@noctcore/lint-meta-rules 0.4.2 → 0.6.0

package/README.md

@@ -45,7 +45,8 @@ over the whole catalog.
 13 nightcore lint-meta rules are ported as 12 factories — nightcore's `web-file-size-ratchet` and
 `engine-file-size-ratchet` were byte-identical logic and collapse into a single
 `createFileSizeRatchetRule` (instantiated once per capped area). Five CI-hygiene rules (category
-`ci`) are ported from a production NestJS + Vite monorepo, one factory each, for 17 factories in all.
+`ci`) are ported from a production NestJS + Vite monorepo, one factory each, and two GitHub Actions
+security rules (also `ci`) are written for this catalog, for 19 factories in all.
 
 | Factory | Source rule(s) | Category | What it enforces |
 | --- | --- | --- | --- |
@@ -63,6 +64,8 @@ over the whole catalog.
 | [`createTestRunnerSegregationRule`](./docs/rules/test-runner-segregation.md) | `test-runner-segregation` | testing | Bun-side and foreign-side test runners are never mixed within a package. |
 | [`createGithubActionsShaPinnedRule`](./docs/rules/github-actions-sha-pinned.md) | `github-actions-sha-pinned` | ci | Workflow `uses:` refs are pinned to a full commit SHA with a `# vN` comment. |
 | [`createGithubActionsRunnerPinnedRule`](./docs/rules/github-actions-runner-pinned.md) | `github-actions-runner-pinned` | ci | Workflow jobs run on a named runner image, never a `*-latest` label. |
+| [`createGithubActionsNoTemplateInjectionRule`](./docs/rules/github-actions-no-template-injection.md) | `github-actions-no-template-injection` | ci | `run:` and github-script bodies never expand attacker-controllable `${{ }}` context (issue/PR titles, comments, branch names). |
+| [`createGithubActionsLeastPrivilegePermissionsRule`](./docs/rules/github-actions-least-privilege-permissions.md) | `github-actions-least-privilege-permissions` | ci | A workflow's top-level `permissions:` exists, is not `write-all`/`read-all`, and grants no write. |
 | [`createServiceImageDigestPinRule`](./docs/rules/service-image-digest-pin.md) | `service-image-digest-pin` | ci | Workflow service/container images and compose images are pinned by `@sha256:` digest. |
 | [`createDockerfileBaseImageDigestPinRule`](./docs/rules/dockerfile-base-image-digest-pin.md) | `dockerfile-base-image-digest-pin` | ci | Dockerfile `FROM` base images are pinned by `@sha256:` digest. |
 | [`createSecurityScannerVersionParityRule`](./docs/rules/security-scanner-version-parity.md) | `security-scanner-version-parity` | ci | CI and the local pre-push hook pin the same secret-scanner version, and the hook checks it at run time. |
@@ -103,3 +106,27 @@ needs the optional peer `eslint`. Neither is in `RULE_FACTORIES`: both need the
 | --- | --- | --- |
 | [`createTenantModelRegistryParityRule`](./docs/rules/tenant-model-registry-parity.md) | config | Every tenant-bearing schema model is scoped at runtime or exempt with a reason, and the tenant lint rules resolve with exactly that registry. |
 | [`createPrismaMethodSurfaceRule`](./docs/rules/prisma-method-surface.md) | config | The reads and writes the rules police are exactly the generated client's delegate methods, so a Prisma upgrade cannot add an unguarded one. |
+
+### `@noctcore/lint-meta-rules/session`
+
+Fences around the one seam that turns an authenticated principal into a session. Each rule is inert
+until you name that seam: the method that mints, the gate in front of it, the files allowed to call it,
+the landings a sign-in can end in. None is in `RULE_FACTORIES`. They load nothing beyond the harness
+contract. Ported from a production NestJS app, where each one exists because its bug shipped once.
+
+| Factory | Category | What it enforces |
+| --- | --- | --- |
+| [`createSessionMintCallersRule`](./docs/rules/session-mint-callers.md) | source-text | The method that mints a session is called only from allowlisted files, so a new sign-in entry point cannot skip the gate in front of it. |
+| [`createSessionKindStampedRule`](./docs/rules/session-kind-stamped.md) | source-text | Every mint stamps the principal kind onto the session, or sits in an allowlisted, provably single-kind flow. |
+| [`createSessionEpochCapturedRule`](./docs/rules/session-epoch-captured.md) | source-text | Every call into the sign-in seam passes the revocation epoch captured before the credential was read. |
+| [`createSessionLandingDeclaredRule`](./docs/rules/session-landing-declared.md) | source-text | Every file that opens a door into a session declares its landing, and a door whose landing demands a return shape has it. |
+
+### `@noctcore/lint-meta-rules/trpc`
+
+Cross-tree checks between tRPC routers and the clients that call them. The decorator shape defaults to
+`nestjs-trpc`'s; the rule is inert until you name the middleware and the two trees. Not in
+`RULE_FACTORIES`.
+
+| Factory | Category | What it enforces |
+| --- | --- | --- |
+| [`createIdempotencyKeyParityRule`](./docs/rules/idempotency-key-parity.md) | source-text | A procedure guarded by an idempotency middleware has a client caller that sends the key, or no client caller at all. |

package/dist/{chunk-Z7TXSZR4.js → chunk-OYFQKSJN.js}

@@ -47,6 +47,13 @@ function unquote(value) {
 function anywhereGlobs(baseNames) {
   return baseNames.flatMap((name) => [`**/${name}`, `**/.*/**/${name}`]);
 }
+function readSourceText(read, rel) {
+  try {
+    return read(rel);
+  } catch {
+    return null;
+  }
+}
 
 export {
   dirOf,
@@ -59,5 +66,6 @@ export {
   globFiles,
   stripYamlComment,
   unquote,
-  anywhereGlobs
+  anywhereGlobs,
+  readSourceText
 };

package/dist/i18n.js

@@ -2,7 +2,7 @@ import {
   DEFAULT_SKIP_DIRS,
   escapeRegExp,
   globFiles
-} from "./chunk-Z7TXSZR4.js";
+} from "./chunk-OYFQKSJN.js";
 
