@intentius/chant 0.124.32 → 0.124.34

package/dist/workspace/__fixtures__/contract-repo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract-repo.d.ts","sourceRoot":"","sources":["../../../src/workspace/__fixtures__/contract-repo.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,OAAO,MAAM,eAAe,CAAC;AAGpC,6CAA6C;AAC7C,eAAO,MAAM,IAAI,QAAwE,CAAC;AAI1F,gGAAgG;AAChG,wBAAgB,YAAY,IAAI,IAAI,CAEnC;AAED,wBAAgB,UAAU,CAAC,MAAM,SAAoB,GAAG,MAAM,CAI7D;AAED,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAM1D;AAED,iFAAiF;AACjF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,CAO7G;AAED,uFAAuF;AACvF,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EAAE,MAAM,UAAQ,GAAG,MAAM,CAS3G;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,MAAM,EAAE,MAAM,SAAyB,GAAG,MAAM,MAAM,CAQ9F;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,SAAS,GAAG,MAAM,CAIhE;AAED,QAAA,MAAM,GAAG,SAAiD,CAAC;AAE3D,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC;IAAC,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAAA;CAAE,CAStH;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,eAAO,MAAM,WAAW,YAAa,OAAO,EAAE,UAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WACL,CAAC;AAE1E;;;GAGG;AACH,eAAO,MAAM,gBAAgB,6XAU5B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,sZASjC,CAAC"}
+{"version":3,"file":"contract-repo.d.ts","sourceRoot":"","sources":["../../../src/workspace/__fixtures__/contract-repo.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,OAAO,MAAM,eAAe,CAAC;AAGpC,6CAA6C;AAC7C,eAAO,MAAM,IAAI,QAAwE,CAAC;AAI1F,gGAAgG;AAChG,wBAAgB,YAAY,IAAI,IAAI,CAEnC;AAED,wBAAgB,UAAU,CAAC,MAAM,SAAoB,GAAG,MAAM,CAI7D;AAED,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAM1D;AAED,iFAAiF;AACjF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,CAO7G;AAED,uFAAuF;AACvF,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EAAE,MAAM,UAAQ,GAAG,MAAM,CAS3G;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,MAAM,EAAE,MAAM,SAAyB,GAAG,MAAM,MAAM,CAiB9F;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,SAAS,GAAG,MAAM,CAIhE;AAED,QAAA,MAAM,GAAG,SAAiD,CAAC;AAE3D,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC;IAAC,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAAA;CAAE,CAStH;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,eAAO,MAAM,WAAW,YAAa,OAAO,EAAE,UAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WACL,CAAC;AAE1E;;;GAGG;AACH,eAAO,MAAM,gBAAgB,6XAU5B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,sZASjC,CAAC"}

package/dist/workspace/__fixtures__/contract-repo.js

@@ -22,7 +22,7 @@ export function scratchDir(prefix = "chant-contract-") {
     return d;
 }
 export function git(cwd, ...args) {
-    return execFileSync("git", ["-c", "user.name=t", "-c", "user.email=t@example.com", "-c", "commit.gpgsign=false", ...args], {
+    return execFileSync("git", ["-c", "user.name=t", "-c", "user.email=t@example.com", "-c", "commit.gpgsign=false", "-c", "gc.auto=0", "-c", "maintenance.auto=false", ...args], {
         cwd,
         encoding: "utf-8",
         stdio: ["ignore", "pipe", "pipe"],
@@ -61,7 +61,18 @@ export function repoFixture(build, prefix = "chant-contract-copy-") {
         if (template === undefined || !existsSync(template))
             template = build();
         const root = scratchDir(prefix);
-        cpSync(template, root, { recursive: true });
+        // A commit can leave a detached `git gc --auto` or maintenance run moving
+        // the template's objects, and a copy that meets it fails with ENOENT on
+        // .git/objects. Copy once more after it settles.
+        try {
+            cpSync(template, root, { recursive: true });
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                throw err;
+            rmSync(root, { recursive: true, force: true });
+            cpSync(template, root, { recursive: true });
+        }
         return root;
     };
 }

package/dist/workspace/check.schema.json

@@ -298,7 +298,50 @@
             "flag-stale",
             "diagram-source-missing",
             "diagram-render-missing",
-            "diagram-render-drift"
+            "diagram-render-drift",
+
+            "security-signers-missing",
+
+            "security-release-gate-missing",
+
+            "security-publish-allows-unsigned",
+
+            "security-sbom-disabled",
+
+            "security-sbom-unsourced",
+
+            "security-publish-no-provenance",
+
+            "security-component-no-sbom",
+
+            "security-component-no-verify",
+
+            "security-signed-since-unset",
+
+            "security-runner-untrusted",
+
+            "security-tick-no-key",
+
+            "security-review-not-required",
+
+            "security-attribution-any",
+
+            "security-gate-unsigned",
+
+            "security-runner-start-no-key",
+
+            "security-runner-start-no-role",
+
+            "security-trust-unreadable",
+            "ci-workflow-green-undeclared",
+            "ci-workflow-no-pre-merge",
+            "ci-workflow-apply-in-green",
+            "ci-workflow-no-components",
+            "ci-workflow-no-environments",
+            "ci-workflow-ungated-env",
+            "ci-workflow-pipeline-missing",
+            "ci-workflow-pipeline-differs",
+            "ci-workflow-publish-missing"
           ],
           "description": "For WSP001: why the declaration can't be read. For WSP121 to WSP127, the box finding (#2726, #2727, #2780, #2850). For WSP117, work-acceptance-unmet (#2772). For WSP118, flag-stale (#4024). For WSP131 to WSP133, the diagram finding (#2764)."
