@mocoto/mahoraga 0.14.0

package/dist/analysts/azure-pipelines/corrections/correction-azure.d.ts

@@ -0,0 +1,4 @@
+import type { Analista, AzureCorrection } from '../../../types/index.js';
+export declare function detectarCorrecoesAzure(src: string, _relPath: string): AzureCorrection[];
+export declare const correctionAzure: Analista;
+//# sourceMappingURL=correction-azure.d.ts.map

package/dist/analysts/azure-pipelines/corrections/correction-azure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"correction-azure.d.ts","sourceRoot":"","sources":["../../../../src/analysts/azure-pipelines/corrections/correction-azure.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAc,MAAM,GAAG,CAAC;AAG/D,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,EAAE,CAwCvF;AAED,eAAO,MAAM,eAAe,EAAE,QAsB7B,CAAC"}

package/dist/analysts/azure-pipelines/corrections/correction-azure.js

@@ -0,0 +1,64 @@
+import { messages } from '../../../core/messages/index.js';
+import { splitLines } from '../../../shared/helpers/index.js';
+import { criarOcorrencia } from '../../../types/index.js';
+export function detectarCorrecoesAzure(src, _relPath) {
+    const correcoes = [];
+    const linhas = splitLines(src);
+    linhas.forEach((linha, index) => {
+        const numeroLinha = index + 1;
+        if (/vmImage:\s*['"]?.*latest['"]?/i.test(linha)) {
+            correcoes.push({
+                tipo: 'azure-fix-latest-image',
+                original: linha,
+                sugerido: linha.replace(/latest/i, 'ubuntu-22.04'),
+                linha: numeroLinha,
+                confianca: 90
+            });
+        }
+        if (/(password|token|secret|key):\s*['"]?([^$({][a-zA-Z0-9_\-]{8,})['"]?/gi.test(linha)) {
+            const replaced = linha.replace(/['"][^'"]+['"]/, '$(SECRET_NAME)');
+            correcoes.push({
+                tipo: 'azure-use-variable',
+                original: linha,
+                sugerido: replaced,
+                linha: numeroLinha,
+                confianca: 90
+            });
+        }
+    });
+    if (!/task:\s*Cache@/i.test(src) && !/CacheBeta@/i.test(src)) {
+        correcoes.push({
+            tipo: 'azure-add-cache',
+            original: linhas[0],
+            sugerido: `- task: Cache@2\n  inputs:\n    key: 'npm | "$(Agent.OS)" | package-lock.json'\n    path: 'node_modules'\n  displayName: Cache npm\n\n${linhas[0]}`,
+            linha: 1,
+            confianca: 80
+        });
+    }
+    return correcoes;
+}
+export const correctionAzure = {
+    nome: 'correction-azure',
+    categoria: 'workflows',
+    descricao: 'Correções automáticas para Azure Pipelines',
+    test: (relPath) => relPath === 'azure-pipelines.yml' || relPath.endsWith('azure-pipelines.yml'),
+    aplicar: (src, relPath) => {
+        if (!src)
+            return [];
+        const correcoes = detectarCorrecoesAzure(src, relPath);
+        return correcoes.map(elem => criarOcorrencia({
+            tipo: `correction-${elem.tipo}`,
+            nivel: elem.confianca > 85 ? 'aviso' : 'info',
+            mensagem: messages.SharedCommonMensagens.correcaoSugerida(elem.tipo),
+            relPath,
+            linha: elem.linha,
+            sugestao: ` ${elem.original}\n ${elem.sugerido}\nConfiança: ${elem.confianca}%`,
+            correcao: {
+                original: elem.original,
+                novo: elem.sugerido,
+                linha: elem.linha
+            }
+        }));
+    }
+};
+//# sourceMappingURL=correction-azure.js.map