 // src/i18n/translation-dead-keys.ts
 import path from "path";

package/dist/index.cjs

@@ -28,6 +28,8 @@ __export(index_exports, {
   createCanonicalHelpersSingleHomeRule: () => createCanonicalHelpersSingleHomeRule,
   createDockerfileBaseImageDigestPinRule: () => createDockerfileBaseImageDigestPinRule,
   createFileSizeRatchetRule: () => createFileSizeRatchetRule,
+  createGithubActionsLeastPrivilegePermissionsRule: () => createGithubActionsLeastPrivilegePermissionsRule,
+  createGithubActionsNoTemplateInjectionRule: () => createGithubActionsNoTemplateInjectionRule,
   createGithubActionsRunnerPinnedRule: () => createGithubActionsRunnerPinnedRule,
   createGithubActionsShaPinnedRule: () => createGithubActionsShaPinnedRule,
   createLayerRankRule: () => createLayerRankRule,
@@ -326,8 +328,293 @@ function createFileSizeRatchetRule(options = {}) {
   };
 }
 
+// src/rules/github-actions-least-privilege-permissions.ts
+var RULE_ID2 = "github-actions-least-privilege-permissions";
+var TOP_KEY = /^([\w-]+):\s*(.*)$/u;
+var SCOPE_ENTRY = /^\s*['"]?([\w-]+)['"]?:\s*['"]?([\w-]+)['"]?\s*$/u;
+function indentOf(line) {
+  return /^\s*/u.exec(line)?.[0].length ?? 0;
+}
+function isContent(line) {
+  const trimmed = line.trim();
+  return trimmed !== "" && !trimmed.startsWith("#");
+}
+function topLevelKeys(lines) {
+  const keys = [];
+  lines.forEach((line, index) => {
+    const match = TOP_KEY.exec(line);
+    if (match === null) return;
+    keys.push({ key: unquote(match[1] ?? ""), value: stripYamlComment(match[2] ?? "").trim(), index });
+  });
+  return keys;
+}
+function blockOf(lines, index) {
+  const block = [];
+  for (let j = index + 1; j < lines.length; j += 1) {
+    const line = lines[j] ?? "";
+    if (!isContent(line)) continue;
+    if (indentOf(line) === 0) break;
+    block.push({ text: stripYamlComment(line), index: j });
+  }
+  return block;
+}
+function scopeEntries(lines, permissions) {
+  if (permissions.value.startsWith("{")) {
+    return permissions.value.replace(/^\{|\}$/gu, "").split(",").map((pair) => SCOPE_ENTRY.exec(pair)).filter((match) => match !== null).map((match) => ({ scope: match[1] ?? "", level: match[2] ?? "", line: permissions.index + 1 }));
+  }
+  return blockOf(lines, permissions.index).flatMap(({ text, index }) => {
+    const match = SCOPE_ENTRY.exec(text);
+    return match === null ? [] : [{ scope: match[1] ?? "", level: match[2] ?? "", line: index + 1 }];
+  });
+}
+function jobsWithoutPermissions(lines, jobs) {
+  const block = blockOf(lines, jobs.index);
+  const jobColumn = indentOf(block[0]?.text ?? "");
+  const missing = [];
+  let current;
+  let keyColumn = -1;
+  const settle = () => {
+    if (current !== void 0 && !current.hasPermissions) missing.push(current.name);
+  };
+  for (const { text } of block) {
+    const column = indentOf(text);
+    if (column === jobColumn) {
+      settle();
+      current = { name: unquote(text.trim().replace(/:.*$/u, "")), hasPermissions: false };
+      keyColumn = -1;
+      continue;
+    }
+    if (current === void 0 || column < jobColumn) continue;
+    if (keyColumn === -1) keyColumn = column;
+    if (column === keyColumn && /^\s*permissions:/u.test(text)) current.hasPermissions = true;
+  }
+  settle();
+  return missing;
+}
+function checkWorkflowPermissions(file, text, allowTopLevelWrite = []) {
+  const lines = text.split("\n");
+  const keys = topLevelKeys(lines);
+  const permissions = keys.find((entry) => entry.key === "permissions");
+  const report = (line, message) => ({
+    file,
+    rule: RULE_ID2,
+    message: `line ${line}: ${message}`,
+    line
+  });
+  if (permissions === void 0) {
+    const jobs = keys.find((entry) => entry.key === "jobs");
+    const missing = jobs === void 0 ? [] : jobsWithoutPermissions(lines, jobs);
+    if (missing.length === 0) return [];
+    return [
+      report(
+        1,
+        `no top-level \`permissions:\`, so ${missing.map((job) => `\`${job}\``).join(", ")} ${missing.length === 1 ? "runs" : "run"} with the repository's default token, which can be read-write. Add \`permissions: { contents: read }\` at the top and grant writes on the job that needs them.`
+      )
+    ];
+  }
+  const shorthand = unquote(permissions.value);
+  if (shorthand === "write-all" || shorthand === "read-all") {
+    return [
+      report(
+        permissions.index + 1,
+        `top-level \`permissions: ${shorthand}\` grants every scope to every job. List only the scopes the workflow reads (for example \`contents: read\`) and grant writes on the job that needs them.`
+      )
+    ];
+  }
+  const allowed = new Set(allowTopLevelWrite);
+  return scopeEntries(lines, permissions).filter(({ scope, level }) => level === "write" && !allowed.has(scope)).map(
+    ({ scope, line }) => report(
+      line,
+      `top-level \`permissions\` grants \`${scope}: write\` to every job. Move it to the job that needs it and keep the top level read-only.`
+    )
+  );
+}
+function createGithubActionsLeastPrivilegePermissionsRule(options = {}) {
+  const workflowGlobs = options.workflowGlobs ?? DEFAULT_WORKFLOW_GLOBS;
+  const allowTopLevelWrite = options.allowTopLevelWrite ?? [];
+  const ciCritical = options.ciCritical ?? true;
+  return {
+    id: RULE_ID2,
+    category: "ci",
+    ciCritical,
+    description: "GitHub Actions workflows declare a read-only top-level `permissions:` (no `write-all`/`read-all`, no `<scope>: write`); writes go on the job that needs them.",
+    run(ctx) {
+      return globFiles((p) => ctx.glob(p), workflowGlobs).flatMap(
+        (file) => checkWorkflowPermissions(file, ctx.read(file) ?? "", allowTopLevelWrite)
+      );
+    }
+  };
+}
+
+// src/rules/github-actions-no-template-injection.ts
+var RULE_ID3 = "github-actions-no-template-injection";
+var DEFAULT_ACTION_GLOBS = anywhereGlobs(["action.yml", "action.yaml"]);
+var EVENT = String.raw`(?<![\w.])github\.event\.`;
+var ANY_ITEM = String.raw`(?:\.\*|\[\d+\])`;
+var TAINTED_CONTEXTS = [
+  new RegExp(String.raw`${EVENT}(?:issue|pull_request|discussion)\.(?:title|body)\b`, "u"),
+  new RegExp(String.raw`${EVENT}pull_request\.head\.(?:ref|label)\b`, "u"),
+  new RegExp(String.raw`${EVENT}(?:comment|review|review_comment)\.body\b`, "u"),
+  new RegExp(String.raw`${EVENT}pages${ANY_ITEM}\.page_name\b`, "u"),
+  new RegExp(String.raw`${EVENT}commits${ANY_ITEM}\.(?:message|author|committer)\b`, "u"),
+  new RegExp(String.raw`${EVENT}head_commit\.(?:message|author|committer)\b`, "u"),
+  new RegExp(String.raw`${EVENT}workflow_run\.head_branch\b`, "u"),
+  new RegExp(String.raw`${EVENT}workflow_run\.head_commit\.(?:message|author|committer)\b`, "u"),
+  /(?<![\w.])github\.head_ref\b/u
+];
+var INPUT_CONTEXT = /(?<![\w.])(?:github\.event\.)?inputs\.([\w-]+)/gu;
+var STEP_OUTPUT_CONTEXT = /(?<![\w.])steps\.[\w-]+\.outputs\.[\w-]+/u;
+var SAFE_INPUT_TYPES = /* @__PURE__ */ new Set(["boolean", "number", "choice"]);
+var EXPRESSION = /\$\{\{(.*?)\}\}/gu;
+var SCRIPT_KEY = /^(\s*)(-\s+)?(run|script):(?:\s+(.*))?$/u;
+var BLOCK_INDICATOR = /^[|>][-+0-9]*\s*(?:#.*)?$/u;
+var MAPPING_LINE = /^\s*[\w-]+:(?:\s|$)/u;
