@mocoto/mahoraga 0.14.0 → 0.14.2

package/dist/analysts/github-actions/analysts/analyst-github-actions.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"analyst-github-actions.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/analysts/analyst-github-actions.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,QAAQ,EAAoB,cAAc,EAAgC,MAAM,GAAG,CAAC;AAkDlG,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAE7E;AACD,wBAAgB,4BAA4B,IAAI,cAAc,EAAE,CAE/D;AACD,eAAO,MAAM,qBAAqB,EAAE,QAuCnC,CAAC;AACF,eAAO,MAAM,2BAA2B,EAAE,QA2HzC,CAAC"}

package/dist/analysts/github-actions/analysts/analyst-github-actions.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"analyst-github-actions.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/analysts/analyst-github-actions.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAIrC,OAAO,EAAE,+BAA+B,EAAE,MAAM,kDAAkD,CAAC;AACnG,OAAO,EAAE,+BAA+B,EAAE,MAAM,iDAAiD,CAAC;AAClG,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AAC9G,OAAO,EAAE,+BAA+B,EAAE,MAAM,kDAAkD,CAAC;AACnG,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAsC/D,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEtC,MAAM,qBAAqB,GAAqB,EAAE,CAAC;AACnD,MAAM,UAAU,8BAA8B,CAAC,QAAwB;IACrE,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC;AACD,MAAM,UAAU,4BAA4B;IAC1C,OAAO,CAAC,GAAG,qBAAqB,CAAC,CAAC;AACpC,CAAC;AACD,MAAM,CAAC,MAAM,qBAAqB,GAAa;IAC7C,IAAI,EAAE,gBAAgB;IACtB,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,wEAAwE;IACnF,IAAI,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC;IACnE,KAAK,CAAC,OAAO,CAAC,QAAgB,EAAE,OAAe,EAAE,OAAgB,IAAI,EAAE,GAAY,EAAE,QAA2B;QAC9G,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAG,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC1E,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE;gBACtH,QAAQ;gBACR,QAAQ;aACT,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACtB,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,wBAAwB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAuB,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC3I,MAAM,kBAAkB,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAuB,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YACjJ,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAuB,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC7I,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,+BAA+B,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAuB,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC9I,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,+BAA+B,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAuB,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YACjJ,MAAM,KAAK,GAAG,CAAC,GAAG,SAAS,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;YACpD,WAAW,CAAC,IAAI,CAAC,GAAI,eAAgC,EAAE,GAAI,kBAAmC,EAAE,GAAI,gBAAiC,EAAE,GAAI,WAA4B,EAAE,GAAI,cAA+B,CAAC,CAAC;YAC9M,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;gBAC5B,WAAW,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,kBAAkB,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE;oBACvE,QAAQ,EAAE,OAAO,CAAC,SAAS;oBAC3B,OAAO;oBACP,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;oBACzB,MAAM,EAAE,CAAC;oBACT,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;oBAChC,KAAK,EAAE,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;iBACtI,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;QAET,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;CACF,CAAC;AACF,MAAM,CAAC,MAAM,2BAA2B,GAAa;IACnD,IAAI,EAAE,uBAAuB;IAC7B,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,6BAA6B;IACxC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK;IACjB,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAsB;QAClD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,GAAiB,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAG3D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,iBAAiB;gBACnE,OAAO,EAAE,UAAU;gBACnB,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC;gBACT,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;QACL,CAAC;QAGD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QACxF,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAwB,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,IAAI,MAAM,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,uCAAuC;gBAC7C,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,oBAAoB;gBACtE,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC;gBACT,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;QACL,CAAC;QAGD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,kCAAkC;gBACxC,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,eAAe;gBACjE,OAAO,EAAE,oBAAoB;gBAC7B,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC;gBACT,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;QACL,CAAC;QAGD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,2CAA2C;gBACjD,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,wBAAwB;gBAC1E,OAAO,EAAE,oBAAoB;gBAC7B,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC;gBACT,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;QACL,CAAC;QAGD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,wCAAwC;gBAC9C,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,qBAAqB;gBACvE,OAAO,EAAE,yBAAyB;gBAClC,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC;gBACT,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;QACL,CAAC;QAGD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,oCAAoC;gBAC1C,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,iBAAiB;gBACnE,OAAO,EAAE,UAAU;gBACnB,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC;gBACT,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;QACL,CAAC;QAGD,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3F,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,4CAA4C;gBAClD,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,yBAAyB;gBAC3E,OAAO,EAAE,oBAAoB;gBAC7B,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC;gBACT,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,6CAA6C;gBACnD,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,0BAA0B;gBAC5E,OAAO,EAAE,oBAAoB;gBAC7B,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC;gBACT,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;QACL,CAAC;QAGD,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QACvF,MAAM,cAAc,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,OAAiB,IAAI,EAAE,CAAC,CAAC,CAAC;QACxH,IAAI,cAAc,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,wCAAwC;gBAC9C,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,qBAAqB;gBACvE,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC;gBACT,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC;AAIF,SAAS,+BAA+B,CAAC,EAAgB,EAAE,GAAW;IAEpE,MAAM,iCAAiC,GAAG,yIAAyI,CAAC;IACpL,IAAI,iCAAiC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAGD,MAAM,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IACvD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,IAAI,EAAE,GAAG,IAAI,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,EAAW,EAAE,GAAW;IAC/D,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAEtB,yBAAyB,GAAG,+BAA+B,CAAC,EAAkB,EAAE,GAAG,CAAC,CAAC;IAGrF,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC9C,iBAAiB,CAAC,IAAoB,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAGD,KAAK,CAAC,IAAI,CAAC,GAAG,2BAA2B,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAGpD,KAAK,CAAC,IAAI,CAAC,GAAG,+BAA+B,CAAC,EAAE,CAAC,CAAC,CAAC;IAGnD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAI,EAOd,CAAC,IAAI,CAAC;QACR,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7C,IAAI,oBAAoB,CAAC,GAKxB,CAAC,EAAE,CAAC;oBACH,KAAK,CAAC,IAAI,CAAC;wBACT,IAAI,EAAE,sBAAsB;wBAC5B,SAAS,EAAE,uBAAuB;wBAClC,UAAU,EAAE,OAAO;qBACpB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAGD,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE,uBAAuB;YAClC,UAAU,EAAE,MAAM;SACnB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,oBAAoB;YAC1B,SAAS,EAAE,4BAA4B;YACvC,UAAU,EAAE,MAAM;SACnB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,iBAAiB,CAAC,EAAgB,EAAE,KAAyB;IAEpE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,mBAAmB;YACzB,SAAS,EAAE,4BAA4B;YACvC,UAAU,EAAE,OAAO;SACpB,CAAC,CAAC;IACL,CAAC;IAGD,IAAI,EAAE,CAAC,SAAS,IAAI,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,oBAAoB;YAC1B,SAAS,EAAE,oBAAoB;YAC/B,UAAU,EAAE,OAAO;SACpB,CAAC,CAAC;IACL,CAAC;IAGD,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;QAClE,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,sBAAsB;YAC5B,SAAS,EAAE,sBAAsB;YACjC,UAAU,EAAE,OAAO;SACpB,CAAC,CAAC;IACL,CAAC;IAGD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QAChD,IAAI,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACvH,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,uBAAuB,KAAK,EAAE;gBACzC,UAAU,EAAE,SAAS;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAGD,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACZ,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3C,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,GAAG,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;gBACrE,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,sBAAsB;oBAC5B,SAAS,EAAE,OAAO,EAAE,gBAAgB;oBACpC,UAAU,EAAE,OAAO;iBACpB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,GAAG,EAAE,SAAS,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACxD,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,oBAAoB;oBAC1B,SAAS,EAAE,6BAA6B;oBACxC,UAAU,EAAE,OAAO;iBACpB,CAAC,CAAC;YACL,CAAC;YAGD,IAAI,2CAA2C,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;gBACvE,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,cAAc;oBACpB,SAAS,EAAE,QAAQ,EAAE,oCAAoC;oBACzD,UAAU,EAAE,OAAO;oBACnB,QAAQ,EAAE,4DAA4D;iBACvE,CAAC,CAAC;YACL,CAAC;YACD,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC;gBACf,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,KAAK;oBAAE,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBAG5D,oBAAoB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBAGvC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;oBAC1B,KAAK,CAAC,IAAI,CAAC;wBACT,IAAI,EAAE,WAAW;wBACjB,SAAS,EAAE,QAAQ,EAAE,YAAY,GAAG,CAAC,KAAK,CAAC,MAAM,sCAAsC;wBACvF,UAAU,EAAE,OAAO;wBACnB,QAAQ,EAAE,6DAA6D;qBACxE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAGD,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAGvC,yBAAyB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAG7C,gCAAgC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC;IAGD,IAAI,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,KAAK,MAAM,MAAM,IAAI,EAAE,CAAC,KAAK;YAAE,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3D,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IAGD,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG;QAAE,YAAY,CAAC,EAAkB,EAAE,KAAK,CAAC,CAAC;AACjE,CAAC;AACD,SAAS,YAAY,CAAC,MAAoB,EAAE,KAAyB;IACnE,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,mBAAmB;gBACzB,SAAS,EAAE,0BAA0B;gBACrC,UAAU,EAAE,OAAO;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,iBAAiB,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpF,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,iBAAiB;YACvB,SAAS,EAAE,gBAAgB;YAC3B,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACxD,IAAI,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvH,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,cAAc;oBACpB,SAAS,EAAE,OAAO,KAAK,YAAY;oBACnC,UAAU,EAAE,SAAS;iBACtB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,kBAAkB;YACxB,SAAS,EAAE,kBAAkB;YAC7B,UAAU,EAAE,MAAM;SACnB,CAAC,CAAC;IACL,CAAC;IAGD,IAAI,MAAM,CAAC,IAAI,IAAI,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,KAAK,SAAS,CAAC;QAC/D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC;QAC3D,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,wBAAwB;gBAC9B,SAAS,EAAE,8CAA8C;gBACzD,UAAU,EAAE,OAAO;gBACnB,QAAQ,EAAE,6DAA6D;aACxE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAGD,IAAI,MAAM,CAAC,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACxE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACtC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAE3B,IAAI,CAAC,yBAAyB,EAAE,CAAC;gBAC/B,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,2BAA2B;oBACjC,SAAS,EAAE,mEAAmE;oBAC9E,UAAU,EAAE,OAAO;oBACnB,QAAQ,EAAE,6FAA6F;iBACxG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,yBAAyB,GAAG;IAChC,kBAAkB;IAClB,oBAAoB;IACpB,sBAAsB;IACtB,oBAAoB;IACpB,kBAAkB;IAClB,sBAAsB;IACtB,oBAAoB;IACpB,yBAAyB;IACzB,2BAA2B;IAC3B,eAAe;IACf,eAAe;IACf,iBAAiB;IACjB,2BAA2B;IAC3B,iCAAiC;IACjC,qBAAqB;IACrB,0BAA0B;IAC1B,wBAAwB;IACxB,4BAA4B;IAC5B,0BAA0B;IAC1B,aAAa;IACb,sBAAsB;IACtB,uCAAuC;IACvC,4BAA4B;IAC5B,2BAA2B;IAC3B,8BAA8B;IAC9B,gCAAgC;IAChC,6BAA6B;IAC7B,0BAA0B;CAC3B,CAAC;AAMF,SAAS,oBAAoB,CAAC,KAAqB,EAAE,KAAyB;IAC5E,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI;YAAE,SAAS;QACrC,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YAE9B,IAAI,MAAM,CAAC,IAAI,IAAI,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC7F,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;YACnE,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,eAAe;gBACrB,SAAS,EAAE,0BAA0B,KAAK,GAAG;gBAC7C,UAAU,EAAE,OAAO;gBACnB,QAAQ,EAAE,oEAAoE;aAC/E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAOD,SAAS,mBAAmB,CAAC,UAAmC,EAAE,KAAyB;IACzF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO;IAGlC,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACnE,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnF,MAAM,iBAAiB,GAAG,8BAA8B,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,8BAA8B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7H,IAAI,iBAAiB;QAAE,OAAO;IAE9B,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,KAAK,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,UAAU,EAAE,CAAC;QACjC,IAAI,GAAG,EAAE,KAAK;YAAE,cAAc,EAAE,CAAC;IACnC,CAAC;IAGD,IAAI,cAAc,KAAK,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,wBAAwB;YAC9B,SAAS,EAAE,iFAAiF;YAC5F,UAAU,EAAE,OAAO;YACnB,QAAQ,EAAE,6EAA6E;SACxF,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAKD,SAAS,yBAAyB,CAAC,UAAmC,EAAE,KAAyB;IAC/F,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,KAAK,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC,GAAG,EAAE,KAAK;YAAE,SAAS;QAC1B,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,MAAM,CAAC,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,aAAa,EAAE,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,kCAAkC;YACxC,SAAS,EAAE,GAAG,aAAa,iEAAiE;YAC5F,UAAU,EAAE,OAAO;YACnB,QAAQ,EAAE,kDAAkD;SAC7D,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAKD,SAAS,gCAAgC,CAAC,UAAmC,EAAE,KAAyB;IACtG,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,qBAAqB,GAAG,KAAK,CAAC;IAClC,KAAK,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC,GAAG,EAAE,KAAK;YAAE,SAAS;QAC1B,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,MAAM,CAAC,GAAG,IAAI,wDAAwD,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5F,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtD,YAAY,GAAG,IAAI,CAAC;YACtB,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;gBACjF,qBAAqB,GAAG,IAAI,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,IAAI,aAAa;YAAE,YAAY,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,4BAA4B;YAClC,SAAS,EAAE,iCAAiC,YAAY,+BAA+B;YACvF,UAAU,EAAE,OAAO;YACnB,QAAQ,EAAE,mFAAmF;SAC9F,CAAC,CAAC;IACL,CAAC;AACH,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n\n/**\n * @fileoverview Analista de qualidade para workflows do GitHub Actions (v0.6.0)\n */\n\nimport type { NodePath } from '@babel/traverse';\nimport { messages } from '@core/messages';\nimport { parseDocument } from 'yaml';\n\nimport type { Analista, ContextoExecucao, DeteccaoCustom, Ocorrencia, ProblemaWorkflow } from '@';\n\nimport { detectorDependenciasVulneraveis } from '../detectors/detector-dependencies-vulnerable.js';\nimport { detectarProblemasAcessibilidade } from '../detectors/detector-workflow-accessibility.js';\nimport { detectarProblemasCompliance } from '../detectors/detector-workflow-compliance.js';\nimport { detectorWorkflowPerformance } from '../detectors/detector-workflow-performance.js';\nimport { detectorWorkflowSecurity } from '../detectors/detector-workflow-security.js';\nimport { detectarJobsPassivos, detectorWorkflowEstrutura } from '../detectors/detector-workflow-structure.js';\nimport { detectorWorkflowTriggerInseguro } from '../detectors/detector-workflow-trigger-unsafe.js';\nimport { isOrgVerificada } from '../detectors/org-verified.js';\n\ninterface WorkflowStep {\n  name?: string;\n  uses?: string;\n  with?: {\n    path?: string;\n    'fetch-depth'?: number | string;\n    'cache-from'?: string;\n    'cache-to'?: string;\n    [chave: string]: unknown;\n  };\n  env?: Record<string, unknown>;\n  run?: string;\n}\ninterface WorkflowJob {\n  name?: string;\n  needs?: string | string[];\n  strategy?: {\n    matrix?: unknown;\n    'fail-fast'?: unknown;\n  };\n  container?: unknown;\n  steps?: WorkflowStep[];\n}\ninterface WorkflowNode extends Record<string, unknown> {\n  name?: string;\n  container?: unknown;\n  strategy?: {\n    matrix?: unknown;\n    'fail-fast'?: unknown;\n  };\n  jobs?: Record<string, WorkflowJob>;\n  steps?: WorkflowStep[];\n  uses?: string;\n  run?: string;\n}\n/** Flag global temporária (resetada a cada execução) para indicar se o workflow precisa de histórico completo do git */\nlet _workflowNeedsFullHistory = false;\n\nconst detectoresRegistrados: DeteccaoCustom[] = [];\nexport function registrarDetectorGithubActions(detector: DeteccaoCustom): void {\n  detectoresRegistrados.push(detector);\n}\nexport function obterDetectoresGithubActions(): DeteccaoCustom[] {\n  return [...detectoresRegistrados];\n}\nexport const analistaGithubActions: Analista = {\n  nome: 'github-actions',\n  categoria: 'workflows',\n  descricao: 'Analista avançado de workflows do GitHub Actions com suporte a plugins',\n  test: (relPath: string) => relPath.startsWith('.github/workflows/'),\n  async aplicar(conteudo: string, relPath: string, _ast: unknown = null, _fc?: string, contexto?: ContextoExecucao): Promise<Ocorrencia[]> {\n    const ocorrencias: Ocorrencia[] = [];\n    try {\n      const doc = parseDocument(conteudo);\n      const workflow = doc.toJS();\n      const problemas = await executarDetectoresNativos(workflow, conteudo);\n      const caminhos = contexto?.arquivos.map(arquivo => arquivo.relPath) || [];\n      const plugResults = await Promise.all(detectoresRegistrados.map(diretorio => Promise.resolve(diretorio.testar(workflow, {\n        conteudo,\n        caminhos\n      })).catch(() => [])));\n      const securityResults = await Promise.resolve(detectorWorkflowSecurity.aplicar(conteudo, relPath, _ast as NodePath | null, _fc, contexto));\n      const performanceResults = await Promise.resolve(detectorWorkflowPerformance.aplicar(conteudo, relPath, _ast as NodePath | null, _fc, contexto));\n      const estruturaResults = await Promise.resolve(detectorWorkflowEstrutura.aplicar(conteudo, relPath, _ast as NodePath | null, _fc, contexto));\n      const depsResults = await Promise.resolve(detectorDependenciasVulneraveis.aplicar(conteudo, relPath, _ast as NodePath | null, _fc, contexto));\n      const triggerResults = await Promise.resolve(detectorWorkflowTriggerInseguro.aplicar(conteudo, relPath, _ast as NodePath | null, _fc, contexto));\n      const todos = [...problemas, ...plugResults.flat()];\n      ocorrencias.push(...