package/dist/analysts/azure-pipelines/corrections/correction-azure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"correction-azure.js","sourceRoot":"","sources":["../../../../src/analysts/azure-pipelines/corrections/correction-azure.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAG7C,OAAO,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AAEpC,MAAM,UAAU,sBAAsB,CAAC,GAAW,EAAE,QAAgB;IAClE,MAAM,SAAS,GAAsB,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAE/B,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC9B,MAAM,WAAW,GAAG,KAAK,GAAG,CAAC,CAAC;QAE9B,IAAI,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,wBAAwB;gBAC9B,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,cAAc,CAAC;gBAClD,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,EAAE;aACd,CAAC,CAAC;QACL,CAAC;QAED,IAAI,uEAAuE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxF,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;YACnE,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,EAAE;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7D,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YACnB,QAAQ,EAAE,yIAAyI,MAAM,CAAC,CAAC,CAAC,EAAE;YAC9J,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;IACL,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAa;IACvC,IAAI,EAAE,kBAAkB;IACxB,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,4CAA4C;IACvD,IAAI,EAAE,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,KAAK,qBAAqB,IAAI,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAChH,OAAO,EAAE,CAAC,GAAW,EAAE,OAAe,EAAgB,EAAE;QACtD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC;YAC3C,IAAI,EAAE,cAAc,IAAI,CAAC,IAAI,EAAE;YAC/B,KAAK,EAAE,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YAC7C,QAAQ,EAAE,QAAQ,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;YACpE,OAAO;YACP,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,IAAI,CAAC,QAAQ,MAAM,IAAI,CAAC,QAAQ,gBAAgB,IAAI,CAAC,SAAS,GAAG;YAC/E,QAAQ,EAAE;gBACR,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,IAAI,CAAC,QAAQ;gBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB;SACF,CAAC,CAAC,CAAC;IACN,CAAC;CACF,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n\nimport { messages } from '@core/messages';\nimport { splitLines } from '@shared/helpers';\n\nimport type { Analista, AzureCorrection, Ocorrencia } from '@';\nimport { criarOcorrencia } from '@';\n\nexport function detectarCorrecoesAzure(src: string, _relPath: string): AzureCorrection[] {\n  const correcoes: AzureCorrection[] = [];\n  const linhas = splitLines(src);\n\n  linhas.forEach((linha, index) => {\n    const numeroLinha = index + 1;\n\n    if (/vmImage:\\s*['\"]?.*latest['\"]?/i.test(linha)) {\n      correcoes.push({\n        tipo: 'azure-fix-latest-image',\n        original: linha,\n        sugerido: linha.replace(/latest/i, 'ubuntu-22.04'),\n        linha: numeroLinha,\n        confianca: 90\n      });\n    }\n\n    if (/(password|token|secret|key):\\s*['\"]?([^$({][a-zA-Z0-9_\\-]{8,})['\"]?/gi.test(linha)) {\n      const replaced = linha.replace(/['\"][^'\"]+['\"]/, '$(SECRET_NAME)');\n      correcoes.push({\n        tipo: 'azure-use-variable',\n        original: linha,\n        sugerido: replaced,\n        linha: numeroLinha,\n        confianca: 90\n      });\n    }\n  });\n\n  if (!/task:\\s*Cache@/i.test(src) && !/CacheBeta@/i.test(src)) {\n    correcoes.push({\n      tipo: 'azure-add-cache',\n      original: linhas[0],\n      sugerido: `- task: Cache@2\\n  inputs:\\n    key: 'npm | \"$(Agent.OS)\" | package-lock.json'\\n    path: 'node_modules'\\n  displayName: Cache npm\\n\\n${linhas[0]}`,\n      linha: 1,\n      confianca: 80\n    });\n  }\n\n  return correcoes;\n}\n\nexport const correctionAzure: Analista = {\n  nome: 'correction-azure',\n  categoria: 'workflows',\n  descricao: 'Correções automáticas para Azure Pipelines',\n  test: (relPath: string): boolean => relPath === 'azure-pipelines.yml' || relPath.endsWith('azure-pipelines.yml'),\n  aplicar: (src: string, relPath: string): Ocorrencia[] => {\n    if (!src) return [];\n    const correcoes = detectarCorrecoesAzure(src, relPath);\n    return correcoes.map(elem => criarOcorrencia({\n      tipo: `correction-${elem.tipo}`,\n      nivel: elem.confianca > 85 ? 'aviso' : 'info',\n      mensagem: messages.SharedCommonMensagens.correcaoSugerida(elem.tipo),\n      relPath,\n      linha: elem.linha,\n      sugestao: ` ${elem.original}\\n ${elem.sugerido}\\nConfiança: ${elem.confianca}%`,\n      correcao: {\n        original: elem.original,\n        novo: elem.sugerido,\n        linha: elem.linha\n      }\n    }));\n  }\n};\n"]}

package/dist/analysts/azure-pipelines/corrections/index.d.ts

@@ -0,0 +1,3 @@
+export * from './autofix-engine.js';
+export * from './correction-azure.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/analysts/azure-pipelines/corrections/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/analysts/azure-pipelines/corrections/index.ts"],"names":[],"mappings":"AACA,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC"}

package/dist/analysts/azure-pipelines/corrections/index.js

@@ -0,0 +1,3 @@
+export * from './autofix-engine.js';
+export * from './correction-azure.js';
+//# sourceMappingURL=index.js.map

package/dist/analysts/azure-pipelines/corrections/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/analysts/azure-pipelines/corrections/index.ts"],"names":[],"mappings":"AACA,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nexport * from './autofix-engine.js';\nexport * from './correction-azure.js';\n"]}

package/dist/analysts/azure-pipelines/detectors/detector-azure-performance.d.ts

@@ -0,0 +1,3 @@
+import type { Analista } from '../../../types/index.js';
+export declare const detectorAzurePerformance: Analista;
+//# sourceMappingURL=detector-azure-performance.d.ts.map

package/dist/analysts/azure-pipelines/detectors/detector-azure-performance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector-azure-performance.d.ts","sourceRoot":"","sources":["../../../../src/analysts/azure-pipelines/detectors/detector-azure-performance.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAc,MAAM,GAAG,CAAC;AAG9C,eAAO,MAAM,wBAAwB,EAAE,QAmHtC,CAAC"}