+var GITHUB_SCRIPT_USES = /^\s*(?:-\s+)?uses:\s*['"]?actions\/github-script@/u;
+function indentOf2(line) {
+  return /^\s*/u.exec(line)?.[0].length ?? 0;
+}
+function isContent2(line) {
+  const trimmed = line.trim();
+  return trimmed !== "" && !trimmed.startsWith("#");
+}
+function parentOf(lines, index, column) {
+  for (let j = index - 1; j >= 0; j -= 1) {
+    const line = lines[j] ?? "";
+    if (isContent2(line) && indentOf2(line) < column) return j;
+  }
+  return -1;
+}
+function isGithubScriptStep(lines, withIndex) {
+  const stepStart = parentOf(lines, withIndex, indentOf2(lines[withIndex] ?? ""));
+  const stepLine = lines[stepStart] ?? "";
+  if (!stepLine.trimStart().startsWith("-")) return false;
+  const dashColumn = indentOf2(stepLine);
+  for (let j = stepStart; j < lines.length; j += 1) {
+    const line = lines[j] ?? "";
+    if (j > stepStart && isContent2(line) && indentOf2(line) <= dashColumn) break;
+    if (GITHUB_SCRIPT_USES.test(line)) return true;
+  }
+  return false;
+}
+function safeInputNames(lines) {
+  const safe = /* @__PURE__ */ new Set();
+  lines.forEach((line, index) => {
+    if (!/^\s*inputs:\s*(?:#.*)?$/u.test(line)) return;
+    const column = indentOf2(line);
+    let nameColumn = -1;
+    let name = "";
+    for (const child of lines.slice(index + 1)) {
+      if (!isContent2(child)) continue;
+      const childColumn = indentOf2(child);
+      if (childColumn <= column) break;
+      if (nameColumn === -1) nameColumn = childColumn;
+      if (childColumn === nameColumn) {
+        name = /^\s*['"]?([\w-]+)['"]?:/u.exec(child)?.[1] ?? "";
+        continue;
+      }
+      const type = /^\s*type:\s*['"]?(\w+)/u.exec(stripYamlComment(child))?.[1];
+      if (type !== void 0 && SAFE_INPUT_TYPES.has(type) && name !== "") safe.add(name);
+    }
+  });
+  return safe;
+}
+function scriptLines(lines, index, keyColumn) {
+  const inline = SCRIPT_KEY.exec(lines[index] ?? "")?.[4] ?? "";
+  const block = BLOCK_INDICATOR.test(inline.trim());
+  const quoted = /^['"]/u.test(inline.trim());
+  const keep = (text) => block || quoted ? text : stripYamlComment(text);
+  const collected = block ? [] : [{ line: index + 1, text: keep(inline) }];
+  for (let j = index + 1; j < lines.length; j += 1) {
+    const line = lines[j] ?? "";
+    if (line.trim() !== "" && indentOf2(line) <= keyColumn) break;
+    collected.push({ line: j + 1, text: keep(line) });
+  }
+  const first = collected.find((entry) => entry.text.trim() !== "");
+  if (inline.trim() === "" && first !== void 0 && MAPPING_LINE.test(first.text)) return [];
+  return collected;
+}
+function taintedContexts(expression, checkInputs, checkStepOutputs, safeInputs) {
+  const found = [];
+  for (const pattern of TAINTED_CONTEXTS) {
+    const match = pattern.exec(expression);
+    if (match !== null) found.push(match[0]);
+  }
+  if (checkInputs) {
+    for (const match of expression.matchAll(INPUT_CONTEXT)) {
+      if (!safeInputs.has(match[1] ?? "")) found.push(match[0]);
+    }
+  }
+  if (checkStepOutputs) {
+    const match = STEP_OUTPUT_CONTEXT.exec(expression);
+    if (match !== null) found.push(match[0]);
+  }
+  return found;
+}
+function checkWorkflowTemplateInjection(file, text, options = {}) {
+  const checkInputs = options.checkInputs ?? true;
+  const checkStepOutputs = options.checkStepOutputs ?? false;
+  const lines = text.split("\n");
+  const safeInputs = checkInputs ? safeInputNames(lines) : /* @__PURE__ */ new Set();
+  const violations = [];
+  let skipThrough = -1;
+  lines.forEach((line, index) => {
+    const match = index > skipThrough ? SCRIPT_KEY.exec(line) : null;
+    if (match === null) return;
+    const keyColumn = (match[1]?.length ?? 0) + (match[2]?.length ?? 0);
+    const key = match[3] ?? "run";
+    if (key === "script") {
+      const parent = parentOf(lines, index, keyColumn);
+      if (!/^\s*with:\s*(?:#.*)?$/u.test(lines[parent] ?? "")) return;
+      if (!isGithubScriptStep(lines, parent)) return;
+    }
+    const where = key === "run" ? "`run:` script" : "`actions/github-script` `script:`";
+    const script = scriptLines(lines, index, keyColumn);
+    skipThrough = (script[script.length - 1]?.line ?? index + 1) - 1;
+    for (const entry of script) {
+      for (const expression of entry.text.matchAll(EXPRESSION)) {
+        const contexts = taintedContexts(
+          expression[1] ?? "",
+          checkInputs,
+          checkStepOutputs,
+          safeInputs
+        );
+        if (contexts.length === 0) continue;
+        violations.push({
+          file,
+          rule: RULE_ID3,
+          message: `line ${entry.line}: \`${expression[0]}\` expands attacker-controllable \`${contexts.join("`, `")}\` into a ${where}, where it runs as code. Pass it through \`env:\` (for example \`VALUE: ${expression[0]}\`) and read \`"$VALUE"\` instead.`,
+          line: entry.line
+        });
+      }
+    }
+  });
+  return violations;
+}
+function createGithubActionsNoTemplateInjectionRule(options = {}) {
+  const workflowGlobs = options.workflowGlobs ?? DEFAULT_WORKFLOW_GLOBS;
+  const actionGlobs = options.actionGlobs ?? DEFAULT_ACTION_GLOBS;
+  const skipDirs = options.skipDirs ?? DEFAULT_SKIP_DIRS;
+  const ciCritical = options.ciCritical ?? true;
+  return {
+    id: RULE_ID3,
+    category: "ci",
+    ciCritical,
+    description: "GitHub Actions `run:` and github-script bodies never expand attacker-controllable `${{ }}` context (issue/PR titles, comments, branch names); pass it through `env:` instead.",
+    run(ctx) {
+      const files = globFiles(
+        (p) => ctx.glob(p),
+        [...workflowGlobs, ...actionGlobs],
+        skipDirs
+      );
+      return files.flatMap(
+        (file) => checkWorkflowTemplateInjection(file, ctx.read(file) ?? "", options)
+      );
+    }
+  };
+}
+
 // src/rules/github-actions-runner-pinned.ts
-var RULE_ID2 = "github-actions-runner-pinned";
+var RULE_ID4 = "github-actions-runner-pinned";
 var RUNS_ON = /^(\s*)runs-on:\s*(.*)$/u;
 var DEFAULT_FLOATING_LABEL = /^[\w.-]+-latest$/u;
 function runnerLabels(lines, start, indent) {
@@ -359,7 +646,7 @@ function checkWorkflowRunnersPinned(file, text, floatingLabel = DEFAULT_FLOATING
       if (floatingLabel.test(label)) {
         violations.push({
           file,
-          rule: RULE_ID2,
+          rule: RULE_ID4,
           message: `line ${index + 1}: \`runs-on\` uses the floating runner label "${label}". Pin a named image (for example \`ubuntu-24.04\`) so a runner image change is a reviewed diff.`,
           line: index + 1
         });
@@ -373,7 +660,7 @@ function createGithubActionsRunnerPinnedRule(options = {}) {
   const floatingLabel = options.floatingLabel ?? DEFAULT_FLOATING_LABEL;
   const ciCritical = options.ciCritical ?? true;
   return {
-    id: RULE_ID2,
+    id: RULE_ID4,
     category: "ci",
     ciCritical,
     description: "GitHub Actions jobs must run on a pinned runner image (for example ubuntu-24.04), never a *-latest label.",
@@ -386,7 +673,7 @@ function createGithubActionsRunnerPinnedRule(options = {}) {
 }
 