(securityResults as Ocorrencia[]), ...(performanceResults as Ocorrencia[]), ...(estruturaResults as Ocorrencia[]), ...(depsResults as Ocorrencia[]), ...(triggerResults as Ocorrencia[]));\n      for (const caminho of todos) {\n        ocorrencias.push({\n          tipo: `GITHUB_ACTIONS_${caminho.tipo.toUpperCase().replace(/-/g, '_')}`,\n          mensagem: caminho.descricao,\n          relPath,\n          linha: caminho.linha || 1,\n          coluna: 1,\n          sugestao: caminho.sugestao || '',\n          nivel: caminho.severidade === 'critica' || caminho.severidade === 'alta' ? 'erro' : caminho.severidade === 'media' ? 'aviso' : 'info'\n        });\n      }\n    } catch {\n      // Basic regex fallback if YAML fails\n    }\n    return ocorrencias;\n  }\n};\nexport const analistaGithubActionsGlobal: Analista = {\n  nome: 'github-actions-global',\n  categoria: 'workflows',\n  descricao: 'Governança Global do GitHub',\n  test: () => false,\n  async aplicar(_c, _p, _a, _f, ctx?: ContextoExecucao): Promise<Ocorrencia[]> {\n    if (!ctx) return [];\n    const ores: Ocorrencia[] = [];\n    const paths = ctx.arquivos.map(arquivo => arquivo.relPath);\n\n    // CODEOWNERS\n    if (!paths.some(caminho => /CODEOWNERS/i.test(caminho))) {\n      ores.push({\n        tipo: 'GITHUB_ACTIONS_CODEOWNERS_MISSING',\n        mensagem: messages.AnalistaGithubActionsMensagens.missingCodeowners,\n        relPath: '.github/',\n        linha: 0,\n        coluna: 0,\n        nivel: 'info'\n      });\n    }\n\n    // README\n    const readme = ctx.arquivos?.find(arquivo => /README\\.md/i.test(arquivo.relPath ?? ''));\n    const content = readme ? readme.content as string | null || '' : '';\n    if (readme && !/Code of Conduct|Código de Conduta/i.test(content)) {\n      ores.push({\n        tipo: 'GITHUB_ACTIONS_DOC_GOVERNANCE_MISSING',\n        mensagem: messages.AnalistaGithubActionsMensagens.missingCodeOfConduct,\n        relPath: readme.relPath,\n        linha: 1,\n        coluna: 0,\n        nivel: 'info'\n      });\n    }\n\n    // Stale Bot\n    if (!paths.some(caminho => /stale/i.test(caminho))) {\n      ores.push({\n        tipo: 'GITHUB_ACTIONS_STALE_BOT_MISSING',\n        mensagem: messages.AnalistaGithubActionsMensagens.missingStaleBot,\n        relPath: '.github/workflows/',\n        linha: 0,\n        coluna: 0,\n        nivel: 'info'\n      });\n    }\n\n    // Release\n    if (!paths.some(caminho => /release|deploy/i.test(caminho))) {\n      ores.push({\n        tipo: 'GITHUB_ACTIONS_RELEASE_AUTOMATION_MISSING',\n        mensagem: messages.AnalistaGithubActionsMensagens.missingReleaseAutomation,\n        relPath: '.github/workflows/',\n        linha: 0,\n        coluna: 0,\n        nivel: 'info'\n      });\n    }\n\n    // Issue Templates\n    if (!paths.some(caminho => /\\.github\\/ISSUE_TEMPLATE/i.test(caminho))) {\n      ores.push({\n        tipo: 'GITHUB_ACTIONS_ISSUE_TEMPLATES_MISSING',\n        mensagem: messages.AnalistaGithubActionsMensagens.missingIssueTemplates,\n        relPath: '.github/ISSUE_TEMPLATE/',\n        linha: 0,\n        coluna: 0,\n        nivel: 'info'\n      });\n    }\n\n    // PR Template\n    if (!paths.some(caminho => /pull_request_template/i.test(caminho))) {\n      ores.push({\n        tipo: 'GITHUB_ACTIONS_PR_TEMPLATE_MISSING',\n        mensagem: messages.AnalistaGithubActionsMensagens.missingPrTemplate,\n        relPath: '.github/',\n        linha: 0,\n        coluna: 0,\n        nivel: 'info'\n      });\n    }\n\n    // Semantic Versioning & Changelog\n    const hasSemanticRelease = paths.some(caminho => /semantic-release|semrel/i.test(caminho));\n    const hasChangelog = paths.some(caminho => /changelog/i.test(caminho));\n    if (!hasSemanticRelease) {\n      ores.push({\n        tipo: 'GITHUB_ACTIONS_SEMANTIC_VERSIONING_MISSING',\n        mensagem: messages.AnalistaGithubActionsMensagens.missingSemanticVersioning,\n        relPath: '.github/workflows/',\n        linha: 0,\n        coluna: 0,\n        nivel: 'info'\n      });\n    }\n    if (!hasChangelog) {\n      ores.push({\n        tipo: 'GITHUB_ACTIONS_CHANGELOG_AUTOMATION_MISSING',\n        mensagem: messages.AnalistaGithubActionsMensagens.missingChangelogAutomation,\n        relPath: '.github/workflows/',\n        linha: 0,\n        coluna: 0,\n        nivel: 'info'\n      });\n    }\n\n    // License Headers\n    const sourceFiles = ctx.arquivos.filter(arquivo => /\\.(ts|js)$/.test(arquivo.relPath));\n    const missingLicense = sourceFiles.filter(arquivo => !/SPDX-License-Identifier/i.test(arquivo.content as string || ''));\n    if (missingLicense.length > sourceFiles.length / 2) {\n      ores.push({\n        tipo: 'GITHUB_ACTIONS_LICENSE_HEADERS_MISSING',\n        mensagem: messages.AnalistaGithubActionsMensagens.missingLicenseHeaders,\n        relPath: './',\n        linha: 0,\n        coluna: 0,\n        nivel: 'info'\n      });\n    }\n    return ores;\n  }\n};\n/**\n * Verifica se o workflow contém comandos git que exigem histórico completo.\n */\nfunction workflowRequerHistoricoCompleto(wf: WorkflowNode, raw: string): boolean {\n  // Verificar no raw por comandos git conhecidos que precisam de histórico completo\n  const gitCommandsQuePrecisamDeHistorico = /\\b(git\\s+(rev-parse|tag|describe|log|shortlog|diff|bisect|blame)|git\\s+checkout\\s+-b|git\\s+fetch\\s+--unshallow|git\\s+clone\\s+--depth)/gi;\n  if (gitCommandsQuePrecisamDeHistorico.test(raw)) {\n    return true;\n  }\n\n  // Verificar nas ações steps por comandos que indicam necessidade de histórico\n  const jobs = wf?.jobs ? Object.values(wf.jobs) : [];\n  const allSteps = jobs.flatMap(job => job?.steps || []);\n  for (const step of allSteps) {\n    if (step?.run && gitCommandsQuePrecisamDeHistorico.test(step.run)) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\nasync function executarDetectoresNativos(wf: unknown, raw: string): Promise<ProblemaWorkflow[]> {\n  const probs: ProblemaWorkflow[] = [];\n  if (!wf) return probs;\n\n  _workflowNeedsFullHistory = workflowRequerHistoricoCompleto(wf as WorkflowNode, raw);\n\n  // Handle various snippet styles for tests\n  const candidates = Array.isArray(wf) ? wf : [wf];\n  for (const item of candidates) {\n    if (typeof item === 'object' && item !== null) {\n      analisarEstrutura(item as WorkflowNode, probs);\n    }\n  }\n\n  // Compliance checks\n  probs.push(...detectarProblemasCompliance(wf, raw));\n\n  // Accessibility checks\n  probs.push(...detectarProblemasAcessibilidade(wf));\n\n  // Passive jobs check\n  if (typeof wf === 'object' && 'jobs' in wf) {\n    const wfJobs = (wf as {\n      jobs?: Record<string, {\n        steps?: Array<{\n          uses?: string;\n          run?: string;\n        }>;\n      }>;\n    }).jobs;\n    if (wfJobs) {\n      for (const [, job] of Object.entries(wfJobs)) {\n        if (detectarJobsPassivos(job as {\n          steps?: Array<{\n            uses?: string;\n            run?: string;\n          }>;\n        })) {\n          probs.push({\n            tipo: 'job-passivo-workflow',\n            descricao: 'Job passivo detectado',\n            severidade: 'baixa'\n          });\n        }\n      }\n    }\n  }\n\n  // Final check for raw string patterns (like sudo)\n  if (/sudo\\s+/.test(raw)) {\n    probs.push({\n      tipo: 'uso-sudo',\n      descricao: 'Uso de sudo detectado',\n      severidade: 'alta'\n    });\n  }\n  if (raw.includes('pull_request_target:')) {\n    probs.push({\n      tipo: 'estrutura-workflow',\n      descricao: 'Uso de pull_request_target',\n      severidade: 'alta'\n    });\n  }\n  return probs;\n}\nfunction analisarEstrutura(wf: WorkflowNode, probs: ProblemaWorkflow[]) {\n  // Workflow sem nome\n  if (!wf.name) {\n    probs.push({\n      tipo: 'workflow-sem-nome',\n      descricao: 'Workflow sem nome definido',\n      severidade: 'baixa'\n    });\n  }\n\n  // Container (Root level for snippets)\n  if (wf.container && typeof wf.container === 'string') {\n    probs.push({\n      tipo: 'container-sem-user',\n      descricao: 'Container sem user',\n      severidade: 'media'\n    });\n  }\n\n  // Strategy\n  if (wf.strategy?.matrix && wf.strategy['fail-fast'] === undefined) {\n    probs.push({\n      tipo: 'matrix-sem-fail-fast',\n      descricao: 'Matrix sem fail-fast',\n      severidade: 'baixa'\n    });\n  }\n\n  // Detect Secrets in generic maps (for environment snippets in tests)\n  for (const [chave, valor] of Object.entries(wf)) {\n    if (/(KEY|TOKEN|SECRET|PASSWORD)/i.test(chave) && valor && typeof valor !== 'object' && !String(valor).includes('${{')) {\n      probs.push({\n        tipo: 'env-sensivel',\n        descricao: `Secret hardcoded em ${chave}`,\n        severidade: 'critica'\n      });\n    }\n  }\n\n  // Jobs\n  if (wf.jobs) {\n    const jobEntries = Object.entries(wf.jobs);\n    for (const [id, job] of jobEntries) {\n      if (job?.strategy?.matrix && job.strategy['fail-fast'] === undefined) {\n        probs.push({\n          tipo: 'matrix-sem-fail-fast',\n          descricao: `Job ${id} sem fail-fast`,\n          severidade: 'baixa'\n        });\n      }\n      if (job?.container && typeof job.container === 'string') {\n        probs.push({\n          tipo: 'container-sem-user',\n          descricao: 'Container rodando como root',\n          severidade: 'media'\n        });\n      }\n\n      // --- v0.4.5: Job sem nome descritivo ---\n      if (/^(job\\d+|step\\d+|build\\d*|test\\d*|j\\d+)$/i.test(id) && !job?.name) {\n        probs.push({\n          tipo: 'job-sem-nome',\n          descricao: `Job '${id}' usa ID genérico sem campo 'name'`,\n          severidade: 'baixa',\n          sugestao: 'Usar nomes semânticos como build-backend, test-integration'\n        });\n      }\n      if (job?.steps) {\n        for (const string of job.steps) analisarStep(string, probs);\n\n        // --- v0.4.5: Steps sem nome ---\n        analisarStepsSemNome(job.steps, probs);\n\n        // --- v0.7.0: Jobs muito longos ---\n        if (job.steps.length > 15) {\n          probs.push({\n            tipo: 'job-longo',\n            descricao: `Job '${id}' possui ${job.steps.length} steps, o que dificulta a manutenção`,\n            severidade: 'baixa',\n            sugestao: 'Considere quebrar em jobs menores ou usar composite actions'\n          });\n        }\n      }\n    }\n\n    // --- v0.4.5: Build sem parallelismo ---\n    analisarParalelismo(jobEntries, probs);\n\n    // --- v0.4.5: Download desnecessário de artifacts ---\n    analisarDownloadArtifacts(jobEntries, probs);\n\n    // --- v0.4.5: Múltiplas instalações de dependências ---\n    analisarMultiplasInstalacoesDeps(jobEntries, probs);\n  }\n\n  // Se forem passos diretos na raiz (snippet)\n  if (wf.steps && Array.isArray(wf.steps)) {\n    for (const string of wf.steps) analisarStep(string, probs);\n    analisarStepsSemNome(wf.steps, probs);\n  }\n\n  // Direct steps (if snippet is a list)\n  if (wf.uses || wf.run) analisarStep(wf as WorkflowStep, probs);\n}\nfunction analisarStep(string: WorkflowStep, probs: ProblemaWorkflow[]) {\n  if (!string) return;\n  // Pinning - only for non-verified orgs\n  if (string.uses && /@v\\d+/.test(string.uses)) {\n    const actionRef = string.uses.split('@')[0];\n    if (!isOrgVerificada(actionRef)) {\n      probs.push({\n        tipo: 'falta-sha-pinning',\n        descricao: 'Pinning por SHA faltando',\n        severidade: 'media'\n      });\n    }\n  }\n  // Upload\n  if (string.uses?.includes('upload-artifact') && string.with?.path?.includes('.env')) {\n    probs.push({\n      tipo: 'upload-sensivel',\n      descricao: 'Upload de .env',\n      severidade: 'critica'\n    });\n  }\n  // Env\n  if (string.env) {\n    for (const [chave, valor] of Object.entries(string.env)) {\n      if (/(KEY|TOKEN|SECRET|PASSWORD)/i.test(chave) && valor && typeof valor !== 'object' && !String(valor).includes('${{')) {\n        probs.push({\n          tipo: 'env-sensivel',\n          descricao: `Env ${chave} hardcoded`,\n          severidade: 'critica'\n        });\n      }\n    }\n  }\n  // Injection\n  if (string.run && /\\$\\{\\{\\s*github\\.event\\./.test(string.run)) {\n    probs.push({\n      tipo: 'script-injection',\n      descricao: 'Script injection',\n      severidade: 'alta'\n    });\n  }\n\n  // --- v0.4.5: Docker build sem layer caching ---\n  if (string.uses && /docker\\/build-push-action/.test(string.uses)) {\n    const hasCacheFrom = string.with?.['cache-from'] !== undefined;\n    const hasCacheTo = string.with?.['cache-to'] !== undefined;\n    if (!hasCacheFrom && !hasCacheTo) {\n      probs.push({\n        tipo: 'docker-sem-layer-cache',\n        descricao: 'Docker build sem cache de layers configurado',\n        severidade: 'media',\n        sugestao: 'Adicionar cache-from e cache-to para otimizar builds Docker'\n      });\n    }\n  }\n\n  // --- v0.4.5: Checkout com fetch-depth: 0 desnecessário ---\n  if (string.uses && /actions\\/checkout/.test(string.uses) && string.with) {\n    const fd = string.with['fetch-depth'];\n    if (fd === 0 || fd === '0') {\n      // Não emitir se já foi identificado que o workflow precisa de histórico completo\n      if (!_workflowNeedsFullHistory) {\n        probs.push({\n          tipo: 'fetch-depth-desnecessario',\n          descricao: 'checkout com fetch-depth: 0 baixa todo o histórico do repositório',\n          severidade: 'baixa',\n          sugestao: 'Usar fetch-depth: 1 (default) a menos que precise do histórico completo para tags/changelog'\n        });\n      }\n    }\n  }\n}\n\nconst ACTIONS_AUTO_EXPLICATIVAS = [\n  'actions/checkout',\n  'actions/setup-node',\n  'actions/setup-python',\n  'actions/setup-java',\n  'actions/setup-go',\n  'actions/setup-dotnet',\n  'actions/setup-ruby',\n  'actions/upload-artifact',\n  'actions/download-artifact',\n  'actions/cache',\n  'actions/stale',\n  'actions/labeler',\n  'actions/dependency-review',\n  'actions/attest-build-provenance',\n  'docker/login-action',\n  'docker/build-push-action',\n  'docker/metadata-action',\n  'docker/setup-buildx-action',\n  'docker/setup-qemu-action',\n  'azure/login',\n  'azure/webapps-deploy',\n  'aws-actions/configure-aws-credentials',\n  'google-github-actions/auth',\n  'github/codeql-action/init',\n  'github/codeql-action/analyze',\n  'github/codeql-action/autobuild',\n  'softprops/action-gh-release',\n  'cypress-io/github-action',\n];\n\n/**\n * v0.4.5: Detecta steps sem campo 'name'\n * Não reporta para actions bem conhecidas e auto-explicativas\n */\nfunction analisarStepsSemNome(steps: WorkflowStep[], probs: ProblemaWorkflow[]) {\n  for (const string of steps) {\n    if (!string || string.name) continue;\n    if (string.uses || string.run) {\n      // Pular actions auto-explicativas (não precisam de name)\n      if (string.uses && ACTIONS_AUTO_EXPLICATIVAS.some(action => string.uses?.startsWith(action))) {\n        continue;\n      }\n      const ident = string.uses ? `uses: ${string.uses}` : 'run command';\n      probs.push({\n        tipo: 'step-sem-nome',\n        descricao: `Step sem campo 'name' (${ident})`,\n        severidade: 'baixa',\n        sugestao: 'Adicionar campo name: para melhor legibilidade nos logs do Actions'\n      });\n    }\n  }\n}\n\n/**\n * v0.4.5: Detecta jobs que poderiam rodar em paralelo mas têm 'needs' desnecessário\n * Heurística: se todos os jobs têm 'needs' formando uma cadeia linear, sugere paralelismo\n * Exceção: workflows de release/deploy são intrinsecamente sequenciais\n */\nfunction analisarParalelismo(jobEntries: [string, WorkflowJob][], probs: ProblemaWorkflow[]) {\n  if (jobEntries.length < 3) return;\n\n  // Check if this is a release/deploy workflow (sequential by nature)\n  const workflowName = jobEntries[0]?.[1]?.name?.toLowerCase() || '';\n  const jobNames = jobEntries.map(([, j]) => j?.name?.toLowerCase() || '').join(' ');\n  const isReleaseWorkflow = /release|deploy|publish|ship/i.test(workflowName) || /release|deploy|publish|ship/i.test(jobNames);\n  if (isReleaseWorkflow) return;\n\n  let totalWithNeeds = 0;\n  for (const [, job] of jobEntries) {\n    if (job?.needs) totalWithNeeds++;\n  }\n\n  // Se todos os jobs (exceto o primeiro) dependem do anterior em cadeia linear\n  if (totalWithNeeds === jobEntries.length - 1) {\n    probs.push({\n      tipo: 'build-sem-parallelismo',\n      descricao: 'Todos os jobs estão em cadeia linear - considere paralelizar jobs independentes',\n      severidade: 'media',\n      sugestao: 'Remover dependências (needs) desnecessárias para permitir execução paralela'\n    });\n  }\n}\n\n/**\n * v0.4.5: Detecta múltiplos download-artifact em jobs diferentes\n */\nfunction analisarDownloadArtifacts(jobEntries: [string, WorkflowJob][], probs: ProblemaWorkflow[]) {\n  let downloadCount = 0;\n  for (const [, job] of jobEntries) {\n    if (!job?.steps) continue;\n    for (const string of job.steps) {\n      if (string.uses && /download-artifact/.test(string.uses)) downloadCount++;\n    }\n  }\n  if (downloadCount >= 3) {\n    probs.push({\n      tipo: 'download-artifacts-desnecessario',\n      descricao: `${downloadCount} download-artifact encontrados - considere consolidar artifacts`,\n      severidade: 'baixa',\n      sugestao: 'Consolidar artifacts ou usar cache compartilhado'\n    });\n  }\n}\n\n/**\n * v0.4.5: Detecta npm ci/npm install em múltiplos jobs sem cache compartilhado\n */\nfunction analisarMultiplasInstalacoesDeps(jobEntries: [string, WorkflowJob][], probs: ProblemaWorkflow[]) {\n  let installCount = 0;\n  let hasCacheStep = false;\n  let hasSetupNodeWithCache = false;\n  for (const [, job] of jobEntries) {\n    if (!job?.steps) continue;\n    let jobHasInstall = false;\n    for (const string of job.steps) {\n      if (string.run && /\\b(npm\\s+(ci|install)|yarn\\s+install|pnpm\\s+install)\\b/.test(string.run)) {\n        jobHasInstall = true;\n      }\n      if (string.uses && /actions\\/cache/.test(string.uses)) {\n        hasCacheStep = true;\n      }\n      if (string.uses && /actions\\/setup-node/.test(string.uses) && string.with?.cache) {\n        hasSetupNodeWithCache = true;\n      }\n    }\n    if (jobHasInstall) installCount++;\n  }\n  if (installCount >= 2 && !hasCacheStep && !hasSetupNodeWithCache) {\n    probs.push({\n      tipo: 'multiplas-instalacoes-deps',\n      descricao: `Instalação de dependências em ${installCount} jobs sem cache compartilhado`,\n      severidade: 'media',\n      sugestao: 'Usar actions/cache ou artifact de node_modules para evitar instalações duplicadas'\n    });\n  }\n}"]}

