@intentius/chant-lexicon-gitlab 0.1.23 → 0.3.0

package/src/lint/post-synth/wgl037.test.ts

@@ -0,0 +1,45 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl037 } from "./wgl037";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["gitlab", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WGL037: regex gate on untrusted ref", () => {
+  test("flags a =~ gate on the ref name", () => {
+    const yaml = `deploy:
+  stage: deploy
+  rules:
+    - if: $CI_COMMIT_REF_NAME =~ /^release/
+  script:
+    - ./deploy.sh
+`;
+    const diags = wgl037.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL037");
+    expect(diags[0].entity).toBe("deploy");
+  });
+
+  test("does not flag an exact == match", () => {
+    const yaml = `deploy:
+  stage: deploy
+  rules:
+    - if: $CI_COMMIT_REF_NAME == "main"
+  script:
+    - ./deploy.sh
+`;
+    const diags = wgl037.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl037.ts

@@ -0,0 +1,47 @@
+/**
+ * WGL037: Security Gate on a Regex Match of an Untrusted Ref
+ *
+ * Flags a `rules:if` that gates execution on a regex match (`=~`) over an
+ * attacker-controllable ref variable (e.g. `$CI_COMMIT_REF_NAME =~ /^release/`).
+ * An outside contributor can craft a branch name that satisfies the pattern
+ * (`release-evil`), passing a gate meant for trusted refs. Match the full ref
+ * with `==`, or gate on a protected condition instead.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs, extractJobSection } from "./yaml-helpers";
+import { UNTRUSTED_CI_VARIABLES } from "../rules/data/untrusted-variables";
+
+const REF_VARS = ["CI_COMMIT_REF_NAME", "CI_COMMIT_REF_SLUG", "CI_COMMIT_BRANCH", "CI_COMMIT_TAG", "CI_MERGE_REQUEST_SOURCE_BRANCH_NAME"]
+  .filter((v) => UNTRUSTED_CI_VARIABLES.includes(v));
+
+export const wgl037: PostSynthCheck = {
+  id: "WGL037",
+  description: "Security gate on a regex match of an untrusted ref variable",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const [job] of extractJobs(yaml)) {
+        const section = extractJobSection(yaml, job);
+        if (!section) continue;
+        // Look at `if:` lines that use a regex match against an untrusted ref var.
+        const ifLines = section.split("\n").filter((l) => /if:\s/.test(l));
+        const flagged = ifLines.some((l) => /=~/.test(l) && REF_VARS.some((v) => l.includes(`$${v}`)));
+        if (flagged) {
+          diagnostics.push({
+            checkId: "WGL037",
+            severity: "warning",
+            message: `Job "${job}" gates on a regex match (=~) of an attacker-controllable ref variable. A crafted branch/tag name can satisfy the pattern — match the full ref with == or gate on a protected condition.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgl038.test.ts

@@ -0,0 +1,54 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl038 } from "./wgl038";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["gitlab", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WGL038: secret reachable from merge requests", () => {
+  test("flags a user secret used in a merge-request-reachable job", () => {
+    const yaml = `deploy:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  script:
+    - curl -H "Auth: $DEPLOY_TOKEN" https://api.example.com
+`;
+    const diags = wgl038.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL038");
+    expect(diags[0].message).toContain("DEPLOY_TOKEN");
+  });
+
+  test("does not flag a built-in CI_ token", () => {
+    const yaml = `deploy:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  script:
+    - echo "$CI_JOB_TOKEN" | docker login --password-stdin
+`;
+    const diags = wgl038.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+
+  test("does not flag a secret gated to a protected branch", () => {
+    const yaml = `deploy:
+  rules:
+    - if: $CI_COMMIT_BRANCH == "main"
+  script:
+    - curl -H "Auth: $DEPLOY_TOKEN" https://api.example.com
+`;
+    const diags = wgl038.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl038.ts

