@intentius/chant-lexicon-gitlab 0.124.31 → 0.124.32

package/dist/lint/post-synth/wgl047.js

@@ -0,0 +1,34 @@
+/**
+ * WGL047: Software Fetched and Executed at Runtime Without Verification
+ *
+ * Flags a `script:` command that pipes a network download straight into a shell
+ * (`curl ... | bash`, `wget ... | sh`). The fetched script is unpinned and
+ * unverified, so whoever controls the URL controls what runs in the job.
+ * Download to a file, verify a checksum/signature, then execute it.
+ */
+import { getPrimaryOutput, extractScriptCommands } from "./yaml-helpers.js";
+const PIPE_TO_SHELL = /\b(curl|wget)\b[^\n|]*\|\s*(sudo\s+)?(ba)?sh\b/i;
+export const wgl047 = {
+    id: "WGL047",
+    description: "Software fetched and piped to a shell without verification",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            const seen = new Set();
+            for (const { job, command } of extractScriptCommands(yaml)) {
+                if (PIPE_TO_SHELL.test(command) && !seen.has(job)) {
+                    seen.add(job);
+                    diagnostics.push({
+                        checkId: "WGL047",
+                        severity: "warning",
+                        message: `Job "${job}" pipes a network download directly into a shell — the fetched code is unpinned and unverified. Download to a file, verify a checksum or signature, then execute it.`,
+                        entity: job,
+                        lexicon: "gitlab",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl048.js

@@ -0,0 +1,32 @@
+/**
+ * WGL048: Pipeline Without a Name
+ *
+ * Flags a pipeline that defines a `workflow:` block but no `workflow:name:`.
+ * A pipeline name shows up in the GitLab UI and audit output; naming pipelines
+ * makes runs easier to identify and review. Only flags pipelines that already
+ * customize `workflow:` (where a name is cheap to add and most useful).
+ */
+import { getPrimaryOutput, topLevelSections } from "./yaml-helpers.js";
+export const wgl048 = {
+    id: "WGL048",
+    description: "Pipeline defines workflow: but no workflow:name",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            const workflowSection = topLevelSections(yaml).find((s) => s.key === "workflow")?.text;
+            if (!workflowSection)
+                continue;
+            if (!/^\s+name:/m.test(workflowSection)) {
+                diagnostics.push({
+                    checkId: "WGL048",
+                    severity: "info",
+                    message: `The pipeline defines a workflow: block but no workflow:name. Add a name so runs are identifiable in the GitLab UI and audit output.`,
+                    entity: "workflow",
+                    lexicon: "gitlab",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl049.js

@@ -0,0 +1,53 @@
+/**
+ * WGL049: Dependency Install Without a Cache
+ *
+ * Flags a job whose `script:` runs a package-manager install command (`npm
+ * ci`, `pip install`, `bundle install`, etc.) with no `cache:` in scope —
+ * neither on the job itself, nor at the pipeline's `default:`/top level.
+ * Every run re-fetches the same dependencies from a cold cache. A job that
+ * `extends:` another config is left alone — the cache may be inherited and
+ * this check has no way to confirm that. Efficiency (#444), not a
+ * correctness or security issue.
+ */
+import { getPrimaryOutput, extractJobs, extractJobSection, topLevelSections } from "./yaml-helpers.js";
+const DEP_INSTALL_RE = /\b(npm (install|ci)|yarn install|pnpm install|pip install|pip3 install|bundle install|composer install|go mod download|mvn (install|dependency:resolve))\b/i;
+function hasPipelineWideCache(yaml) {
+    const sections = topLevelSections(yaml);
+    if (sections.some((s) => s.key === "cache"))
+        return true;
+    const defaultSection = sections.find((s) => s.key === "default")?.text;
+    return !!defaultSection && /\n\s+cache:/.test(defaultSection);
+}
+export const wgl049 = {
+    id: "WGL049",
+    description: "Job installs dependencies with no cache: in scope",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            if (hasPipelineWideCache(yaml))
+                continue;
+            for (const [jobName, job] of extractJobs(yaml)) {
+                if (jobName.startsWith("."))