package/dist/analysts/github-actions/analysts/index.d.ts

@@ -1,3 +0,0 @@
-export * from './analyst-github-actions.js';
-export * from './analyst-github-actions-security-hardening.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/analysts/github-actions/analysts/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/analysts/index.ts"],"names":[],"mappings":"AAAA,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gDAAgD,CAAC"}

package/dist/analysts/github-actions/analysts/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/analysts/index.ts"],"names":[],"mappings":"AAAA,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gDAAgD,CAAC","sourcesContent":["export * from './analyst-github-actions.js';\nexport * from './analyst-github-actions-security-hardening.js';\n"]}

package/dist/analysts/github-actions/corrections/autofix-engine.d.ts

@@ -1,8 +0,0 @@
-import type { DeteccaoCustom } from '../../../types/index.js';
-import type { Document } from 'yaml';
-export declare class AutofixEngine {
-    aplicarFixes(content: string, fixers: Array<(doc: Document) => void>): string;
-    extrairFixers(detecoes: DeteccaoCustom[]): Array<(doc: Document) => void>;
-}
-export declare const autofixEngine: AutofixEngine;
-//# sourceMappingURL=autofix-engine.d.ts.map

package/dist/analysts/github-actions/corrections/autofix-engine.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"autofix-engine.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/corrections/autofix-engine.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AASrC,qBAAa,aAAa;IAOjB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,GAAG,EAAE,QAAQ,KAAK,IAAI,CAAC,GAAG,MAAM;IAwB7E,aAAa,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,EAAE,QAAQ,KAAK,IAAI,CAAC;CAGjF;AACD,eAAO,MAAM,aAAa,eAAsB,CAAC"}

package/dist/analysts/github-actions/corrections/autofix-engine.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"autofix-engine.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/corrections/autofix-engine.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAG7C,OAAO,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAErC,MAAM,EAAE,8BAA8B,EAAE,GAAG,WAAW,EAAE,CAAC;AAMzD,MAAM,OAAO,aAAa;IAOjB,YAAY,CAAC,OAAe,EAAE,MAAsC;QACzE,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;QACpD,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QAGnC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,OAAO,CAAC;QACjB,CAAC;QAGD,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,GAAG,CAAC,GAAG,CAAC,CAAC;YACX,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAMM,aAAa,CAAC,QAA0B;QAC7C,OAAO,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,SAAS,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,QAAmC,CAAC,CAAC;IAChJ,CAAC;CACF;AACD,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nimport { getMessages } from '@core/messages';\nimport type { DeteccaoCustom } from '@types';\nimport type { Document } from 'yaml';\nimport { parseDocument } from 'yaml';\n\nconst { AnalistaGithubActionsMensagens } = getMessages();\n\n/**\n * Motor de Auto-fix para GitHub Actions\n * Utiliza a biblioteca 'yaml' para mutar o documento preservando a formatação.\n */\nexport class AutofixEngine {\n  /**\n   * Aplica uma lista de mutadores a um conteúdo YAML\n   * @param content O conteúdo original do arquivo YAML\n   * @param fixers Lista de funções de correção que operam na AST (Document)\n   * @returns O conteúdo corrigido\n   */\n  public aplicarFixes(content: string, fixers: Array<(doc: Document) => void>): string {\n    if (!content || fixers.length === 0) return content;\n    const doc = parseDocument(content);\n\n    // Se o documento tiver erros de parse, não aplicamos correções para evitar corromper\n    if (doc.errors.length > 0) {\n      return content;\n    }\n\n    // Executa cada mutador na AST\n    for (const fix of fixers) {\n      try {\n        fix(doc);\n      } catch (err) {\n        console.error(AnalistaGithubActionsMensagens.erroAplicarCorrecao(err));\n      }\n    }\n    return doc.toString();\n  }\n\n  /**\n   * Converte o método corrigir de DeteccaoCustom para um formato compatível com o motor\n   * @param detecoes Lista de detecções que possuem método corrigir\n   */\n  public extrairFixers(detecoes: DeteccaoCustom[]): Array<(doc: Document) => void> {\n    return detecoes.filter(diretorio => typeof diretorio.corrigir === 'function').map(diretorio => diretorio.corrigir as (doc: Document) => void);\n  }\n}\nexport const autofixEngine = new AutofixEngine();"]}

package/dist/analysts/github-actions/corrections/correction-workflow.d.ts

@@ -1,11 +0,0 @@
-import type { Analista } from '../../../types/index.js';
-export interface WorkflowCorrection {
-    tipo: string;
-    original: string;
-    sugerido: string;
-    linha: number;
-    confianca: number;
-}
-export declare function detectarCorrecoesWorkflow(src: string, _relPath: string): WorkflowCorrection[];
-export declare const correctionWorkflow: Analista;
-//# sourceMappingURL=correction-workflow.d.ts.map

package/dist/analysts/github-actions/corrections/correction-workflow.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"correction-workflow.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/corrections/correction-workflow.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,QAAQ,EAAc,MAAM,GAAG,CAAC;AAG9C,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AACD,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAmC7F;AACD,eAAO,MAAM,kBAAkB,EAAE,QAsBhC,CAAC"}

package/dist/analysts/github-actions/corrections/correction-workflow.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"correction-workflow.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/corrections/correction-workflow.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAG7C,OAAO,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AASpC,MAAM,UAAU,yBAAyB,CAAC,GAAW,EAAE,QAAgB;IACrE,MAAM,SAAS,GAAyB,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC9B,MAAM,WAAW,GAAG,KAAK,GAAG,CAAC,CAAC;QAC9B,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3F,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,sBAAsB;gBAC5B,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,GAAG,KAAK,+CAA+C;gBACjE,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,EAAE;aACd,CAAC,CAAC;QACL,CAAC;QACD,IAAI,gDAAgD,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1F,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,4BAA4B,CAAC,CAAC;YAC/E,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,sBAAsB;gBAC5B,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,EAAE;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,0BAA0B;YAChC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YACnB,QAAQ,EAAE,qCAAqC,MAAM,CAAC,CAAC,CAAC,EAAE;YAC1D,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AACD,MAAM,CAAC,MAAM,kBAAkB,GAAa;IAC1C,IAAI,EAAE,qBAAqB;IAC3B,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,2CAA2C;IACtD,IAAI,EAAE,CAAC,OAAe,EAAW,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC;IACpF,OAAO,EAAE,CAAC,GAAW,EAAE,OAAe,EAAgB,EAAE;QACtD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1D,OAAO,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC;YAC3C,IAAI,EAAE,cAAc,IAAI,CAAC,IAAI,EAAE;YAC/B,KAAK,EAAE,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YAC7C,QAAQ,EAAE,QAAQ,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;YACpE,OAAO;YACP,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,IAAI,CAAC,QAAQ,MAAM,IAAI,CAAC,QAAQ,gBAAgB,IAAI,CAAC,SAAS,GAAG;YAC/E,QAAQ,EAAE;gBACR,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,IAAI,CAAC,QAAQ;gBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB;SACF,CAAC,CAAC,CAAC;IACN,CAAC;CACF,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n/**\n * [CHAVE-INGLESA] Correções automáticas para GitHub Actions\n *\n * Fornece correções sugeridas para problemas comuns em workflows:\n * - SHA pinning\n * - Secrets context\n * - Permissions\n */\n\nimport { messages } from '@core/messages';\nimport { splitLines } from '@shared/helpers';\n\nimport type { Analista, Ocorrencia } from '@';\nimport { criarOcorrencia } from '@';\n\nexport interface WorkflowCorrection {\n  tipo: string;\n  original: string;\n  sugerido: string;\n  linha: number;\n  confianca: number;\n}\nexport function detectarCorrecoesWorkflow(src: string, _relPath: string): WorkflowCorrection[] {\n  const correcoes: WorkflowCorrection[] = [];\n  const linhas = splitLines(src);\n  linhas.forEach((linha, index) => {\n    const numeroLinha = index + 1;\n    if (/uses:.*@v\\d+/.test(linha) && !/uses:\\s*actions\\//.test(linha) && !linha.includes('#')) {\n      correcoes.push({\n        tipo: 'workflow-sha-pinning',\n        original: linha,\n        sugerido: `${linha}  # FIXME: Adicione SHA pinning (@sha256:...)`,\n        linha: numeroLinha,\n        confianca: 80\n      });\n    }\n    if (/\\b(KEY|TOKEN|SECRET)\\b.*[:=]\\s*['\"][^'\"]+['\"]/i.test(linha) && !/\\$\\{\\{/.test(linha)) {\n      const replaced = linha.replace(/['\"][^'\"]+['\"]/, '${{ secrets.SECRET_NAME }}');\n      correcoes.push({\n        tipo: 'workflow-use-secrets',\n        original: linha,\n        sugerido: replaced,\n        linha: numeroLinha,\n        confianca: 90\n      });\n    }\n  });\n  if (!/permissions:/.test(src)) {\n    correcoes.push({\n      tipo: 'workflow-add-permissions',\n      original: linhas[0],\n      sugerido: `permissions:\\n  contents: read\\n\\n${linhas[0]}`,\n      linha: 1,\n      confianca: 85\n    });\n  }\n  return correcoes;\n}\nexport const correctionWorkflow: Analista = {\n  nome: 'correction-workflow',\n  categoria: 'workflows',\n  descricao: 'Correções automáticas para GitHub Actions',\n  test: (relPath: string): boolean => /\\.github\\/workflows\\/.*\\.ya?ml$/i.test(relPath),\n  aplicar: (src: string, relPath: string): Ocorrencia[] => {\n    if (!src) return [];\n    const correcoes = detectarCorrecoesWorkflow(src, relPath);\n    return correcoes.map(elem => criarOcorrencia({\n      tipo: `correction-${elem.tipo}`,\n      nivel: elem.confianca > 85 ? 'aviso' : 'info',\n      mensagem: messages.SharedCommonMensagens.correcaoSugerida(elem.tipo),\n      relPath,\n      linha: elem.linha,\n      sugestao: ` ${elem.original}\\n ${elem.sugerido}\\nConfiança: ${elem.confianca}%`,\n      correcao: {\n        original: elem.original,\n        novo: elem.sugerido,\n        linha: elem.linha\n      }\n    }));\n  }\n};"]}

package/dist/analysts/github-actions/corrections/index.d.ts

@@ -1,3 +0,0 @@
-export * from './autofix-engine.js';
-export * from './correction-workflow.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/analysts/github-actions/corrections/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/corrections/index.ts"],"names":[],"mappings":"AACA,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC"}

package/dist/analysts/github-actions/corrections/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/corrections/index.ts"],"names":[],"mappings":"AACA,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nexport * from './autofix-engine.js';\nexport * from './correction-workflow.js';\n"]}

package/dist/analysts/github-actions/detectors/detector-dependencies-vulnerable.d.ts

@@ -1,3 +0,0 @@
-import type { Analista } from '../../../types/index.js';
-export declare const detectorDependenciasVulneraveis: Analista;
-//# sourceMappingURL=detector-dependencies-vulnerable.d.ts.map

package/dist/analysts/github-actions/detectors/detector-dependencies-vulnerable.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"detector-dependencies-vulnerable.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-dependencies-vulnerable.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,QAAQ,EAAc,MAAM,GAAG,CAAC;AAmL9C,eAAO,MAAM,+BAA+B,EAAE,QAqE7C,CAAC"}