         }
@@ -377,7 +420,50 @@
             "flag-stale",
             "diagram-source-missing",
             "diagram-render-missing",
-            "diagram-render-drift"
+            "diagram-render-drift",
+
+            "security-signers-missing",
+
+            "security-release-gate-missing",
+
+            "security-publish-allows-unsigned",
+
+            "security-sbom-disabled",
+
+            "security-sbom-unsourced",
+
+            "security-publish-no-provenance",
+
+            "security-component-no-sbom",
+
+            "security-component-no-verify",
+
+            "security-signed-since-unset",
+
+            "security-runner-untrusted",
+
+            "security-tick-no-key",
+
+            "security-review-not-required",
+
+            "security-attribution-any",
+
+            "security-gate-unsigned",
+
+            "security-runner-start-no-key",
+
+            "security-runner-start-no-role",
+
+            "security-trust-unreadable",
+            "ci-workflow-green-undeclared",
+            "ci-workflow-no-pre-merge",
+            "ci-workflow-apply-in-green",
+            "ci-workflow-no-components",
+            "ci-workflow-no-environments",
+            "ci-workflow-ungated-env",
+            "ci-workflow-pipeline-missing",
+            "ci-workflow-pipeline-differs",
+            "ci-workflow-publish-missing"
           ],
           "description": "For WSP001: why the declaration can't be read. For WSP121 to WSP127, the box finding (#2726, #2727, #2780, #2850). For WSP117, work-acceptance-unmet (#2772). For WSP118, flag-stale (#4024). For WSP131 to WSP133, the diagram finding (#2764)."
         },

package/dist/workspace/checks/ci-workflow.d.ts

@@ -0,0 +1,17 @@
+/**
+ * WSP151 (#4168 step 6): what a member under `ci.workflow` still lacks.
+ *
+ * A declaration that names no workflow gets no finding from this file. The
+ * requirements and their codes are {@link CI_WORKFLOW_REQUIREMENTS}
+ * (../ci-workflow.ts). Like the security checklists (./security.ts), the
+ * check reads files and never runs them: `chant.config.ts` for the
+ * environments (its literal `environments`, as `workspace status` reads it),
+ * `*.component.ts` for components and gates, and the forge pipeline files for
+ * the jobs. A generated file that differs from what its generator writes is
+ * WSP101 to WSP106's to report; this check asks only whether the jobs the
+ * workflow needs are there.
+ */
+import type { WorkspaceCheck } from "../checks.js";
+export declare const WSP_CI_WORKFLOW = "WSP151";
+export declare const CI_WORKFLOW_CHECKS: readonly WorkspaceCheck[];
+//# sourceMappingURL=ci-workflow.d.ts.map

package/dist/workspace/checks/ci-workflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-workflow.d.ts","sourceRoot":"","sources":["../../../src/workspace/checks/ci-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,WAAW,CAAC;AAQrE,eAAO,MAAM,eAAe,WAAW,CAAC;AAaxC,eAAO,MAAM,kBAAkB,EAAE,SAAS,cAAc,EA6FvD,CAAC"}

package/dist/workspace/checks/ci-workflow.js

@@ -0,0 +1,123 @@
+/**
+ * WSP151 (#4168 step 6): what a member under `ci.workflow` still lacks.
+ *
+ * A declaration that names no workflow gets no finding from this file. The
+ * requirements and their codes are {@link CI_WORKFLOW_REQUIREMENTS}
+ * (../ci-workflow.ts). Like the security checklists (./security.ts), the
+ * check reads files and never runs them: `chant.config.ts` for the
+ * environments (its literal `environments`, as `workspace status` reads it),
+ * `*.component.ts` for components and gates, and the forge pipeline files for
+ * the jobs. A generated file that differs from what its generator writes is
+ * WSP101 to WSP106's to report; this check asks only whether the jobs the
+ * workflow needs are there.