+                    continue; // hidden/template job, not run directly
+                if (job.extends && job.extends.length > 0)
+                    continue; // cache may be inherited; can't confirm
+                const section = extractJobSection(yaml, jobName);
+                if (!section)
+                    continue;
+                if (/^\s+cache:/m.test(section))
+                    continue; // job-level cache present
+                if (!DEP_INSTALL_RE.test(section))
+                    continue;
+                diagnostics.push({
+                    checkId: "WGL049",
+                    severity: "info",
+                    message: `Job "${jobName}" installs dependencies with no cache: in scope — every run re-fetches from the registry. Add a cache: covering the dependency directory.`,
+                    entity: jobName,
+                    lexicon: "gitlab",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgl050.js

@@ -0,0 +1,42 @@
+/**
+ * WGL050: Merge-Request Job Missing interruptible
+ *
+ * Flags a job reachable from merge-request pipelines that doesn't set
+ * `interruptible: true`. Without it, GitLab's auto-cancel-redundant-pipelines
+ * setting can't cancel the job when a new push supersedes it, so the runner
+ * keeps spending capacity on a pipeline nobody wants anymore. Deploy jobs are
+ * left alone — cancelling mid-deploy is its own hazard, not an efficiency
+ * win. Efficiency (#444), not a correctness or security issue.
+ */
+import { getPrimaryOutput, isMergeRequestReachable, extractJobs, extractJobSection } from "./yaml-helpers.js";
+export const wgl050 = {
+    id: "WGL050",
+    description: "Merge-request-reachable job is not interruptible",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            for (const [jobName] of extractJobs(yaml)) {
+                if (jobName.startsWith("."))
+                    continue;
+                const section = extractJobSection(yaml, jobName);
+                if (!section)
+                    continue;
+                if (/deploy/i.test(jobName))
+                    continue; // cancelling mid-deploy is a hazard, not a win
+                if (!isMergeRequestReachable(section))
+                    continue;
+                if (/^\s+interruptible:\s*true\s*$/m.test(section))
+                    continue;
+                diagnostics.push({
+                    checkId: "WGL050",
+                    severity: "info",
+                    message: `Job "${jobName}" runs on merge-request pipelines but is not interruptible: true — when a new commit supersedes this pipeline, this job keeps running instead of being cancelled. Add interruptible: true.`,
+                    entity: jobName,
+                    lexicon: "gitlab",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/yaml-helpers.js

@@ -0,0 +1,432 @@
+/**
+ * Helpers for parsing serialized GitLab CI YAML in post-synth checks.
+ *
+ * Jobs, stages and global variables are read with the structural parser
+ * (`parseYAML`, js-yaml with chant's schema). Checks that pattern-match a
+ * job's text get it from {@link extractJobSection}, which cuts the document
+ * at top-level keys rather than at blank lines, so it does not depend on the
+ * serializer's spacing.
+ */
+import { parseYAML } from "@intentius/chant/yaml";
+export { getPrimaryOutput } from "@intentius/chant/lint/post-synth";
+/**
+ * Top-level keys that are global keywords, not jobs. `image`, `services`,
+ * `cache`, `before_script` and `after_script` are the deprecated global
+ * forms of the `default:` keywords; `spec` is a CI component's header.
+ */
+export const RESERVED_TOP_LEVEL_KEYS = new Set([
+    "stages",
+    "variables",
+    "default",
+    "include",
+    "workflow",
+    "image",
+    "services",
+    "cache",
+    "before_script",
+    "after_script",
+    "spec",
+]);
+/** Parse the pipeline document; `undefined` when the YAML cannot be read. */
+export function parsePipeline(yaml) {
+    try {
+        const doc = parseYAML(yaml);
+        return doc && typeof doc === "object" && !Array.isArray(doc) ? doc : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function isMapping(v) {
+    return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function scalarString(v) {
+    if (typeof v === "string")
+        return v;
+    if (typeof v === "number" || typeof v === "boolean")
+        return String(v);
+    return undefined;
+}
+/**
+ * Every job in the pipeline as `[id, rawJobObject]`: each top-level key whose
+ * value is a mapping, minus the global keywords. Hidden jobs (ids starting
+ * with `.`, used as `extends:` templates) are included.