@@ -0,0 +1,48 @@
+/**
+ * WGL038: Secret Reachable from a Merge-Request Pipeline
+ *
+ * Flags a user-defined secret-like variable (`*_PASSWORD`, `*_SECRET`,
+ * `*_TOKEN`, `*_API_KEY`, …) referenced in a job reachable from merge-request
+ * pipelines. Those pipelines can run an outside contributor's code, so a secret
+ * they can read is a secret they can exfiltrate. Gate secret-using jobs to
+ * protected refs, or make the variable protected so MR pipelines can't see it.
+ *
+ * Built-in `CI_*` variables are project-managed and excluded.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs, extractJobSection, isMergeRequestReachable } from "./yaml-helpers";
+
+const SECRET_VAR = /\$\{?((?!CI_)[A-Z][A-Z0-9_]*(?:PASSWORD|SECRET|TOKEN|API[_-]?KEY|PRIVATE[_-]?KEY|CREDENTIALS?))\}?/g;
+
+export const wgl038: PostSynthCheck = {
+  id: "WGL038",
+  description: "Secret-like variable reachable from a merge-request pipeline",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const [job] of extractJobs(yaml)) {
+        const section = extractJobSection(yaml, job);
+        if (!section || !isMergeRequestReachable(section)) continue;
+        const found = new Set<string>();
+        let m: RegExpExecArray | null;
+        SECRET_VAR.lastIndex = 0;
+        while ((m = SECRET_VAR.exec(section)) !== null) found.add(m[1]);
+        if (found.size > 0) {
+          diagnostics.push({
+            checkId: "WGL038",
+            severity: "warning",
+            message: `Job "${job}" reads secret-like variable(s) ${[...found].map((v) => `$${v}`).join(", ")} and is reachable from merge-request pipelines, which can run untrusted code. Gate it to protected refs or mark the variable protected.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgl039.test.ts

@@ -0,0 +1,39 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl039 } from "./wgl039";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["gitlab", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WGL039: secret echoed to logs", () => {
+  test("flags echo of a secret variable", () => {
+    const yaml = `debug:
+  script:
+    - echo $API_TOKEN
+`;
+    const diags = wgl039.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL039");
+    expect(diags[0].entity).toBe("debug");
+  });
+
+  test("does not flag a normal echo", () => {
+    const yaml = `build:
+  script:
+    - echo "building the project"
+`;
+    const diags = wgl039.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl039.ts

@@ -0,0 +1,41 @@
+/**
+ * WGL039: Secret Echoed to Job Logs
+ *
+ * Flags a `script:` command that prints a secret-like variable (`echo`,
+ * `printf`, `print`, `cat`) — even masked variables leak when transformed
+ * (base64, reversed) before printing, and job logs are broadly readable.
+ * Remove the debug print or pipe the value where it is needed without echoing it.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractScriptCommands } from "./yaml-helpers";
+
+const PRINT_SECRET = /\b(echo|printf|print|cat)\b[^\n]*\$\{?[A-Z][A-Z0-9_]*(?:PASSWORD|SECRET|TOKEN|API[_-]?KEY|PRIVATE[_-]?KEY|CREDENTIALS?)\}?/i;
+
+export const wgl039: PostSynthCheck = {
+  id: "WGL039",
+  description: "Secret-like variable printed to job logs",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      const seen = new Set<string>();
+      for (const { job, command } of extractScriptCommands(yaml)) {
+        if (PRINT_SECRET.test(command) && !seen.has(job)) {
+          seen.add(job);
+          diagnostics.push({
+            checkId: "WGL039",
+            severity: "warning",
+            message: `Job "${job}" prints a secret-like variable to the job log. Logs are broadly readable and masking can be defeated by transforms — remove the print.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgl040.test.ts

@@ -0,0 +1,48 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl040 } from "./wgl040";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["gitlab", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WGL040: hardcoded registry credential", () => {
+  test("flags docker login with a literal password", () => {
+    const yaml = `publish:
+  script:
+    - docker login -u ci -p hunter2 registry.example.com
+`;
+    const diags = wgl040.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL040");
+    expect(diags[0].severity).toBe("error");
+  });
+
+  test("does not flag a variable password", () => {
+    const yaml = `publish:
+  script:
+    - docker login -u ci -p $CI_REGISTRY_PASSWORD registry.example.com
+`;
+    const diags = wgl040.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+
+  test("does not flag --password-stdin", () => {
+    const yaml = `publish:
+  script:
+    - echo "$REG_PASS" | docker login -u ci --password-stdin registry.example.com
+`;
+    const diags = wgl040.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl040.ts

