@intentius/chant-lexicon-gitlab 0.124.30 → 0.124.32

package/dist/lint/post-synth/wgl032.js

@@ -0,0 +1,64 @@
+/**
+ * WGL032: Include/Component Source Resembling a Well-Known Project
+ *
+ * Flags an `include:project` path or `component:` source that is a near-miss
+ * (edit distance 1–2) of a well-known GitLab CI source but not an exact match —
+ * a likely typo or an impersonation of the trusted project. Advisory; backed by
+ * a vendored reference list.
+ */
+import { getPrimaryOutput, extractIncludes } from "./yaml-helpers.js";
+import { KNOWN_INCLUDE_SOURCES, editDistance } from "../rules/data/known-include-sources.js";
+const KNOWN = new Set(KNOWN_INCLUDE_SOURCES);
+/** Reduce a component address (`host/group/name@ver`) or project path to its group/name path. */
+function sourcePath(value, kind) {
+    let v = value;
+    if (kind === "component") {
+        const at = v.lastIndexOf("@");
+        if (at !== -1)
+            v = v.slice(0, at);
+        const slash = v.indexOf("/");
+        if (slash !== -1 && v.slice(0, slash).includes("."))
+            v = v.slice(slash + 1); // drop host
+    }
+    return v;
+}
+export function nearestKnownSource(path) {
+    if (KNOWN.has(path))
+        return undefined;
+    let best;
+    let bestDist = 3;
+    for (const known of KNOWN) {
+        const d = editDistance(path, known, 2);
+        if (d >= 1 && d <= 2 && d < bestDist) {
+            best = known;
+            bestDist = d;
+        }
+    }
+    return best;
+}
+export const wgl032 = {
+    id: "WGL032",
+    description: "Include/component source resembles a well-known project (possible impersonation)",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const entry of extractIncludes(yaml)) {
+                if (entry.kind !== "project" && entry.kind !== "component")
+                    continue;
+                const path = sourcePath(entry.value, entry.kind);
+                const lookAlike = nearestKnownSource(path);
+                if (!lookAlike)
+                    continue;
+                diagnostics.push({
+                    checkId: "WGL032",
+                    severity: "warning",
+                    message: `Include source "${path}" closely resembles the well-known "${lookAlike}". Confirm the source is who you intend — this may be a typo or impersonation.`,
+                    entity: entry.value,
+                    lexicon: "gitlab",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl033.js

@@ -0,0 +1,32 @@
+/**
+ * WGL033: OIDC id_token Without a Scoped Audience
+ *
+ * Flags an `id_tokens:` declaration with no `aud:` or a wildcard audience. The
+ * audience binds the minted OIDC token to a specific relying party; without it
+ * (or with `*`), a leaked token is accepted anywhere, defeating the point of
+ * short-lived federated identity. Set `aud:` to the exact audience(s) needed.
+ */
+import { getPrimaryOutput, extractIdTokens } from "./yaml-helpers.js";
+export const wgl033 = {
+    id: "WGL033",
+    description: "OIDC id_token without a scoped audience",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const { job, name, aud } of extractIdTokens(yaml)) {
+                const broad = aud.length === 0 || aud.some((a) => a === "*" || a === "" || a.includes("*"));
+                if (broad) {
+                    diagnostics.push({
+                        checkId: "WGL033",
+                        severity: "warning",
+                        message: `Job "${job}" id_token "${name}" has ${aud.length === 0 ? "no aud:" : "a wildcard audience"}. Scope it to the exact audience the relying party expects so a leaked token cannot be used elsewhere.`,
+                        entity: job,
+                        lexicon: "gitlab",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl034.js