+ */
+export function jobEntries(yaml) {
+    const doc = parsePipeline(yaml);
+    if (!doc)
+        return [];
+    const out = [];
+    for (const [name, val] of Object.entries(doc)) {
+        if (RESERVED_TOP_LEVEL_KEYS.has(name))
+            continue;
+        if (isMapping(val))
+            out.push([name, val]);
+    }
+    return out;
+}
+/**
+ * Extract stages list from serialized YAML (block or flow list).
+ */
+export function extractStages(yaml) {
+    const stages = parsePipeline(yaml)?.stages;
+    if (!Array.isArray(stages))
+        return [];
+    return stages.map(scalarString).filter((s) => s !== undefined);
+}
+/**
+ * Extract jobs with their stage, `needs:` and `extends:` from serialized YAML.
+ *
+ * Built on the structural parser, so every job id is read (capitals, spaces,
+ * colons, quoted ids) and every `needs:` entry is read whatever keys follow
+ * `job:` in its map. The line-based version this replaced skipped ids that
+ * start with a capital and stopped reading a `needs:` list at an
+ * `artifacts: true` line (#3256). YAML the parser cannot read gives no jobs.
+ */
+export function extractJobs(yaml) {
+    const jobs = new Map();
+    for (const [name, obj] of jobEntries(yaml)) {
+        const job = { name };
+        const stage = scalarString(obj.stage);
+        if (stage !== undefined)
+            job.stage = stage;
+        if (obj.needs !== undefined && obj.needs !== null) {
+            const entries = Array.isArray(obj.needs) ? obj.needs : [obj.needs];
+            const needs = [];
+            const optional = [];
+            for (const entry of entries) {
+                const plain = scalarString(entry);
+                if (plain !== undefined) {
+                    needs.push(plain);
+                    continue;
+                }
+                if (!isMapping(entry))
+                    continue;
+                // Cross-pipeline needs name a job in another pipeline.
+                if ("pipeline" in entry || "project" in entry)
+                    continue;
+                const target = scalarString(entry.job);
+                if (target === undefined)
+                    continue;
+                needs.push(target);
+                if (entry.optional === true)
+                    optional.push(target);
+            }
+            job.needs = needs;
+            if (optional.length > 0)
+                job.optionalNeeds = optional;
+        }
+        if (obj.extends !== undefined && obj.extends !== null) {
+            const ext = Array.isArray(obj.extends) ? obj.extends : [obj.extends];
+            job.extends = ext.map(scalarString).filter((s) => s !== undefined);
+        }
+        jobs.set(name, job);
+    }
+    return jobs;
+}
+/**
+ * Check whether the YAML contains an `include:` directive.
+ * When includes are present, `needs:` and `extends:` may reference
+ * jobs/templates from included files, so checks should be lenient.
+ */
+export function hasInclude(yaml) {
+    return /^include:/m.test(yaml);
+}
+/**
+ * Extract global variables from serialized YAML. A variable in the expanded
+ * form (`value:` / `description:` / `options:`) maps to its `value`.
+ */
+export function extractGlobalVariables(yaml) {
+    const vars = new Map();
+    const variables = parsePipeline(yaml)?.variables;
+    if (!isMapping(variables))
+        return vars;
+    for (const [key, val] of Object.entries(variables)) {
+        const v = isMapping(val) ? scalarString(val.value) : scalarString(val);
+        vars.set(key, v ?? "");
+    }
+    return vars;
+}
+/**
+ * The key of a top-level mapping line (`build:`, `Build_Docs:`,
+ * `build:linux:`, `"deploy prod":`), unquoted, or undefined when the line
+ * does not start a top-level key.