+ */
+import { appliesOnMerge, STUB_MARKER, workflowOf } from "../ci-workflow.js";
+import { matchesCheckRun } from "../ci-green.js";
+import { staticPromotionOrder } from "../promotion-order.js";
+import { joinPath } from "../tree.js";
+import { allPipelineFiles, commandLines, componentFiles, read } from "./security.js";
+export const WSP_CI_WORKFLOW = "WSP151";
+const memberDir = (dir) => (dir === "." ? "" : dir);
+const PLAN = /\bci\s+run\s+plan\b|\bcomponents\s+pr-plan\b/;
+const RECORD = /\bci\s+run\s+record\b|\bcomponents\s+pr-record\b/;
+const APPLY = /\bci\s+run\s+apply\b|\bcomponents\s+pr-apply\b/;
+const TICK = /\bci\s+tick\b/;
+const PUBLISH = /\brelease\s+publish\b/;
+/** The apply job names a required phase could match. */
+const APPLY_JOB_NAMES = ["apply", "pr-apply"];
+export const CI_WORKFLOW_CHECKS = [
+    {
+        id: WSP_CI_WORKFLOW,
+        name: "ci-workflow",
+        description: "Under ci.workflow: ci.green with pre-merge phases and no apply job required, each member with a component, environments and a gate on each component, and pipeline files that plan, record (or apply under apply on merge), tick and publish.",
+        severity: "warning",
+        configurable: true,
+        check(ctx) {
+            const d = ctx.declaration;
+            const under = d.members
+                .map((m) => ({ member: m, workflow: workflowOf(d, m) }))
+                .filter((u) => u.workflow !== null)
+                // The top level's workflow covers the members that build with chant; a member that names one itself is held to it.
+                .filter((u) => u.member.ciWorkflow !== null || ctx.tree.stat(joinPath(memberDir(u.member.dir), "chant.config.ts")) === "file");
+            if (under.length === 0 && !d.ci?.workflow)
+                return [];
+            const pointer = d.ci?.workflow ? "/ci/workflow" : `${under[0].member.pointer}/ci/workflow`;
+            const out = [];
+            const finding = (code, message, at = {}) => {
+                out.push({
+                    checkId: this.id,
+                    severity: this.severity,
+                    code,
+                    message: `${code}: ${message}`,
+                    pointer: at.pointer ?? pointer,
+                    ...(at.entity !== undefined ? { entity: at.entity } : {}),
+                    ...(at.treeFile !== undefined ? { treeFile: at.treeFile, line: at.line ?? 1, column: 1 } : {}),
+                });
+            };
+            const green = d.ci?.green ?? null;
+            if (!green) {
+                finding("ci-workflow-green-undeclared", "the workspace follows a ci.workflow and declares no ci.green, so no commit gets a verdict and no release can be cut; run chant ci init or add a ci.green block");
+            }
+            else {
+                if ((green.preMerge ?? []).length === 0) {
+                    finding("ci-workflow-no-pre-merge", "ci.green.preMerge names no phase, so nothing says which checks run before the branch moves; name the quick ones", { pointer: green.pointer });
+                }
+                for (const name of green.require) {
+                    const phase = green.phases.find((p) => p.name === name);
+                    const hit = phase?.runs.find((pattern) => APPLY_JOB_NAMES.some((job) => matchesCheckRun(pattern, job)));
+                    if (phase && hit) {
+                        finding("ci-workflow-apply-in-green", `the required phase ${name} matches the apply job with ${JSON.stringify(hit)}, so an apply that waits for a green commit would wait on itself; drop the pattern`, { pointer: phase.pointer });
+                    }
+                }
+            }
+            for (const { member } of under) {
+                const dir = memberDir(member.dir);
+                const components = componentFiles(ctx.tree, dir);
+                if (components.length === 0) {
+                    finding("ci-workflow-no-components", `member ${member.name} declares no component, so nothing of it can be cut or promoted; chant ci init writes a stub`, { pointer: member.pointer, entity: member.name });
+                }
+                else if (components.every((f) => (read(ctx.tree, f) ?? "").includes(STUB_MARKER))) {
+                    finding("ci-workflow-no-components", `member ${member.name}'s only component is the stub chant ci init wrote (${components[0]}); say how it is built and deployed, then delete its ${STUB_MARKER} line`, { pointer: member.pointer, entity: member.name, treeFile: components[0] });
+                }
+                const configPath = joinPath(dir, "chant.config.ts");
+                const config = read(ctx.tree, configPath);
+                // A config whose environments aren't literals can't be read without running it; say nothing rather than guess.