@@ -0,0 +1,37 @@
+/**
+ * WGL034: OIDC id_token Mintable from a Merge-Request Pipeline
+ *
+ * Flags a job that declares an `id_tokens:` (OIDC) and is reachable from
+ * merge-request pipelines. MR pipelines can be triggered by outside
+ * contributors, so a job that mints a cloud-federated token there hands fork
+ * code a path to your cloud roles. Gate OIDC jobs to protected refs, or require
+ * approval before they run.
+ */
+import { getPrimaryOutput, extractIdTokens, extractJobSection, isMergeRequestReachable } from "./yaml-helpers.js";
+export const wgl034 = {
+    id: "WGL034",
+    description: "OIDC id_token mintable from a merge-request pipeline",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            const seen = new Set();
+            for (const { job } of extractIdTokens(yaml)) {
+                if (seen.has(job))
+                    continue;
+                const section = extractJobSection(yaml, job);
+                if (section && isMergeRequestReachable(section)) {
+                    seen.add(job);
+                    diagnostics.push({
+                        checkId: "WGL034",
+                        severity: "warning",
+                        message: `Job "${job}" mints an OIDC id_token and is reachable from merge-request pipelines, which outside contributors can trigger. Restrict it to protected refs or require approval before it runs.`,
+                        entity: job,
+                        lexicon: "gitlab",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl035.js

@@ -0,0 +1,40 @@
+/**
+ * WGL035: Untrusted CI Variable Interpolated into a Script
+ *
+ * Flags an attacker-controllable predefined variable (branch/tag name, commit or
+ * merge-request title/description, author) referenced in a `script:` command. A
+ * crafted branch name or commit title containing shell metacharacters can break
+ * out of the command. Quote the reference and avoid using it in sensitive
+ * commands, or sanitize it first.
+ */
+import { getPrimaryOutput, extractScriptCommands } from "./yaml-helpers.js";
+import { UNTRUSTED_CI_VARIABLES, variableReferenced } from "../rules/data/untrusted-variables.js";
+export const wgl035 = {
+    id: "WGL035",
+    description: "Untrusted CI variable interpolated into a script command",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            const seen = new Set();
+            for (const { job, command } of extractScriptCommands(yaml)) {
+                for (const name of UNTRUSTED_CI_VARIABLES) {
+                    if (!variableReferenced(command, name))
+                        continue;
+                    const key = `${job}:${name}`;
+                    if (seen.has(key))
+                        continue;
+                    seen.add(key);
+                    diagnostics.push({
+                        checkId: "WGL035",
+                        severity: "warning",
+                        message: `Job "${job}" uses the attacker-controllable variable $${name} in a script command. A crafted value can inject shell commands — quote it ("$${name}") and avoid using it in sensitive commands, or sanitize it first.`,
+                        entity: job,
+                        lexicon: "gitlab",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl036.js

@@ -0,0 +1,38 @@
+/**
+ * WGL036: Privileged Service / Docker-in-Docker Reachable from Merge Requests
+ *
+ * Flags a job that uses Docker-in-Docker (a privileged service) and is reachable
+ * from merge-request pipelines. MR pipelines can run code from an outside
+ * contributor; a privileged DinD service shares the host daemon socket and can
+ * be used to escape the build and reach the runner. Restrict privileged services
+ * to protected refs, or require approval before such jobs run.
+ *
+ * Complements WGL026 (DinD without TLS) by adding the trust-boundary dimension.
+ */
+import { getPrimaryOutput, extractJobs, extractJobSection, isMergeRequestReachable } from "./yaml-helpers.js";
+const DIND_RE = /docker:[\w.-]*dind|dind|privileged:\s*true/;
+export const wgl036 = {
+    id: "WGL036",
+    description: "Privileged service / DinD reachable from merge-request pipelines",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const [job] of extractJobs(yaml)) {
+                const section = extractJobSection(yaml, job);
+                if (!section)
+                    continue;
+                if (DIND_RE.test(section) && isMergeRequestReachable(section)) {
+                    diagnostics.push({
+                        checkId: "WGL036",
+                        severity: "warning",
+                        message: `Job "${job}" runs a privileged Docker-in-Docker service and is reachable from merge-request pipelines, which outside contributors can trigger. Restrict privileged services to protected refs or require approval.`,
+                        entity: job,
+                        lexicon: "gitlab",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl037.js