+ */
+export function topLevelKey(line) {
+    if (line === "" || /^[\s#]/.test(line) || /^(---|\.\.\.)(\s|$)/.test(line) || line.startsWith("- "))
+        return undefined;
+    const dq = line.match(/^"((?:[^"\\]|\\.)*)"\s*:(?:\s|$)/);
+    if (dq) {
+        try {
+            return JSON.parse(`"${dq[1]}"`);
+        }
+        catch {
+            return dq[1];
+        }
+    }
+    const sq = line.match(/^'((?:[^']|'')*)'\s*:(?:\s|$)/);
+    if (sq)
+        return sq[1].replace(/''/g, "'");
+    const plain = line.match(/^(.+?)\s*:(?:\s|$)/);
+    return plain ? plain[1] : undefined;
+}
+/**
+ * Split the document into top-level sections. A section starts at a line
+ * holding a top-level key and runs to the next one; blank lines and
+ * column-0 comments at its end are dropped. Unlike splitting on blank
+ * lines, this does not depend on the serializer's spacing.
+ */
+export function topLevelSections(yaml) {
+    const lines = yaml.replace(/\r\n?/g, "\n").split("\n");
+    const out = [];
+    let key;
+    let start = 0;
+    const flush = (end) => {
+        if (key === undefined)
+            return;
+        let last = end;
+        while (last > start + 1 && (lines[last - 1].trim() === "" || lines[last - 1].startsWith("#")))
+            last--;
+        out.push({ key, text: lines.slice(start, last).join("\n") });
+    };
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const k = topLevelKey(line);
+        const boundary = k !== undefined || /^(---|\.\.\.)(\s|$)/.test(line);
+        if (!boundary)
+            continue;
+        flush(i);
+        key = k;
+        start = i;
+    }
+    flush(lines.length);
+    return out;
+}
+/**
+ * Extract the full section text for a given job name (exact key match, so
+ * `build` never returns the `build:linux` section).
+ */
+export function extractJobSection(yaml, jobName) {
+    return topLevelSections(yaml).find((s) => s.key === jobName)?.text ?? null;
+}
+/**
+ * Extract rules from a job section.
+ */
+export function extractJobRules(section) {
+    const rules = [];
+    const lines = section.split("\n");
+    let inRules = false;
+    let currentRule = {};
+    for (const line of lines) {
+        if (line.match(/^\s+rules:$/)) {
+            inRules = true;
+            continue;
+        }
+        if (inRules) {
+            const ruleStart = line.match(/^\s+- (if|when|changes):\s*(.*)$/);
+            if (ruleStart) {
+                if (Object.keys(currentRule).length > 0) {
+                    rules.push(currentRule);
+                }
+                currentRule = {};
+                if (ruleStart[1] === "if")
+                    currentRule.if = ruleStart[2].trim();
+                if (ruleStart[1] === "when")
+                    currentRule.when = ruleStart[2].trim();
+                continue;
+            }
+            const whenMatch = line.match(/^\s+when:\s+(.+)$/);
+            if (whenMatch) {
+                currentRule.when = whenMatch[1].trim();
+                continue;
+            }
+            // End of rules block
+            if (!line.match(/^\s+\s/) || line.match(/^\s+[a-z_]+:/) && !line.match(/^\s+when:/)) {
+                if (Object.keys(currentRule).length > 0) {
+                    rules.push(currentRule);
+                }
+                inRules = false;
+            }
+        }
+    }
+    if (inRules && Object.keys(currentRule).length > 0) {
+        rules.push(currentRule);
+    }
+    return rules;
+}
+/**
+ * Extract container image references from `image:` and `services:` across the
+ * pipeline. Handles both the object form (`image:\n  name: ...`) and the inline
+ * string form (`image: ...`).