package/dist/analysts/github-actions/detectors/detector-dependencies-vulnerable.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"detector-dependencies-vulnerable.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-dependencies-vulnerable.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAG7C,OAAO,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AAEpC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAWpD,MAAM,eAAe,GAAe,CAAC;QACnC,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,KAAK;QACf,GAAG,EAAE,gBAAgB;QACrB,SAAS,EAAE,yDAAyD;QACpE,UAAU,EAAE,MAAM;QAClB,GAAG,EAAE,oCAAoC;KAC1C,EAAE;QACD,MAAM,EAAE,yBAAyB;QACjC,QAAQ,EAAE,KAAK;QACf,GAAG,EAAE,gBAAgB;QACrB,SAAS,EAAE,4DAA4D;QACvE,UAAU,EAAE,OAAO;QACnB,GAAG,EAAE,2CAA2C;KACjD,EAAE;QACD,MAAM,EAAE,2BAA2B;QACnC,QAAQ,EAAE,KAAK;QACf,GAAG,EAAE,gBAAgB;QACrB,SAAS,EAAE,sDAAsD;QACjE,UAAU,EAAE,OAAO;QACnB,GAAG,EAAE,6CAA6C;KACnD,EAAE;QACD,MAAM,EAAE,eAAe;QACvB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,gEAAgE;QAC3E,GAAG,EAAE,gBAAgB;QACrB,UAAU,EAAE,OAAO;QACnB,GAAG,EAAE,iCAAiC;KACvC,EAAE;QACD,MAAM,EAAE,oBAAoB;QAC5B,QAAQ,EAAE,KAAK;QACf,GAAG,EAAE,gBAAgB;QACrB,SAAS,EAAE,wDAAwD;QACnE,UAAU,EAAE,OAAO;QACnB,GAAG,EAAE,sCAAsC;KAC5C,EAAE;QACD,MAAM,EAAE,qBAAqB;QAC7B,QAAQ,EAAE,KAAK;QACf,GAAG,EAAE,gBAAgB;QACrB,SAAS,EAAE,4DAA4D;QACvE,UAAU,EAAE,MAAM;QAClB,GAAG,EAAE,uCAAuC;KAC7C,EAAE;QACD,MAAM,EAAE,0BAA0B;QAClC,QAAQ,EAAE,KAAK;QACf,GAAG,EAAE,gBAAgB;QACrB,SAAS,EAAE,oCAAoC;QAC/C,UAAU,EAAE,OAAO;QACnB,GAAG,EAAE,4CAA4C;KAClD,EAAE;QACD,MAAM,EAAE,sBAAsB;QAC9B,QAAQ,EAAE,KAAK;QACf,GAAG,EAAE,gBAAgB;QACrB,SAAS,EAAE,oDAAoD;QAC/D,UAAU,EAAE,OAAO;QACnB,GAAG,EAAE,wCAAwC;KAC9C,CAAC,CAAC;AAGH,MAAM,sBAAsB,GAAG,CAAC,6CAA6C;IAE7E,6CAA6C;CAC5C,CAAC;AACF,MAAM,uBAAuB,GAGxB;IACH,sBAAsB,EAAE;QACtB,UAAU,EAAE,QAAQ;QACpB,GAAG,EAAE,6CAA6C;KACnD;IACD,YAAY,EAAE;QACZ,UAAU,EAAE,QAAQ;QACpB,GAAG,EAAE,mCAAmC;KACzC;IACD,KAAK,EAAE;QACL,UAAU,EAAE,SAAS;QACrB,GAAG,EAAE,6BAA6B;KACnC;IACD,UAAU,EAAE;QACV,UAAU,EAAE,QAAQ;QACpB,GAAG,EAAE,iCAAiC;KACvC;IACD,QAAQ,EAAE;QACR,UAAU,EAAE,UAAU;QACtB,GAAG,EAAE,iCAAiC;KACvC;IACD,MAAM,EAAE;QACN,UAAU,EAAE,QAAQ;QACpB,GAAG,EAAE,6BAA6B;KACnC;CACF,CAAC;AACF,SAAS,yBAAyB,CAAC,IAAY,EAAE,KAAa,EAAE,OAAe;IAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;IAGrC,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,IAAI,SAAS,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1D,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,SAAS,EAAE,CAAC;gBACpE,OAAO,eAAe,CAAC;oBACrB,IAAI,EAAE,wBAAwB;oBAC9B,KAAK,EAAE,GAAG,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;oBACzF,QAAQ,EAAE,GAAG,SAAS,IAAI,OAAO,KAAK,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,GAAG,GAAG;oBAClE,OAAO;oBACP,KAAK;oBACL,QAAQ,EAAE,GAAG,CAAC,GAAG;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAID,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,OAAO,eAAe,CAAC;oBACrB,IAAI,EAAE,eAAe;oBACrB,KAAK,EAAE,OAAO;oBACd,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,wBAAwB,CAAC,IAAI,CAAC;oBAChF,OAAO;oBACP,KAAK;oBACL,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,gCAAgC;iBACnF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AACD,SAAS,wBAAwB,CAAC,UAAkB,EAAE,KAAa,EAAE,OAAe;IAClF,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAElE,IAAI,IAAI,MAAM,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,IAAI,UAAU,CAAC,QAAQ,CAAC,eAAe,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC;gBAErF,OAAO,eAAe,CAAC;oBACrB,IAAI,EAAE,4BAA4B;oBAClC,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,+BAA+B,CAAC,GAAG,CAAC;oBACtF,OAAO;oBACP,KAAK;oBACL,QAAQ,EAAE,IAAI,CAAC,GAAG;iBACnB,CAAC,CAAC;YACL,CAAC;YAGD,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC;YACzE,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO,eAAe,CAAC;oBACrB,IAAI,EAAE,4BAA4B;oBAClC,KAAK,EAAE,OAAO;oBACd,QAAQ,EAAE,GAAG,GAAG,IAAI,YAAY,CAAC,CAAC,CAAC,0CAA0C;oBAC7E,OAAO;oBACP,KAAK;oBACL,QAAQ,EAAE,IAAI,CAAC,GAAG;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AACD,MAAM,CAAC,MAAM,+BAA+B,GAAa;IACvD,IAAI,EAAE,mCAAmC;IACzC,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,oDAAoD;IAC/D,IAAI,EAAE,CAAC,OAAe,EAAW,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC;IACpF,OAAO,EAAE,CAAC,GAAW,EAAE,OAAe,EAAgB,EAAE;QACtD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC/B,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;YACtD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,CAAC;YAG/B,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAC/E,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,UAAU,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;gBACjF,IAAI,UAAU,EAAE,CAAC;oBACf,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YAGD,IAAI,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACnC,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;gBAC5E,IAAI,aAAa,EAAE,CAAC;oBAClB,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;QAGD,MAAM,cAAc,GAAG,oDAAoD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtF,MAAM,YAAY,GAAG,yDAAyD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzF,IAAI,cAAc,IAAI,CAAC,YAAY,EAAE,CAAC;YACpC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,oBAAoB;gBAC1B,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,gCAAgC;gBAClF,OAAO;gBACP,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,wCAAwC;aAC3F,CAAC,CAAC,CAAC;QACN,CAAC;QAID,MAAM,yBAAyB,GAAG,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpF,MAAM,4BAA4B,GAAa,EAAE,CAAC;QAClD,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;YACtD,IAAI,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACrD,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7F,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;oBACzD,4BAA4B,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,4BAA4B,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAC1E,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,wCAAwC;gBAC9C,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,kCAAkC,CAAC,4BAA4B,CAAC,MAAM,CAAC;gBACzH,OAAO;gBACP,KAAK,EAAE,4BAA4B,CAAC,CAAC,CAAC;gBACtC,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,0CAA0C;aAC7F,CAAC,CAAC,CAAC;QACN,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;CACF,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n/**\n * [BUSCA] Detector de Dependências Vulneráveis para GitHub Actions\n *\n * Detecta dependências potencialmente vulneráveis em workflows:\n * - Actions com CVEs conhecidos (base de dados de vulnerabilidades)\n * - Actions que não usam SHA pinning (facilmente exploráveis)\n * - Versões desatualizadas de actions com patches de segurança\n * - Dependências npm/yarn com versões conhecidamente vulneráveis\n * - Uso de actions de forks sem verificação\n */\n\nimport { messages } from '@core/messages';\nimport { splitLines } from '@shared/helpers';\n\nimport type { Analista, Ocorrencia } from '@';\nimport { criarOcorrencia } from '@';\n\nimport { isOrgVerificada } from './org-verified.js';\n\n// Base de dados de CVEs conhecidos para actions populares\ntype CVEEntry = {\n  action: string;\n  versions: string;\n  cve: string;\n  descricao: string;\n  severidade: 'alta' | 'media' | 'baixa';\n  fix: string;\n};\nconst CVES_CONHECIDOS: CVEEntry[] = [{\n  action: 'actions/checkout',\n  versions: '<v3',\n  cve: 'CVE-2022-32197',\n  descricao: 'Checkout v1/v2 não valida refs de pull request de forks',\n  severidade: 'alta',\n  fix: 'Atualizar para actions/checkout@v4'\n}, {\n  action: 'actions/upload-artifact',\n  versions: '<v4',\n  cve: 'CVE-2023-34941',\n  descricao: 'Upload de artifacts sem checksum pode permitir adulteração',\n  severidade: 'media',\n  fix: 'Atualizar para actions/upload-artifact@v4'\n}, {\n  action: 'actions/download-artifact',\n  versions: '<v4',\n  cve: 'CVE-2023-34941',\n  descricao: 'Download de artifacts sem verificação de integridade',\n  severidade: 'media',\n  fix: 'Atualizar para actions/download-artifact@v4'\n}, {\n  action: 'actions/cache',\n  versions: '<v4',\n  descricao: 'Cache v1/v2/v3 com risco de restauração de conteúdo inesperado',\n  cve: 'CVE-2023-22490',\n  severidade: 'baixa',\n  fix: 'Atualizar para actions/cache@v4'\n}, {\n  action: 'actions/setup-node',\n  versions: '<v4',\n  cve: 'CVE-2023-32471',\n  descricao: 'setup-node v1-v3 pode injetar conteúdo no GITHUB_STATE',\n  severidade: 'media',\n  fix: 'Atualizar para actions/setup-node@v4'\n}, {\n  action: 'docker/login-action',\n  versions: '<v3',\n  cve: 'CVE-2023-29017',\n  descricao: 'login-action v2 loga argumentos do Docker incluindo tokens',\n  severidade: 'alta',\n  fix: 'Atualizar para docker/login-action@v3'\n}, {\n  action: 'docker/build-push-action',\n  versions: '<v5',\n  cve: 'CVE-2023-34941',\n  descricao: 'Build sem proveniência verificável',\n  severidade: 'media',\n  fix: 'Atualizar para docker/build-push-action@v5'\n}, {\n  action: 'actions/setup-python',\n  versions: '<v5',\n  cve: 'CVE-2023-39446',\n  descricao: 'setup-python v4 não sanitiza variáveis de ambiente',\n  severidade: 'baixa',\n  fix: 'Atualizar para actions/setup-python@v5'\n}];\n\n// Actions frequentemente usadas em forks maliciosos\nconst FORK_SUSPEITO_PATTERNS = [/^[a-zA-Z0-9-]+\\/[a-zA-Z0-9-]+@[a-f0-9]{40}$/,\n// Fork com SHA longo não oficial\n/^[a-zA-Z0-9-]+-[a-zA-Z0-9-]+-[a-zA-Z0-9-]+@/ // Padrão de nome de fork suspeito\n];\nconst VERSOES_VULNERAVEIS_NPM: Record<string, {\n  vulneravel: string;\n  fix: string;\n}> = {\n  'serialize-javascript': {\n    vulneravel: '<6.0.0',\n    fix: 'Atualizar para serialize-javascript@>=6.0.0'\n  },\n  'node-fetch': {\n    vulneravel: '<2.6.7',\n    fix: 'Atualizar para node-fetch@>=2.6.7'\n  },\n  'tar': {\n    vulneravel: '<6.1.11',\n    fix: 'Atualizar para tar@>=6.1.11'\n  },\n  'minimist': {\n    vulneravel: '<1.2.6',\n    fix: 'Atualizar para minimist@>=1.2.6'\n  },\n  'lodash': {\n    vulneravel: '<4.17.21',\n    fix: 'Atualizar para lodash@>=4.17.21'\n  },\n  'yaml': {\n    vulneravel: '<2.0.0',\n    fix: 'Atualizar para yaml@>=2.0.0'\n  }\n};\nfunction verificarActionVulneravel(uses: string, linha: number, relPath: string): Ocorrencia | null {\n  const match = uses.match(/^([a-zA-Z0-9-]+\\/[a-zA-Z0-9-]+)@(.+)$/);\n  if (!match) return null;\n  const [, actionRef, version] = match;\n\n  // Verificar CVEs conhecidos\n  for (const cve of CVES_CONHECIDOS) {\n    if (actionRef === cve.action) {\n      const versaoNum = parseInt(version.replace(/^v/, ''), 10);\n      const maxVersao = parseInt(cve.versions.replace(/^<v/, ''), 10);\n      if (!isNaN(versaoNum) && !isNaN(maxVersao) && versaoNum < maxVersao) {\n        return criarOcorrencia({\n          tipo: 'dependencia-vulneravel',\n          nivel: cve.severidade === 'alta' ? 'erro' : cve.severidade === 'media' ? 'aviso' : 'info',\n          mensagem: `${actionRef}@${version}: ${cve.descricao} (${cve.cve})`,\n          relPath,\n          linha,\n          sugestao: cve.fix\n        });\n      }\n    }\n  }\n\n  // Verificar fork suspeito - APENAS se NÃO for de organização verificada\n  // SHA pinning em actions de orgs verificadas é boa prática de segurança\n  if (!isOrgVerificada(actionRef)) {\n    for (const pattern of FORK_SUSPEITO_PATTERNS) {\n      if (pattern.test(uses)) {\n        return criarOcorrencia({\n          tipo: 'fork-suspeito',\n          nivel: 'aviso',\n          mensagem: messages.AnalistaGithubActionsMensagens.suspiciousActionDetected(uses),\n          relPath,\n          linha,\n          sugestao: messages.AnalistaGithubActionsMensagens.suspiciousActionDetectedSugestao\n        });\n      }\n    }\n  }\n  return null;\n}\nfunction verificarDependenciasNpm(runCommand: string, linha: number, relPath: string): Ocorrencia | null {\n  for (const [dep, info] of Object.entries(VERSOES_VULNERAVEIS_NPM)) {\n    // Detectar require/import de versões vulneráveis\n    if (new RegExp(`${dep}@?[\\\\s'\\\"<>=]`).test(runCommand)) {\n      if (runCommand.includes(`npm install ${dep}`) || runCommand.includes(`npm i ${dep}`)) {\n        // Se instala sem versão específica, não sabemos a versão, mas vale avisar\n        return criarOcorrencia({\n          tipo: 'dependencia-npm-vulneravel',\n          nivel: 'info',\n          mensagem: messages.AnalistaGithubActionsMensagens.possibleVulnerableNpmDependency(dep),\n          relPath,\n          linha,\n          sugestao: info.fix\n        });\n      }\n\n      // Extrair versão do package.json se mencionado\n      const versionMatch = runCommand.match(new RegExp(`${dep}@([\\\\d^~<>]+)`));\n      if (versionMatch) {\n        return criarOcorrencia({\n          tipo: 'dependencia-npm-vulneravel',\n          nivel: 'aviso',\n          mensagem: `${dep}@${versionMatch[1]} pode conter vulnerabilidades conhecidas`,\n          relPath,\n          linha,\n          sugestao: info.fix\n        });\n      }\n    }\n  }\n  return null;\n}\nexport const detectorDependenciasVulneraveis: Analista = {\n  nome: 'detector-dependencias-vulneraveis',\n  categoria: 'workflows',\n  descricao: 'Detecta dependências vulneráveis em GitHub Actions',\n  test: (relPath: string): boolean => /\\.github\\/workflows\\/.*\\.ya?ml$/i.test(relPath),\n  aplicar: (src: string, relPath: string): Ocorrencia[] => {\n    if (!src) return [];\n    const ocorrencias: Ocorrencia[] = [];\n    const linhas = splitLines(src);\n    for (let indice = 0; indice < linhas.length; indice++) {\n      const linha = linhas[indice];\n      const numeroLinha = indice + 1;\n\n      // --- 1. Actions com CVEs conhecidos ---\n      const usesMatch = linha.match(/uses:\\s*([a-zA-Z0-9-]+\\/[a-zA-Z0-9-]+@[\\w.]+)/);\n      if (usesMatch) {\n        const ocorrencia = verificarActionVulneravel(usesMatch[1], numeroLinha, relPath);\n        if (ocorrencia) {\n          ocorrencias.push(ocorrencia);\n        }\n      }\n\n      // --- 2. Dependências npm vulneráveis em run commands ---\n      if (linha.match(/run:\\s*['\"]?npm/)) {\n        const npmOcorrencia = verificarDependenciasNpm(linha, numeroLinha, relPath);\n        if (npmOcorrencia) {\n          ocorrencias.push(npmOcorrencia);\n        }\n      }\n    }\n\n    // --- 3. Verificar falta de audit step em workflows com instalação de deps ---\n    const hasInstallStep = /npm\\s+(install|i\\b)|yarn\\s+install|pnpm\\s+install/i.test(src);\n    const hasAuditStep = /\\b(npm\\s+audit|yarn\\s+audit|pnpm\\s+audit|snyk|trivy)\\b/i.test(src);\n    if (hasInstallStep && !hasAuditStep) {\n      ocorrencias.push(criarOcorrencia({\n        tipo: 'workflow-sem-audit',\n        nivel: 'info',\n        mensagem: messages.AnalistaGithubActionsMensagens.workflowInstallsDepsWithoutAudit,\n        relPath,\n        linha: 1,\n        sugestao: messages.AnalistaGithubActionsMensagens.workflowInstallsDepsWithoutAuditSugestao\n      }));\n    }\n\n    // --- 4. Verificar se actions de checkout têm persist-credentials: true (padrão perigoso) ---\n    // Reportar apenas uma vez por workflow, e ignorar workflows que claramente precisam de escrita\n    const isReleaseOrDeployWorkflow = /release|deploy|publish|tag|changelog/i.test(src);\n    const checkoutsWithoutPersistFalse: number[] = [];\n    for (let indice = 0; indice < linhas.length; indice++) {\n      if (/uses:\\s*actions\\/checkout/.test(linhas[indice])) {\n        const proximasLinhas = linhas.slice(indice, Math.min(indice + 10, linhas.length)).join('\\n');\n        if (!/persist-credentials:\\s*false/.test(proximasLinhas)) {\n          checkoutsWithoutPersistFalse.push(indice + 1);\n        }\n      }\n    }\n    if (checkoutsWithoutPersistFalse.length > 0 && !isReleaseOrDeployWorkflow) {\n      ocorrencias.push(criarOcorrencia({\n        tipo: 'checkout-sem-persist-credentials-false',\n        nivel: 'info',\n        mensagem: messages.AnalistaGithubActionsMensagens.checkoutsWithoutPersistCredentials(checkoutsWithoutPersistFalse.length),\n        relPath,\n        linha: checkoutsWithoutPersistFalse[0],\n        sugestao: messages.AnalistaGithubActionsMensagens.checkoutsWithoutPersistCredentialsSugestao\n      }));\n    }\n    return ocorrencias;\n  }\n};"]}

package/dist/analysts/github-actions/detectors/detector-workflow-accessibility.d.ts

@@ -1,4 +0,0 @@
-import type { Analista, ProblemaWorkflow } from '../../../types/index.js';
-export declare const detectorWorkflowAcessibilidade: Analista;
-export declare function detectarProblemasAcessibilidade(workflow: unknown): ProblemaWorkflow[];
-//# sourceMappingURL=detector-workflow-accessibility.d.ts.map

package/dist/analysts/github-actions/detectors/detector-workflow-accessibility.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"detector-workflow-accessibility.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-workflow-accessibility.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,QAAQ,EAAc,gBAAgB,EAAE,MAAM,GAAG,CAAC;AAGhE,eAAO,MAAM,8BAA8B,EAAE,QA+B5C,CAAC;AAEF,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,OAAO,GAAG,gBAAgB,EAAE,CA8BrF"}

package/dist/analysts/github-actions/detectors/detector-workflow-accessibility.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"detector-workflow-accessibility.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-workflow-accessibility.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1C,OAAO,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AAEpC,MAAM,CAAC,MAAM,8BAA8B,GAAa;IACtD,IAAI,EAAE,kCAAkC;IACxC,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,uDAAuD;IAClE,IAAI,EAAE,CAAC,OAAe,EAAW,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC;IACpF,OAAO,EAAE,CAAC,GAAW,EAAE,OAAe,EAAgB,EAAE;QACtD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,UAAU,GAAG,KAAK,CAAC;QAEvB,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YACvB,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,UAAU,GAAG,IAAI,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,sBAAsB;gBAC5B,KAAK,EAAE,OAAO;gBACd,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,sBAAsB;gBACxE,OAAO;gBACP,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,8BAA8B;aACjF,CAAC,CAAC,CAAC;QACN,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;CACF,CAAC;AAEF,MAAM,UAAU,+BAA+B,CAAC,QAAiB;IAC/D,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,MAAM,EAAE,GAAG,QAMS,CAAC;IAErB,IAAI,CAAC,EAAE,EAAE,IAAI;QAAE,OAAO,SAAS,CAAC;IAEhC,IAAI,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,SAAS,CAAC;IAErD,KAAK,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,GAAG;YAAE,SAAS;QAEnB,IAAI,GAAG,CAAC,iBAAiB,CAAC;YAAE,UAAU,GAAG,IAAI,CAAC;IAChD,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,sBAAsB;YAC5B,SAAS,EAAE,QAAQ,CAAC,8BAA8B,CAAC,sBAAsB;YACzE,UAAU,EAAE,OAAO;YACnB,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,8BAA8B;SACjF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n/**\n * Detector de Acessibilidade para GitHub Actions\n *\n * Detecta problemas de acessibilidade/usabilidade em workflows:\n * - Steps sem nome descritivo\n * - Jobs sem timeout configurado\n */\n\nimport { messages } from '@core/messages';\n\nimport type { Analista, Ocorrencia, ProblemaWorkflow } from '@';\nimport { criarOcorrencia } from '@';\n\nexport const detectorWorkflowAcessibilidade: Analista = {\n  nome: 'detector-workflow-acessibilidade',\n  categoria: 'workflows',\n  descricao: 'Detecta problemas de acessibilidade em GitHub Actions',\n  test: (relPath: string): boolean => /\\.github\\/workflows\\/.*\\.ya?ml$/i.test(relPath),\n  aplicar: (src: string, relPath: string): Ocorrencia[] => {\n    if (!src) return [];\n    const ocorrencias: Ocorrencia[] = [];\n    const linhas = src.split('\\n');\n\n    let hasTimeout = false;\n\n    linhas.forEach((linha) => {\n      if (/timeout-minutes/.test(linha)) {\n        hasTimeout = true;\n      }\n    });\n\n    if (!hasTimeout) {\n      ocorrencias.push(criarOcorrencia({\n        tipo: 'workflow-sem-timeout',\n        nivel: 'aviso',\n        mensagem: messages.AnalistaGithubActionsMensagens.workflowWithoutTimeout,\n        relPath,\n        linha: 1,\n        sugestao: messages.AnalistaGithubActionsMensagens.workflowWithoutTimeoutSugestao\n      }));\n    }\n\n    return ocorrencias;\n  }\n};\n\nexport function detectarProblemasAcessibilidade(workflow: unknown): ProblemaWorkflow[] {\n  const problemas: ProblemaWorkflow[] = [];\n  const wf = workflow as {\n    jobs?: Record<string, {\n      steps?: Array<{ name?: string; run?: string }>;\n      'timeout-minutes'?: number;\n    }>;\n    'timeout-minutes'?: number;\n  } | null | undefined;\n\n  if (!wf?.jobs) return problemas;\n\n  let hasTimeout = wf['timeout-minutes'] !== undefined;\n\n  for (const [, job] of Object.entries(wf.jobs)) {\n    if (!job) continue;\n\n    if (job['timeout-minutes']) hasTimeout = true;\n  }\n\n  if (!hasTimeout) {\n    problemas.push({\n      tipo: 'workflow-sem-timeout',\n      descricao: messages.AnalistaGithubActionsMensagens.workflowWithoutTimeout,\n      severidade: 'media',\n      sugestao: messages.AnalistaGithubActionsMensagens.workflowWithoutTimeoutSugestao\n    });\n  }\n\n  return problemas;\n}\n"]}