package/dist/analysts/azure-pipelines/detectors/detector-azure-performance.js

@@ -0,0 +1,105 @@
+import { messages } from '../../../core/messages/index.js';
+import { criarOcorrencia } from '../../../types/index.js';
+export const detectorAzurePerformance = {
+    nome: 'detector-azure-performance',
+    categoria: 'performance',
+    descricao: 'Detecta problemas de performance em Azure Pipelines',
+    test: (relPath) => relPath.includes('azure-pipelines') && /\.(ya?ml)$/i.test(relPath),
+    aplicar: (src, relPath) => {
+        if (!src)
+            return [];
+        const ocorrencias = [];
+        if (!/task:\s*Cache@/i.test(src) && !/CacheBeta@/i.test(src)) {
+            ocorrencias.push(criarOcorrencia({
+                tipo: 'azure-pipelines-missing-cache',
+                nivel: 'aviso',
+                mensagem: messages.RelatorioAzureMensagens.missingCacheTask,
+                relPath,
+                linha: 1,
+                sugestao: messages.RelatorioAzureMensagens.missingCacheTaskSugestao,
+            }));
+        }
+        if (/task:\s*DotNetCoreCLI@.*test/i.test(src) || /task:\s*Npm@.*test/i.test(src)) {
+            if (!/parallel:\s*\d+/i.test(src) && !/strategy:\s*matrix:/i.test(src)) {
+                ocorrencias.push(criarOcorrencia({
+                    tipo: 'azure-pipelines-optimization-parallel',
+                    nivel: 'info',
+                    mensagem: 'Testes detectados sem estratégia de paralelismo',
+                    relPath,
+                    linha: 1,
+                    sugestao: 'Use "strategy: parallel" ou "matrix" para dividir a carga de testes entre múltiplos agentes',
+                }));
+            }
+        }
+        if (/(stage|job).*deploy/i.test(src) && !/checkout:\s*none/i.test(src)) {
+            ocorrencias.push(criarOcorrencia({
+                tipo: 'azure-pipelines-checkout-none',
+                nivel: 'info',
+                mensagem: 'Job de deploy pode não precisar do código fonte completo',
+                relPath,
+                linha: 1,
+                sugestao: 'Use "checkout: none" se o job apenas consome artifacts, economizando tempo de clonagem',
+            }));
+        }
+        if (/environment:/i.test(src) && /deploy/i.test(src)) {
+            const deployJobs = src.match(/- job:\s*\w+/g);
+            const deployStages = src.match(/- stage:\s*\w+/g);
+            const totalDeployUnits = (deployJobs ? deployJobs.length : 0) + (deployStages ? deployStages.length : 0);
+            if (totalDeployUnits > 1) {
+                const hasDependsOn = /dependsOn:/i.test(src);
+                if (!hasDependsOn) {
+                    ocorrencias.push(criarOcorrencia({
+                        tipo: 'azure-pipelines-missing-parallel-deployment',
+                        nivel: 'info',
+                        mensagem: messages.RelatorioAzureMensagens.missingParallelDeployment,
+                        relPath,
+                        linha: 1,
+                        sugestao: messages.RelatorioAzureMensagens.missingParallelDeploymentSugestao,
+                    }));
+                }
+            }
+        }
+        const publishArtifacts = src.match(/task:\s*PublishBuildArtifacts@/gi);
+        if (publishArtifacts && publishArtifacts.length > 3) {
+            ocorrencias.push(criarOcorrencia({
+                tipo: 'azure-pipelines-large-artifact-staging',
+                nivel: 'info',
+                mensagem: messages.RelatorioAzureMensagens.largeArtifactStaging,
+                relPath,
+                linha: 1,
+                sugestao: messages.RelatorioAzureMensagens.largeArtifactStagingSugestao,
+            }));
+        }
+        if (/platform|os:|vmImage/i.test(src)) {
+            const hasMatrix = /strategy:\s*matrix:/i.test(src);
+            const hasMultiplePlatforms = /(ubuntu|windows|macos|linux)/i.test(src);
+            if (!hasMatrix && hasMultiplePlatforms) {
+                ocorrencias.push(criarOcorrencia({
+                    tipo: 'azure-pipelines-single-build-all-platforms',
+                    nivel: 'info',
+                    mensagem: messages.RelatorioAzureMensagens.singleBuildForAllPlatforms,
+                    relPath,
+                    linha: 1,
+                    sugestao: messages.RelatorioAzureMensagens.singleBuildForAllPlatformsSugestao,
+                }));
+            }
+        }
+        const stepLines = src.match(/^\s*-\s+(task|script|bash|powershell|pwsh|checkout):/gim);
+        if (stepLines && stepLines.length > 0) {
+            const conditionalCount = (src.match(/condition:/gi) || []).length;
+            const unconditionalRatio = stepLines.length / (conditionalCount + 1);
+            if (unconditionalRatio > 5 && stepLines.length > 5) {
+                ocorrencias.push(criarOcorrencia({
+                    tipo: 'azure-pipelines-missing-conditional-steps',
+                    nivel: 'info',
+                    mensagem: messages.RelatorioAzureMensagens.missingConditionalSteps,
+                    relPath,
+                    linha: 1,
+                    sugestao: messages.RelatorioAzureMensagens.missingConditionalStepsSugestao,
+                }));
+            }
+        }
+        return ocorrencias;
+    }
+};
+//# sourceMappingURL=detector-azure-performance.js.map