+ */
+export function extractImageRefs(yaml) {
+    const refs = [];
+    for (const { key: job, text: section } of topLevelSections(yaml)) {
+        const lines = section.split("\n");
+        for (let i = 0; i < lines.length; i++) {
+            // image: as object (next indented `name:`) or inline string
+            const imgInline = lines[i].match(/^\s+image:\s+(\S.*)$/);
+            if (imgInline) {
+                refs.push({ job, image: imgInline[1].trim().replace(/^['"]|['"]$/g, ""), source: "image" });
+                continue;
+            }
+            if (/^\s+image:\s*$/.test(lines[i])) {
+                const nameLine = lines.slice(i + 1, i + 4).find((l) => /^\s+name:\s+/.test(l));
+                if (nameLine) {
+                    const v = nameLine.replace(/^\s+name:\s+/, "").trim().replace(/^['"]|['"]$/g, "");
+                    refs.push({ job, image: v, source: "image" });
+                }
+                continue;
+            }
+            // services: list entries — `- name:` or `- 'image'`
+            const svcName = lines[i].match(/^\s+-\s+name:\s+(\S.*)$/);
+            if (svcName) {
+                refs.push({ job, image: svcName[1].trim().replace(/^['"]|['"]$/g, ""), source: "service" });
+            }
+        }
+    }
+    return refs;
+}
+/**
+ * Parse the top-level `include:` block into structured entries.
+ */
+export function extractIncludes(yaml) {
+    const entries = [];
+    const section = topLevelSections(yaml).find((s) => s.key === "include")?.text;
+    if (!section)
+        return entries;
+    // Inline string form: `include: <value>` (value on the same line, not a list)
+    const inline = section.match(/^include:[ \t]+(\S.*)$/m);
+    if (inline) {
+        entries.push({ kind: "string", value: inline[1].trim().replace(/^['"]|['"]$/g, "") });
+        return entries;
+    }
+    const lines = section.split("\n");
+    let current;
+    const push = () => { if (current)
+        entries.push(current); current = undefined; };
+    for (const line of lines) {
+        const start = line.match(/^\s+-\s+(project|remote|component|local|template):\s*(.*)$/);
+        if (start) {
+            push();
+            current = { kind: start[1], value: start[2].trim().replace(/^['"]|['"]$/g, "") };
+            continue;
+        }
+        const refLine = line.match(/^\s+ref:\s+(.+)$/);
+        if (refLine && current) {
+            current.ref = refLine[1].trim().replace(/^['"]|['"]$/g, "");
+        }
+        // A bare `- 'https://...'` short remote form
+        const bare = line.match(/^\s+-\s+(['"]?https?:\/\/\S+['"]?)\s*$/);
+        if (bare) {
+            push();
+            entries.push({ kind: "remote", value: bare[1].replace(/^['"]|['"]$/g, "") });
+        }
+    }
+    push();
+    return entries;
+}
+/** True if a git ref is an immutable pin (40-hex SHA or a vN.N.N-style tag). */
+export function isPinnedRef(ref) {
+    if (/^[0-9a-f]{40}$/.test(ref))
+        return true;
+    // Semver-ish tag with all components fixed (v1.2.3 / 1.2.3)
+    if (/^v?\d+\.\d+\.\d+$/.test(ref))
+        return true;
+    return false;
+}
+/**
+ * Extract `id_tokens:` declarations (OIDC) per job, with their audiences.