@@ -0,0 +1,41 @@
+/**
+ * WGL037: Security Gate on a Regex Match of an Untrusted Ref
+ *
+ * Flags a `rules:if` that gates execution on a regex match (`=~`) over an
+ * attacker-controllable ref variable (e.g. `$CI_COMMIT_REF_NAME =~ /^release/`).
+ * An outside contributor can craft a branch name that satisfies the pattern
+ * (`release-evil`), passing a gate meant for trusted refs. Match the full ref
+ * with `==`, or gate on a protected condition instead.
+ */
+import { getPrimaryOutput, extractJobs, extractJobSection } from "./yaml-helpers.js";
+import { UNTRUSTED_CI_VARIABLES } from "../rules/data/untrusted-variables.js";
+const REF_VARS = ["CI_COMMIT_REF_NAME", "CI_COMMIT_REF_SLUG", "CI_COMMIT_BRANCH", "CI_COMMIT_TAG", "CI_MERGE_REQUEST_SOURCE_BRANCH_NAME"]
+    .filter((v) => UNTRUSTED_CI_VARIABLES.includes(v));
+export const wgl037 = {
+    id: "WGL037",
+    description: "Security gate on a regex match of an untrusted ref variable",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const [job] of extractJobs(yaml)) {
+                const section = extractJobSection(yaml, job);
+                if (!section)
+                    continue;
+                // Look at `if:` lines that use a regex match against an untrusted ref var.
+                const ifLines = section.split("\n").filter((l) => /if:\s/.test(l));
+                const flagged = ifLines.some((l) => /=~/.test(l) && REF_VARS.some((v) => l.includes(`$${v}`)));
+                if (flagged) {
+                    diagnostics.push({
+                        checkId: "WGL037",
+                        severity: "warning",
+                        message: `Job "${job}" gates on a regex match (=~) of an attacker-controllable ref variable. A crafted branch/tag name can satisfy the pattern — match the full ref with == or gate on a protected condition.`,
+                        entity: job,
+                        lexicon: "gitlab",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl038.js

@@ -0,0 +1,43 @@
+/**
+ * WGL038: Secret Reachable from a Merge-Request Pipeline
+ *
+ * Flags a user-defined secret-like variable (`*_PASSWORD`, `*_SECRET`,
+ * `*_TOKEN`, `*_API_KEY`, …) referenced in a job reachable from merge-request
+ * pipelines. Those pipelines can run an outside contributor's code, so a secret
+ * they can read is a secret they can exfiltrate. Gate secret-using jobs to
+ * protected refs, or make the variable protected so MR pipelines can't see it.
+ *
+ * Built-in `CI_*` variables are project-managed and excluded.
+ */
+import { getPrimaryOutput, extractJobs, extractJobSection, isMergeRequestReachable } from "./yaml-helpers.js";
+const SECRET_VAR = /\$\{?((?!CI_)[A-Z][A-Z0-9_]*(?:PASSWORD|SECRET|TOKEN|API[_-]?KEY|PRIVATE[_-]?KEY|CREDENTIALS?))\}?/g;
+export const wgl038 = {
+    id: "WGL038",
+    description: "Secret-like variable reachable from a merge-request pipeline",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const [job] of extractJobs(yaml)) {
+                const section = extractJobSection(yaml, job);
+                if (!section || !isMergeRequestReachable(section))
+                    continue;
+                const found = new Set();
+                let m;
+                SECRET_VAR.lastIndex = 0;
+                while ((m = SECRET_VAR.exec(section)) !== null)
+                    found.add(m[1]);
+                if (found.size > 0) {
+                    diagnostics.push({
+                        checkId: "WGL038",
+                        severity: "warning",
+                        message: `Job "${job}" reads secret-like variable(s) ${[...found].map((v) => `$${v}`).join(", ")} and is reachable from merge-request pipelines, which can run untrusted code. Gate it to protected refs or mark the variable protected.`,
+                        entity: job,
+                        lexicon: "gitlab",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl039.js

