@intentius/chant-lexicon-gitlab 0.1.23 → 0.3.0

package/src/lint/post-synth/wgl044.test.ts

@@ -0,0 +1,46 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl044 } from "./wgl044";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["gitlab", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WGL044: public artifacts", () => {
+  test("flags artifacts:public: true", () => {
+    const yaml = `build:
+  artifacts:
+    public: true
+    paths:
+      - dist/
+  script:
+    - make
+`;
+    const diags = wgl044.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL044");
+    expect(diags[0].entity).toBe("build");
+  });
+
+  test("does not flag private artifacts", () => {
+    const yaml = `build:
+  artifacts:
+    paths:
+      - dist/
+  script:
+    - make
+`;
+    const diags = wgl044.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl044.ts

@@ -0,0 +1,41 @@
+/**
+ * WGL044: Public Artifacts
+ *
+ * Flags `artifacts:public: true`. Public artifacts are downloadable by anyone,
+ * including unauthenticated users for public projects, exposing build output and
+ * anything swept into it. Keep artifacts private unless they are deliberately
+ * meant to be world-readable.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs, extractJobSection } from "./yaml-helpers";
+
+const PUBLIC_ARTIFACTS = /^\s+public:\s*true\s*$/m;
+
+export const wgl044: PostSynthCheck = {
+  id: "WGL044",
+  description: "Public artifacts expose build output",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const [job] of extractJobs(yaml)) {
+        const section = extractJobSection(yaml, job);
+        if (!section || !/^\s+artifacts:/m.test(section)) continue;
+        if (PUBLIC_ARTIFACTS.test(section)) {
+          diagnostics.push({
+            checkId: "WGL044",
+            severity: "warning",
+            message: `Job "${job}" publishes public artifacts (artifacts:public: true), downloadable by anyone. Keep them private unless they are meant to be world-readable.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgl045.test.ts

@@ -0,0 +1,48 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl045 } from "./wgl045";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["gitlab", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WGL045: credential-bearing artifact path", () => {
+  test("flags an artifact path that captures .env", () => {
+    const yaml = `build:
+  artifacts:
+    paths:
+      - dist/
+      - .env
+  script:
+    - make
+`;
+    const diags = wgl045.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL045");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].message).toContain(".env");
+  });
+
+  test("does not flag ordinary build output paths", () => {
+    const yaml = `build:
+  artifacts:
+    paths:
+      - dist/
+      - build/output.js
+  script:
+    - make
+`;
+    const diags = wgl045.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl045.ts

@@ -0,0 +1,57 @@
+/**
+ * WGL045: Credential-Bearing Artifact Path
+ *
+ * Flags an `artifacts:paths:` entry that looks like it would sweep a credential
+ * or sensitive file into the artifact (`.env`, `*.pem`, `id_rsa`, `*.key`,
+ * `.npmrc`, `.netrc`, `credentials`). Artifacts flow to later stages and are
+ * downloadable, so a captured credential leaks across the boundary. Exclude the
+ * sensitive file from the artifact path.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs, extractJobSection } from "./yaml-helpers";
+
+const CREDENTIAL_PATH = /(^|\/)(\.env(\.|$)|\.npmrc|\.netrc|id_rsa|.*\.pem|.*\.key|.*\.p12|credentials?(\.|$))/i;
+
+export const wgl045: PostSynthCheck = {
+  id: "WGL045",
+  description: "Artifact path that may capture a credential file",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const [job] of extractJobs(yaml)) {
+        const section = extractJobSection(yaml, job);
+        if (!section) continue;
+        // Collect the lines under the artifacts: block (deeper indent than the key).
+        const lines = section.split("\n");
+        const artifactsIdx = lines.findIndex((l) => /^\s+artifacts:\s*$/.test(l));
+        if (artifactsIdx === -1) continue;
+        const artifactsIndent = lines[artifactsIdx].search(/\S/);
+        const blockLines: string[] = [];
+        for (let i = artifactsIdx + 1; i < lines.length; i++) {
+          if (lines[i].trim() === "") continue;
+          if (lines[i].search(/\S/) <= artifactsIndent) break;
+          blockLines.push(lines[i]);
+        }
+        const hit = blockLines
+          .filter((l) => /^\s+-\s+/.test(l))
+          .map((l) => l.replace(/^\s+-\s+/, "").trim().replace(/^['"]|['"]$/g, ""))
+          .find((p) => CREDENTIAL_PATH.test(p));
+        if (hit) {
+          diagnostics.push({
+            checkId: "WGL045",
+            severity: "error",
+            message: `Job "${job}" includes a credential-like file ("${hit}") in its artifacts. Exclude it — artifacts are passed downstream and are downloadable.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgl046.test.ts

@@ -0,0 +1,67 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl046 } from "./wgl046";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["gitlab", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WGL046: cache populated in a merge-request pipeline", () => {
+  test("flags a cache write reachable from merge requests", () => {
+    const yaml = `build:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  cache:
+    key: build-cache
+    paths:
+      - node_modules/
+  script:
+    - npm ci
+`;
+    const diags = wgl046.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL046");
+    expect(diags[0].entity).toBe("build");
+  });
+
+  test("does not flag a pull-only cache", () => {
+    const yaml = `build:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  cache:
+    key: build-cache
+    paths:
+      - node_modules/
+    policy: pull
+  script:
+    - npm ci
+`;
+    const diags = wgl046.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+
+  test("does not flag a cache on a protected-only job", () => {
+    const yaml = `build:
+  rules:
+    - if: $CI_COMMIT_BRANCH == "main"
+  cache:
+    key: build-cache
+    paths:
+      - node_modules/
+  script:
+    - npm ci
+`;
+    const diags = wgl046.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl046.ts