+ */
+export function extractIdTokens(yaml) {
+    const out = [];
+    for (const { key: job, text: section } of topLevelSections(yaml)) {
+        const lines = section.split("\n");
+        let inIdTokens = false;
+        let idTokensIndent = -1;
+        let current;
+        const flush = () => { if (current)
+            out.push(current); current = undefined; };
+        for (const line of lines) {
+            if (/^\s+id_tokens:\s*$/.test(line)) {
+                inIdTokens = true;
+                idTokensIndent = line.search(/\S/);
+                continue;
+            }
+            if (!inIdTokens)
+                continue;
+            const indent = line.search(/\S/);
+            if (line.trim() !== "" && indent <= idTokensIndent) {
+                flush();
+                inIdTokens = false;
+                continue;
+            }
+            const tokenName = line.match(/^\s+([A-Z_][A-Z0-9_]*):\s*$/);
+            if (tokenName && indent === idTokensIndent + 2) {
+                flush();
+                current = { job, name: tokenName[1], aud: [] };
+                continue;
+            }
+            const audInline = line.match(/^\s+aud:\s+(\S.*)$/);
+            if (audInline && current) {
+                const v = audInline[1].trim();
+                if (v.startsWith("[")) {
+                    for (const p of v.replace(/^\[|\]$/g, "").split(",")) {
+                        const t = p.trim().replace(/^['"]|['"]$/g, "");
+                        if (t)
+                            current.aud.push(t);
+                    }
+                }
+                else {
+                    current.aud.push(v.replace(/^['"]|['"]$/g, ""));
+                }
+                continue;
+            }
+            const audItem = line.match(/^\s+-\s+(\S.*)$/);
+            if (audItem && current) {
+                current.aud.push(audItem[1].trim().replace(/^['"]|['"]$/g, ""));
+            }
+        }
+        flush();
+    }
+    return out;
+}
+/** True if a job section's rules make it reachable from merge-request pipelines. */
+export function isMergeRequestReachable(section) {
+    return /merge_request_event|CI_MERGE_REQUEST|CI_PIPELINE_SOURCE\s*==\s*['"]?merge_request/.test(section);
+}
+/**
+ * Extract shell command lines from all `script:` family blocks, per job.
+ */
+export function extractScriptCommands(yaml) {
+    const out = [];
+    for (const { key: job, text: section } of topLevelSections(yaml)) {
+        const lines = section.split("\n");
+        let inScript = false;
+        let scriptIndent = -1;
+        for (const line of lines) {
+            if (/^\s+(before_script|after_script|script):\s*$/.test(line)) {
+                inScript = true;
+                scriptIndent = line.search(/\S/);
+                continue;
+            }
+            // inline form `script: cmd`
+            const inlineScript = line.match(/^\s+(?:before_script|after_script|script):\s+(\S.*)$/);
+            if (inlineScript) {
+                out.push({ job, command: inlineScript[1].trim().replace(/^['"]|['"]$/g, "") });
+                continue;
+            }
+            if (!inScript)
+                continue;
+            const indent = line.search(/\S/);
+            if (line.trim() !== "" && indent <= scriptIndent) {
+                inScript = false;
+                continue;
+            }
+            const item = line.match(/^\s+-\s+(.*)$/);
+            if (item)
+                out.push({ job, command: item[1].trim().replace(/^['"]|['"]$/g, "") });
+        }
+    }
+    return out;
+}

package/dist/lint/rules/artifact-no-expiry.js

@@ -0,0 +1,53 @@
+/**
+ * WGL004: Artifacts without expiry
+ *
+ * Artifacts without `expireIn` (or `expire_in`) will be kept indefinitely,
+ * wasting storage. Always set an expiry for job artifacts.
+ */
+import { ts } from "@intentius/chant/lint/typescript";
+export const artifactNoExpiryRule = {
+    id: "WGL004",
+    severity: "warning",
+    category: "performance",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function visit(node) {
+            if (ts.isNewExpression(node)) {
+                let isArtifacts = false;
+                const expression = node.expression;
+                if (ts.isIdentifier(expression) && expression.text === "Artifacts") {
+                    isArtifacts = true;
+                }
+                else if (ts.isPropertyAccessExpression(expression) && expression.name.text === "Artifacts") {
+                    isArtifacts = true;
+                }
+                if (isArtifacts && node.arguments && node.arguments.length > 0) {
+                    const props = node.arguments[0];
+                    if (ts.isObjectLiteralExpression(props)) {
+                        const hasExpiry = props.properties.some((prop) => {
+                            if (ts.isPropertyAssignment(prop) && ts.isIdentifier(prop.name)) {
+                                return prop.name.text === "expireIn" || prop.name.text === "expire_in";
+                            }
+                            return false;
+                        });
+                        if (!hasExpiry) {
+                            const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                            diagnostics.push({
+                                file: sourceFile.fileName,
+                                line: line + 1,
+                                column: character + 1,
+                                ruleId: "WGL004",
+                                severity: "warning",
+                                message: 'Artifacts without "expireIn" will be kept indefinitely. Set an expiry to save storage.',
+                            });
+                        }
+                    }
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};