRANCH == "main"
+  id_tokens:
+    GCP_TOKEN:
+      aud: https://iam.googleapis.com
+  script:
+    - echo deploy
+`;
+    const diags = wgl034.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+
+  test("does not flag a merge-request job without OIDC", () => {
+    const yaml = `test:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  script:
+    - echo test
+`;
+    const diags = wgl034.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl034.ts

@@ -0,0 +1,42 @@
+/**
+ * WGL034: OIDC id_token Mintable from a Merge-Request Pipeline
+ *
+ * Flags a job that declares an `id_tokens:` (OIDC) and is reachable from
+ * merge-request pipelines. MR pipelines can be triggered by outside
+ * contributors, so a job that mints a cloud-federated token there hands fork
+ * code a path to your cloud roles. Gate OIDC jobs to protected refs, or require
+ * approval before they run.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractIdTokens, extractJobSection, isMergeRequestReachable } from "./yaml-helpers";
+
+export const wgl034: PostSynthCheck = {
+  id: "WGL034",
+  description: "OIDC id_token mintable from a merge-request pipeline",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      const seen = new Set<string>();
+      for (const { job } of extractIdTokens(yaml)) {
+        if (seen.has(job)) continue;
+        const section = extractJobSection(yaml, job);
+        if (section && isMergeRequestReachable(section)) {
+          seen.add(job);
+          diagnostics.push({
+            checkId: "WGL034",
+            severity: "warning",
+            message: `Job "${job}" mints an OIDC id_token and is reachable from merge-request pipelines, which outside contributors can trigger. Restrict it to protected refs or require approval before it runs.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgl035.test.ts

@@ -0,0 +1,42 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl035 } from "./wgl035";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["gitlab", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WGL035: untrusted CI variable in script", () => {
+  test("flags an untrusted ref name used in a script command", () => {
+    const yaml = `build:
+  stage: build
+  script:
+    - git checkout $CI_COMMIT_REF_NAME
+`;
+    const diags = wgl035.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL035");
+    expect(diags[0].entity).toBe("build");
+    expect(diags[0].message).toContain("CI_COMMIT_REF_NAME");
+  });
+
+  test("does not flag a trusted variable", () => {
+    const yaml = `build:
+  stage: build
+  script:
+    - echo "$CI_COMMIT_SHA"
+`;
+    const diags = wgl035.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl035.ts

@@ -0,0 +1,44 @@
+/**
+ * WGL035: Untrusted CI Variable Interpolated into a Script
+ *
+ * Flags an attacker-controllable predefined variable (branch/tag name, commit or
+ * merge-request title/description, author) referenced in a `script:` command. A
+ * crafted branch name or commit title containing shell metacharacters can break
+ * out of the command. Quote the reference and avoid using it in sensitive
+ * commands, or sanitize it first.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractScriptCommands } from "./yaml-helpers";
+import { UNTRUSTED_CI_VARIABLES, variableReferenced } from "../rules/data/untrusted-variables";
+
+export const wgl035: PostSynthCheck = {
+  id: "WGL035",
+  description: "Untrusted CI variable interpolated into a script command",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      const seen = new Set<string>();
+      for (const { job, command } of extractScriptCommands(yaml)) {
+        for (const name of UNTRUSTED_CI_VARIABLES) {
+          if (!variableReferenced(command, name)) continue;
+          const key = `${job}:${name}`;
+          if (seen.has(key)) continue;
+          seen.add(key);
+          diagnostics.push({
+            checkId: "WGL035",
+            severity: "warning",
+            message: `Job "${job}" uses the attacker-controllable variable $${name} in a script command. A crafted value can inject shell commands — quote it ("$${name}") and avoid using it in sensitive commands, or sanitize it first.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgl036.test.ts

@@ -0,0 +1,49 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl036 } from "./wgl036";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["gitlab", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WGL036: privileged DinD reachable from merge requests", () => {
+  test("flags DinD in a merge-request-reachable job", () => {
+    const yaml = `build:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  image: docker:24
+  services:
+    - docker:24-dind
+  script:
+    - docker build .
+`;
+    const diags = wgl036.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL036");
+    expect(diags[0].entity).toBe("build");
+  });
+
+  test("does not flag DinD gated to a protected branch", () => {
+    const yaml = `build:
+  rules:
+    - if: $CI_COMMIT_BRANCH == "main"
+  image: docker:24
+  services:
+    - docker:24-dind
+  script:
+    - docker build .
+`;
+    const diags = wgl036.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl036.ts