package/dist/analysts/azure-pipelines/detectors/detector-azure-performance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector-azure-performance.js","sourceRoot":"","sources":["../../../../src/analysts/azure-pipelines/detectors/detector-azure-performance.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1C,OAAO,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AAEpC,MAAM,CAAC,MAAM,wBAAwB,GAAa;IAChD,IAAI,EAAE,4BAA4B;IAClC,SAAS,EAAE,aAAa;IACxB,SAAS,EAAE,qDAAqD;IAChE,IAAI,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;IAC7F,OAAO,EAAE,CAAC,GAAW,EAAE,OAAe,EAAgB,EAAE;QACtD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,WAAW,GAAiB,EAAE,CAAC;QAGrC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7D,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,+BAA+B;gBACrC,KAAK,EAAE,OAAO;gBACd,QAAQ,EAAE,QAAQ,CAAC,uBAAuB,CAAC,gBAAgB;gBAC3D,OAAO;gBACP,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,QAAQ,CAAC,uBAAuB,CAAC,wBAAwB;aACpE,CAAC,CAAC,CAAC;QACN,CAAC;QAGD,IAAI,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjF,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvE,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,uCAAuC;oBAC7C,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,iDAAiD;oBAC3D,OAAO;oBACP,KAAK,EAAE,CAAC;oBACR,QAAQ,EAAE,6FAA6F;iBACxG,CAAC,CAAC,CAAC;YACN,CAAC;QACH,CAAC;QAGD,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvE,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,+BAA+B;gBACrC,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,0DAA0D;gBACpE,OAAO;gBACP,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,wFAAwF;aACnG,CAAC,CAAC,CAAC;QACN,CAAC;QAGD,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAC9C,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAClD,MAAM,gBAAgB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzG,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC7C,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;wBAC/B,IAAI,EAAE,6CAA6C;wBACnD,KAAK,EAAE,MAAM;wBACb,QAAQ,EAAE,QAAQ,CAAC,uBAAuB,CAAC,yBAAyB;wBACpE,OAAO;wBACP,KAAK,EAAE,CAAC;wBACR,QAAQ,EAAE,QAAQ,CAAC,uBAAuB,CAAC,iCAAiC;qBAC7E,CAAC,CAAC,CAAC;gBACN,CAAC;YACH,CAAC;QACH,CAAC;QAGD,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACvE,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,wCAAwC;gBAC9C,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,QAAQ,CAAC,uBAAuB,CAAC,oBAAoB;gBAC/D,OAAO;gBACP,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,QAAQ,CAAC,uBAAuB,CAAC,4BAA4B;aACxE,CAAC,CAAC,CAAC;QACN,CAAC;QAGD,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnD,MAAM,oBAAoB,GAAG,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvE,IAAI,CAAC,SAAS,IAAI,oBAAoB,EAAE,CAAC;gBACvC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,4CAA4C;oBAClD,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,QAAQ,CAAC,uBAAuB,CAAC,0BAA0B;oBACrE,OAAO;oBACP,KAAK,EAAE,CAAC;oBACR,QAAQ,EAAE,QAAQ,CAAC,uBAAuB,CAAC,kCAAkC;iBAC9E,CAAC,CAAC,CAAC;YACN,CAAC;QACH,CAAC;QAGD,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACvF,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,gBAAgB,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YAClE,MAAM,kBAAkB,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC;YACrE,IAAI,kBAAkB,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnD,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,2CAA2C;oBACjD,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,QAAQ,CAAC,uBAAuB,CAAC,uBAAuB;oBAClE,OAAO;oBACP,KAAK,EAAE,CAAC;oBACR,QAAQ,EAAE,QAAQ,CAAC,uBAAuB,CAAC,+BAA+B;iBAC3E,CAAC,CAAC,CAAC;YACN,CAAC;QACH,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;CACF,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n\nimport { messages } from '@core/messages';\n\nimport type { Analista, Ocorrencia } from '@';\nimport { criarOcorrencia } from '@';\n\nexport const detectorAzurePerformance: Analista = {\n  nome: 'detector-azure-performance',\n  categoria: 'performance',\n  descricao: 'Detecta problemas de performance em Azure Pipelines',\n  test: (relPath: string) => relPath.includes('azure-pipelines') && /\\.(ya?ml)$/i.test(relPath),\n  aplicar: (src: string, relPath: string): Ocorrencia[] => {\n    if (!src) return [];\n    const ocorrencias: Ocorrencia[] = [];\n\n    // 1. Cache de dependências\n    if (!