@@ -0,0 +1,34 @@
+/**
+ * WGL039: Secret Echoed to Job Logs
+ *
+ * Flags a `script:` command that prints a secret-like variable (`echo`,
+ * `printf`, `print`, `cat`) — even masked variables leak when transformed
+ * (base64, reversed) before printing, and job logs are broadly readable.
+ * Remove the debug print or pipe the value where it is needed without echoing it.
+ */
+import { getPrimaryOutput, extractScriptCommands } from "./yaml-helpers.js";
+const PRINT_SECRET = /\b(echo|printf|print|cat)\b[^\n]*\$\{?[A-Z][A-Z0-9_]*(?:PASSWORD|SECRET|TOKEN|API[_-]?KEY|PRIVATE[_-]?KEY|CREDENTIALS?)\}?/i;
+export const wgl039 = {
+    id: "WGL039",
+    description: "Secret-like variable printed to job logs",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            const seen = new Set();
+            for (const { job, command } of extractScriptCommands(yaml)) {
+                if (PRINT_SECRET.test(command) && !seen.has(job)) {
+                    seen.add(job);
+                    diagnostics.push({
+                        checkId: "WGL039",
+                        severity: "warning",
+                        message: `Job "${job}" prints a secret-like variable to the job log. Logs are broadly readable and masking can be defeated by transforms — remove the print.`,
+                        entity: job,
+                        lexicon: "gitlab",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl040.js

@@ -0,0 +1,35 @@
+/**
+ * WGL040: Hardcoded Credential in a Registry Login
+ *
+ * Flags a `docker login` (or compatible) in a `script:` that passes a literal
+ * password via `-p` / `--password` instead of a variable or `--password-stdin`.
+ * An inlined credential sits in the committed pipeline and the job log. Use a
+ * masked CI/CD variable and `--password-stdin`. Extends WGL016 to scripts.
+ */
+import { getPrimaryOutput, extractScriptCommands } from "./yaml-helpers.js";
+// docker/podman/buildah/helm login with -p/--password followed by a non-variable literal
+const LITERAL_LOGIN = /\b(?:docker|podman|buildah|helm|crane|skopeo)\b[^\n]*\blogin\b[^\n]*(?:-p|--password)[=\s]+(?!["']?\$)["']?[^\s"']+/i;
+export const wgl040 = {
+    id: "WGL040",
+    description: "Hardcoded credential in a registry login command",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            const seen = new Set();
+            for (const { job, command } of extractScriptCommands(yaml)) {
+                if (LITERAL_LOGIN.test(command) && !seen.has(job)) {
+                    seen.add(job);
+                    diagnostics.push({
+                        checkId: "WGL040",
+                        severity: "error",
+                        message: `Job "${job}" passes a hardcoded password to a registry login. Use a masked CI/CD variable with --password-stdin instead of inlining the credential.`,
+                        entity: job,
+                        lexicon: "gitlab",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl041.js

@@ -0,0 +1,53 @@
+/**
+ * WGL041: Logically Unsound rules:if Condition
+ *
+ * Flags a `rules:if` that reads like a gate but is a constant — both sides of an
+ * `==`/`!=` are identical, so the condition is always true or always false.
+ * Generalizes WGL011 (rules that always evaluate to never) to tautological
+ * conditions presented as gates.
+ */
+import { getPrimaryOutput, extractJobs, extractJobSection, extractJobRules } from "./yaml-helpers.js";
+function strip(s) {
+    return s.trim().replace(/^['"]|['"]$/g, "").trim();
+}
+/** Classify an `if:` expression as a tautology, returning a reason or undefined. */
+export function tautologyReason(expr) {
+    const e = strip(expr).replace(/^\$\{?/, "$").trim();
+    const eq = e.match(/^(\S.*?)\s*==\s*(\S.*?)$/);
+    if (eq && strip(eq[1]) === strip(eq[2]))
+        return "always true (both sides of == are identical)";
+    const ne = e.match(/^(\S.*?)\s*!=\s*(\S.*?)$/);
+    if (ne && strip(ne[1]) === strip(ne[2]))
+        return "always false (both sides of != are identical)";
+    return undefined;
+}
+export const wgl041 = {
+    id: "WGL041",
+    description: "Logically unsound (tautological) rules:if condition",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const [job] of extractJobs(yaml)) {
+                const section = extractJobSection(yaml, job);
+                if (!section)
+                    continue;
+                for (const rule of extractJobRules(section)) {
+                    if (!rule.if)
+                        continue;
+                    const reason = tautologyReason(rule.if);
+                    if (reason) {
+                        diagnostics.push({
+                            checkId: "WGL041",
+                            severity: "warning",
+                            message: `Job "${job}" has a rules:if that is ${reason}: "${rule.if}". A gate that does not constrain anything is misleading — write the real condition or remove it.`,
+                            entity: job,
+                            lexicon: "gitlab",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl042.js