+                const order = config === null ? [] : staticPromotionOrder(config);
+                if (order !== undefined && order.length === 0) {
+                    finding("ci-workflow-no-environments", `member ${member.name}'s chant.config.ts declares no environments, so a release has nowhere to be promoted to`, { pointer: member.pointer, entity: member.name, ...(config !== null ? { treeFile: configPath } : {}) });
+                }
+                for (const file of components) {
+                    const text = read(ctx.tree, file) ?? "";
+                    if (/\bgate\s*\(|kind\s*:\s*["']gate["']/.test(text))
+                        continue;
+                    const last = order && order.length > 0 ? order[order.length - 1].name : "the last environment";
+                    finding("ci-workflow-ungated-env", `${file} has no gate, so a promote to ${last} waits on no approval; add a gate() step`, { pointer: member.pointer, entity: member.name, treeFile: file });
+                }
+            }
+            const files = allPipelineFiles(ctx);
+            const has = (re) => files.some((f) => f.lines.some((l) => re.test(l)));
+            const applyOnMerge = under.some((u) => appliesOnMerge(u.workflow)) || (d.ci?.workflow ? appliesOnMerge(d.ci.workflow) : false);
+            const missing = [
+                ...(has(PLAN) ? [] : ["a plan job (ci run plan)"]),
+                ...(has(RECORD) || has(APPLY) ? [] : [applyOnMerge ? "an apply job (ci run apply)" : "a record job (ci run record)"]),
+                ...(has(TICK) ? [] : ["chant ci tick"]),
+            ];
+            if (missing.length > 0) {
+                finding("ci-workflow-pipeline-missing", `no pipeline file runs ${missing.join(", ")}; generate them with chant build --components --generate <forge> --pr-loop and chant ci workflow`);
+            }
+            if (!applyOnMerge) {
+                for (const l of commandLines(ctx, APPLY)) {
+                    finding("ci-workflow-pipeline-differs", `${l.path} applies on merge, and the workflow is trunk-curated, where a merge records the plan and deploys nothing; regenerate without --apply-on-merge, or set ci.workflow to trunk-curated+apply-on-merge`, { treeFile: l.path, line: l.line });
+                }
+            }
+            else if (!has(APPLY) && has(RECORD)) {
+                const l = commandLines(ctx, RECORD)[0];
+                finding("ci-workflow-pipeline-differs", `${l.path} records on merge, and the workflow is trunk-curated+apply-on-merge; regenerate with --apply-on-merge`, { treeFile: l.path, line: l.line });
+            }
+            if (!has(PUBLISH)) {
+                finding("ci-workflow-publish-missing", "no pipeline file runs chant release publish, so a cut release is never published; generate one with chant release workflow");
+            }
+            return out;
+        },
+    },
+];

package/dist/workspace/checks/security.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The security group checklists, WSP161 to WSP165 (#4168 step 7).
+ *
+ * A workspace opts into a security group with `security` in the
+ * declaration, at the top level or on a member (../security.ts). Each group
+ * has one check here, which reports what the group still lacks in the tree
+ * read. A group the declaration does not name is never checked, so a
+ * workspace that opts into nothing gets no finding from this file (#4168:
+ * security features are opt-in).
+ *
+ * | Id | Group | Codes |
+ * |---|---|---|
+ * | WSP161 | `verified-releases` | `security-signers-missing`, `security-release-gate-missing`, `security-publish-allows-unsigned` |
+ * | WSP162 | `supply-chain` | `security-sbom-disabled`, `security-sbom-unsourced`, `security-publish-no-provenance`, `security-component-no-sbom`, `security-component-no-verify` |
+ * | WSP163 | `who-ran-it` | `security-signed-since-unset`, `security-runner-untrusted`, `security-tick-no-key` |
+ * | WSP164 | `review-rules` | `security-review-not-required`, `security-attribution-any`, `security-gate-unsigned` |
+ * | WSP165 | `isolated-runners` | `security-runner-start-no-key`, `security-runner-start-no-role`, `security-trust-unreadable` |
+ *
+ * The checks read files, never run them: a member's `chant.config.ts` and
+ * `*.component.ts` are scanned as text, and the pipeline files are the
+ * forge files at the workspace root and in each member (`.github/workflows`,
+ * `.forgejo/workflows`, `.gitlab-ci.yml`). A command line is one line of a
+ * pipeline file that runs `chant release publish`, `chant ci tick` or
+ * `chant components pr-apply`.