 // src/rules/github-actions-sha-pinned.ts
-var RULE_ID3 = "github-actions-sha-pinned";
+var RULE_ID5 = "github-actions-sha-pinned";
 var USES_LINE = /^\s*(?:-\s+)?uses:\s*['"]?([^\s'"#]+)['"]?\s*(#.*)?$/u;
 var FULL_SHA = /^[0-9a-f]{40}$/u;
 var DOCKER_DIGEST = /@sha256:[0-9a-f]{64}$/u;
@@ -401,7 +688,7 @@ function checkWorkflowActionsPinned(file, text) {
     }
     const where = `line ${index + 1}`;
     const report = (message) => {
-      violations.push({ file, rule: RULE_ID3, message, line: index + 1 });
+      violations.push({ file, rule: RULE_ID5, message, line: index + 1 });
     };
     if (ref.startsWith("docker://")) {
       if (!DOCKER_DIGEST.test(ref)) {
@@ -429,7 +716,7 @@ function createGithubActionsShaPinnedRule(options = {}) {
   const workflowGlobs = options.workflowGlobs ?? DEFAULT_WORKFLOW_GLOBS;
   const ciCritical = options.ciCritical ?? true;
   return {
-    id: RULE_ID3,
+    id: RULE_ID5,
     category: "ci",
     ciCritical,
     description: "GitHub Actions `uses:` refs must be pinned to a 40-character commit SHA with a `# vN` comment (local ./ actions exempt).",
@@ -654,7 +941,7 @@ function createPackageShapeRule(options = {}) {
 }
 