@@ -0,0 +1,41 @@
+/**
+ * WGL042: Unreachable rules After an Unconditional Match
+ *
+ * GitLab evaluates `rules:` top-down and the first match wins. A rule with no
+ * `if:` (and not `when: never`) matches every pipeline, so any rule listed after
+ * it is dead — it can never be reached. Such dead rules usually mean the gate
+ * the author intended is not actually applied. Reorder so specific rules precede
+ * the catch-all.
+ */
+import { getPrimaryOutput, extractJobs, extractJobSection, extractJobRules } from "./yaml-helpers.js";
+export const wgl042 = {
+    id: "WGL042",
+    description: "Unreachable rules after an unconditional match",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const [job] of extractJobs(yaml)) {
+                const section = extractJobSection(yaml, job);
+                if (!section)
+                    continue;
+                const rules = extractJobRules(section);
+                for (let i = 0; i < rules.length - 1; i++) {
+                    const r = rules[i];
+                    const unconditional = !r.if && r.when !== "never";
+                    if (unconditional) {
+                        diagnostics.push({
+                            checkId: "WGL042",
+                            severity: "warning",
+                            message: `Job "${job}" has an unconditional rule at position ${i + 1} that matches every pipeline, making the ${rules.length - i - 1} rule(s) after it unreachable. Put specific rules before the catch-all.`,
+                            entity: job,
+                            lexicon: "gitlab",
+                        });
+                        break;
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl043.js

@@ -0,0 +1,39 @@
+/**
+ * WGL043: Match-Anything Regex Gate
+ *
+ * Flags a `rules:if` whose regex match (`=~`) uses a pattern that matches every
+ * value — an empty regex, dot-star, or an anchored dot-star. The condition reads
+ * like a filter on a ref or variable but admits everything, so it gates nothing.
+ * This is how an unsound condition is obscured behind a regex. Tighten the
+ * pattern or remove the gate.
+ */
+import { getPrimaryOutput, extractJobs, extractJobSection, extractJobRules } from "./yaml-helpers.js";
+// `=~` followed by a regex literal that matches anything.
+const MATCH_ANYTHING = /=~\s*\/(?:|\.\*|\^\.\*\$|\^\.\*|\.\*\$)\//;
+export const wgl043 = {
+    id: "WGL043",
+    description: "Match-anything regex gate in rules:if",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const [job] of extractJobs(yaml)) {
+                const section = extractJobSection(yaml, job);
+                if (!section)
+                    continue;
+                for (const rule of extractJobRules(section)) {
+                    if (rule.if && MATCH_ANYTHING.test(rule.if)) {
+                        diagnostics.push({
+                            checkId: "WGL043",
+                            severity: "warning",
+                            message: `Job "${job}" gates on a regex that matches everything ("${rule.if}") — the rule reads like a filter but admits every value. Tighten the pattern or remove the gate.`,
+                            entity: job,
+                            lexicon: "gitlab",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl044.js

@@ -0,0 +1,35 @@
+/**
+ * WGL044: Public Artifacts
+ *
+ * Flags `artifacts:public: true`. Public artifacts are downloadable by anyone,
+ * including unauthenticated users for public projects, exposing build output and
+ * anything swept into it. Keep artifacts private unless they are deliberately
+ * meant to be world-readable.
+ */
+import { getPrimaryOutput, extractJobs, extractJobSection } from "./yaml-helpers.js";
+const PUBLIC_ARTIFACTS = /^\s+public:\s*true\s*$/m;
+export const wgl044 = {
+    id: "WGL044",
+    description: "Public artifacts expose build output",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const [job] of extractJobs(yaml)) {
+                const section = extractJobSection(yaml, job);
+                if (!section || !/^\s+artifacts:/m.test(section))
+                    continue;
+                if (PUBLIC_ARTIFACTS.test(section)) {
+                    diagnostics.push({
+                        checkId: "WGL044",
+                        severity: "warning",
+                        message: `Job "${job}" publishes public artifacts (artifacts:public: true), downloadable by anyone. Keep them private unless they are meant to be world-readable.`,
+                        entity: job,
+                        lexicon: "gitlab",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl045.js