+ */
+import type { WorkspaceCheck, WorkspaceCheckContext } from "../checks.js";
+import { type WorkspaceTree } from "../tree.js";
+/** The read contract's codes for the security findings, carried as `code` on each. */
+export declare const SECURITY_FINDING_CODES: readonly ["security-signers-missing", "security-release-gate-missing", "security-publish-allows-unsigned", "security-sbom-disabled", "security-sbom-unsourced", "security-publish-no-provenance", "security-component-no-sbom", "security-component-no-verify", "security-signed-since-unset", "security-runner-untrusted", "security-tick-no-key", "security-review-not-required", "security-attribution-any", "security-gate-unsigned", "security-runner-start-no-key", "security-runner-start-no-role", "security-trust-unreadable"];
+export declare const WSP_SECURITY_VERIFIED_RELEASES = "WSP161";
+export declare const WSP_SECURITY_SUPPLY_CHAIN = "WSP162";
+export declare const WSP_SECURITY_WHO_RAN_IT = "WSP163";
+export declare const WSP_SECURITY_REVIEW_RULES = "WSP164";
+export declare const WSP_SECURITY_ISOLATED_RUNNERS = "WSP165";
+export declare function read(tree: WorkspaceTree, path: string): string | null;
+/** Every pipeline file of the workspace: its root's, and each member's. */
+export declare function allPipelineFiles(ctx: WorkspaceCheckContext): {
+    path: string;
+    lines: string[];
+}[];
+/** The lines of the pipeline files that run a chant command, `command` naming it, such as `release publish`. */
+export declare function commandLines(ctx: WorkspaceCheckContext, command: RegExp): {
+    path: string;
+    line: number;
+    text: string;
+}[];
+/** The member's `*.component.ts` files, walked a few levels down, past node_modules and build output. */
+export declare function componentFiles(tree: WorkspaceTree, dir: string, depth?: number): string[];
+export declare const SECURITY_CHECKS: readonly WorkspaceCheck[];
+//# sourceMappingURL=security.d.ts.map

package/dist/workspace/checks/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/workspace/checks/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAuB,MAAM,WAAW,CAAC;AAI5F,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,SAAS,CAAC;AAMvD,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,ygBAkBO,CAAC;AAI3C,eAAO,MAAM,8BAA8B,WAAW,CAAC;AACvD,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAClD,eAAO,MAAM,uBAAuB,WAAW,CAAC;AAChD,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAClD,eAAO,MAAM,6BAA6B,WAAW,CAAC;AAsBtD,wBAAgB,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOrE;AAkBD,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,CAGhG;AAED,gHAAgH;AAChH,wBAAgB,YAAY,CAAC,GAAG,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,CAExH;AAED,yGAAyG;AACzG,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,SAAI,GAAG,MAAM,EAAE,CAQpF;AAuCD,eAAO,MAAM,eAAe,EAAE,SAAS,cAAc,EAuIpD,CAAC"}

package/dist/workspace/checks/security.js

@@ -0,0 +1,305 @@
+/**
+ * The security group checklists, WSP161 to WSP165 (#4168 step 7).
+ *
+ * A workspace opts into a security group with `security` in the
+ * declaration, at the top level or on a member (../security.ts). Each group
+ * has one check here, which reports what the group still lacks in the tree
+ * read. A group the declaration does not name is never checked, so a
+ * workspace that opts into nothing gets no finding from this file (#4168:
+ * security features are opt-in).
+ *
+ * | Id | Group | Codes |
+ * |---|---|---|
+ * | WSP161 | `verified-releases` | `security-signers-missing`, `security-release-gate-missing`, `security-publish-allows-unsigned` |
+ * | WSP162 | `supply-chain` | `security-sbom-disabled`, `security-sbom-unsourced`, `security-publish-no-provenance`, `security-component-no-sbom`, `security-component-no-verify` |
+ * | WSP163 | `who-ran-it` | `security-signed-since-unset`, `security-runner-untrusted`, `security-tick-no-key` |
+ * | WSP164 | `review-rules` | `security-review-not-required`, `security-attribution-any`, `security-gate-unsigned` |
+ * | WSP165 | `isolated-runners` | `security-runner-start-no-key`, `security-runner-start-no-role`, `security-trust-unreadable` |
+ *
+ * The checks read files, never run them: a member's `chant.config.ts` and
+ * `*.component.ts` are scanned as text, and the pipeline files are the
+ * forge files at the workspace root and in each member (`.github/workflows`,
+ * `.forgejo/workflows`, `.gitlab-ci.yml`). A command line is one line of a
+ * pipeline file that runs `chant release publish`, `chant ci tick` or
+ * `chant components pr-apply`.