/task:\\s*Cache@/i.test(src) && !/CacheBeta@/i.test(src)) {\n      ocorrencias.push(criarOcorrencia({\n        tipo: 'azure-pipelines-missing-cache',\n        nivel: 'aviso',\n        mensagem: messages.RelatorioAzureMensagens.missingCacheTask,\n        relPath,\n        linha: 1,\n        sugestao: messages.RelatorioAzureMensagens.missingCacheTaskSugestao,\n      }));\n    }\n\n    // 2. Paralelismo em Testes\n    if (/task:\\s*DotNetCoreCLI@.*test/i.test(src) || /task:\\s*Npm@.*test/i.test(src)) {\n      if (!/parallel:\\s*\\d+/i.test(src) && !/strategy:\\s*matrix:/i.test(src)) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'azure-pipelines-optimization-parallel',\n          nivel: 'info',\n          mensagem: 'Testes detectados sem estratégia de paralelismo',\n          relPath,\n          linha: 1,\n          sugestao: 'Use \"strategy: parallel\" ou \"matrix\" para dividir a carga de testes entre múltiplos agentes',\n        }));\n      }\n    }\n\n    // 3. Checkout desnecessário em pipelines de deploy\n    if (/(stage|job).*deploy/i.test(src) && !/checkout:\\s*none/i.test(src)) {\n      ocorrencias.push(criarOcorrencia({\n        tipo: 'azure-pipelines-checkout-none',\n        nivel: 'info',\n        mensagem: 'Job de deploy pode não precisar do código fonte completo',\n        relPath,\n        linha: 1,\n        sugestao: 'Use \"checkout: none\" se o job apenas consome artifacts, economizando tempo de clonagem',\n      }));\n    }\n\n    // 4. Parallel deployment detection\n    if (/environment:/i.test(src) && /deploy/i.test(src)) {\n      const deployJobs = src.match(/- job:\\s*\\w+/g);\n      const deployStages = src.match(/- stage:\\s*\\w+/g);\n      const totalDeployUnits = (deployJobs ? deployJobs.length : 0) + (deployStages ? deployStages.length : 0);\n      if (totalDeployUnits > 1) {\n        const hasDependsOn = /dependsOn:/i.test(src);\n        if (!hasDependsOn) {\n          ocorrencias.push(criarOcorrencia({\n            tipo: 'azure-pipelines-missing-parallel-deployment',\n            nivel: 'info',\n            mensagem: messages.RelatorioAzureMensagens.missingParallelDeployment,\n            relPath,\n            linha: 1,\n            sugestao: messages.RelatorioAzureMensagens.missingParallelDeploymentSugestao,\n          }));\n        }\n      }\n    }\n\n    // 5. Large artifact staging\n    const publishArtifacts = src.match(/task:\\s*PublishBuildArtifacts@/gi);\n    if (publishArtifacts && publishArtifacts.length > 3) {\n      ocorrencias.push(criarOcorrencia({\n        tipo: 'azure-pipelines-large-artifact-staging',\n        nivel: 'info',\n        mensagem: messages.RelatorioAzureMensagens.largeArtifactStaging,\n        relPath,\n        linha: 1,\n        sugestao: messages.RelatorioAzureMensagens.largeArtifactStagingSugestao,\n      }));\n    }\n\n    // 6. Matrix strategy detection for multi-platform builds\n    if (/platform|os:|vmImage/i.test(src)) {\n      const hasMatrix = /strategy:\\s*matrix:/i.test(src);\n      const hasMultiplePlatforms = /(ubuntu|windows|macos|linux)/i.test(src);\n      if (!hasMatrix && hasMultiplePlatforms) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'azure-pipelines-single-build-all-platforms',\n          nivel: 'info',\n          mensagem: messages.RelatorioAzureMensagens.singleBuildForAllPlatforms,\n          relPath,\n          linha: 1,\n          sugestao: messages.RelatorioAzureMensagens.singleBuildForAllPlatformsSugestao,\n        }));\n      }\n    }\n\n    // 7. Conditional step analysis\n    const stepLines = src.match(/^\\s*-\\s+(task|script|bash|powershell|pwsh|checkout):/gim);\n    if (stepLines && stepLines.length > 0) {\n      const conditionalCount = (src.match(/condition:/gi) || []).length;\n      const unconditionalRatio = stepLines.length / (conditionalCount + 1);\n      if (unconditionalRatio > 5 && stepLines.length > 5) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'azure-pipelines-missing-conditional-steps',\n          nivel: 'info',\n          mensagem: messages.RelatorioAzureMensagens.missingConditionalSteps,\n          relPath,\n          linha: 1,\n          sugestao: messages.RelatorioAzureMensagens.missingConditionalStepsSugestao,\n        }));\n      }\n    }\n\n    return ocorrencias;\n  }\n};\n"]}