 // src/rules/security-scanner-version-parity.ts
-var RULE_ID4 = "security-scanner-version-parity";
+var RULE_ID6 = "security-scanner-version-parity";
 function createSecurityScannerVersionParityRule(options = {}) {
   const scanner = options.scanner ?? "gitleaks";
   const versionVariable = options.versionVariable ?? "GITLEAKS_VERSION";
@@ -679,7 +966,7 @@ function createSecurityScannerVersionParityRule(options = {}) {
   const runtimeCheck = new RegExp(`\\b${name}\\s+version\\b`, "u");
   const mentionsScanner = new RegExp(name, "iu");
   return {
-    id: RULE_ID4,
+    id: RULE_ID6,
     category: "ci",
     ciCritical,
     description: `The ${scanner} version pinned in the workflows must equal the one in ${hookFile}, and the hook must compare a native ${scanner} against it at run time.`,
@@ -698,7 +985,7 @@ function createSecurityScannerVersionParityRule(options = {}) {
       }
       const violations = [];
       const report = (file, message) => {
-        violations.push({ file, rule: RULE_ID4, message });
+        violations.push({ file, rule: RULE_ID6, message });
       };
       if (ciVersions.size > 1) {
         report(
@@ -751,7 +1038,7 @@ function createSecurityScannerVersionParityRule(options = {}) {
 }
 