+ */
+import { securityGroupsOf } from "../security.js";
+import { joinPath } from "../tree.js";
+import { runnerStartReadiness } from "../ci-runner-start.js";
+import { readTrustPolicy } from "../trust/policy.js";
+import { DEFAULT_SIGNERS_PATH, TRUST_CONFIG_PATH } from "../trust/trust-files.js";
+/** The read contract's codes for the security findings, carried as `code` on each. */
+export const SECURITY_FINDING_CODES = [
+    "security-signers-missing",
+    "security-release-gate-missing",
+    "security-publish-allows-unsigned",
+    "security-sbom-disabled",
+    "security-sbom-unsourced",
+    "security-publish-no-provenance",
+    "security-component-no-sbom",
+    "security-component-no-verify",
+    "security-signed-since-unset",
+    "security-runner-untrusted",
+    "security-tick-no-key",
+    "security-review-not-required",
+    "security-attribution-any",
+    "security-gate-unsigned",
+    "security-runner-start-no-key",
+    "security-runner-start-no-role",
+    "security-trust-unreadable",
+];
+export const WSP_SECURITY_VERIFIED_RELEASES = "WSP161";
+export const WSP_SECURITY_SUPPLY_CHAIN = "WSP162";
+export const WSP_SECURITY_WHO_RAN_IT = "WSP163";
+export const WSP_SECURITY_REVIEW_RULES = "WSP164";
+export const WSP_SECURITY_ISOLATED_RUNNERS = "WSP165";
+const memberDir = (dir) => (dir === "." ? "" : dir);
+/** The members under `group`: every member when the top level names it, else those that name it themselves. */
+function membersUnder(declaration, group) {
+    return declaration.members.filter((m) => securityGroupsOf(declaration, m.name).has(group));
+}
+/** Whether the declaration names `group` anywhere. */
+function declares(declaration, group) {
+    return declaration.security.includes(group) || declaration.members.some((m) => m.security.includes(group));
+}
+/** Where the group is named, for the finding's pointer: the top level, else the first member naming it. */
+function groupPointer(declaration, group) {
+    const top = declaration.security.indexOf(group);
+    if (top >= 0)
+        return `/security/${top}`;
+    const m = declaration.members.find((e) => e.security.includes(group));
+    return m ? `${m.pointer}/security/${m.security.indexOf(group)}` : "/security";
+}
+export function read(tree, path) {
+    if (tree.stat(path) !== "file")
+        return null;
+    try {
+        return tree.read(path);
+    }
+    catch {
+        return null;
+    }
+}
+/** The forge pipeline files under `dir`, each as its path and lines. */
+function pipelineFiles(tree, dir) {
+    const out = [];
+    for (const folder of [".github/workflows", ".forgejo/workflows", ".gitea/workflows"]) {
+        for (const e of tree.list(joinPath(dir, folder)) ?? []) {
+            if (e.type !== "file" || !/\.ya?ml$/.test(e.name))
+                continue;
+            const path = joinPath(dir, folder, e.name);
+            const text = read(tree, path);
+            if (text !== null)
+                out.push({ path, lines: text.split("\n") });
+        }
+    }
+    const gitlab = read(tree, joinPath(dir, ".gitlab-ci.yml"));
+    if (gitlab !== null)
+        out.push({ path: joinPath(dir, ".gitlab-ci.yml"), lines: gitlab.split("\n") });
+    return out;
+}
+/** Every pipeline file of the workspace: its root's, and each member's. */
+export function allPipelineFiles(ctx) {
+    const dirs = new Set(["", ...ctx.declaration.members.map((m) => memberDir(m.dir))]);
+    return [...dirs].flatMap((d) => pipelineFiles(ctx.tree, d));
+}
+/** The lines of the pipeline files that run a chant command, `command` naming it, such as `release publish`. */
+export function commandLines(ctx, command) {
+    return allPipelineFiles(ctx).flatMap((f) => f.lines.flatMap((text, i) => (command.test(text) ? [{ path: f.path, line: i + 1, text }] : [])));
+}
+/** The member's `*.component.ts` files, walked a few levels down, past node_modules and build output. */
+export function componentFiles(tree, dir, depth = 4) {
+    const out = [];
+    for (const e of tree.list(dir) ?? []) {
+        if (e.type === "dir") {
+            if (depth > 0 && !["node_modules", "dist", ".git", ".chant", "target"].includes(e.name))
+                out.push(...componentFiles(tree, joinPath(dir, e.name), depth - 1));
+        }
+        else if (e.name.endsWith(".component.ts"))
+            out.push(joinPath(dir, e.name));
+    }
+    return out;
+}
+/** Whether a lockfile chant writes an SBOM from is in `dir` or a directory above it in the tree. */
+function lockfileAbove(tree, dir) {
+    let at = dir;
+    for (;;) {
+        if (["package-lock.json", "pom.xml", "Cargo.lock"].some((f) => tree.stat(joinPath(at, f)) === "file"))
+            return true;
+        if (at === "")
+            return false;
+        at = at.includes("/") ? at.slice(0, at.lastIndexOf("/")) : "";
+    }
+}
+/** The trust policy in the tree read: `.chant/trust.json` and the signers file it names. */
+function treePolicy(tree) {
+    const source = {
+        label: tree.label,
+        list: (dir) => tree.list(dir)?.filter((e) => e.type === "file").map((e) => e.name),
+        read: (path) => tree.read(path),
+        bytes: (path) => (tree.bytes ? tree.bytes(path) : new Uint8Array(Buffer.from(tree.read(path), "utf-8"))),
+    };
+    return readTrustPolicy(source, null);
+}
