@ploaness/governance 1.2.0 → 1.4.0

package/dist/terraform-files.js

@@ -0,0 +1,50 @@
+// Identify OpenTofu and Terraform sources, and the analyzer configuration that would shadow the rules.
+//
+// The same shape as the container-file reader beside it: predicates over the working-tree inventory,
+// so the gate discovers what a repository actually tracks rather than reading a list somebody wrote
+// once. A `.tf` added later is analysed the day it appears rather than the day somebody remembers it.
+const basenameOf = (file) => file.slice(file.lastIndexOf('/') + 1);
+// `.tf` is the configuration and `.tfvars` carries the values a placeholder credential would sit in.
+// `.tf.json` is deliberately absent: it is JSON rather than HCL, so the text rules would misread it,
+// and the analyzer reads it anyway through the directory it is pointed at.
+const TERRAFORM_EXTENSIONS = ['.tf', '.tfvars'];
+/**
+ * Decide whether a path names an OpenTofu or Terraform source.
+ *
+ * An example file is not one. `terraform.tfvars.example` documents the variables an environment needs
+ * and is meant to carry placeholders, so reading it as configuration would report a project for the
+ * one file whose job is to hold the values it tells a reader to replace.
+ * @param file a repo-relative path.
+ * @returns true when the file is configuration the gate judges.
+ */
+export const isTerraformFile = (file) => TERRAFORM_EXTENSIONS.some((extension) => file.endsWith(extension));
+/**
+ * Every OpenTofu or Terraform source the repository tracks.
+ * @param tracked the repo-relative paths of the tracked files.
+ * @returns the sources, ordered so a report reads the same on every machine.
+ */
+export const terraformFilesIn = (tracked) => tracked
+    .filter((file) => isTerraformFile(file))
+    .toSorted((left, right) => left.localeCompare(right));
+// The names checkov reads on its own. A project that commits one can turn off the curated checks from
+// inside the tree the gate judges, which is the shadowing the harness refuses for every other analyzer.
+const CHECKOV_CONFIG_BASENAMES = new Set([
+    '.checkov.yaml',
+    '.checkov.yml',
+    '.checkov.json',
+]);
+/**
+ * Decide whether a path names a checkov configuration.
+ * @param file a repo-relative path.
+ * @returns true for a configuration checkov would read on its own, at any depth.
+ */
+export const isCheckovConfigFile = (file) => CHECKOV_CONFIG_BASENAMES.has(basenameOf(file));
+/**
+ * Every checkov configuration the repository tracks.
+ * @param tracked the repo-relative paths of the tracked files.
+ * @returns the configurations, ordered so a report reads the same on every machine.
+ */
+export const checkovConfigsIn = (tracked) => tracked
+    .filter((file) => isCheckovConfigFile(file))
+    .toSorted((left, right) => left.localeCompare(right));
+//# sourceMappingURL=terraform-files.js.map

package/dist/terraform-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terraform-files.js","sourceRoot":"","sources":["../src/terraform-files.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,EAAE;AACF,qGAAqG;AACrG,oGAAoG;AACpG,sGAAsG;AAEtG,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;AAElF,qGAAqG;AACrG,qGAAqG;AACrG,2EAA2E;AAC3E,MAAM,oBAAoB,GAAsB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;AAElE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAY,EAAW,EAAE,CACvD,oBAAoB,CAAC,IAAI,CAAC,CAAC,SAAiB,EAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;AAErF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAA0B,EAAqB,EAAE,CAChF,OAAO;KACJ,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;KACxD,QAAQ,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;AAEjF,sGAAsG;AACtG,wGAAwG;AACxG,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC;IAC5D,eAAe;IACf,cAAc;IACd,eAAe;CAChB,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAW,EAAE,CAC3D,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAA0B,EAAqB,EAAE,CAChF,OAAO;KACJ,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;KAC5D,QAAQ,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA"}

package/dist/terraform-policy.d.ts

@@ -0,0 +1,13 @@
+/** An infrastructure defect found in a project's own configuration. */
+export interface TerraformViolation {
+    readonly line: number;
+    readonly rule: string;
+    readonly reason: string;
+}
+/**
+ * Report every infrastructure defect a text reader can decide.
+ * @param source the file's text, as tracked.
+ * @returns one violation per defect, ordered by the line it sits on.
+ */
+export declare const findTerraformViolations: (source: string) => readonly TerraformViolation[];
+//# sourceMappingURL=terraform-policy.d.ts.map