 // src/rules/service-image-digest-pin.ts
-var RULE_ID5 = "service-image-digest-pin";
+var RULE_ID7 = "service-image-digest-pin";
 var DIGEST2 = /@sha256:[0-9a-f]{64}$/u;
 var KEY_LINE = /^(\s*)(?:-\s+)?([\w-]+):\s*(.*)$/u;
 var DEFAULT_COMPOSE_GLOBS = anywhereGlobs(
@@ -759,7 +1046,7 @@ var DEFAULT_COMPOSE_GLOBS = anywhereGlobs(
     (stem) => ["", ".*", "-*"].flatMap((infix) => ["yml", "yaml"].map((ext) => `${stem}${infix}.${ext}`))
   )
 );
-function indentOf(line) {
+function indentOf3(line) {
   return /^\s*/u.exec(line)?.[0].length ?? 0;
 }
 function workflowImages(text) {
@@ -811,7 +1098,7 @@ function composeImages(text) {
     if (line.trim() === "" || line.trimStart().startsWith("#")) {
       continue;
     }
-    const indent = indentOf(line);
+    const indent = indentOf3(line);
     if (indent === 0) {
       break;
     }
@@ -845,7 +1132,7 @@ function violationsFor(file, images, allowUnpinned) {
     const reference = image.split("@")[0];
     return {
       file,
-      rule: RULE_ID5,
+      rule: RULE_ID7,
       message: `line ${line}: image "${image}" is not pinned by digest. Write \`${reference}@sha256:<digest>\` (resolve it with \`docker buildx imagetools inspect ${reference}\`) so CI and local runs use the same bytes.`,
       line
     };
@@ -858,7 +1145,7 @@ function createServiceImageDigestPinRule(options = {}) {
   const allowUnpinned = new Set(options.allowUnpinned ?? []);
   const ciCritical = options.ciCritical ?? true;
   return {
-    id: RULE_ID5,
+    id: RULE_ID7,
     category: "ci",
     ciCritical,
     description: "Workflow service and container images, and docker-compose images, must be pinned by `@sha256:` digest (a service that builds locally is exempt).",
@@ -1143,6 +1430,8 @@ var RULE_FACTORIES = {
   "canonical-helpers-single-home": createCanonicalHelpersSingleHomeRule,
   "dockerfile-base-image-digest-pin": createDockerfileBaseImageDigestPinRule,
   "file-size-ratchet": createFileSizeRatchetRule,
+  "github-actions-least-privilege-permissions": createGithubActionsLeastPrivilegePermissionsRule,
+  "github-actions-no-template-injection": createGithubActionsNoTemplateInjectionRule,
   "github-actions-runner-pinned": createGithubActionsRunnerPinnedRule,
   "github-actions-sha-pinned": createGithubActionsShaPinnedRule,
   "layer-rank": createLayerRankRule,
@@ -1171,6 +1460,8 @@ function createAllRules() {
   createCanonicalHelpersSingleHomeRule,
   createDockerfileBaseImageDigestPinRule,
   createFileSizeRatchetRule,
+  createGithubActionsLeastPrivilegePermissionsRule,
+  createGithubActionsNoTemplateInjectionRule,
   createGithubActionsRunnerPinnedRule,
   createGithubActionsShaPinnedRule,
   createLayerRankRule,

package/dist/index.d.cts

@@ -116,6 +116,46 @@ interface FileSizeRatchetOptions {
  */
 declare function createFileSizeRatchetRule(options?: FileSizeRatchetOptions): IMetaRule;
 
+/** Options for {@link createGithubActionsLeastPrivilegePermissionsRule}. */
+interface GithubActionsLeastPrivilegePermissionsOptions {
+    /** Globs of the workflow files to scan. Default `.github/workflows/*.y(a)ml`. */
+    readonly workflowGlobs?: readonly string[];
+    /**
+     * Scopes allowed at `write` in the top-level `permissions:` block (for example `contents` in a
+     * release workflow whose every job pushes). Default none.
+     */
+    readonly allowTopLevelWrite?: readonly string[];
+    /** Whether a violation fails CI. Default `true`. */
+    readonly ciCritical?: boolean;
+}
+/** A workflow's top-level `permissions:` exists, is not `*-all`, and grants no write. */
+declare function createGithubActionsLeastPrivilegePermissionsRule(options?: GithubActionsLeastPrivilegePermissionsOptions): IMetaRule;
+
+/** Options for {@link createGithubActionsNoTemplateInjectionRule}. */
+interface GithubActionsNoTemplateInjectionOptions {
+    /** Globs of the workflow files to scan. Default `.github/workflows/*.y(a)ml`. */
+    readonly workflowGlobs?: readonly string[];
+    /** Globs that find composite action metadata. Default `action.yml` / `action.yaml` at any depth. */
+    readonly actionGlobs?: readonly string[];
+    /** An action path with any of these segments is skipped. Default `node_modules`, `.git`, `dist`, `.turbo`, `coverage`. */
+    readonly skipDirs?: readonly string[];
+    /**
+     * Treat `inputs.<name>` (and `github.event.inputs.<name>`) as attacker-controlled. An input the
+     * same file declares with `type: boolean`, `number` or `choice` is still left alone: its value
+     * cannot carry a script. Default `true`.
+     */
+    readonly checkInputs?: boolean;
+    /**
+     * Treat `steps.<id>.outputs.<name>` as attacker-controlled. An output is only as tainted as
+     * whatever the step wrote into it, which the text cannot show. Default `false`.
+     */
+    readonly checkStepOutputs?: boolean;
+    /** Whether a violation fails CI. Default `true`. */
+    readonly ciCritical?: boolean;
+}
+/** No attacker-controllable `${{ }}` expression may be expanded into a `run:` or github-script body. */
+declare function createGithubActionsNoTemplateInjectionRule(options?: GithubActionsNoTemplateInjectionOptions): IMetaRule;
+
 /**
  * Options for {@link createGithubActionsRunnerPinnedRule}.
  *
@@ -499,6 +539,8 @@ declare const RULE_FACTORIES: {
     readonly 'canonical-helpers-single-home': typeof createCanonicalHelpersSingleHomeRule;
     readonly 'dockerfile-base-image-digest-pin': typeof createDockerfileBaseImageDigestPinRule;
     readonly 'file-size-ratchet': typeof createFileSizeRatchetRule;
+    readonly 'github-actions-least-privilege-permissions': typeof createGithubActionsLeastPrivilegePermissionsRule;
+    readonly 'github-actions-no-template-injection': typeof createGithubActionsNoTemplateInjectionRule;
     readonly 'github-actions-runner-pinned': typeof createGithubActionsRunnerPinnedRule;
     readonly 'github-actions-sha-pinned': typeof createGithubActionsShaPinnedRule;
     readonly 'layer-rank': typeof createLayerRankRule;
@@ -518,4 +560,4 @@ declare const RULE_IDS: (keyof typeof RULE_FACTORIES)[];
 /** Instantiate every catalog rule with its default options. */
 declare function createAllRules(): IMetaRule[];
 