@@ -0,0 +1,43 @@
+/**
+ * WGL046: Cache Populated in a Merge-Request Pipeline (Poisoning Risk)
+ *
+ * Flags a job that writes a cache (`cache:` with a push policy) and is reachable
+ * from merge-request pipelines. An outside contributor's MR can populate the
+ * cache; a later protected run that restores the same key then executes
+ * attacker-influenced contents. Restrict cache writes to protected refs, or
+ * scope cache keys so MR pipelines cannot write entries a protected run reads.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractJobs, extractJobSection, isMergeRequestReachable } from "./yaml-helpers";
+
+export const wgl046: PostSynthCheck = {
+  id: "WGL046",
+  description: "Cache populated in a merge-request pipeline (poisoning risk)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      for (const [job] of extractJobs(yaml)) {
+        const section = extractJobSection(yaml, job);
+        if (!section || !/^\s+cache:/m.test(section)) continue;
+        if (!isMergeRequestReachable(section)) continue;
+        // pull-only caches cannot poison; flag push/pull-push (the default when policy is absent)
+        const policyMatch = section.match(/^\s+policy:\s*(\S+)/m);
+        const policy = policyMatch ? policyMatch[1].replace(/^['"]|['"]$/g, "") : "pull-push";
+        if (policy === "pull") continue;
+        diagnostics.push({
+          checkId: "WGL046",
+          severity: "warning",
+          message: `Job "${job}" writes a cache and is reachable from merge-request pipelines. An MR can poison the cache for a later protected run that restores the same key — restrict cache writes to protected refs or scope the key.`,
+          entity: job,
+          lexicon: "gitlab",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgl047.test.ts

@@ -0,0 +1,40 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl047 } from "./wgl047";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["gitlab", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WGL047: curl | bash runtime execution", () => {
+  test("flags curl piped to bash", () => {
+    const yaml = `build:
+  script:
+    - curl -sSL https://example.com/install.sh | bash
+`;
+    const diags = wgl047.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL047");
+    expect(diags[0].entity).toBe("build");
+  });
+
+  test("does not flag download-then-run on separate lines", () => {
+    const yaml = `build:
+  script:
+    - curl -sSLo install.sh https://example.com/install.sh
+    - bash install.sh
+`;
+    const diags = wgl047.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl047.ts

@@ -0,0 +1,41 @@
+/**
+ * WGL047: Software Fetched and Executed at Runtime Without Verification
+ *
+ * Flags a `script:` command that pipes a network download straight into a shell
+ * (`curl ... | bash`, `wget ... | sh`). The fetched script is unpinned and
+ * unverified, so whoever controls the URL controls what runs in the job.
+ * Download to a file, verify a checksum/signature, then execute it.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput, extractScriptCommands } from "./yaml-helpers";
+
+const PIPE_TO_SHELL = /\b(curl|wget)\b[^\n|]*\|\s*(sudo\s+)?(ba)?sh\b/i;
+
+export const wgl047: PostSynthCheck = {
+  id: "WGL047",
+  description: "Software fetched and piped to a shell without verification",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      const seen = new Set<string>();
+      for (const { job, command } of extractScriptCommands(yaml)) {
+        if (PIPE_TO_SHELL.test(command) && !seen.has(job)) {
+          seen.add(job);
+          diagnostics.push({
+            checkId: "WGL047",
+            severity: "warning",
+            message: `Job "${job}" pipes a network download directly into a shell — the fetched code is unpinned and unverified. Download to a file, verify a checksum or signature, then execute it.`,
+            entity: job,
+            lexicon: "gitlab",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wgl048.test.ts

@@ -0,0 +1,56 @@
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { wgl048 } from "./wgl048";
+
+function makeCtx(yaml: string): PostSynthContext {
+  return {
+    outputs: new Map([["gitlab", yaml]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["gitlab", yaml]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WGL048: pipeline without a name", () => {
+  test("flags a workflow: block with no name", () => {
+    const yaml = `workflow:
+  rules:
+    - if: $CI_COMMIT_BRANCH
+
+build:
+  script:
+    - make
+`;
+    const diags = wgl048.check(makeCtx(yaml));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WGL048");
+  });
+
+  test("does not flag a named workflow", () => {
+    const yaml = `workflow:
+  name: My Pipeline
+  rules:
+    - if: $CI_COMMIT_BRANCH
+
+build:
+  script:
+    - make
+`;
+    const diags = wgl048.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+
+  test("does not flag a pipeline with no workflow block", () => {
+    const yaml = `build:
+  script:
+    - make
+`;
+    const diags = wgl048.check(makeCtx(yaml));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/wgl048.ts

@@ -0,0 +1,37 @@
+/**
+ * WGL048: Pipeline Without a Name
+ *
+ * Flags a pipeline that defines a `workflow:` block but no `workflow:name:`.
+ * A pipeline name shows up in the GitLab UI and audit output; naming pipelines
+ * makes runs easier to identify and review. Only flags pipelines that already
+ * customize `workflow:` (where a name is cheap to add and most useful).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { getPrimaryOutput } from "./yaml-helpers";
+
+export const wgl048: PostSynthCheck = {
+  id: "WGL048",
+  description: "Pipeline defines workflow: but no workflow:name",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      const yaml = getPrimaryOutput(output);
+      const workflowSection = yaml.split("\n\n").find((s) => /^workflow:/.test(s));
+      if (!workflowSection) continue;
+      if (!/^\s+name:/m.test(workflowSection)) {
+        diagnostics.push({
+          checkId: "WGL048",
+          severity: "info",
+          message: `The pipeline defines a workflow: block but no workflow:name. Add a name so runs are identifiable in the GitLab UI and audit output.`,
+          entity: "workflow",
+          lexicon: "gitlab",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};