package/dist/analysts/github-actions/detectors/detector-workflow-compliance.d.ts

@@ -1,4 +0,0 @@
-import type { Analista, ProblemaWorkflow } from '../../../types/index.js';
-export declare const detectorWorkflowCompliance: Analista;
-export declare function detectarProblemasCompliance(workflow: unknown, _conteudo: string): ProblemaWorkflow[];
-//# sourceMappingURL=detector-workflow-compliance.d.ts.map

package/dist/analysts/github-actions/detectors/detector-workflow-compliance.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"detector-workflow-compliance.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-workflow-compliance.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,QAAQ,EAAc,gBAAgB,EAAE,MAAM,GAAG,CAAC;AAkBhE,eAAO,MAAM,0BAA0B,EAAE,QAuFxC,CAAC;AAEF,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAyCpG"}

package/dist/analysts/github-actions/detectors/detector-workflow-compliance.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"detector-workflow-compliance.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-workflow-compliance.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AAEpC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,CAAC,kBAAkB,EAAE,8BAA8B,CAAC;IACpD,CAAC,kBAAkB,EAAE,8BAA8B,CAAC;IACpD,CAAC,qBAAqB,EAAE,iCAAiC,CAAC;IAC1D,CAAC,qBAAqB,EAAE,iCAAiC,CAAC;IAC1D,CAAC,uBAAuB,EAAE,mCAAmC,CAAC;IAC9D,CAAC,uBAAuB,EAAE,mCAAmC,CAAC;IAC9D,CAAC,4BAA4B,EAAE,wCAAwC,CAAC;IACxE,CAAC,4BAA4B,EAAE,wCAAwC,CAAC;IACxE,CAAC,8BAA8B,EAAE,0CAA0C,CAAC;IAC5E,CAAC,8BAA8B,EAAE,0CAA0C,CAAC;CAC7E,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAa;IAClD,IAAI,EAAE,8BAA8B;IACpC,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,mDAAmD;IAC9D,IAAI,EAAE,CAAC,OAAe,EAAW,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC;IACpF,OAAO,EAAE,CAAC,GAAW,EAAE,OAAe,EAAgB,EAAE;QACtD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE/B,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC9B,MAAM,WAAW,GAAG,KAAK,GAAG,CAAC,CAAC;YAE9B,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAC5D,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;gBAEzC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;oBAChC,MAAM,WAAW,GAAG,gCAAgC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACrE,IAAI,WAAW,EAAE,CAAC;wBAChB,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;4BAC/B,IAAI,EAAE,gCAAgC;4BACtC,KAAK,EAAE,OAAO;4BACd,QAAQ,EAAE,mCAAmC,SAAS,EAAE;4BACxD,OAAO;4BACP,KAAK,EAAE,WAAW;4BAClB,QAAQ,EAAE,mEAAmE;yBAC9E,CAAC,CAAC,CAAC;oBACN,CAAC;gBACH,CAAC;gBAED,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;gBAC5C,IAAI,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBACvC,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBACxD,IAAI,YAAY,EAAE,CAAC;wBACjB,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;4BAC/B,IAAI,EAAE,4BAA4B;4BAClC,KAAK,EAAE,OAAO;4BACd,QAAQ,EAAE,sBAAsB,SAAS,EAAE;4BAC3C,OAAO;4BACP,KAAK,EAAE,WAAW;4BAClB,QAAQ,EAAE,kBAAkB,YAAY,EAAE;yBAC3C,CAAC,CAAC,CAAC;oBACN,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;gBACzD,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxC,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;wBACd,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;4BAC/B,IAAI,EAAE,8BAA8B;4BACpC,KAAK,EAAE,MAAM;4BACb,QAAQ,EAAE,oCAAoC,IAAI,OAAO;4BACzD,OAAO;4BACP,KAAK,EAAE,WAAW;4BAClB,QAAQ,EAAE,gFAAgF;yBAC3F,CAAC,CAAC,CAAC;oBACN,CAAC;yBAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;wBACtB,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;4BAC/B,IAAI,EAAE,6BAA6B;4BACnC,KAAK,EAAE,OAAO;4BACd,QAAQ,EAAE,yCAAyC;4BACnD,OAAO;4BACP,KAAK,EAAE,WAAW;4BAClB,QAAQ,EAAE,qEAAqE;yBAChF,CAAC,CAAC,CAAC;oBACN,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/D,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,+BAA+B;gBACrC,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,uDAAuD;gBACjE,OAAO;gBACP,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,oEAAoE;aAC/E,CAAC,CAAC,CAAC;QACN,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;CACF,CAAC;AAEF,MAAM,UAAU,2BAA2B,CAAC,QAAiB,EAAE,SAAiB;IAC9E,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,MAAM,EAAE,GAAG,QAA8H,CAAC;IAC1I,IAAI,CAAC,EAAE,EAAE,IAAI;QAAE,OAAO,SAAS,CAAC;IAEhC,KAAK,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,GAAG,EAAE,KAAK;YAAE,SAAS;QAC1B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,SAAS;YAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxD,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEzB,MAAM,CAAC,EAAE,SAAS,CAAC,GAAG,SAAS,CAAC;YAEhC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChC,MAAM,WAAW,GAAG,gCAAgC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACrE,IAAI,WAAW,EAAE,CAAC;oBAChB,SAAS,CAAC,IAAI,CAAC;wBACb,IAAI,EAAE,uBAAuB;wBAC7B,SAAS,EAAE,mCAAmC,SAAS,EAAE;wBACzD,UAAU,EAAE,OAAO;qBACpB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,gBAAgB,CAAC,KAAK,SAAS,EAAE,CAAC;gBAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBACjD,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;oBACd,SAAS,CAAC,IAAI,CAAC;wBACb,IAAI,EAAE,qBAAqB;wBAC3B,SAAS,EAAE,oCAAoC,IAAI,OAAO;wBAC1D,UAAU,EAAE,OAAO;wBACnB,QAAQ,EAAE,+BAA+B;qBAC1C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n/**\n * [BUSCA] Detector de Compliance para GitHub Actions\n *\n * Detecta problemas de compliance em workflows:\n * - Licenças incompatíveis em actions\n * - Actions de fontes não verificadas\n * - Políticas de retenção de artifacts\n * - Actions depreciadas\n * - Uso de actions de forks não oficiais\n */\n\nimport type { Analista, Ocorrencia, ProblemaWorkflow } from '@';\nimport { criarOcorrencia } from '@';\n\nimport { isOrgVerificada } from './org-verified.js';\n\nconst ACTIONS_DEPRECIADAS = new Map([\n  ['actions/cache@v1', 'actions/cache@v3 ou superior'],\n  ['actions/cache@v2', 'actions/cache@v3 ou superior'],\n  ['actions/checkout@v1', 'actions/checkout@v3 ou superior'],\n  ['actions/checkout@v2', 'actions/checkout@v3 ou superior'],\n  ['actions/setup-node@v1', 'actions/setup-node@v3 ou superior'],\n  ['actions/setup-node@v2', 'actions/setup-node@v3 ou superior'],\n  ['actions/upload-artifact@v1', 'actions/upload-artifact@v3 ou superior'],\n  ['actions/upload-artifact@v2', 'actions/upload-artifact@v3 ou superior'],\n  ['actions/download-artifact@v1', 'actions/download-artifact@v3 ou superior'],\n  ['actions/download-artifact@v2', 'actions/download-artifact@v3 ou superior'],\n]);\n\nexport const detectorWorkflowCompliance: Analista = {\n  nome: 'detector-workflow-compliance',\n  categoria: 'workflows',\n  descricao: 'Detecta problemas de compliance em GitHub Actions',\n  test: (relPath: string): boolean => /\\.github\\/workflows\\/.*\\.ya?ml$/i.test(relPath),\n  aplicar: (src: string, relPath: string): Ocorrencia[] => {\n    if (!src) return [];\n    const ocorrencias: Ocorrencia[] = [];\n    const linhas = src.split('\\n');\n\n    linhas.forEach((linha, index) => {\n      const numeroLinha = index + 1;\n\n      const usesMatch = linha.match(/uses:\\s*([^\\s@]+)@([^\\s]+)/);\n      if (usesMatch) {\n        const [, actionRef, version] = usesMatch;\n\n        if (!isOrgVerificada(actionRef)) {\n          const isOrgAction = /^[a-zA-Z0-9-]+\\/[a-zA-Z0-9-]+$/.test(actionRef);\n          if (isOrgAction) {\n            ocorrencias.push(criarOcorrencia({\n              tipo: 'workflow-action-nao-verificada',\n              nivel: 'aviso',\n              mensagem: `Action de fonte não verificada: ${actionRef}`,\n              relPath,\n              linha: numeroLinha,\n              sugestao: 'Prefira actions oficiais do GitHub ou de organizações verificadas'\n            }));\n          }\n        }\n\n        const actionKey = `${actionRef}@${version}`;\n        if (ACTIONS_DEPRECIADAS.has(actionKey)) {\n          const recomendacao = ACTIONS_DEPRECIADAS.get(actionKey);\n          if (recomendacao) {\n            ocorrencias.push(criarOcorrencia({\n              tipo: 'workflow-action-depreciada',\n              nivel: 'aviso',\n              mensagem: `Action depreciada: ${actionKey}`,\n              relPath,\n              linha: numeroLinha,\n              sugestao: `Atualizar para ${recomendacao}`\n            }));\n          }\n        }\n      }\n\n      if (/retention-days/.test(linha)) {\n        const daysMatch = linha.match(/retention-days:\\s*(\\d+)/);\n        if (daysMatch) {\n          const days = parseInt(daysMatch[1], 10);\n          if (days > 90) {\n            ocorrencias.push(criarOcorrencia({\n              tipo: 'workflow-retention-excessiva',\n              nivel: 'info',\n              mensagem: `Retenção de artifacts excessiva: ${days} dias`,\n              relPath,\n              linha: numeroLinha,\n              sugestao: 'Considere reduzir retention-days para 30 dias ou menos para economizar storage'\n            }));\n          } else if (days === 0) {\n            ocorrencias.push(criarOcorrencia({\n              tipo: 'workflow-retention-infinita',\n              nivel: 'aviso',\n              mensagem: 'Retenção de artifacts infinita (0 dias)',\n              relPath,\n              linha: numeroLinha,\n              sugestao: 'Defina um período de retenção finito para evitar acúmulo de storage'\n            }));\n          }\n        }\n      }\n    });\n\n    if (!/retention-days/.test(src) && /upload-artifact/.test(src)) {\n      ocorrencias.push(criarOcorrencia({\n        tipo: 'workflow-sem-retention-policy',\n        nivel: 'info',\n        mensagem: 'Upload de artifacts sem política de retenção definida',\n        relPath,\n        linha: 1,\n        sugestao: 'Adicionar retention-days para controlar armazenamento de artifacts'\n      }));\n    }\n\n    return ocorrencias;\n  }\n};\n\nexport function detectarProblemasCompliance(workflow: unknown, _conteudo: string): ProblemaWorkflow[] {\n  const problemas: ProblemaWorkflow[] = [];\n  const wf = workflow as { jobs?: Record<string, { steps?: Array<{ uses?: string; with?: Record<string, unknown> }> }> } | null | undefined;\n  if (!wf?.jobs) return problemas;\n\n  for (const [, job] of Object.entries(wf.jobs)) {\n    if (!job?.steps) continue;\n    for (const step of job.steps) {\n      if (!step.uses) continue;\n\n      const usesMatch = step.uses.match(/([^\\s@]+)@([^\\s]+)/);\n      if (!usesMatch) continue;\n\n      const [, actionRef] = usesMatch;\n\n      if (!isOrgVerificada(actionRef)) {\n        const isOrgAction = /^[a-zA-Z0-9-]+\\/[a-zA-Z0-9-]+$/.test(actionRef);\n        if (isOrgAction) {\n          problemas.push({\n            tipo: 'action-nao-verificada',\n            descricao: `Action de fonte não verificada: ${actionRef}`,\n            severidade: 'media'\n          });\n        }\n      }\n\n      if (step.with?.['retention-days'] !== undefined) {\n        const days = Number(step.with['retention-days']);\n        if (days > 90) {\n          problemas.push({\n            tipo: 'retention-excessiva',\n            descricao: `Retenção de artifacts excessiva: ${days} dias`,\n            severidade: 'baixa',\n            sugestao: 'Reduzir para 30 dias ou menos'\n          });\n        }\n      }\n    }\n  }\n\n  return problemas;\n}\n"]}

package/dist/analysts/github-actions/detectors/detector-workflow-performance.d.ts

@@ -1,3 +0,0 @@
-import type { Analista } from '../../../types/index.js';
-export declare const detectorWorkflowPerformance: Analista;
-//# sourceMappingURL=detector-workflow-performance.d.ts.map

package/dist/analysts/github-actions/detectors/detector-workflow-performance.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"detector-workflow-performance.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-workflow-performance.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,QAAQ,EAAc,MAAM,GAAG,CAAC;AAG9C,eAAO,MAAM,2BAA2B,EAAE,QAwIzC,CAAC"}

package/dist/analysts/github-actions/detectors/detector-workflow-performance.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"detector-workflow-performance.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-workflow-performance.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AAEpC,MAAM,CAAC,MAAM,2BAA2B,GAAa;IACnD,IAAI,EAAE,+BAA+B;IACrC,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,oDAAoD;IAC/D,IAAI,EAAE,CAAC,OAAe,EAAW,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC;IACpF,OAAO,EAAE,CAAC,GAAW,EAAE,OAAe,EAAgB,EAAE;QACtD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;QACnD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC7C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QAExC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC9B,MAAM,WAAW,GAAG,KAAK,GAAG,CAAC,CAAC;YAG9B,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,aAAa,GAAG,IAAI,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,IAAI,aAAa,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvG,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC7C,CAAC;YAGD,IAAI,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,sCAAsC,CAAC,EAAE,CAAC;oBAChG,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;wBAC/B,IAAI,EAAE,sCAAsC;wBAC5C,KAAK,EAAE,MAAM;wBACb,QAAQ,EAAE,yDAAyD;wBACnE,OAAO;wBACP,KAAK,EAAE,WAAW;wBAClB,QAAQ,EAAE,uEAAuE;qBAClF,CAAC,CAAC,CAAC;gBACN,CAAC;YACH,CAAC;YAGD,IAAI,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,IAAI,UAAU,EAAE,CAAC;oBACf,gBAAgB,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAChF,CAAC;YACH,CAAC;YACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;gBAClD,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;gBAC7C,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAChC,CAAC;YAGD,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;gBACpD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBACrD,MAAM,cAAc,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBACxD,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;oBAC9D,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;wBAC/B,IAAI,EAAE,yBAAyB;wBAC/B,KAAK,EAAE,OAAO;wBACd,QAAQ,EAAE,0CAA0C;wBACpD,OAAO;wBACP,KAAK,EAAE,WAAW;wBAClB,QAAQ,EAAE,oEAAoE;qBAC/E,CAAC,CAAC,CAAC;gBACN,CAAC;YACH,CAAC;YAGD,IAAI,6CAA6C,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvG,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,wBAAwB;oBAC9B,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,kDAAkD;oBAC5D,OAAO;oBACP,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,uEAAuE;iBAClF,CAAC,CAAC,CAAC;YACN,CAAC;YAGD,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,0BAA0B,CAAC,EAAE,CAAC;oBACpF,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;wBAC/B,IAAI,EAAE,0BAA0B;wBAChC,KAAK,EAAE,MAAM;wBACb,QAAQ,EAAE,mDAAmD;wBAC7D,OAAO;wBACP,KAAK,EAAE,WAAW;wBAClB,QAAQ,EAAE,+EAA+E;qBAC1F,CAAC,CAAC,CAAC;gBACN,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,6BAA6B,GAAG,KAAK,CAAC;QAC1C,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,gBAAgB,EAAE,CAAC;YACzC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,6BAA6B,GAAG,IAAI,CAAC;gBACrC,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,6BAA6B,EAAE,CAAC;YAClC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,6BAA6B;gBACnC,KAAK,EAAE,OAAO;gBACd,QAAQ,EAAE,6CAA6C;gBACvD,OAAO;gBACP,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,+DAA+D;aAC1E,CAAC,CAAC,CAAC;QACN,CAAC;QAED,IAAI,sBAAsB,GAAG,KAAK,CAAC;QACnC,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACrC,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,sBAAsB,GAAG,IAAI,CAAC;gBAC9B,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,sBAAsB,EAAE,CAAC;YAC3B,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,gCAAgC;gBACtC,KAAK,EAAE,OAAO;gBACd,QAAQ,EAAE,0CAA0C;gBACpD,OAAO;gBACP,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,wCAAwC;aACnD,CAAC,CAAC,CAAC;QACN,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;CACF,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n/**\n * [BUSCA] Detector de Performance para GitHub Actions\n *\n * Detecta problemas de performance em workflows:\n * - Falta de compressão de artefatos\n * - Passos redundantes\n * - Estratégia de matrix ineficiente\n */\n\nimport type { Analista, Ocorrencia } from '@';\nimport { criarOcorrencia } from '@';\n\nexport const detectorWorkflowPerformance: Analista = {\n  nome: 'detector-workflow-performance',\n  categoria: 'workflows',\n  descricao: 'Detecta problemas de performance em GitHub Actions',\n  test: (relPath: string): boolean => /\\.github\\/workflows\\/.*\\.ya?ml$/i.test(relPath),\n  aplicar: (src: string, relPath: string): Ocorrencia[] => {\n    if (!src) return [];\n    const ocorrencias: Ocorrencia[] = [];\n    const linhas = src.split('\\n');\n\n    let inJobsSection = false;\n    let currentJob = '';\n    const jobsWithCheckout = new Map<string, number>();\n    const jobsWithNpmInstall = new Set<string>();\n    const jobsWithNpmCi = new Set<string>();\n\n    linhas.forEach((linha, index) => {\n      const numeroLinha = index + 1;\n\n      // Track job context - jobs are at root level under 'jobs:'\n      if (/^jobs:\\s*$/.test(linha)) {\n        inJobsSection = true;\n        return;\n      }\n      if (inJobsSection && /^\\w[\\w-]*:\\s*$/.test(linha) && !linha.startsWith(' ') && !linha.startsWith('\\t')) {\n        currentJob = linha.trim().replace(':', '');\n      }\n\n      // 1. Artifact Compression\n      if (/\\bzips?\\s+.*upload-artifact/i.test(src) || /tar\\s+.*upload-artifact/i.test(src)) {\n        if (!ocorrencias.some(ocorrencia => ocorrencia.tipo === 'workflow-manual-artifact-compression')) {\n          ocorrencias.push(criarOcorrencia({\n            tipo: 'workflow-manual-artifact-compression',\n            nivel: 'info',\n            mensagem: 'Compressão manual de artefato detectada antes de upload',\n            relPath,\n            linha: numeroLinha,\n            sugestao: 'Use actions/upload-artifact@v4 que possui compressão nativa eficiente'\n          }));\n        }\n      }\n\n      // 2. Redundant Steps - track checkouts per job\n      if (/uses:\\s*actions\\/checkout/.test(linha)) {\n        if (currentJob) {\n          jobsWithCheckout.set(currentJob, (jobsWithCheckout.get(currentJob) || 0) + 1);\n        }\n      }\n      if (/\\bnpm\\s+install\\b/.test(linha) && currentJob) {\n        jobsWithNpmInstall.add(currentJob);\n      }\n      if (/\\bnpm\\s+ci\\b/.test(linha) && currentJob) {\n        jobsWithNpmCi.add(currentJob);\n      }\n\n      // 3. Matrix efficiency\n      if (/matrix:/.test(linha)) {\n        const matrixContent = src.slice(src.indexOf(linha));\n        const itemsMatch = matrixContent.match(/\\[(.*?)\\]/g);\n        const dimensionCount = (linha.match(/:/g) || []).length;\n        if (itemsMatch && itemsMatch.length > 5 || dimensionCount > 3) {\n          ocorrencias.push(criarOcorrencia({\n            tipo: 'workflow-complex-matrix',\n            nivel: 'aviso',\n            mensagem: 'Matrix strategy muito complexa ou grande',\n            relPath,\n            linha: numeroLinha,\n            sugestao: 'Considere simplificar a matrix ou usar jobs separados para clareza'\n          }));\n        }\n      }\n\n      // 5. Retry Policy\n      if (/\\b(npm install|curl|wget|apt-get install)\\b/.test(linha) && !/retry|continue-on-error/i.test(src)) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'workflow-missing-retry',\n          nivel: 'info',\n          mensagem: 'Operação de rede sem política de retry detectada',\n          relPath,\n          linha: numeroLinha,\n          sugestao: 'Adicione mecanismos de retry para evitar falhas intermitentes de rede'\n        }));\n      }\n\n      // 6. Clean-up\n      if (/\\b(mkdir|touch|cp|dd)\\b/.test(linha) && !/\\b(rm|clean|delete|prune)\\b/i.test(src)) {\n        if (!ocorrencias.some(ocorrencia => ocorrencia.tipo === 'workflow-missing-cleanup')) {\n          ocorrencias.push(criarOcorrencia({\n            tipo: 'workflow-missing-cleanup',\n            nivel: 'info',\n            mensagem: 'Possível falta de limpeza de arquivos temporários',\n            relPath,\n            linha: numeroLinha,\n            sugestao: 'Adicione um passo de limpeza (cleanup) para evitar consumo excessivo de disco'\n          }));\n        }\n      }\n    });\n    // Only flag redundant checkout if multiple checkouts in SAME job (not across different jobs)\n    let hasRedundantCheckoutInSameJob = false;\n    for (const [, count] of jobsWithCheckout) {\n      if (count > 1) {\n        hasRedundantCheckoutInSameJob = true;\n        break;\n      }\n    }\n    if (hasRedundantCheckoutInSameJob) {\n      ocorrencias.push(criarOcorrencia({\n        tipo: 'workflow-redundant-checkout',\n        nivel: 'aviso',\n        mensagem: 'Múltiplos checkouts detectados no mesmo job',\n        relPath,\n        linha: 1,\n        sugestao: 'Consolidar steps para evitar múltiplos checkouts no mesmo job'\n      }));\n    }\n    // Only flag redundant npm install if both npm install AND npm ci exist in the SAME job\n    let hasRedundantNpmInstall = false;\n    for (const job of jobsWithNpmInstall) {\n      if (jobsWithNpmCi.has(job)) {\n        hasRedundantNpmInstall = true;\n        break;\n      }\n    }\n    if (hasRedundantNpmInstall) {\n      ocorrencias.push(criarOcorrencia({\n        tipo: 'workflow-redundant-npm-install',\n        nivel: 'aviso',\n        mensagem: 'Uso de npm install e npm ci no mesmo job',\n        relPath,\n        linha: 1,\n        sugestao: 'Use apenas npm ci para ambientes de CI'\n      }));\n    }\n    return ocorrencias;\n  }\n};"]}