package/dist/analysts/azure-pipelines/detectors/detector-azure-security.d.ts

@@ -0,0 +1,3 @@
+import type { Analista } from '../../../types/index.js';
+export declare const detectorAzureSecurity: Analista;
+//# sourceMappingURL=detector-azure-security.d.ts.map

package/dist/analysts/azure-pipelines/detectors/detector-azure-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector-azure-security.d.ts","sourceRoot":"","sources":["../../../../src/analysts/azure-pipelines/detectors/detector-azure-security.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAc,MAAM,GAAG,CAAC;AAoB9C,eAAO,MAAM,qBAAqB,EAAE,QAmKnC,CAAC"}

package/dist/analysts/azure-pipelines/detectors/detector-azure-security.js

@@ -0,0 +1,162 @@
+import { messages } from '../../../core/messages/index.js';
+import { criarOcorrencia } from '../../../types/index.js';
+const VULNERABLE_TASKS = {
+    'Npm@1': 'Npm@1',
+    'NuGetCommand@2': 'NuGetCommand@2',
+    'DotNetCoreCLI@1': 'DotNetCoreCLI@1',
+    'VSBuild@1': 'VSBuild@1',
+    'VsTest@1': 'VsTest@1',
+};
+const SECRET_PATTERNS = [
+    /(password|passwd|pwd)\s*[:=]\s*['"][^'"]+['"]/gi,
+    /(api[_-]?key|apikey)\s*[:=]\s*['"][^'"]+['"]/gi,
+    /(access[_-]?token|accesstoken)\s*[:=]\s*['"][^'"]+['"]/gi,
+    /(secret|token)\s*[:=]\s*['"][^'"]+['"]/gi,
+    /(connection[_-]?string)\s*[:=]\s*['"][^'"]+['"]/gi,
+    /(azure[_-]?devops[_-]?pat)\s*[:=]\s*['"][^'"]+['"]/gi,
+];
+export const detectorAzureSecurity = {
+    nome: 'detector-azure-security',
+    categoria: 'seguranca',
+    descricao: 'Detecta vulnerabilidades em Azure Pipelines',
+    test: (relPath) => relPath.includes('azure-pipelines') && /\.(ya?ml)$/i.test(relPath),
+    aplicar: (src, relPath) => {
+        if (!src)
+            return [];
+        const ocorrencias = [];
+        if (/vmImage:\s*['"]?.*latest['"]?/i.test(src)) {
+            ocorrencias.push(criarOcorrencia({
+                tipo: 'azure-pipelines-latest-image',
+                nivel: 'aviso',
+                mensagem: messages.RelatorioAzureMensagens.vulnerableTask,
+                relPath,
+                linha: 1,
+                sugestao: messages.RelatorioAzureMensagens.vulnerableTaskSugestao,
+            }));
+        }
+        for (const [taskPattern, taskName] of Object.entries(VULNERABLE_TASKS)) {
+            const taskRegex = new RegExp(`task:\\s*${taskPattern.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}`, 'i');
+            if (taskRegex.test(src)) {
+                ocorrencias.push(criarOcorrencia({
+                    tipo: 'azure-pipelines-vulnerable-task',
+                    nivel: 'erro',
+                    mensagem: `${messages.RelatorioAzureMensagens.vulnerableTask}: ${taskName}`,
+                    relPath,
+                    linha: 1,
+                    sugestao: messages.RelatorioAzureMensagens.vulnerableTaskSugestao,
+                }));
+            }
+        }
+        const secretRegex = /(password|token|secret|key|password):\s*['"]?([^$({][a-zA-Z0-9_\-]{8,})['"]?/gi;
+        let match;
+        while ((match = secretRegex.exec(src)) !== null) {
+            ocorrencias.push(criarOcorrencia({
+                tipo: 'azure-pipelines-secret-hardcoded',
+                nivel: 'erro',
+                mensagem: `Potencial segredo hardcoded detectado na propriedade '${match[1]}'`,
+                relPath,
+                linha: 1,
+                sugestao: 'Use Azure Key Vault ou variáveis de biblioteca com $(NOME_DA_VARIAVEL)',
+            }));
+        }
+        if (/bash:\s*curl.*\|\s*bash/i.test(src)) {
+            ocorrencias.push(criarOcorrencia({
+                tipo: 'azure-pipelines-dangerous-curl',
+                nivel: 'erro',
+                mensagem: 'Padrão "curl | bash" detectado',
+                relPath,
+                linha: 1,
+                sugestao: 'Baixe o script, valide o checksum e execute localmente para evitar Remote Code Execution',
+            }));
+        }
+        if (/checkout:\s*self/i.test(src) || /checkout:\s*[a-z]/i.test(src)) {
+            const hasToken = /persistCredentials|persist-credentials/i.test(src);
+            if (!hasToken) {
+                ocorrencias.push(criarOcorrencia({
+                    tipo: 'azure-pipelines-missing-checkout-token',
+                    nivel: 'aviso',
+                    mensagem: messages.RelatorioAzureMensagens.missingCheckoutToken,
+                    relPath,
+                    linha: 1,
+                    sugestao: messages.RelatorioAzureMensagens.missingCheckoutTokenSugestao,
+                }));
+            }
+        }
+        for (const pattern of SECRET_PATTERNS) {
+            const secretMatch = pattern.exec(src);
+            if (secretMatch) {
+                ocorrencias.push(criarOcorrencia({
+                    tipo: 'azure-pipelines-inline-secret',
+                    nivel: 'erro',
+                    mensagem: messages.RelatorioAzureMensagens.scriptWithInlineSecrets,
+                    relPath,
+                    linha: 1,
+                    sugestao: messages.RelatorioAzureMensagens.scriptWithInlineSecretsSugestao,
+                }));
+            }
+        }
+        if (/environment:/i.test(src)) {
+            const hasApproval = /approvals?|approval|reviewers?/i.test(src);
+            if (!hasApproval) {
+                ocorrencias.push(criarOcorrencia({
+                    tipo: 'azure-pipelines-missing-approval-gate',
+                    nivel: 'aviso',
+                    mensagem: messages.RelatorioAzureMensagens.missingApprovalGate,
+                    relPath,
+                    linha: 1,
+                    sugestao: messages.RelatorioAzureMensagens.missingApprovalGateSugestao,
+                }));
+            }
+        }
+        const envBlocks = src.match(/environment:\s*[^\n]+/gi);
+        if (envBlocks) {
+            for (const envBlock of envBlocks) {
+                if (!/reviewers?/i.test(envBlock)) {
+                    ocorrencias.push(criarOcorrencia({
+                        tipo: 'azure-pipelines-environment-no-reviewers',
+                        nivel: 'aviso',
+                        mensagem: messages.RelatorioAzureMensagens.environmentWithoutReviewers,
+                        relPath,
+                        linha: 1,
+                        sugestao: messages.RelatorioAzureMensagens.environmentWithoutReviewersSugestao,
+                    }));
+                }
+            }
+        }
+        if (/\$\s*\(/i.test(src) && /script:|bash:|powershell:|pwsh:/i.test(src)) {
+            const unsafeInjection = /script:.*\$\s*\(/i.test(src) || /bash:.*\$\s*\(/i.test(src) || /powershell:.*\$\s*\(/i.test(src) || /pwsh:.*\$\s*\(/i.test(src);
+            if (unsafeInjection) {
+                ocorrencias.push(criarOcorrencia({
+                    tipo: 'azure-pipelines-unsafe-variable-injection',
+                    nivel: 'aviso',
+                    mensagem: messages.RelatorioAzureMensagens.unsafeVariableInjection,
+                    relPath,
+                    linha: 1,
+                    sugestao: messages.RelatorioAzureMensagens.unsafeVariableInjectionSugestao,
+                }));
+            }
+        }
+        const variableLines = src.match(/^\s*variables\s*:\s*$/im);
+        if (variableLines) {
+            const varSection = src.slice(src.indexOf('variables:'));
+            const secretVars = varSection.match(/([a-zA-Z_]\w*)\s*:\s*['"][^'"]+['"]/g);
+            if (secretVars) {
+                for (const sv of secretVars) {
+                    const varName = sv.split(':')[0].trim();
+                    if (/(password|token|secret|key|connection)/i.test(varName)) {
+                        ocorrencias.push(criarOcorrencia({
+                            tipo: 'azure-pipelines-secret-variable-plaintext',
+                            nivel: 'erro',
+                            mensagem: `Variável '${varName}' definida em texto plano na seção variables`,
+                            relPath,
+                            linha: 1,
+                            sugestao: 'Use um grupo de variáveis com proteção de segredo ou referencie como $(varName)',
+                        }));
+                    }
+                }
+            }
+        }
+        return ocorrencias;
+    }
+};
+//# sourceMappingURL=detector-azure-security.js.map