@@ -0,0 +1,42 @@
+/**
+ * WGL040: Hardcoded Credential in a Registry Login
+ *
+ * Flags a `docker login` (or compatible) in a `script:` that passes a literal
+ * password via `-p` / `--password` instead of a variable or `--password-stdin`.
+ * An inlined credential sits in the committed pipeline and the job log. Use a
+ * masked CI/CD variable and `--password-stdin`. Extends WGL016 to scripts.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractScriptCommands } from "./yaml-helpers";
+
+// docker/podman/buildah/helm login with -p/--password followed by a non-variable literal
+const LITERAL_LOGIN = /\b(?:docker|podman|buildah|helm|crane|skopeo)\b[^\n]*\blogin\b[^\n]*(?:-p|--password)[=\s]+(?!["']?\$)["']?[^\s"']+/i;
+
+export const wgl040: PostSynthCheck = {
+  id: "WGL040",
+  description: "Hardcoded credential in a registry login command",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      const seen = new Set<string>();
+      for (const { job, command } of extractScriptCommands(yaml)) {
+        if (LITERAL_LOGIN.test(command) && !seen.has(job)) {
+          seen.add(job);
+          diagnostics.push({
+            checkId: "WGL040",
+            severity: "error",
+            message: `Job "${job}" passes a hardcoded password to a registry login. Use a masked CI/CD variable with --password-stdin instead of inlining the credential.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgl041.test.ts

@@ -0,0 +1,49 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl041, tautologyReason } from "./wgl041";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["gitlab", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WGL041: unsound rules:if", () => {
+  test("tautologyReason classifies identical operands", () => {
+    expect(tautologyReason('$CI_COMMIT_BRANCH == $CI_COMMIT_BRANCH')).toContain("always true");
+    expect(tautologyReason('$X != $X')).toContain("always false");
+    expect(tautologyReason('$CI_COMMIT_BRANCH == "main"')).toBeUndefined();
+  });
+
+  test("flags a tautological rule condition", () => {
+    const yaml = `deploy:
+  rules:
+    - if: $CI_COMMIT_BRANCH == $CI_COMMIT_BRANCH
+  script:
+    - echo deploy
+`;
+    const diags = wgl041.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL041");
+    expect(diags[0].entity).toBe("deploy");
+  });
+
+  test("does not flag a real condition", () => {
+    const yaml = `deploy:
+  rules:
+    - if: $CI_COMMIT_BRANCH == "main"
+  script:
+    - echo deploy
+`;
+    const diags = wgl041.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl041.ts

@@ -0,0 +1,57 @@
+/**
+ * WGL041: Logically Unsound rules:if Condition
+ *
+ * Flags a `rules:if` that reads like a gate but is a constant — both sides of an
+ * `==`/`!=` are identical, so the condition is always true or always false.
+ * Generalizes WGL011 (rules that always evaluate to never) to tautological
+ * conditions presented as gates.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs, extractJobSection, extractJobRules } from "./yaml-helpers";
+
+function strip(s: string): string {
+  return s.trim().replace(/^['"]|['"]$/g, "").trim();
+}
+
+/** Classify an `if:` expression as a tautology, returning a reason or undefined. */
+export function tautologyReason(expr: string): string | undefined {
+  const e = strip(expr).replace(/^\$\{?/, "$").trim();
+  const eq = e.match(/^(\S.*?)\s*==\s*(\S.*?)$/);
+  if (eq && strip(eq[1]) === strip(eq[2])) return "always true (both sides of == are identical)";
+  const ne = e.match(/^(\S.*?)\s*!=\s*(\S.*?)$/);
+  if (ne && strip(ne[1]) === strip(ne[2])) return "always false (both sides of != are identical)";
+  return undefined;
+}
+
+export const wgl041: PostSynthCheck = {
+  id: "WGL041",
+  description: "Logically unsound (tautological) rules:if condition",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const [job] of extractJobs(yaml)) {
+        const section = extractJobSection(yaml, job);
+        if (!section) continue;
+        for (const rule of extractJobRules(section)) {
+          if (!rule.if) continue;
+          const reason = tautologyReason(rule.if);
+          if (reason) {
+            diagnostics.push({
+              checkId: "WGL041",
+              severity: "warning",
+              message: `Job "${job}" has a rules:if that is ${reason}: "${rule.if}". A gate that does not constrain anything is misleading — write the real condition or remove it.`,
+              entity: job,
+              lexicon: "gitlab",
+            });
+          }
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgl042.test.ts