package/dist/analysts/github-actions/detectors/detector-workflow-security.d.ts

@@ -1,3 +0,0 @@
-import type { Analista } from '../../../types/index.js';
-export declare const detectorWorkflowSecurity: Analista;
-//# sourceMappingURL=detector-workflow-security.d.ts.map

package/dist/analysts/github-actions/detectors/detector-workflow-security.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"detector-workflow-security.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-workflow-security.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,QAAQ,EAAc,MAAM,GAAG,CAAC;AAK9C,eAAO,MAAM,wBAAwB,EAAE,QA4JtC,CAAC"}

package/dist/analysts/github-actions/detectors/detector-workflow-security.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"detector-workflow-security.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-workflow-security.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAG7C,OAAO,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AAEpC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,CAAC,MAAM,wBAAwB,GAAa;IAChD,IAAI,EAAE,4BAA4B;IAClC,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,4CAA4C;IACvD,IAAI,EAAE,CAAC,OAAe,EAAW,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC;IACpF,OAAO,EAAE,CAAC,GAAW,EAAE,OAAe,EAAgB,EAAE;QACtD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAE/B,MAAM,oBAAoB,GAA6C,EAAE,CAAC;QAE1E,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC9B,MAAM,WAAW,GAAG,KAAK,GAAG,CAAC,CAAC;YAE9B,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjE,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,2BAA2B;oBACjC,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,uBAAuB;oBACzE,OAAO;oBACP,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,+BAA+B;iBAClF,CAAC,CAAC,CAAC;YACN,CAAC;YAED,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAC5D,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;gBACzC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;oBACzD,oBAAoB,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,SAAS,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC;gBACvF,CAAC;YACH,CAAC;YAED,IAAI,yDAAyD,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnG,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,2BAA2B;oBACjC,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,eAAe;oBACjE,OAAO;oBACP,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,uBAAuB;iBAC1E,CAAC,CAAC,CAAC;YACN,CAAC;YAED,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,qBAAqB;oBAC3B,KAAK,EAAE,OAAO;oBACd,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,iBAAiB;oBACnE,OAAO;oBACP,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,yBAAyB;iBAC5E,CAAC,CAAC,CAAC;YACN,CAAC;YAED,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5D,MAAM,WAAW,GAAG,wDAAwD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzF,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gBAC/C,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvD,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACpD,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;wBAC/B,IAAI,EAAE,yBAAyB;wBAC/B,KAAK,EAAE,MAAM;wBACf,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,yBAAyB;wBAC3E,OAAO;wBACP,KAAK,EAAE,WAAW;wBAClB,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,iCAAiC;qBAClF,CAAC,CAAC,CAAC;gBACN,CAAC;YACH,CAAC;YAED,IAAI,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACzI,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,2BAA2B;oBACjC,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,sBAAsB;oBACxE,OAAO;oBACP,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,8BAA8B;iBACjF,CAAC,CAAC,CAAC;YACN,CAAC;YAED,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,oBAAoB;oBAC1B,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,iCAAiC;oBACnF,OAAO;oBACP,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,yCAAyC;iBAC5F,CAAC,CAAC,CAAC;YACN,CAAC;YAED,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,sBAAsB;oBAC5B,KAAK,EAAE,OAAO;oBACd,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,iBAAiB;oBACnE,OAAO;oBACP,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,yBAAyB;iBAC5E,CAAC,CAAC,CAAC;YACN,CAAC;YAED,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClE,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,2BAA2B;oBACjC,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,sBAAsB;oBACxE,OAAO;oBACP,KAAK,EAAE,WAAW;oBAClB,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,8BAA8B;iBACjF,CAAC,CAAC,CAAC;YACN,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,8BAA8B;gBACpC,KAAK,EAAE,OAAO;gBACd,QAAQ,EAAE,GAAG,oBAAoB,CAAC,MAAM,gDAAgD,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC5I,OAAO;gBACP,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,gEAAgE;aAC3E,CAAC,CAAC,CAAC;QACN,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,8BAA8B;gBACpC,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,qBAAqB;gBACvE,OAAO;gBACP,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,6BAA6B;aAChF,CAAC,CAAC,CAAC;QACN,CAAC;QAED,MAAM,YAAY,GAAG,2EAA2E,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3G,MAAM,eAAe,GAAG,4EAA4E,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/G,MAAM,kBAAkB,GAAG,2DAA2D,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEjG,IAAI,eAAe,IAAI,CAAC,YAAY,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5D,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,gCAAgC;gBACtC,KAAK,EAAE,OAAO;gBACd,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,+BAA+B;gBACjF,OAAO;gBACP,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,uCAAuC;aAC1F,CAAC,CAAC,CAAC;QACN,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;CACF,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n/**\n * [BUSCA] Detector de segurança GitHub Actions\n *\n * Detecta vulnerabilidades em workflows:\n * - Script injection\n * - Missing SHA pinning\n * - Hardcoded secrets\n * - sudo usage\n * - pull_request_target\n * - Missing permissions\n */\n\nimport { messages } from '@core/messages';\nimport { splitLines } from '@shared/helpers';\n\nimport type { Analista, Ocorrencia } from '@';\nimport { criarOcorrencia } from '@';\n\nimport { isOrgVerificada } from './org-verified.js';\n\nexport const detectorWorkflowSecurity: Analista = {\n  nome: 'detector-workflow-security',\n  categoria: 'workflows',\n  descricao: 'Detecta vulnerabilidades em GitHub Actions',\n  test: (relPath: string): boolean => /\\.github\\/workflows\\/.*\\.ya?ml$/i.test(relPath),\n  aplicar: (src: string, relPath: string): Ocorrencia[] => {\n    if (!src) return [];\n    const ocorrencias: Ocorrencia[] = [];\n    const linhas = splitLines(src);\n\n    const actionsSemShaPinning: Array<{ linha: number; action: string }> = [];\n\n    linhas.forEach((linha, index) => {\n      const numeroLinha = index + 1;\n\n      if (/\\$\\{\\{\\s*github\\.event\\./.test(linha) && /run:/.test(linha)) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'workflow-script-injection',\n          nivel: 'erro',\n          mensagem: messages.AnalistaGithubActionsMensagens.possibleScriptInjection,\n          relPath,\n          linha: numeroLinha,\n          sugestao: messages.AnalistaGithubActionsMensagens.possibleScriptInjectionSugestao\n        }));\n      }\n\n      const usesMatch = linha.match(/uses:\\s*([^\\s@]+)@([^\\s]+)/);\n      if (usesMatch) {\n        const [, actionRef, version] = usesMatch;\n        if (/^v\\d+/.test(version) && !isOrgVerificada(actionRef)) {\n          actionsSemShaPinning.push({ linha: numeroLinha, action: `${actionRef}@${version}` });\n        }\n      }\n\n      if (/\\b(KEY|TOKEN|SECRET|PASSWORD)\\b.*[:=]\\s*['\"][^'\"]+['\"]/i.test(linha) && !/\\$\\{\\{/.test(linha)) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'workflow-hardcoded-secret',\n          nivel: 'erro',\n          mensagem: messages.AnalistaGithubActionsMensagens.hardcodedSecret,\n          relPath,\n          linha: numeroLinha,\n          sugestao: messages.AnalistaGithubActionsMensagens.hardcodedSecretSugestao\n        }));\n      }\n\n      if (/\\bsudo\\s+/.test(linha)) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'workflow-sudo-usage',\n          nivel: 'aviso',\n          mensagem: messages.AnalistaGithubActionsMensagens.sudoUsageDetected,\n          relPath,\n          linha: numeroLinha,\n          sugestao: messages.AnalistaGithubActionsMensagens.sudoUsageDetectedSugestao\n        }));\n      }\n\n      if (/\\/home\\/runner\\//.test(linha) || /\\/tmp\\//.test(linha)) {\n        const isGitHubVar = /\\$\\{?\\{?\\s*(runner\\.temp|GITHUB_WORKSPACE|RUNNER_TEMP)/.test(linha);\n        const isComment = linha.trim().startsWith('#');\n        const isCleanupCommand = /rm\\s+-.+\\/tmp\\//.test(linha);\n        if (!isGitHubVar && !isComment && !isCleanupCommand) {\n          ocorrencias.push(criarOcorrencia({\n            tipo: 'workflow-hardcoded-path',\n            nivel: 'info',\n          mensagem: messages.AnalistaGithubActionsMensagens.absoluteTempPathHardcoded,\n          relPath,\n          linha: numeroLinha,\n          sugestao: messages.AnalistaGithubActionsMensagens.absoluteTempPathHardcodedSugestao\n          }));\n        }\n      }\n\n      if (/echo\\s+.*::set-output\\s+name=.*secret/i.test(linha) || (/echo\\s+.*\\$(SECRET|TOKEN|KEY)/i.test(linha) && !/::add-mask::/i.test(src))) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'workflow-sensitive-output',\n          nivel: 'erro',\n          mensagem: messages.AnalistaGithubActionsMensagens.possibleSecretExposure,\n          relPath,\n          linha: numeroLinha,\n          sugestao: messages.AnalistaGithubActionsMensagens.possibleSecretExposureSugestao\n        }));\n      }\n\n      if (/pull_request_target:/.test(linha)) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'workflow-pr-target',\n          nivel: 'erro',\n          mensagem: messages.AnalistaGithubActionsMensagens.pullRequestTargetExecutesForkCode,\n          relPath,\n          linha: numeroLinha,\n          sugestao: messages.AnalistaGithubActionsMensagens.pullRequestTargetExecutesForkCodeSugestao\n        }));\n      }\n\n      if (/workflow_run:/.test(linha)) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'workflow-run-trigger',\n          nivel: 'aviso',\n          mensagem: messages.AnalistaGithubActionsMensagens.workflowRunUnsafe,\n          relPath,\n          linha: numeroLinha,\n          sugestao: messages.AnalistaGithubActionsMensagens.workflowRunUnsafeSugestao\n        }));\n      }\n\n      if (/checkout@v\\d+/.test(linha) && /fetch-depth:\\s*0/.test(linha)) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'workflow-fetch-depth-zero',\n          nivel: 'info',\n          mensagem: messages.AnalistaGithubActionsMensagens.checkoutFetchDepthZero,\n          relPath,\n          linha: numeroLinha,\n          sugestao: messages.AnalistaGithubActionsMensagens.checkoutFetchDepthZeroSugestao\n        }));\n      }\n    });\n\n    if (actionsSemShaPinning.length > 0) {\n      ocorrencias.push(criarOcorrencia({\n        tipo: 'workflow-missing-sha-pinning',\n        nivel: 'aviso',\n        mensagem: `${actionsSemShaPinning.length} action(s) de terceiros sem pinning por SHA: ${actionsSemShaPinning.map(a => a.action).join(', ')}`,\n        relPath,\n        linha: 1,\n        sugestao: 'Use @<commit-sha-completo> para garantir integridade da action'\n      }));\n    }\n\n    if (!/permissions:/.test(src)) {\n      ocorrencias.push(criarOcorrencia({\n        tipo: 'workflow-missing-permissions',\n        nivel: 'info',\n        mensagem: messages.AnalistaGithubActionsMensagens.permissionsNotDefined,\n        relPath,\n        linha: 1,\n        sugestao: messages.AnalistaGithubActionsMensagens.permissionsNotDefinedSugestao\n      }));\n    }\n\n    const hasAuditStep = /\\b(npm audit|yarn audit|snyk|trivy|checkov|terrascan|gitleaks|semgrep)\\b/i.test(src);\n    const isBuildOrDeploy = /\\b(npm install|yarn|pnpm|build|deploy|publish|docker build|docker push)\\b/i.test(src);\n    const isSecurityWorkflow = /codeql|security-advanced|security-enhanced-code-scanning/i.test(src);\n\n    if (isBuildOrDeploy && !hasAuditStep && !isSecurityWorkflow) {\n      ocorrencias.push(criarOcorrencia({\n        tipo: 'workflow-missing-security-scan',\n        nivel: 'aviso',\n        mensagem: messages.AnalistaGithubActionsMensagens.buildDeployWithoutSecurityAudit,\n        relPath,\n        linha: 1,\n        sugestao: messages.AnalistaGithubActionsMensagens.buildDeployWithoutSecurityAuditSugestao\n      }));\n    }\n\n    return ocorrencias;\n  }\n};\n"]}

package/dist/analysts/github-actions/detectors/detector-workflow-structure.d.ts

@@ -1,16 +0,0 @@
-import type { Analista } from '../../../types/index.js';
-interface WorkflowJob {
-    name?: string;
-    needs?: string | string[];
-    container?: unknown;
-    steps?: Array<{
-        uses?: string;
-        run?: string;
-        with?: unknown;
-    }>;
-    'runs-on'?: string;
-}
-export declare function detectarJobsPassivos(job: WorkflowJob): boolean;
-export declare const detectorWorkflowEstrutura: Analista;
-export {};
-//# sourceMappingURL=detector-workflow-structure.d.ts.map

package/dist/analysts/github-actions/detectors/detector-workflow-structure.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"detector-workflow-structure.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-workflow-structure.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,QAAQ,EAAc,MAAM,GAAG,CAAC;AAyB9C,UAAU,WAAW;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC,CAAC;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AACD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAQ9D;AACD,eAAO,MAAM,yBAAyB,EAAE,QA8KvC,CAAC"}