+function finding(check, code, message, at) {
+    return {
+        checkId: check.id,
+        severity: check.severity,
+        code,
+        message: `${code}: ${message}`,
+        pointer: at.pointer,
+        ...(at.entity !== undefined ? { entity: at.entity } : {}),
+        ...(at.treeFile !== undefined ? { treeFile: at.treeFile, line: at.line ?? 1, column: 1 } : {}),
+    };
+}
+const RELEASE_PUBLISH = /\bchant\b.*\brelease\s+publish\b/;
+const CI_TICK = /\bchant\b.*\bci\s+tick\b|main\.ts\s+ci\s+tick\b/;
+const PR_APPLY = /\bcomponents\s+pr-apply\b|\bci\s+run\s+apply\b/;
+export const SECURITY_CHECKS = [
+    {
+        id: WSP_SECURITY_VERIFIED_RELEASES,
+        name: "security-verified-releases",
+        description: "Under the verified-releases group: a signers file, a release gate naming a class, and no publish job that passes --allow-unsigned.",
+        severity: "warning",
+        configurable: true,
+        check(ctx) {
+            const d = ctx.declaration;
+            if (!declares(d, "verified-releases"))
+                return [];
+            const pointer = groupPointer(d, "verified-releases");
+            const out = [];
+            if (ctx.tree.stat(DEFAULT_SIGNERS_PATH) !== "file") {
+                out.push(finding(this, "security-signers-missing", `the workspace opts into verified-releases, and there is no ${DEFAULT_SIGNERS_PATH}${ctx.tree.label} to verify a release's signature against; add the keys of the people who cut releases to it, in ssh-keygen's allowed_signers format`, { pointer }));
+            }
+            const gate = d.identity?.gates.release;
+            if (!gate?.class) {
+                out.push(finding(this, "security-release-gate-missing", gate ? `identity.gates.release names no class, so any signer in ${DEFAULT_SIGNERS_PATH} may cut a release; name the class that may` : "the workspace opts into verified-releases, and identity.gates has no release entry, so a cut is not held to a class of signers", { pointer: gate?.pointer ?? pointer }));
+            }
+            for (const l of commandLines(ctx, RELEASE_PUBLISH)) {
+                if (!/--allow-unsigned\b/.test(l.text))
+                    continue;
+                out.push(finding(this, "security-publish-allows-unsigned", `${l.path} runs release publish with --allow-unsigned, which publishes a release whose signature does not verify`, { pointer, treeFile: l.path, line: l.line }));
+            }
+            return out;
+        },
+    },
+    {
+        id: WSP_SECURITY_SUPPLY_CHAIN,
+        name: "security-supply-chain",
+        description: "Under the supply-chain group: every publish target attaches an SBOM it has a source for, publish jobs require OIDC provenance, and components generate an SBOM and verify what they deploy.",
+        severity: "warning",
+        configurable: true,
+        check(ctx) {
+            const d = ctx.declaration;
+            if (!declares(d, "supply-chain"))
+                return [];
+            const pointer = groupPointer(d, "supply-chain");
+            const out = [];
+            for (const m of membersUnder(d, "supply-chain")) {
+                const configPath = joinPath(memberDir(m.dir), "chant.config.ts");
+                const config = read(ctx.tree, configPath);
+                if (config !== null && /\bpublish\s*:/.test(config)) {
+                    const lines = config.split("\n");
+                    const off = lines.findIndex((l) => /\bsbom\s*:\s*false\b/.test(l));
+                    if (off >= 0)
+                        out.push(finding(this, "security-sbom-disabled", `member ${m.name}'s chant.config.ts sets sbom: false on a publish target, so what it publishes carries no SBOM`, { pointer, entity: m.name, treeFile: configPath, line: off + 1 }));
+                    else if (!/\bsbom\s*:\s*["'`]/.test(config) && !lockfileAbove(ctx.tree, memberDir(m.dir))) {
+                        out.push(finding(this, "security-sbom-unsourced", `member ${m.name} publishes, names no sbom file and has no package-lock.json, pom.xml or Cargo.lock in its directory or above it, so publish would refuse it as publish-sbom-missing`, { pointer, entity: m.name, treeFile: configPath }));
+                    }
+                }
+                const components = componentFiles(ctx.tree, memberDir(m.dir));
+                if (components.length === 0)
+                    continue;
+                const text = components.map((f) => read(ctx.tree, f) ?? "").join("\n");
+                if (!/\bgenerateSbom\s*\(|["']generate-sbom["']/.test(text)) {
+                    out.push(finding(this, "security-component-no-sbom", `member ${m.name}'s components have no generate-sbom step, so what they build carries no SBOM`, { pointer, entity: m.name, treeFile: components[0] }));
+                }
+                if (!/\bverify\s*\(|["']verify["']/.test(text)) {
+                    out.push(finding(this, "security-component-no-verify", `member ${m.name}'s components have no verify step, so a signature or attestation is never checked before a deploy`, { pointer, entity: m.name, treeFile: components[0] }));
+                }
+            }
+            for (const l of commandLines(ctx, RELEASE_PUBLISH)) {
+                if (/--require-provenance\b/.test(l.text))
+                    continue;