-export { type AgentsDocPresenceOptions, type CanonicalHelpersSingleHomeOptions, type DockerfileBaseImageDigestPinOptions, type FileSizeRatchetOptions, type GithubActionsRunnerPinnedOptions, type GithubActionsShaPinnedOptions, type LayerRankOptions, type NoClonedComponentFoldersOptions, type NoWarnSeverityOptions, type PackageShapeOptions, RULE_FACTORIES, RULE_IDS, type SecurityScannerVersionParityOptions, type ServiceImageDigestPinOptions, type TestRunnerSegregationOptions, type TestSiblingEnforcementOptions, type TestWorkspaceEnrollmentOptions, type UiPrimitiveShapeOptions, type WorkspaceGraphParityOptions, countLines, createAgentsDocPresenceRule, createAllRules, createCanonicalHelpersSingleHomeRule, createDockerfileBaseImageDigestPinRule, createFileSizeRatchetRule, createGithubActionsRunnerPinnedRule, createGithubActionsShaPinnedRule, createLayerRankRule, createNoClonedComponentFoldersRule, createNoWarnSeverityRule, createPackageShapeRule, createSecurityScannerVersionParityRule, createServiceImageDigestPinRule, createTestRunnerSegregationRule, createTestSiblingEnforcementRule, createTestWorkspaceEnrollmentRule, createUiPrimitiveShapeRule, createWorkspaceGraphParityRule };
+export { type AgentsDocPresenceOptions, type CanonicalHelpersSingleHomeOptions, type DockerfileBaseImageDigestPinOptions, type FileSizeRatchetOptions, type GithubActionsLeastPrivilegePermissionsOptions, type GithubActionsNoTemplateInjectionOptions, type GithubActionsRunnerPinnedOptions, type GithubActionsShaPinnedOptions, type LayerRankOptions, type NoClonedComponentFoldersOptions, type NoWarnSeverityOptions, type PackageShapeOptions, RULE_FACTORIES, RULE_IDS, type SecurityScannerVersionParityOptions, type ServiceImageDigestPinOptions, type TestRunnerSegregationOptions, type TestSiblingEnforcementOptions, type TestWorkspaceEnrollmentOptions, type UiPrimitiveShapeOptions, type WorkspaceGraphParityOptions, countLines, createAgentsDocPresenceRule, createAllRules, createCanonicalHelpersSingleHomeRule, createDockerfileBaseImageDigestPinRule, createFileSizeRatchetRule, createGithubActionsLeastPrivilegePermissionsRule, createGithubActionsNoTemplateInjectionRule, createGithubActionsRunnerPinnedRule, createGithubActionsShaPinnedRule, createLayerRankRule, createNoClonedComponentFoldersRule, createNoWarnSeverityRule, createPackageShapeRule, createSecurityScannerVersionParityRule, createServiceImageDigestPinRule, createTestRunnerSegregationRule, createTestSiblingEnforcementRule, createTestWorkspaceEnrollmentRule, createUiPrimitiveShapeRule, createWorkspaceGraphParityRule };

package/dist/index.d.ts

@@ -116,6 +116,46 @@ interface FileSizeRatchetOptions {
  */
 declare function createFileSizeRatchetRule(options?: FileSizeRatchetOptions): IMetaRule;
 