@@ -0,0 +1,54 @@
+/**
+ * WGL045: Credential-Bearing Artifact Path
+ *
+ * Flags an `artifacts:paths:` entry that looks like it would sweep a credential
+ * or sensitive file into the artifact (`.env`, `*.pem`, `id_rsa`, `*.key`,
+ * `.npmrc`, `.netrc`, `credentials`). Artifacts flow to later stages and are
+ * downloadable, so a captured credential leaks across the boundary. Exclude the
+ * sensitive file from the artifact path.
+ */
+import { getPrimaryOutput, extractJobs, extractJobSection } from "./yaml-helpers.js";
+const CREDENTIAL_PATH = /(^|\/)(\.env(\.|$)|\.npmrc|\.netrc|id_rsa|.*\.pem|.*\.key|.*\.p12|credentials?(\.|$))/i;
+export const wgl045 = {
+    id: "WGL045",
+    description: "Artifact path that may capture a credential file",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const [job] of extractJobs(yaml)) {
+                const section = extractJobSection(yaml, job);
+                if (!section)
+                    continue;
+                // Collect the lines under the artifacts: block (deeper indent than the key).
+                const lines = section.split("\n");
+                const artifactsIdx = lines.findIndex((l) => /^\s+artifacts:\s*$/.test(l));
+                if (artifactsIdx === -1)
+                    continue;
+                const artifactsIndent = lines[artifactsIdx].search(/\S/);
+                const blockLines = [];
+                for (let i = artifactsIdx + 1; i < lines.length; i++) {
+                    if (lines[i].trim() === "")
+                        continue;
+                    if (lines[i].search(/\S/) <= artifactsIndent)
+                        break;
+                    blockLines.push(lines[i]);
+                }
+                const hit = blockLines
+                    .filter((l) => /^\s+-\s+/.test(l))
+                    .map((l) => l.replace(/^\s+-\s+/, "").trim().replace(/^['"]|['"]$/g, ""))
+                    .find((p) => CREDENTIAL_PATH.test(p));
+                if (hit) {
+                    diagnostics.push({
+                        checkId: "WGL045",
+                        severity: "error",
+                        message: `Job "${job}" includes a credential-like file ("${hit}") in its artifacts. Exclude it — artifacts are passed downstream and are downloadable.`,
+                        entity: job,
+                        lexicon: "gitlab",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl046.js

@@ -0,0 +1,40 @@
+/**
+ * WGL046: Cache Populated in a Merge-Request Pipeline (Poisoning Risk)
+ *
+ * Flags a job that writes a cache (`cache:` with a push policy) and is reachable
+ * from merge-request pipelines. An outside contributor's MR can populate the
+ * cache; a later protected run that restores the same key then executes
+ * attacker-influenced contents. Restrict cache writes to protected refs, or
+ * scope cache keys so MR pipelines cannot write entries a protected run reads.
+ */
+import { getPrimaryOutput, extractJobs, extractJobSection, isMergeRequestReachable } from "./yaml-helpers.js";
+export const wgl046 = {
+    id: "WGL046",
+    description: "Cache populated in a merge-request pipeline (poisoning risk)",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const [job] of extractJobs(yaml)) {
+                const section = extractJobSection(yaml, job);
+                if (!section || !/^\s+cache:/m.test(section))
+                    continue;
+                if (!isMergeRequestReachable(section))
+                    continue;
+                // pull-only caches cannot poison; flag push/pull-push (the default when policy is absent)
+                const policyMatch = section.match(/^\s+policy:\s*(\S+)/m);
+                const policy = policyMatch ? policyMatch[1].replace(/^['"]|['"]$/g, "") : "pull-push";
+                if (policy === "pull")
+                    continue;
+                diagnostics.push({
+                    checkId: "WGL046",
+                    severity: "warning",
+                    message: `Job "${job}" writes a cache and is reachable from merge-request pipelines. An MR can poison the cache for a later protected run that restores the same key — restrict cache writes to protected refs or scope the key.`,
+                    entity: job,
+                    lexicon: "gitlab",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};