@@ -0,0 +1,44 @@
+/**
+ * WGL036: Privileged Service / Docker-in-Docker Reachable from Merge Requests
+ *
+ * Flags a job that uses Docker-in-Docker (a privileged service) and is reachable
+ * from merge-request pipelines. MR pipelines can run code from an outside
+ * contributor; a privileged DinD service shares the host daemon socket and can
+ * be used to escape the build and reach the runner. Restrict privileged services
+ * to protected refs, or require approval before such jobs run.
+ *
+ * Complements WGL026 (DinD without TLS) by adding the trust-boundary dimension.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs, extractJobSection, isMergeRequestReachable } from "./yaml-helpers";
+
+const DIND_RE = /docker:[\w.-]*dind|dind|privileged:\s*true/;
+
+export const wgl036: PostSynthCheck = {
+  id: "WGL036",
+  description: "Privileged service / DinD reachable from merge-request pipelines",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const [job] of extractJobs(yaml)) {
+        const section = extractJobSection(yaml, job);
+        if (!section) continue;
+        if (DIND_RE.test(section) && isMergeRequestReachable(section)) {
+          diagnostics.push({
+            checkId: "WGL036",
+            severity: "warning",
+            message: `Job "${job}" runs a privileged Docker-in-Docker service and is reachable from merge-request pipelines, which outside contributors can trigger. Restrict privileged services to protected refs or require approval.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgl037.test.ts

@@ -0,0 +1,45 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl037 } from "./wgl037";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["gitlab", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WGL037: regex gate on untrusted ref", () => {
+  test("flags a =~ gate on the ref name", () => {
+    const yaml = `deploy:
+  stage: deploy
+  rules:
+    - if: $CI_COMMIT_REF_NAME =~ /^release/
+  script:
+    - ./deploy.sh
+`;
+    const diags = wgl037.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL037");
+    expect(diags[0].entity).toBe("deploy");
+  });
+
+  test("does not flag an exact == match", () => {
+    const yaml = `deploy:
+  stage: deploy
+  rules:
+    - if: $CI_COMMIT_REF_NAME == "main"
+  script:
+    - ./deploy.sh
+`;
+    const diags = wgl037.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl037.ts

@@ -0,0 +1,47 @@
+/**
+ * WGL037: Security Gate on a Regex Match of an Untrusted Ref
+ *
+ * Flags a `rules:if` that gates execution on a regex match (`=~`) over an
+ * attacker-controllable ref variable (e.g. `$CI_COMMIT_REF_NAME =~ /^release/`).
+ * An outside contributor can craft a branch name that satisfies the pattern
+ * (`release-evil`), passing a gate meant for trusted refs. Match the full ref
+ * with `==`, or gate on a protected condition instead.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs, extractJobSection } from "./yaml-helpers";
+import { UNTRUSTED_CI_VARIABLES } from "../rules/data/untrusted-variables";
+
+const REF_VARS = ["CI_COMMIT_REF_NAME", "CI_COMMIT_REF_SLUG", "CI_COMMIT_BRANCH", "CI_COMMIT_TAG", "CI_MERGE_REQUEST_SOURCE_BRANCH_NAME"]
+  .filter((v) => UNTRUSTED_CI_VARIABLES.includes(v));
+
+export const wgl037: PostSynthCheck = {
+  id: "WGL037",
+  description: "Security gate on a regex match of an untrusted ref variable",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const [job] of extractJobs(yaml)) {
+        const section = extractJobSection(yaml, job);
+        if (!section) continue;
+        // Look at `if:` lines that use a regex match against an untrusted ref var.
+        const ifLines = section.split("\n").filter((l) => /if:\s/.test(l));
+        const flagged = ifLines.some((l) => /=~/.test(l) && REF_VARS.some((v) => l.includes(`$${v}`)));
+        if (flagged) {
+          diagnostics.push({
+            checkId: "WGL037",
+            severity: "warning",
+            message: `Job "${job}" gates on a regex match (=~) of an attacker-controllable ref variable. A crafted branch/tag name can satisfy the pattern — match the full ref with == or gate on a protected condition.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgl038.test.ts

@@ -0,0 +1,54 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl038 } from "./wgl038";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["gitlab", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WGL038: secret reachable from merge requests", () => {
+  test("flags a user secret used in a merge-request-reachable job", () => {
+    const yaml = `deploy:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  script:
+    - curl -H "Auth: $DEPLOY_TOKEN" https://api.example.com
+`;
+    const diags = wgl038.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL038");
+    expect(diags[0].message).toContain("DEPLOY_TOKEN");
+  });
+
+  test("does not flag a built-in CI_ token", () => {
+    const yaml = `deploy:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  script:
+    - echo "$CI_JOB_TOKEN" | docker login --password-stdin
+`;
+    const diags = wgl038.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+
+  test("does not flag a secret gated to a protected branch", () => {
+    const yaml = `deploy:
+  rules:
+    - if: $CI_COMMIT_BRANCH == "main"
+  script:
+    - curl -H "Auth: $DEPLOY_TOKEN" https://api.example.com
+`;
+    const diags = wgl038.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl038.ts