package/dist/analysts/github-actions/detectors/detector-workflow-structure.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"detector-workflow-structure.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-workflow-structure.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAGrC,OAAO,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AAEpC,MAAM,mBAAmB,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;AAC1E,MAAM,mBAAmB,GAKpB,CAAC;QACJ,OAAO,EAAE,uBAAuB;QAChC,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,kCAAkC;QAC5C,QAAQ,EAAE,iDAAiD;KAC5D,EAAE;QACD,OAAO,EAAE,eAAe;QACxB,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,yCAAyC;QACnD,QAAQ,EAAE,uEAAuE;KAClF,EAAE;QACD,OAAO,EAAE,uBAAuB;QAChC,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,uDAAuD;QACjE,QAAQ,EAAE,2DAA2D;KACtE,CAAC,CAAC;AAYH,MAAM,UAAU,oBAAoB,CAAC,GAAgB;IACnD,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,2BAA2B,CAAC,IAAI,CAAC,4CAA4C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1J,CAAC,CAAC,CAAC;IACH,OAAO,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC;AACtC,CAAC;AACD,MAAM,CAAC,MAAM,yBAAyB,GAAa;IACjD,IAAI,EAAE,6BAA6B;IACnC,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,iDAAiD;IAC5D,IAAI,EAAE,CAAC,OAAe,EAAW,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC;IACpF,OAAO,EAAE,CAAC,GAAW,EAAE,OAAe,EAAgB,EAAE;QACtD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;gBAAE,OAAO,WAAW,CAAC;YAClE,MAAM,IAAI,GAAiC,QAEzC,CAAC,IAAI,IAAI,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,IAAI,CAAC,GAAG;oBAAE,SAAS;gBAGnB,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;oBACd,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;oBACrE,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;wBAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;4BACzD,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gCAC/B,IAAI,EAAE,WAAW;gCACjB,KAAK,EAAE,MAAM;gCACb,QAAQ,EAAE,QAAQ,KAAK,iBAAiB,IAAI,kBAAkB;gCAC9D,OAAO;gCACP,KAAK,EAAE,CAAC;gCACR,QAAQ,EAAE,uBAAuB,IAAI,qDAAqD;6BAC3F,CAAC,CAAC,CAAC;wBACN,CAAC;oBACH,CAAC;gBACH,CAAC;gBAGD,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC/B,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;wBAC7F,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;4BAC/B,IAAI,EAAE,uBAAuB;4BAC7B,KAAK,EAAE,MAAM;4BACb,QAAQ,EAAE,QAAQ,KAAK,+CAA+C;4BACtE,OAAO;4BACP,KAAK,EAAE,CAAC;4BACR,QAAQ,EAAE,6EAA6E;yBACxF,CAAC,CAAC,CAAC;oBACN,CAAC;oBACD,IAAI,MAAM,KAAK,eAAe,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;wBAC5L,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;4BAC/B,IAAI,EAAE,uBAAuB;4BAC7B,KAAK,EAAE,MAAM;4BACb,QAAQ,EAAE,QAAQ,KAAK,gDAAgD;4BACvE,OAAO;4BACP,KAAK,EAAE,CAAC;4BACR,QAAQ,EAAE,oEAAoE;yBAC/E,CAAC,CAAC,CAAC;oBACN,CAAC;gBACH,CAAC;gBAGD,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;oBAChE,MAAM,KAAK,GAAI,GAAG,CAAC,SAAqC,CAAC,KAA2B,CAAC;oBACrF,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;wBACnE,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;4BAC/B,IAAI,EAAE,uBAAuB;4BAC7B,KAAK,EAAE,OAAO;4BACd,QAAQ,EAAE,QAAQ,KAAK,oCAAoC,KAAK,GAAG;4BACnE,OAAO;4BACP,KAAK,EAAE,CAAC;4BACR,QAAQ,EAAE,uFAAuF;yBAClG,CAAC,CAAC,CAAC;oBACN,CAAC;gBACH,CAAC;gBAGD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;oBAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;oBAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;oBAC/B,OAAO,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrG,CAAC,CAAC,CAAC;gBACH,IAAI,WAAW,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,iCAAiC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChG,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;wBAC/B,IAAI,EAAE,wBAAwB;wBAC9B,KAAK,EAAE,OAAO;wBACd,QAAQ,EAAE,QAAQ,KAAK,iDAAiD,MAAM,GAAG;wBACjF,OAAO;wBACP,KAAK,EAAE,CAAC;wBACR,QAAQ,EAAE,uEAAuE;qBAClF,CAAC,CAAC,CAAC;gBACN,CAAC;YACH,CAAC;YAGD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;YACpC,KAAK,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,GAAG,EAAE,IAAI;oBAAE,SAAS;gBACzB,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;gBAClD,IAAI,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/B,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;wBAC/B,IAAI,EAAE,oBAAoB;wBAC1B,KAAK,EAAE,OAAO;wBACd,QAAQ,EAAE,qCAAqC,GAAG,CAAC,IAAI,GAAG;wBAC1D,OAAO;wBACP,KAAK,EAAE,CAAC;wBACR,QAAQ,EAAE,8EAA8E;qBACzF,CAAC,CAAC,CAAC;gBACN,CAAC;gBACD,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC7B,CAAC;YAGD,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;gBACtC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;wBAC/B,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,KAAK,EAAE,OAAO;wBACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;wBACtB,OAAO;wBACP,KAAK,EAAE,CAAC;wBACR,QAAQ,EAAE,GAAG,CAAC,QAAQ;qBACvB,CAAC,CAAC,CAAC;gBACN,CAAC;YACH,CAAC;YAGD,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;gBACtD,IAAI,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;oBACtD,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;oBAClG,IAAI,CAAC,cAAc,EAAE,CAAC;wBACpB,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;4BAC/B,IAAI,EAAE,aAAa;4BACnB,KAAK,EAAE,MAAM;4BACb,QAAQ,EAAE,qDAAqD;4BAC/D,OAAO;4BACP,KAAK,EAAE,MAAM,GAAG,CAAC;4BACjB,QAAQ,EAAE,gFAAgF;yBAC3F,CAAC,CAAC,CAAC;oBACN,CAAC;gBACH,CAAC;YACH,CAAC;YAGD,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9B,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;wBAC/B,IAAI,EAAE,aAAa;wBACnB,KAAK,EAAE,MAAM;wBACb,QAAQ,EAAE,QAAQ,KAAK,wCAAwC;wBAC/D,OAAO;wBACP,KAAK,EAAE,CAAC;wBACR,QAAQ,EAAE,mDAAmD;qBAC9D,CAAC,CAAC,CAAC;gBACN,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YAEP,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;gBACtC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;wBAC/B,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,KAAK,EAAE,OAAO;wBACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;wBACtB,OAAO;wBACP,KAAK,EAAE,CAAC;wBACR,QAAQ,EAAE,GAAG,CAAC,QAAQ;qBACvB,CAAC,CAAC,CAAC;gBACN,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;CACF,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n/**\n * [BUSCA] Detector de Estrutura para GitHub Actions\n *\n * Detecta problemas estruturais em workflows:\n * - Jobs órfãos (needs referencia job inexistente)\n * - Over-provisioning (runs-on excessivo)\n * - Under-provisioning (runs-on insuficiente)\n * - Workflows duplicados (nomes de jobs duplicados)\n * - Features depreciadas do GitHub Actions\n * - Jobs passivos (sem operações significativas)\n * - Steps frágeis (continue-on-error sem condição)\n */\n\nimport { splitLines } from '@shared/helpers';\nimport { parseDocument } from 'yaml';\n\nimport type { Analista, Ocorrencia } from '@';\nimport { criarOcorrencia } from '@';\n\nconst SELF_HOSTED_MARKERS = ['self-hosted', 'my-runner', 'custom-runner'];\nconst DEPRECATED_FEATURES: Array<{\n  pattern: RegExp;\n  tipo: string;\n  mensagem: string;\n  sugestao: string;\n}> = [{\n  pattern: /::set-output\\s+name=/i,\n  tipo: 'deprecated-set-output',\n  mensagem: 'Uso de ::set-output:: depreciado',\n  sugestao: 'Use $GITHUB_OUTPUT para definir outputs de step'\n}, {\n  pattern: /::add-mask::/i,\n  tipo: 'deprecated-add-mask',\n  mensagem: '::add-mask:: pode expor secrets em logs',\n  sugestao: 'Use actions/create-github-app-token ou secrets mascarados nativamente'\n}, {\n  pattern: /::save-state\\s+name=/i,\n  tipo: 'deprecated-save-state',\n  mensagem: '::save-state:: depreciado para comunicação entre jobs',\n  sugestao: 'Use artifacts ou cache para compartilhar dados entre jobs'\n}];\ninterface WorkflowJob {\n  name?: string;\n  needs?: string | string[];\n  container?: unknown;\n  steps?: Array<{\n    uses?: string;\n    run?: string;\n    with?: unknown;\n  }>;\n  'runs-on'?: string;\n}\nexport function detectarJobsPassivos(job: WorkflowJob): boolean {\n  if (!job?.steps || job.steps.length <= 1) return false;\n  const meaningfulSteps = job.steps.filter(string => {\n    const uses = string.uses || '';\n    const run = string.run || '';\n    return !uses.startsWith('actions/checkout') && !uses.startsWith('actions/download-artifact') && !/echo\\s+::(set-output|save-state|add-mask)/i.test(run);\n  });\n  return meaningfulSteps.length === 0;\n}\nexport const detectorWorkflowEstrutura: Analista = {\n  nome: 'detector-workflow-estrutura',\n  categoria: 'workflows',\n  descricao: 'Detecta problemas estruturais em GitHub Actions',\n  test: (relPath: string): boolean => /\\.github\\/workflows\\/.*\\.ya?ml$/i.test(relPath),\n  aplicar: (src: string, relPath: string): Ocorrencia[] => {\n    if (!src) return [];\n    const ocorrencias: Ocorrencia[] = [];\n    const linhas = splitLines(src);\n    try {\n      const doc = parseDocument(src);\n      const workflow = doc.toJS();\n      if (!workflow || typeof workflow !== 'object') return ocorrencias;\n      const jobs: Record<string, WorkflowJob> = (workflow as {\n        jobs?: Record<string, WorkflowJob>;\n      }).jobs || {};\n      const jobNames = Object.keys(jobs);\n      for (const [jobId, job] of Object.entries(jobs)) {\n        if (!job) continue;\n\n        // --- 1. Jobs órfãos (needs referencia job inexistente) ---\n        if (job.needs) {\n          const needsList = Array.isArray(job.needs) ? job.needs : [job.needs];\n          for (const need of needsList) {\n            if (typeof need === 'string' && !jobNames.includes(need)) {\n              ocorrencias.push(criarOcorrencia({\n                tipo: 'job-orfao',\n                nivel: 'erro',\n                mensagem: `Job '${jobId}' depende de '${need}' que não existe`,\n                relPath,\n                linha: 1,\n                sugestao: `Verifique se o job '${need}' está definido no workflow ou remova a dependência`\n              }));\n            }\n          }\n        }\n\n        // --- 2. Over-provisioning (runs-on excessivo) ---\n        const runsOn = job['runs-on'];\n        if (typeof runsOn === 'string') {\n          if (SELF_HOSTED_MARKERS.some(metrica => runsOn.toLowerCase().includes(metrica)) && !job.name) {\n            ocorrencias.push(criarOcorrencia({\n              tipo: 'job-over-provisioning',\n              nivel: 'info',\n              mensagem: `Job '${jobId}' usa runner self-hosted sem label específico`,\n              relPath,\n              linha: 1,\n              sugestao: 'Use labels específicos para self-hosted runners (ex: self-hosted-linux-gpu)'\n            }));\n          }\n          if (runsOn === 'ubuntu-latest' && job.steps && job.steps.length <= 3 && job.steps.every(string => string.uses?.startsWith('actions/checkout') || string.uses?.startsWith('actions/setup-'))) {\n            ocorrencias.push(criarOcorrencia({\n              tipo: 'job-over-provisioning',\n              nivel: 'info',\n              mensagem: `Job '${jobId}' usa ubuntu-latest apenas para checkout/setup`,\n              relPath,\n              linha: 1,\n              sugestao: 'Considere usar runs-on: ubuntu-22.04 ou ubuntu-20.04 se compatível'\n            }));\n          }\n        }\n\n        // Over-provisioning de container grande\n        if (typeof job.container === 'object' && job.container !== null) {\n          const image = (job.container as Record<string, unknown>).image as string | undefined;\n          if (image && (image.includes('large') || image.includes('xlarge'))) {\n            ocorrencias.push(criarOcorrencia({\n              tipo: 'job-over-provisioning',\n              nivel: 'aviso',\n              mensagem: `Job '${jobId}' usa container de grande porte (${image})`,\n              relPath,\n              linha: 1,\n              sugestao: 'Verifique se realmente precisa de um container grande; considere usar o runner direto'\n            }));\n          }\n        }\n\n        // --- 3. Under-provisioning ---\n        const hasHeavyOps = job.steps?.some(string => {\n          const run = string.run || '';\n          const uses = string.uses || '';\n          return /\\b(docker\\s+build|make|cmake|bazel)\\b/.test(run) || /docker\\/build-push-action/.test(uses);\n        });\n        if (hasHeavyOps && typeof runsOn === 'string' && /^(ubuntu-20\\.04|ubuntu-18\\.04)$/.test(runsOn)) {\n          ocorrencias.push(criarOcorrencia({\n            tipo: 'job-under-provisioning',\n            nivel: 'aviso',\n            mensagem: `Job '${jobId}' realiza operações pesadas em runner antigo (${runsOn})`,\n            relPath,\n            linha: 1,\n            sugestao: 'Considere usar ubuntu-22.04, ubuntu-24.04 ou runner com mais recursos'\n          }));\n        }\n      }\n\n      // --- 4. Workflows duplicados (nomes de jobs duplicados) ---\n      const seenNames = new Set<string>();\n      for (const [, job] of Object.entries(jobs)) {\n        if (!job?.name) continue;\n        const displayName = job.name.toLowerCase().trim();\n        if (seenNames.has(displayName)) {\n          ocorrencias.push(criarOcorrencia({\n            tipo: 'workflow-duplicado',\n            nivel: 'aviso',\n            mensagem: `Nome de job duplicado detectado: \"${job.name}\"`,\n            relPath,\n            linha: 1,\n            sugestao: 'Renomeie jobs para evitar confusão nos logs e na interface do GitHub Actions'\n          }));\n        }\n        seenNames.add(displayName);\n      }\n\n      // --- 5. Features depreciadas do GitHub Actions ---\n      for (const dep of DEPRECATED_FEATURES) {\n        if (dep.pattern.test(src)) {\n          ocorrencias.push(criarOcorrencia({\n            tipo: dep.tipo,\n            nivel: 'aviso',\n            mensagem: dep.mensagem,\n            relPath,\n            linha: 1,\n            sugestao: dep.sugestao\n          }));\n        }\n      }\n\n      // --- 6. Steps com continue-on-error sem if condition ---\n      for (let indice = 0; indice < linhas.length; indice++) {\n        if (/continue-on-error:\\s*true/i.test(linhas[indice])) {\n          const hasIfCondition = /if:/.test(linhas[indice]) || indice > 0 && /if:/.test(linhas[indice - 1]);\n          if (!hasIfCondition) {\n            ocorrencias.push(criarOcorrencia({\n              tipo: 'step-fragil',\n              nivel: 'info',\n              mensagem: 'Step com continue-on-error sem condição de fallback',\n              relPath,\n              linha: indice + 1,\n              sugestao: 'Adicione uma condição \"if:\" para tornar o fallback mais explícito e controlado'\n            }));\n          }\n        }\n      }\n\n      // --- 7. Jobs passivos (sem operações significativas) ---\n      for (const [jobId, job] of Object.entries(jobs)) {\n        if (detectarJobsPassivos(job)) {\n          ocorrencias.push(criarOcorrencia({\n            tipo: 'job-passivo',\n            nivel: 'info',\n            mensagem: `Job '${jobId}' não realiza operações significativas`,\n            relPath,\n            linha: 1,\n            sugestao: 'Considere remover o job ou consolidá-lo com outro'\n          }));\n        }\n      }\n    } catch {\n      // Fallback para análise por regex se o YAML parsing falhar\n      for (const dep of DEPRECATED_FEATURES) {\n        if (dep.pattern.test(src)) {\n          ocorrencias.push(criarOcorrencia({\n            tipo: dep.tipo,\n            nivel: 'aviso',\n            mensagem: dep.mensagem,\n            relPath,\n            linha: 1,\n            sugestao: dep.sugestao\n          }));\n        }\n      }\n    }\n    return ocorrencias;\n  }\n};"]}

package/dist/analysts/github-actions/detectors/detector-workflow-trigger-unsafe.d.ts

@@ -1,3 +0,0 @@
-import type { Analista } from '../../../types/index.js';
-export declare const detectorWorkflowTriggerInseguro: Analista;
-//# sourceMappingURL=detector-workflow-trigger-unsafe.d.ts.map

package/dist/analysts/github-actions/detectors/detector-workflow-trigger-unsafe.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"detector-workflow-trigger-unsafe.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-workflow-trigger-unsafe.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,QAAQ,EAAc,MAAM,GAAG,CAAC;AAO9C,eAAO,MAAM,+BAA+B,EAAE,QAiM7C,CAAC"}