package/dist/analysts/azure-pipelines/detectors/detector-azure-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector-azure-security.js","sourceRoot":"","sources":["../../../../src/analysts/azure-pipelines/detectors/detector-azure-security.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1C,OAAO,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC;AAEpC,MAAM,gBAAgB,GAA2B;IAC/C,OAAO,EAAE,OAAO;IAChB,gBAAgB,EAAE,gBAAgB;IAClC,iBAAiB,EAAE,iBAAiB;IACpC,WAAW,EAAE,WAAW;IACxB,UAAU,EAAE,UAAU;CACvB,CAAC;AAEF,MAAM,eAAe,GAAG;IACtB,iDAAiD;IACjD,gDAAgD;IAChD,0DAA0D;IAC1D,0CAA0C;IAC1C,mDAAmD;IACnD,sDAAsD;CACvD,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAa;IAC7C,IAAI,EAAE,yBAAyB;IAC/B,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,6CAA6C;IACxD,IAAI,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;IAC7F,OAAO,EAAE,CAAC,GAAW,EAAE,OAAe,EAAgB,EAAE;QACtD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,WAAW,GAAiB,EAAE,CAAC;QAGrC,IAAI,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,8BAA8B;gBACpC,KAAK,EAAE,OAAO;gBACd,QAAQ,EAAE,QAAQ,CAAC,uBAAuB,CAAC,cAAc;gBACzD,OAAO;gBACP,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,QAAQ,CAAC,uBAAuB,CAAC,sBAAsB;aAClE,CAAC,CAAC,CAAC;QACN,CAAC;QAGD,KAAK,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACvE,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,YAAY,WAAW,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACpG,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,iCAAiC;oBACvC,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,GAAG,QAAQ,CAAC,uBAAuB,CAAC,cAAc,KAAK,QAAQ,EAAE;oBAC3E,OAAO;oBACP,KAAK,EAAE,CAAC;oBACR,QAAQ,EAAE,QAAQ,CAAC,uBAAuB,CAAC,sBAAsB;iBAClE,CAAC,CAAC,CAAC;YACN,CAAC;QACH,CAAC;QAGD,MAAM,WAAW,GAAG,gFAAgF,CAAC;QACrG,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAChD,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,kCAAkC;gBACxC,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,yDAAyD,KAAK,CAAC,CAAC,CAAC,GAAG;gBAC9E,OAAO;gBACP,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,wEAAwE;aACnF,CAAC,CAAC,CAAC;QACN,CAAC;QAGD,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,gCAAgC;gBACtC,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,gCAAgC;gBAC1C,OAAO;gBACP,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,0FAA0F;aACrG,CAAC,CAAC,CAAC;QACN,CAAC;QAGD,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpE,MAAM,QAAQ,GAAG,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,wCAAwC;oBAC9C,KAAK,EAAE,OAAO;oBACd,QAAQ,EAAE,QAAQ,CAAC,uBAAuB,CAAC,oBAAoB;oBAC/D,OAAO;oBACP,KAAK,EAAE,CAAC;oBACR,QAAQ,EAAE,QAAQ,CAAC,uBAAuB,CAAC,4BAA4B;iBACxE,CAAC,CAAC,CAAC;YACN,CAAC;QACH,CAAC;QAGD,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;YACtC,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,WAAW,EAAE,CAAC;gBAChB,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,+BAA+B;oBACrC,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,QAAQ,CAAC,uBAAuB,CAAC,uBAAuB;oBAClE,OAAO;oBACP,KAAK,EAAE,CAAC;oBACR,QAAQ,EAAE,QAAQ,CAAC,uBAAuB,CAAC,+BAA+B;iBAC3E,CAAC,CAAC,CAAC;YACN,CAAC;QACH,CAAC;QAGD,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,iCAAiC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,uCAAuC;oBAC7C,KAAK,EAAE,OAAO;oBACd,QAAQ,EAAE,QAAQ,CAAC,uBAAuB,CAAC,mBAAmB;oBAC9D,OAAO;oBACP,KAAK,EAAE,CAAC;oBACR,QAAQ,EAAE,QAAQ,CAAC,uBAAuB,CAAC,2BAA2B;iBACvE,CAAC,CAAC,CAAC;YACN,CAAC;QACH,CAAC;QAGD,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACvD,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAClC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;wBAC/B,IAAI,EAAE,0CAA0C;wBAChD,KAAK,EAAE,OAAO;wBACd,QAAQ,EAAE,QAAQ,CAAC,uBAAuB,CAAC,2BAA2B;wBACtE,OAAO;wBACP,KAAK,EAAE,CAAC;wBACR,QAAQ,EAAE,QAAQ,CAAC,uBAAuB,CAAC,mCAAmC;qBAC/E,CAAC,CAAC,CAAC;gBACN,CAAC;YACH,CAAC;QACH,CAAC;QAGD,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACzE,MAAM,eAAe,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzJ,IAAI,eAAe,EAAE,CAAC;gBACpB,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;oBAC/B,IAAI,EAAE,2CAA2C;oBACjD,KAAK,EAAE,OAAO;oBACd,QAAQ,EAAE,QAAQ,CAAC,uBAAuB,CAAC,uBAAuB;oBAClE,OAAO;oBACP,KAAK,EAAE,CAAC;oBACR,QAAQ,EAAE,QAAQ,CAAC,uBAAuB,CAAC,+BAA+B;iBAC3E,CAAC,CAAC,CAAC;YACN,CAAC;QACH,CAAC;QAGD,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC3D,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;YACxD,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC5E,IAAI,UAAU,EAAE,CAAC;gBACf,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;oBAC5B,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBACxC,IAAI,yCAAyC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC5D,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;4BAC/B,IAAI,EAAE,2CAA2C;4BACjD,KAAK,EAAE,MAAM;4BACb,QAAQ,EAAE,aAAa,OAAO,8CAA8C;4BAC5E,OAAO;4BACP,KAAK,EAAE,CAAC;4BACR,QAAQ,EAAE,iFAAiF;yBAC5F,CAAC,CAAC,CAAC;oBACN,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;CACF,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\n\nimport { messages } from '@core/messages';\n\nimport type { Analista, Ocorrencia } from '@';\nimport { criarOcorrencia } from '@';\n\nconst VULNERABLE_TASKS: Record<string, string> = {\n  'Npm@1': 'Npm@1',\n  'NuGetCommand@2': 'NuGetCommand@2',\n  'DotNetCoreCLI@1': 'DotNetCoreCLI@1',\n  'VSBuild@1': 'VSBuild@1',\n  'VsTest@1': 'VsTest@1',\n};\n\nconst SECRET_PATTERNS = [\n  /(password|passwd|pwd)\\s*[:=]\\s*['\"][^'\"]+['\"]/gi,\n  /(api[_-]?key|apikey)\\s*[:=]\\s*['\"][^'\"]+['\"]/gi,\n  /(access[_-]?token|accesstoken)\\s*[:=]\\s*['\"][^'\"]+['\"]/gi,\n  /(secret|token)\\s*[:=]\\s*['\"][^'\"]+['\"]/gi,\n  /(connection[_-]?string)\\s*[:=]\\s*['\"][^'\"]+['\"]/gi,\n  /(azure[_-]?devops[_-]?pat)\\s*[:=]\\s*['\"][^'\"]+['\"]/gi,\n];\n\nexport const detectorAzureSecurity: Analista = {\n  nome: 'detector-azure-security',\n  categoria: 'seguranca',\n  descricao: 'Detecta vulnerabilidades em Azure Pipelines',\n  test: (relPath: string) => relPath.includes('azure-pipelines') && /\\.(ya?ml)$/i.test(relPath),\n  aplicar: (src: string, relPath: string): Ocorrencia[] => {\n    if (!src) return [];\n    const ocorrencias: Ocorrencia[] = [];\n\n    // 1. Imagem latest\n    if (/vmImage:\\s*['\"]?.*latest['\"]?