@@ -0,0 +1,48 @@
+/**
+ * WGL038: Secret Reachable from a Merge-Request Pipeline
+ *
+ * Flags a user-defined secret-like variable (`*_PASSWORD`, `*_SECRET`,
+ * `*_TOKEN`, `*_API_KEY`, …) referenced in a job reachable from merge-request
+ * pipelines. Those pipelines can run an outside contributor's code, so a secret
+ * they can read is a secret they can exfiltrate. Gate secret-using jobs to
+ * protected refs, or make the variable protected so MR pipelines can't see it.
+ *
+ * Built-in `CI_*` variables are project-managed and excluded.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs, extractJobSection, isMergeRequestReachable } from "./yaml-helpers";
+
+const SECRET_VAR = /\$\{?((?!CI_)[A-Z][A-Z0-9_]*(?:PASSWORD|SECRET|TOKEN|API[_-]?KEY|PRIVATE[_-]?KEY|CREDENTIALS?))\}?/g;
+
+export const wgl038: PostSynthCheck = {
+  id: "WGL038",
+  description: "Secret-like variable reachable from a merge-request pipeline",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const [job] of extractJobs(yaml)) {
+        const section = extractJobSection(yaml, job);
+        if (!section || !isMergeRequestReachable(section)) continue;
+        const found = new Set<string>();
+        let m: RegExpExecArray | null;
+        SECRET_VAR.lastIndex = 0;
+        while ((m = SECRET_VAR.exec(section)) !== null) found.add(m[1]);
+        if (found.size > 0) {
+          diagnostics.push({
+            checkId: "WGL038",
+            severity: "warning",
+            message: `Job "${job}" reads secret-like variable(s) ${[...found].map((v) => `$${v}`).join(", ")} and is reachable from merge-request pipelines, which can run untrusted code. Gate it to protected refs or mark the variable protected.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgl039.test.ts

@@ -0,0 +1,39 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl039 } from "./wgl039";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["gitlab", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WGL039: secret echoed to logs", () => {
+  test("flags echo of a secret variable", () => {
+    const yaml = `debug:
+  script:
+    - echo $API_TOKEN
+`;
+    const diags = wgl039.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL039");
+    expect(diags[0].entity).toBe("debug");
+  });
+
+  test("does not flag a normal echo", () => {
+    const yaml = `build:
+  script:
+    - echo "building the project"
+`;
+    const diags = wgl039.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl039.ts

@@ -0,0 +1,41 @@
+/**
+ * WGL039: Secret Echoed to Job Logs
+ *
+ * Flags a `script:` command that prints a secret-like variable (`echo`,
+ * `printf`, `print`, `cat`) — even masked variables leak when transformed
+ * (base64, reversed) before printing, and job logs are broadly readable.
+ * Remove the debug print or pipe the value where it is needed without echoing it.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractScriptCommands } from "./yaml-helpers";
+
+const PRINT_SECRET = /\b(echo|printf|print|cat)\b[^\n]*\$\{?[A-Z][A-Z0-9_]*(?:PASSWORD|SECRET|TOKEN|API[_-]?KEY|PRIVATE[_-]?KEY|CREDENTIALS?)\}?/i;
+
+export const wgl039: PostSynthCheck = {
+  id: "WGL039",
+  description: "Secret-like variable printed to job logs",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      const seen = new Set<string>();
+      for (const { job, command } of extractScriptCommands(yaml)) {
+        if (PRINT_SECRET.test(command) && !seen.has(job)) {
+          seen.add(job);
+          diagnostics.push({
+            checkId: "WGL039",
+            severity: "warning",
+            message: `Job "${job}" prints a secret-like variable to the job log. Logs are broadly readable and masking can be defeated by transforms — remove the print.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgl040.test.ts

@@ -0,0 +1,48 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl040 } from "./wgl040";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["gitlab", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WGL040: hardcoded registry credential", () => {
+  test("flags docker login with a literal password", () => {
+    const yaml = `publish:
+  script:
+    - docker login -u ci -p hunter2 registry.example.com
+`;
+    const diags = wgl040.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL040");
+    expect(diags[0].severity).toBe("error");
+  });
+
+  test("does not flag a variable password", () => {
+    const yaml = `publish:
+  script:
+    - docker login -u ci -p $CI_REGISTRY_PASSWORD registry.example.com
+`;
+    const diags = wgl040.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+
+  test("does not flag --password-stdin", () => {
+    const yaml = `publish:
+  script:
+    - echo "$REG_PASS" | docker login -u ci --password-stdin registry.example.com
+`;
+    const diags = wgl040.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});