+/** Options for {@link createGithubActionsLeastPrivilegePermissionsRule}. */
+interface GithubActionsLeastPrivilegePermissionsOptions {
+    /** Globs of the workflow files to scan. Default `.github/workflows/*.y(a)ml`. */
+    readonly workflowGlobs?: readonly string[];
+    /**
+     * Scopes allowed at `write` in the top-level `permissions:` block (for example `contents` in a
+     * release workflow whose every job pushes). Default none.
+     */
+    readonly allowTopLevelWrite?: readonly string[];
+    /** Whether a violation fails CI. Default `true`. */
+    readonly ciCritical?: boolean;
+}
+/** A workflow's top-level `permissions:` exists, is not `*-all`, and grants no write. */
+declare function createGithubActionsLeastPrivilegePermissionsRule(options?: GithubActionsLeastPrivilegePermissionsOptions): IMetaRule;
+
+/** Options for {@link createGithubActionsNoTemplateInjectionRule}. */
+interface GithubActionsNoTemplateInjectionOptions {
+    /** Globs of the workflow files to scan. Default `.github/workflows/*.y(a)ml`. */
+    readonly workflowGlobs?: readonly string[];
+    /** Globs that find composite action metadata. Default `action.yml` / `action.yaml` at any depth. */
+    readonly actionGlobs?: readonly string[];
+    /** An action path with any of these segments is skipped. Default `node_modules`, `.git`, `dist`, `.turbo`, `coverage`. */
+    readonly skipDirs?: readonly string[];
+    /**
+     * Treat `inputs.<name>` (and `github.event.inputs.<name>`) as attacker-controlled. An input the
+     * same file declares with `type: boolean`, `number` or `choice` is still left alone: its value
+     * cannot carry a script. Default `true`.
+     */
+    readonly checkInputs?: boolean;
+    /**
+     * Treat `steps.<id>.outputs.<name>` as attacker-controlled. An output is only as tainted as
+     * whatever the step wrote into it, which the text cannot show. Default `false`.
+     */
+    readonly checkStepOutputs?: boolean;
+    /** Whether a violation fails CI. Default `true`. */
+    readonly ciCritical?: boolean;
+}
+/** No attacker-controllable `${{ }}` expression may be expanded into a `run:` or github-script body. */
+declare function createGithubActionsNoTemplateInjectionRule(options?: GithubActionsNoTemplateInjectionOptions): IMetaRule;
+
 /**
  * Options for {@link createGithubActionsRunnerPinnedRule}.
  *
@@ -499,6 +539,8 @@ declare const RULE_FACTORIES: {
     readonly 'canonical-helpers-single-home': typeof createCanonicalHelpersSingleHomeRule;
     readonly 'dockerfile-base-image-digest-pin': typeof createDockerfileBaseImageDigestPinRule;
     readonly 'file-size-ratchet': typeof createFileSizeRatchetRule;
+    readonly 'github-actions-least-privilege-permissions': typeof createGithubActionsLeastPrivilegePermissionsRule;
+    readonly 'github-actions-no-template-injection': typeof createGithubActionsNoTemplateInjectionRule;
     readonly 'github-actions-runner-pinned': typeof createGithubActionsRunnerPinnedRule;
     readonly 'github-actions-sha-pinned': typeof createGithubActionsShaPinnedRule;
     readonly 'layer-rank': typeof createLayerRankRule;
@@ -518,4 +560,4 @@ declare const RULE_IDS: (keyof typeof RULE_FACTORIES)[];
 /** Instantiate every catalog rule with its default options. */
 declare function createAllRules(): IMetaRule[];
 
-export { type AgentsDocPresenceOptions, type CanonicalHelpersSingleHomeOptions, type DockerfileBaseImageDigestPinOptions, type FileSizeRatchetOptions, type GithubActionsRunnerPinnedOptions, type GithubActionsShaPinnedOptions, type LayerRankOptions, type NoClonedComponentFoldersOptions, type NoWarnSeverityOptions, type PackageShapeOptions, RULE_FACTORIES, RULE_IDS, type SecurityScannerVersionParityOptions, type ServiceImageDigestPinOptions, type TestRunnerSegregationOptions, type TestSiblingEnforcementOptions, type TestWorkspaceEnrollmentOptions, type UiPrimitiveShapeOptions, type WorkspaceGraphParityOptions, countLines, createAgentsDocPresenceRule, createAllRules, createCanonicalHelpersSingleHomeRule, createDockerfileBaseImageDigestPinRule, createFileSizeRatchetRule, createGithubActionsRunnerPinnedRule, createGithubActionsShaPinnedRule, createLayerRankRule, createNoClonedComponentFoldersRule, createNoWarnSeverityRule, createPackageShapeRule, createSecurityScannerVersionParityRule, createServiceImageDigestPinRule, createTestRunnerSegregationRule, createTestSiblingEnforcementRule, createTestWorkspaceEnrollmentRule, createUiPrimitiveShapeRule, createWorkspaceGraphParityRule };
+export { type AgentsDocPresenceOptions, type CanonicalHelpersSingleHomeOptions, type DockerfileBaseImageDigestPinOptions, type FileSizeRatchetOptions, type GithubActionsLeastPrivilegePermissionsOptions, type GithubActionsNoTemplateInjectionOptions, type GithubActionsRunnerPinnedOptions, type GithubActionsShaPinnedOptions, type LayerRankOptions, type NoClonedComponentFoldersOptions, type NoWarnSeverityOptions, type PackageShapeOptions, RULE_FACTORIES, RULE_IDS, type SecurityScannerVersionParityOptions, type ServiceImageDigestPinOptions, type TestRunnerSegregationOptions, type TestSiblingEnforcementOptions, type TestWorkspaceEnrollmentOptions, type UiPrimitiveShapeOptions, type WorkspaceGraphParityOptions, countLines, createAgentsDocPresenceRule, createAllRules, createCanonicalHelpersSingleHomeRule, createDockerfileBaseImageDigestPinRule, createFileSizeRatchetRule, createGithubActionsLeastPrivilegePermissionsRule, createGithubActionsNoTemplateInjectionRule, createGithubActionsRunnerPinnedRule, createGithubActionsShaPinnedRule, createLayerRankRule, createNoClonedComponentFoldersRule, createNoWarnSeverityRule, createPackageShapeRule, createSecurityScannerVersionParityRule, createServiceImageDigestPinRule, createTestRunnerSegregationRule, createTestSiblingEnforcementRule, createTestWorkspaceEnrollmentRule, createUiPrimitiveShapeRule, createWorkspaceGraphParityRule };