/i.test(src)) {\n      ocorrencias.push(criarOcorrencia({\n        tipo: 'azure-pipelines-latest-image',\n        nivel: 'aviso',\n        mensagem: messages.RelatorioAzureMensagens.vulnerableTask,\n        relPath,\n        linha: 1,\n        sugestao: messages.RelatorioAzureMensagens.vulnerableTaskSugestao,\n      }));\n    }\n\n    // 2. Vulnerable task versions\n    for (const [taskPattern, taskName] of Object.entries(VULNERABLE_TASKS)) {\n      const taskRegex = new RegExp(`task:\\\\s*${taskPattern.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')}`, 'i');\n      if (taskRegex.test(src)) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'azure-pipelines-vulnerable-task',\n          nivel: 'erro',\n          mensagem: `${messages.RelatorioAzureMensagens.vulnerableTask}: ${taskName}`,\n          relPath,\n          linha: 1,\n          sugestao: messages.RelatorioAzureMensagens.vulnerableTaskSugestao,\n        }));\n      }\n    }\n\n    // 3. Hardcoded Secrets (heurística)\n    const secretRegex = /(password|token|secret|key|password):\\s*['\"]?([^$({][a-zA-Z0-9_\\-]{8,})['\"]?/gi;\n    let match;\n    while ((match = secretRegex.exec(src)) !== null) {\n      ocorrencias.push(criarOcorrencia({\n        tipo: 'azure-pipelines-secret-hardcoded',\n        nivel: 'erro',\n        mensagem: `Potencial segredo hardcoded detectado na propriedade '${match[1]}'`,\n        relPath,\n        linha: 1,\n        sugestao: 'Use Azure Key Vault ou variáveis de biblioteca com $(NOME_DA_VARIAVEL)',\n      }));\n    }\n\n    // 4. Comandos perigosos\n    if (/bash:\\s*curl.*\\|\\s*bash/i.test(src)) {\n      ocorrencias.push(criarOcorrencia({\n        tipo: 'azure-pipelines-dangerous-curl',\n        nivel: 'erro',\n        mensagem: 'Padrão \"curl | bash\" detectado',\n        relPath,\n        linha: 1,\n        sugestao: 'Baixe o script, valide o checksum e execute localmente para evitar Remote Code Execution',\n      }));\n    }\n\n    // 5. Checkout token configuration\n    if (/checkout:\\s*self/i.test(src) || /checkout:\\s*[a-z]/i.test(src)) {\n      const hasToken = /persistCredentials|persist-credentials/i.test(src);\n      if (!hasToken) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'azure-pipelines-missing-checkout-token',\n          nivel: 'aviso',\n          mensagem: messages.RelatorioAzureMensagens.missingCheckoutToken,\n          relPath,\n          linha: 1,\n          sugestao: messages.RelatorioAzureMensagens.missingCheckoutTokenSugestao,\n        }));\n      }\n    }\n\n    // 6. Inline secrets in scripts\n    for (const pattern of SECRET_PATTERNS) {\n      const secretMatch = pattern.exec(src);\n      if (secretMatch) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'azure-pipelines-inline-secret',\n          nivel: 'erro',\n          mensagem: messages.RelatorioAzureMensagens.scriptWithInlineSecrets,\n          relPath,\n          linha: 1,\n          sugestao: messages.RelatorioAzureMensagens.scriptWithInlineSecretsSugestao,\n        }));\n      }\n    }\n\n    // 7. Environment approval gates\n    if (/environment:/i.test(src)) {\n      const hasApproval = /approvals?|approval|reviewers?/i.test(src);\n      if (!hasApproval) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'azure-pipelines-missing-approval-gate',\n          nivel: 'aviso',\n          mensagem: messages.RelatorioAzureMensagens.missingApprovalGate,\n          relPath,\n          linha: 1,\n          sugestao: messages.RelatorioAzureMensagens.missingApprovalGateSugestao,\n        }));\n      }\n    }\n\n    // 8. Environment without reviewers\n    const envBlocks = src.match(/environment:\\s*[^\\n]+/gi);\n    if (envBlocks) {\n      for (const envBlock of envBlocks) {\n        if (!/reviewers?/i.test(envBlock)) {\n          ocorrencias.push(criarOcorrencia({\n            tipo: 'azure-pipelines-environment-no-reviewers',\n            nivel: 'aviso',\n            mensagem: messages.RelatorioAzureMensagens.environmentWithoutReviewers,\n            relPath,\n            linha: 1,\n            sugestao: messages.RelatorioAzureMensagens.environmentWithoutReviewersSugestao,\n          }));\n        }\n      }\n    }\n\n    // 9. Variable injection safety\n    if (/\\$\\s*\\(/i.test(src) && /script:|bash:|powershell:|pwsh:/i.test(src)) {\n      const unsafeInjection = /script:.*\\$\\s*\\(/i.test(src) || /bash:.*\\$\\s*\\(/i.test(src) || /powershell:.*\\$\\s*\\(/i.test(src) || /pwsh:.*\\$\\s*\\(/i.test(src);\n      if (unsafeInjection) {\n        ocorrencias.push(criarOcorrencia({\n          tipo: 'azure-pipelines-unsafe-variable-injection',\n          nivel: 'aviso',\n          mensagem: messages.RelatorioAzureMensagens.unsafeVariableInjection,\n          relPath,\n          linha: 1,\n          sugestao: messages.RelatorioAzureMensagens.unsafeVariableInjectionSugestao,\n        }));\n      }\n    }\n\n    // 10. Secret variable detection in plain text\n    const variableLines = src.match(/^\\s*variables\\s*:\\s*$/im);\n    if (variableLines) {\n      const varSection = src.slice(src.indexOf('variables:'));\n      const secretVars = varSection.match(/([a-zA-Z_]\\w*)\\s*:\\s*['\"][^'\"]+['\"]/g);\n      if (secretVars) {\n        for (const sv of secretVars) {\n          const varName = sv.split(':')[0].trim();\n          if (/(password|token|secret|key|connection)/i.test(varName)) {\n            ocorrencias.push(criarOcorrencia({\n              tipo: 'azure-pipelines-secret-variable-plaintext',\n              nivel: 'erro',\n              mensagem: `Variável '${varName}' definida em texto plano na seção variables`,\n              relPath,\n              linha: 1,\n              sugestao: 'Use um grupo de variáveis com proteção de segredo ou referencie como $(varName)',\n            }));\n          }\n        }\n      }\n    }\n\n    return ocorrencias;\n  }\n};\n"]}

package/dist/analysts/azure-pipelines/detectors/detector-azure-structure.d.ts

@@ -0,0 +1,3 @@
+import type { Analista } from '../../../types/index.js';
+export declare const detectorAzureEstrutura: Analista;
+//# sourceMappingURL=detector-azure-structure.d.ts.map

package/dist/analysts/azure-pipelines/detectors/detector-azure-structure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector-azure-structure.d.ts","sourceRoot":"","sources":["../../../../src/analysts/azure-pipelines/detectors/detector-azure-structure.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAc,MAAM,GAAG,CAAC;AAG9C,eAAO,MAAM,sBAAsB,EAAE,QA8NpC,CAAC"}