package/dist/analysts/github-actions/detectors/detector-workflow-trigger-unsafe.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"detector-workflow-trigger-unsafe.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/detector-workflow-trigger-unsafe.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAGrC,OAAO,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AAEpC,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAGhF,MAAM,iBAAiB,GAAG,CAAC,kBAAkB,EAAE,sCAAsC,EAAE,iCAAiC,EAAE,gCAAgC,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,uCAAuC,EAAE,4BAA4B,EAAE,aAAa,EAAE,wBAAwB,CAAC,CAAC;AAC/Y,MAAM,CAAC,MAAM,+BAA+B,GAAa;IACvD,IAAI,EAAE,oCAAoC;IAC1C,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,uDAAuD;IAClE,IAAI,EAAE,CAAC,OAAe,EAAW,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC;IACpF,OAAO,EAAE,CAAC,GAAW,EAAE,OAAe,EAAgB,EAAE;QACtD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;gBAAE,OAAO,WAAW,CAAC;YAClE,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC9C,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,iBAAiB;oBACvB,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,sBAAsB;oBACxE,OAAO;oBACP,KAAK,EAAE,CAAC;oBACR,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,8BAA8B;iBACjF,CAAC,CAAC,CAAC;gBACJ,OAAO,WAAW,CAAC;YACrB,CAAC;YAGD,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAClB,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC;gBAG/B,IAAI,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAE1E,CAAC;qBAAM,CAAC;oBACN,MAAM,QAAQ,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBAG3T,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,eAAe,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;wBACjK,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;4BAC/B,IAAI,EAAE,yBAAyB;4BAC/B,KAAK,EAAE,OAAO;4BACd,QAAQ,EAAE,8CAA8C;4BACxD,OAAO;4BACP,KAAK,EAAE,CAAC;4BACR,QAAQ,EAAE,0FAA0F;yBACrG,CAAC,CAAC,CAAC;oBACN,CAAC;oBAGD,IAAI,QAAQ,EAAE,CAAC;wBACb,MAAM,cAAc,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,cAAc,CAAC,IAAI,QAAQ,CAAC,WAAW,CAAC,CAAC;wBACvH,IAAI,CAAC,cAAc,EAAE,CAAC;4BACpB,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;gCAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;oCACpL,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;wCAC/B,IAAI,EAAE,+BAA+B;wCACrC,KAAK,EAAE,OAAO;wCACd,QAAQ,EAAE,mDAAmD,MAAM,uBAAuB;wCAC1F,OAAO;wCACP,KAAK,EAAE,CAAC;wCACR,QAAQ,EAAE,sFAAsF;qCACjG,CAAC,CAAC,CAAC;gCACN,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAGD,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;gBAE1B,IAAI,QAAQ,CAAC,mBAAmB,EAAE,CAAC;oBACjC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;wBAC/B,IAAI,EAAE,6BAA6B;wBACnC,KAAK,EAAE,MAAM;wBACb,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,uCAAuC;wBACzF,OAAO;wBACP,KAAK,EAAE,CAAC;wBACR,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,+CAA+C;qBAClG,CAAC,CAAC,CAAC;gBACN,CAAC;YACH,CAAC;YAGD,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;gBAC/B,MAAM,YAAY,GAAG,QAAQ,CAAC,iBAAiB,CAAC;gBAChD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;oBAC5D,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;oBACnC,KAAK,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;wBAC1F,MAAM,SAAS,GAAG,WAAkD,CAAC;wBACrE,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;wBAEvC,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;oBAC7D,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;wBAC/B,IAAI,EAAE,sCAAsC;wBAC5C,KAAK,EAAE,MAAM;wBACf,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,6BAA6B;wBAC/E,OAAO;wBACP,KAAK,EAAE,CAAC;wBACR,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,qCAAqC;qBACtF,CAAC,CAAC,CAAC;gBACN,CAAC;YACH,CAAC;YAGD,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACtB,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC;gBAC/B,MAAM,cAAc,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACnK,IAAI,cAAc,EAAE,CAAC;oBACnB,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;wBACpC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,YAAY,EAAE,CAAC;4BACxE,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gCAC/B,IAAI,EAAE,kCAAkC;gCACxC,KAAK,EAAE,OAAO;gCACd,QAAQ,EAAE,4DAA4D;gCACtE,OAAO;gCACP,KAAK,EAAE,CAAC;gCACR,QAAQ,EAAE,6DAA6D;6BACxE,CAAC,CAAC,CAAC;wBACN,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAGD,MAAM,OAAO,GAAG,GAAG,CAAC;YACpB,IAAI,sDAAsD,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,sDAAsD,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjJ,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,wBAAwB;oBAC9B,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,wEAAwE;oBAClF,OAAO;oBACP,KAAK,EAAE,CAAC;oBACR,QAAQ,EAAE,mEAAmE;iBAC9E,CAAC,CAAC,CAAC;YACN,CAAC;YAGD,IAAI,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;gBAE5C,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBACxG,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;oBAC/B,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;wBAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;wBAC9C,OAAO,SAAS,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;oBACjF,CAAC,CAAC,CAAC;oBACH,MAAM,mBAAmB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;oBACzF,IAAI,mBAAmB,IAAI,kBAAkB,EAAE,CAAC;wBAC9C,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;4BAC/B,IAAI,EAAE,0CAA0C;4BAChD,KAAK,EAAE,OAAO;4BACd,QAAQ,EAAE,oFAAoF;4BAC9F,OAAO;4BACP,KAAK,EAAE,CAAC;4BACR,QAAQ,EAAE,qGAAqG;yBAChH,CAAC,CAAC,CAAC;oBACN,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YAIP,IAAI,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;gBACzC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,6BAA6B;oBACnC,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,uCAAuC;oBACzF,OAAO;oBACP,KAAK,EAAE,CAAC;oBACR,QAAQ,EAAE,QAAQ,CAAC,8BAA8B,CAAC,yCAAyC;iBAC5F,CAAC,CAAC,CAAC;YACN,CAAC;YAGD,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7E,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,yBAAyB;oBAC/B,KAAK,EAAE,OAAO;oBACd,QAAQ,EAAE,8CAA8C;oBACxD,OAAO;oBACP,KAAK,EAAE,CAAC;oBACR,QAAQ,EAAE,iDAAiD;iBAC5D,CAAC,CAAC,CAAC;YACN,CAAC;QACH,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;CACF,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n/**\n * [BUSCA] Detector de Workflow Triggers Inseguros para GitHub Actions\n *\n * Detecta configurações de trigger perigosas em workflows:\n * - Push em branches protegidos (main, master, release/*) sem proteção\n * - Workflow_dispatch sem restrições\n * - Schedule em branches sensíveis\n * - Triggers amplos demais (push em wildcards)\n */\n\nimport { messages } from '@core/messages';\nimport { splitLines } from '@shared/helpers';\nimport { parseDocument } from 'yaml';\n\nimport type { Analista, Ocorrencia } from '@';\nimport { criarOcorrencia } from '@';\n\nconst BRANCHES_PROTEGIDOS = ['main', 'master', 'production', 'release', 'prod'];\n\n// Actions que modificam o estado do repositório (alta permissão)\nconst DANGEROUS_ACTIONS = ['actions/checkout', 'peter-evans/create-or-update-comment', 'peter-evans/create-pull-request', 'marocchino/sticky-pull-request', 'softprops/action-gh-release', 'ncipollo/release-action', 'docker/build-push-action', 'docker/login-action', 'docker/push-action', 'aws-actions/configure-aws-credentials', 'google-github-actions/auth', 'azure/login', 'hashicorp/vault-action'];\nexport const detectorWorkflowTriggerInseguro: Analista = {\n  nome: 'detector-workflow-trigger-inseguro',\n  categoria: 'workflows',\n  descricao: 'Detecta triggers de workflow potencialmente inseguros',\n  test: (relPath: string): boolean => /\\.github\\/workflows\\/.*\\.ya?ml$/i.test(relPath),\n  aplicar: (src: string, relPath: string): Ocorrencia[] => {\n    if (!src) return [];\n    const ocorrencias: Ocorrencia[] = [];\n    try {\n      const doc = parseDocument(src);\n      const workflow = doc.toJS();\n      if (!workflow || typeof workflow !== 'object') return ocorrencias;\n      const onConfig = workflow.on;\n      if (!onConfig || typeof onConfig !== 'object') {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'trigger-ausente',\n          nivel: 'info',\n          mensagem: messages.AnalistaGithubActionsMensagens.workflowWithoutTrigger,\n          relPath,\n          linha: 1,\n          sugestao: messages.AnalistaGithubActionsMensagens.workflowWithoutTriggerSugestao\n        }));\n        return ocorrencias;\n      }\n\n      // --- 1. Push em branches protegidos ---\n      if (onConfig.push) {\n        const pushConf = onConfig.push;\n\n        // Se push tem apenas tags, não é push em branches - é disparo por tag\n        if (pushConf.tags && !pushConf.branches && !pushConf['branches-ignore']) {\n          // Workflow disparado por tags, não por branches - não aplicar esta regra\n        } else {\n          const branches = typeof pushConf === 'object' && pushConf?.branches ? Array.isArray(pushConf.branches) ? pushConf.branches : [pushConf.branches] : typeof pushConf === 'object' && pushConf?.branches_ignore ? Array.isArray(pushConf.branches_ignore) ? pushConf.branches_ignore : [pushConf.branches_ignore] : undefined;\n\n          // Detectar push sem filtro de branches (triggeria em todos os branches)\n          if (typeof pushConf === 'object' && !pushConf.branches && !pushConf.branches_ignore && !pushConf.tags || Array.isArray(pushConf) || typeof pushConf === 'string') {\n            ocorrencias.push(criarOcorrencia({\n              tipo: 'trigger-push-sem-filtro',\n              nivel: 'aviso',\n              mensagem: 'Trigger push sem filtro de branches definido',\n              relPath,\n              linha: 1,\n              sugestao: 'Defina branches específicos em on.push.branches para limitar onde o workflow é executado'\n            }));\n          }\n\n          // Verificar se inclui branches protegidos sem paths filter\n          if (branches) {\n            const hasPathsFilter = !!(pushConf.paths || pushConf.paths_ignore || pushConf['paths-ignore'] || pushConf.pathsIgnore);\n            if (!hasPathsFilter) {\n              for (const branch of branches) {\n                if (typeof branch === 'string' && BRANCHES_PROTEGIDOS.some(caminho => branch.toLowerCase() === caminho.toLowerCase() || new RegExp(`^${caminho.replace('/', '\\\\/')}`).test(branch))) {\n                  ocorrencias.push(criarOcorrencia({\n                    tipo: 'trigger-push-branch-protegido',\n                    nivel: 'aviso',\n                    mensagem: `Trigger push configurado para branch protegido \"${branch}\" sem filtro de paths`,\n                    relPath,\n                    linha: 1,\n                    sugestao: 'Adicione filtros de paths (on.push.paths) para limitar quando o workflow é executado'\n                  }));\n                }\n              }\n            }\n          }\n        }\n      }\n\n      // --- 2. Pull request sem verificação de branches ---\n      if (onConfig.pull_request) {\n        // Detectar pull_request_target\n        if (onConfig.pull_request_target) {\n          ocorrencias.push(criarOcorrencia({\n            tipo: 'trigger-pull-request-target',\n            nivel: 'erro',\n            mensagem: messages.AnalistaGithubActionsMensagens.pullRequestTargetGrantsWritePermissions,\n            relPath,\n            linha: 1,\n            sugestao: messages.AnalistaGithubActionsMensagens.pullRequestTargetGrantsWritePermissionsSugestao\n          }));\n        }\n      }\n\n      // --- 3. Workflow_dispatch sem inputs de validação ---\n      if (onConfig.workflow_dispatch) {\n        const dispatchConf = onConfig.workflow_dispatch;\n        if (typeof dispatchConf === 'object' && dispatchConf.inputs) {\n          const inputs = dispatchConf.inputs;\n          for (const [_inputName, inputConfig] of Object.entries(inputs as Record<string, unknown>)) {\n            const inputConf = inputConfig as Record<string, unknown> | undefined;\n            if (inputConf && !inputConf.required) {\n              // Não é erro, mas pode ser melhorado\n            }\n          }\n        }\n        // workflow_dispatch sem inputs de qualquer tipo é potencialmente perigoso\n        if (typeof dispatchConf !== 'object' || !dispatchConf.inputs) {\n          ocorrencias.push(criarOcorrencia({\n            tipo: 'trigger-workflow-dispatch-sem-inputs',\n            nivel: 'info',\n          mensagem: messages.AnalistaGithubActionsMensagens.workflowDispatchWithoutInputs,\n          relPath,\n          linha: 1,\n          sugestao: messages.AnalistaGithubActionsMensagens.workflowDispatchWithoutInputsSugestao\n          }));\n        }\n      }\n\n      // --- 4. Schedule em branches sensíveis ---\n      if (onConfig.schedule) {\n        const pushConf = onConfig.push;\n        const targetBranches = typeof pushConf === 'object' && pushConf?.branches ? Array.isArray(pushConf.branches) ? pushConf.branches : [pushConf.branches] : undefined;\n        if (targetBranches) {\n          for (const branch of targetBranches) {\n            if (typeof branch === 'string' && branch.toLowerCase() === 'production') {\n              ocorrencias.push(criarOcorrencia({\n                tipo: 'trigger-schedule-branch-sensivel',\n                nivel: 'aviso',\n                mensagem: 'Workflow com schedule direcionado para branch \"production\"',\n                relPath,\n                linha: 1,\n                sugestao: 'Considere usar branches de staging para execuções agendadas'\n              }));\n            }\n          }\n        }\n      }\n\n      // --- 5. Triggers com wildcards excessivamente amplos ---\n      const yamlRaw = src;\n      if (/on:\\s*\\n\\s*push:\\s*\\n\\s*branches:\\s*\\n\\s*-\\s+'\\*\\*'/m.test(yamlRaw) || /on:\\s*\\n\\s*push:\\s*\\n\\s*branches:\\s*\\n\\s*-\\s+\"\\*\\*\"/m.test(yamlRaw)) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'trigger-wildcard-amplo',\n          nivel: 'info',\n          mensagem: 'Trigger push com wildcard \"**\" em branches (captura todos os branches)',\n          relPath,\n          linha: 1,\n          sugestao: 'Use padrões mais específicos para limitar os branches monitorados'\n        }));\n      }\n\n      // --- 6. Verificar se workflow executa actions perigosas em triggers de push amplo ---\n      if (onConfig.push && !onConfig.pull_request) {\n        // Se push tem apenas tags, não é push em branches\n        const isPushToTags = onConfig.push.tags && !onConfig.push.branches && !onConfig.push['branches-ignore'];\n        if (!isPushToTags) {\n          const linhas = splitLines(src);\n          const hasDangerousAction = linhas.some(linha => {\n            const usesMatch = linha.match(/uses:\\s*(.+)/);\n            return usesMatch && DANGEROUS_ACTIONS.some(arquivo => linha.includes(arquivo));\n          });\n          const isPushToAllBranches = !onConfig.push.branches && !onConfig.push['branches-ignore'];\n          if (isPushToAllBranches && hasDangerousAction) {\n            ocorrencias.push(criarOcorrencia({\n              tipo: 'trigger-push-ampla-com-actions-perigosas',\n              nivel: 'aviso',\n              mensagem: 'Push sem restrição de branches executa actions que modificam estado do repositório',\n              relPath,\n              linha: 1,\n              sugestao: 'Considere restringir push branches ou adicionar proteções (environment protection rules, approvals)'\n            }));\n          }\n        }\n      }\n    } catch {\n      // Fallback para análise por regex se o YAML parsing falhar\n\n      // Detectar pull_request_target\n      if (src.includes('pull_request_target:')) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'trigger-pull-request-target',\n          nivel: 'erro',\n          mensagem: messages.AnalistaGithubActionsMensagens.pullRequestTargetGrantsWritePermissions,\n          relPath,\n          linha: 1,\n          sugestao: messages.AnalistaGithubActionsMensagens.pullRequestTargetExecutesForkCodeSugestao\n        }));\n      }\n\n      // Detectar push sem filtro\n      if (/on:\\s*push:\\s*$/m.test(src) || /on:\\s*\\n\\s*push:\\s*true\\s*$/m.test(src)) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'trigger-push-sem-filtro',\n          nivel: 'aviso',\n          mensagem: 'Trigger push sem filtro de branches definido',\n          relPath,\n          linha: 1,\n          sugestao: 'Defina branches específicos em on.push.branches'\n        }));\n      }\n    }\n    return ocorrencias;\n  }\n};"]}

package/dist/analysts/github-actions/detectors/index.d.ts

@@ -1,9 +0,0 @@
-export * from './detector-dependencies-vulnerable.js';
-export * from './detector-workflow-accessibility.js';
-export * from './detector-workflow-compliance.js';
-export * from './detector-workflow-performance.js';
-export * from './detector-workflow-security.js';
-export * from './detector-workflow-structure.js';
-export * from './detector-workflow-trigger-unsafe.js';
-export * from './org-verified.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/analysts/github-actions/detectors/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/index.ts"],"names":[],"mappings":"AACA,cAAc,uCAAuC,CAAC;AACtD,cAAc,sCAAsC,CAAC;AACrD,cAAc,mCAAmC,CAAC;AAClD,cAAc,oCAAoC,CAAC;AACnD,cAAc,iCAAiC,CAAC;AAChD,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,mBAAmB,CAAC"}

package/dist/analysts/github-actions/detectors/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/index.ts"],"names":[],"mappings":"AACA,cAAc,uCAAuC,CAAC;AACtD,cAAc,sCAAsC,CAAC;AACrD,cAAc,mCAAmC,CAAC;AAClD,cAAc,oCAAoC,CAAC;AACnD,cAAc,iCAAiC,CAAC;AAChD,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,mBAAmB,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nexport * from './detector-dependencies-vulnerable.js';\nexport * from './detector-workflow-accessibility.js';\nexport * from './detector-workflow-compliance.js';\nexport * from './detector-workflow-performance.js';\nexport * from './detector-workflow-security.js';\nexport * from './detector-workflow-structure.js';\nexport * from './detector-workflow-trigger-unsafe.js';\nexport * from './org-verified.js';\n"]}

package/dist/analysts/github-actions/detectors/org-verified.d.ts

@@ -1,3 +0,0 @@
-export declare const ORG_VERIFICADAS: Set<string>;
-export declare function isOrgVerificada(actionRef: string): boolean;
-//# sourceMappingURL=org-verified.d.ts.map

package/dist/analysts/github-actions/detectors/org-verified.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"org-verified.d.ts","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/org-verified.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,eAAe,aAiB1B,CAAC;AAMH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAG1D"}

package/dist/analysts/github-actions/detectors/org-verified.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"org-verified.js","sourceRoot":"","sources":["../../../../src/analysts/github-actions/detectors/org-verified.ts"],"names":[],"mappings":"AAQA,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IACrC,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,YAAY;IACZ,SAAS;IACT,cAAc;IACd,cAAc;IACd,MAAM;IACN,eAAe;IACf,WAAW;IACX,eAAe;IACf,MAAM;IACN,YAAY;IACZ,SAAS;IACT,WAAW;CACZ,CAAC,CAAC;AAMH,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n/**\n * [SHIELD] Organizações/donos verificados de GitHub Actions\n *\n * Actions destes donos são consideradas confiáveis.\n * SHA pinning nestas actions é boa prática de segurança, não suspeito.\n */\n\nexport const ORG_VERIFICADAS = new Set([\n  'actions',          // GitHub official actions\n  'github',           // GitHub organization\n  'dependabot',       // GitHub Dependabot\n  'docker',           // Docker official actions\n  'peterevans',       // Peter Evans (verified creator)\n  'anchore',          // Anchore (security scanning)\n  'aquasecurity',     // Aqua Security (trivy)\n  'bridgecrewio',     // Bridgecrew (checkov)\n  'ossf',             // Open Source Security Foundation\n  'step-security',    // StepSecurity\n  'reviewdog',        // Reviewdog\n  'julia-actions',    // Julia language\n  'ruby',             // Ruby language\n  'actions-rs',       // Rust actions\n  'dtolnay',          // David Tolnay (verified Rust tooling)\n  'softprops',        // softprops/action-gh-release (popular release action)\n]);\n\n/**\n * Verifica se uma action pertence a uma organização verificada\n * @param actionRef Ex: \"actions/checkout\", \"dependabot/fetch-metadata\"\n */\nexport function isOrgVerificada(actionRef: string): boolean {\n  const owner = actionRef.split('/')[0];\n  return ORG_VERIFICADAS.has(owner);\n}\n"]}

package/dist/analysts/github-actions/index.d.ts

@@ -1,7 +0,0 @@
-export * from './analysts/analyst-github-actions.js';
-export * from './analysts/analyst-github-actions-security-hardening.js';
-export * from './corrections/index.js';
-export * from './detectors/index.js';
-export * from './reports/index.js';
-export * from './scorers/index.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/analysts/github-actions/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/analysts/github-actions/index.ts"],"names":[],"mappings":"AAOA,cAAc,sCAAsC,CAAC;AACrD,cAAc,yDAAyD,CAAC;AACxE,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC"}

package/dist/analysts/github-actions/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/analysts/github-actions/index.ts"],"names":[],"mappings":"AAOA,cAAc,sCAAsC,CAAC;AACrD,cAAc,yDAAyD,CAAC;AACxE,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n/**\n * [BUSCA] Analistas de GitHub Actions\n *\n * Analista avançado de workflows do GitHub Actions com suporte a plugins.\n */\n\nexport * from './analysts/analyst-github-actions.js';\nexport * from './analysts/analyst-github-actions-security-hardening.js';\nexport * from './corrections/index.js';\nexport * from './detectors/index.js';\nexport * from './reports/index.js';\nexport * from './scorers/index.js';\n"]}