+                out.push(finding(this, "security-publish-no-provenance", `${l.path} runs release publish without --require-provenance, so a run with no OIDC token publishes with only a warning`, { pointer, treeFile: l.path, line: l.line }));
+            }
+            return out;
+        },
+    },
+    {
+        id: WSP_SECURITY_WHO_RAN_IT,
+        name: "security-who-ran-it",
+        description: "Under the who-ran-it group: ci.green.signedSince is set, .chant/trust.json lists a runner key, and the tick signs its tags.",
+        severity: "warning",
+        configurable: true,
+        check(ctx) {
+            const d = ctx.declaration;
+            if (!declares(d, "who-ran-it"))
+                return [];
+            const pointer = groupPointer(d, "who-ran-it");
+            const out = [];
+            if (!d.ci?.green?.signedSince) {
+                out.push(finding(this, "security-signed-since-unset", d.ci?.green ? "ci.green sets no signedSince, so an unsigned green tag still counts" : "the workspace opts into who-ran-it, and has no ci.green block, so no commit's green tag is signed", { pointer: d.ci?.green?.pointer ?? pointer }));
+            }
+            const runners = treePolicy(ctx.tree).runners.filter((r) => r.class === "runner").length;
+            if (runners === 0) {
+                out.push(finding(this, "security-runner-untrusted", `${TRUST_CONFIG_PATH}${ctx.tree.label} lists no runner key, so no run or tag can be traced to a runner; add one with chant ci serve --setup-key --trust`, { pointer }));
+            }
+            for (const l of commandLines(ctx, CI_TICK)) {
+                const file = allPipelineFiles(ctx).find((f) => f.path === l.path);
+                if (/--key\b/.test(l.text) || file?.lines.some((t) => /CHANT_RUNNER_KEY/.test(t)))
+                    continue;
+                out.push(finding(this, "security-tick-no-key", `${l.path} runs ci tick with no runner key, so its tags are unsigned; regenerate it with chant ci workflow --runner-key-secret <NAME>`, { pointer, treeFile: l.path, line: l.line }));
+            }
+            return out;
+        },
+    },
+    {
+        id: WSP_SECURITY_REVIEW_RULES,
+        name: "security-review-rules",
+        description: "Under the review-rules group: no apply job turns forge review off, attribution is identified, and every gate an apply job names needs a signed approval.",
+        severity: "warning",
+        configurable: true,
+        check(ctx) {
+            const d = ctx.declaration;
+            if (!declares(d, "review-rules"))
+                return [];
+            const pointer = groupPointer(d, "review-rules");
+            const out = [];
+            const applies = commandLines(ctx, PR_APPLY);
+            for (const l of applies) {
+                if (!/--no-require-review\b/.test(l.text))
+                    continue;
+                out.push(finding(this, "security-review-not-required", `${l.path} passes --no-require-review, which the review-rules group overrides; drop it so the file says what runs`, { pointer, treeFile: l.path, line: l.line }));
+            }
+            if (d.identity?.attribution !== "identified") {
+                out.push(finding(this, "security-attribution-any", "identity.attribution is not identified, so a person-attributed write may name anyone", { pointer: d.identity ? "/identity" : pointer }));
+            }
+            const signed = new Set(Object.keys(d.identity?.gates ?? {}));
+            const named = new Set(applies.flatMap((l) => [...l.text.matchAll(/--(?:wave-)?gate\s+["']?([A-Za-z0-9_.-]+)/g)].map((m) => m[1])));
+            const unsigned = [...named].filter((g) => !signed.has(g));
+            if (unsigned.length > 0) {
+                out.push(finding(this, "security-gate-unsigned", `the apply jobs name the gate${unsigned.length > 1 ? "s" : ""} ${unsigned.join(", ")}, which identity.gates does not list, so an unsigned approval passes ${unsigned.length > 1 ? "them" : "it"}`, { pointer }));
+            }
+            else if (named.size === 0 && signed.size === 0) {
+                out.push(finding(this, "security-gate-unsigned", "identity.gates lists no gate, so every approval may be unsigned", { pointer }));
+            }
+            return out;
+        },
+    },
+    {
+        id: WSP_SECURITY_ISOLATED_RUNNERS,
+        name: "security-isolated-runners",
+        description: "Under the isolated-runners group: .chant/trust.json lists a runner key whose principal holds the runner role, so an apply job can require a runner-start statement (#4147).",
+        severity: "warning",
+        configurable: true,
+        check(ctx) {
+            const d = ctx.declaration;
+            if (!declares(d, "isolated-runners"))
+                return [];
+            const pointer = groupPointer(d, "isolated-runners");
+            const codes = { "no-runner-key": "security-runner-start-no-key", "no-runner-role": "security-runner-start-no-role", "trust-unreadable": "security-trust-unreadable" };
+            return runnerStartReadiness(treePolicy(ctx.tree)).gaps.map((g) => finding(this, codes[g.gap], `the workspace opts into isolated-runners, so every apply job requires a runner-start statement, and ${g.reason}`, { pointer }));
+        },
+    },
+];