@@ -0,0 +1,45 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl042 } from "./wgl042";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["gitlab", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WGL042: unreachable rules after unconditional match", () => {
+  test("flags a rule after an unconditional catch-all", () => {
+    const yaml = `deploy:
+  rules:
+    - when: always
+    - if: $CI_COMMIT_BRANCH == "main"
+  script:
+    - echo deploy
+`;
+    const diags = wgl042.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL042");
+    expect(diags[0].entity).toBe("deploy");
+  });
+
+  test("does not flag a trailing when: never default", () => {
+    const yaml = `deploy:
+  rules:
+    - if: $CI_COMMIT_BRANCH == "main"
+    - when: never
+  script:
+    - echo deploy
+`;
+    const diags = wgl042.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl042.ts

@@ -0,0 +1,46 @@
+/**
+ * WGL042: Unreachable rules After an Unconditional Match
+ *
+ * GitLab evaluates `rules:` top-down and the first match wins. A rule with no
+ * `if:` (and not `when: never`) matches every pipeline, so any rule listed after
+ * it is dead — it can never be reached. Such dead rules usually mean the gate
+ * the author intended is not actually applied. Reorder so specific rules precede
+ * the catch-all.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs, extractJobSection, extractJobRules } from "./yaml-helpers";
+
+export const wgl042: PostSynthCheck = {
+  id: "WGL042",
+  description: "Unreachable rules after an unconditional match",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const [job] of extractJobs(yaml)) {
+        const section = extractJobSection(yaml, job);
+        if (!section) continue;
+        const rules = extractJobRules(section);
+        for (let i = 0; i < rules.length - 1; i++) {
+          const r = rules[i];
+          const unconditional = !r.if && r.when !== "never";
+          if (unconditional) {
+            diagnostics.push({
+              checkId: "WGL042",
+              severity: "warning",
+              message: `Job "${job}" has an unconditional rule at position ${i + 1} that matches every pipeline, making the ${rules.length - i - 1} rule(s) after it unreachable. Put specific rules before the catch-all.`,
+              entity: job,
+              lexicon: "gitlab",
+            });
+            break;
+          }
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgl043.test.ts

@@ -0,0 +1,43 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl043 } from "./wgl043";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["gitlab", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WGL043: match-anything regex gate", () => {
+  test("flags a =~ /.*/ gate", () => {
+    const yaml = `deploy:
+  rules:
+    - if: $CI_COMMIT_REF_NAME =~ /.*/
+  script:
+    - echo deploy
+`;
+    const diags = wgl043.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL043");
+    expect(diags[0].entity).toBe("deploy");
+  });
+
+  test("does not flag a specific regex", () => {
+    const yaml = `deploy:
+  rules:
+    - if: $CI_COMMIT_REF_NAME =~ /^release/
+  script:
+    - echo deploy
+`;
+    const diags = wgl043.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl043.ts

@@ -0,0 +1,45 @@
+/**
+ * WGL043: Match-Anything Regex Gate
+ *
+ * Flags a `rules:if` whose regex match (`=~`) uses a pattern that matches every
+ * value — an empty regex, dot-star, or an anchored dot-star. The condition reads
+ * like a filter on a ref or variable but admits everything, so it gates nothing.
+ * This is how an unsound condition is obscured behind a regex. Tighten the
+ * pattern or remove the gate.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs, extractJobSection, extractJobRules } from "./yaml-helpers";
+
+// `=~` followed by a regex literal that matches anything.
+const MATCH_ANYTHING = /=~\s*\/(?:|\.\*|\^\.\*\$|\^\.\*|\.\*\$)\//;
+
+export const wgl043: PostSynthCheck = {
+  id: "WGL043",
+  description: "Match-anything regex gate in rules:if",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const [job] of extractJobs(yaml)) {
+        const section = extractJobSection(yaml, job);
+        if (!section) continue;
+        for (const rule of extractJobRules(section)) {
+          if (rule.if && MATCH_ANYTHING.test(rule.if)) {
+            diagnostics.push({
+              checkId: "WGL043",
+              severity: "warning",
+              message: `Job "${job}" gates on a regex that matches everything ("${rule.if}") — the rule reads like a filter but admits every value. Tighten the pattern or remove the gate.`,
+              entity: job,
+              lexicon: "gitlab",
+            });
+          }
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};