package/dist/terraform-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terraform-policy.d.ts","sourceRoot":"","sources":["../src/terraform-policy.ts"],"names":[],"mappings":"AAiBA,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAySD;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,GAAI,QAAQ,MAAM,KAAG,SAAS,kBAAkB,EAcnF,CAAA"}

package/dist/terraform-policy.js

@@ -0,0 +1,261 @@
+// Infrastructure defects a text reader can decide on its own, and only those.
+//
+// Every rule here owns a question the analyzer beside it does not answer. Where checkov has a check,
+// checkov keeps it: one semantic rule has one owner, and a second opinion written as a regular
+// expression would be the weaker of the two. So `AdministratorAccess`, wildcard IAM actions and a
+// publicly reachable database are absent from this file deliberately - they are enabled as curated
+// checks instead, where the resource graph is understood rather than guessed at from one line.
+//
+// `0.0.0.0/0` is read in exactly one place: the standalone ingress rule resource, whose TYPE names its
+// direction. Everywhere else text cannot decide it. The same address is correct on egress and fatal on
+// ingress, and an `ingress` block or an `aws_security_group_rule` carries its direction in a nested
+// block or a sibling attribute that a line reader cannot tie to the address - so those forms stay
+// with the analyzer, which knows which side of the rule it is looking at. The standalone resource is
+// this file's because the analyzer does not read its idiomatic spelling at all, and its own SSH and RDP
+// checks read a rule naming another security group as its source as open to the world.
+import { stripComments } from './source-text.js';
+const FIRST_LINE = 1;
+// An argument assigned one literal value, bare or quoted, on its own line. Terraform accepts both
+// spellings of a boolean, and a quoted string is what the other values are.
+const assigned = (attribute, value) => new RegExp(String.raw `^[ \t]*${attribute}[ \t]*=[ \t]*"?${value}"?(?:[ \t]|$)`);
+// The Owner definition has one id in every Azure tenant, and a role assignment may name it by id
+// rather than by name.
+const AZURE_OWNER_DEFINITION = '8e3af657-a8ff-443c-a75c-2fe8c4bcb635';
+// Each rule refuses an explicit literal and never an absence, which is what keeps every one of them
+// free of false positives: a value that arrives through a variable or a reference never matches. The
+// first two arguments exist only where they destroy data, and checkov ships no check for either. The
+// last two stand in for checks that fail the rubric - `CKV_GCP_6` rejects the correct
+// `ENCRYPTED_ONLY`, `CKV_AZURE_3` and `CKV_AZURE_91` read only the argument names azurerm retired,
+// and every project-role check on Google Cloud also flags `viewer` or a documented deploy role,
+// while Azure has no check for an Owner assignment at all. A checkov check that fails the rubric
+// returns its question to text. The patterns are built once here rather than per line, so the scan
+// is one pass over the text.
+const FLAG_RULES = [
+    {
+        patterns: [assigned('force_destroy', 'true')],
+        rule: 'no-force-destroy',
+        reason: 'force_destroy lets a destroy remove a bucket or repository that still holds objects, so a ' +
+            'replacement-forcing edit deletes the data rather than failing - remove it, and empty the ' +
+            'store deliberately when it is genuinely meant to go',
+    },
+    {
+        patterns: [assigned('skip_final_snapshot', 'true')],
+        rule: 'no-skipped-final-snapshot',
+        reason: 'skip_final_snapshot leaves a deleted database with nothing to restore from, and a destroy ' +
+            'that was never meant to reach production is exactly when that snapshot is wanted - remove it ' +
+            'and let the final snapshot be taken',
+    },
+    {
+        patterns: [
+            assigned('role', 'roles/owner'),
+            assigned('role', 'roles/editor'),
+            assigned('role_definition_name', 'Owner'),
+            new RegExp(String.raw `^[ \t]*role_definition_id[ \t]*=[ \t]*"[^"]*${AZURE_OWNER_DEFINITION}"`),
+        ],
+        rule: 'no-administrative-role-grant',
+        reason: 'an administrative role is granted outright, which is every permission on everything in its ' +
+            'scope - grant the specific roles the principal needs, and no more',
+    },
+    {
+        patterns: [
+            assigned('ssl_mode', 'ALLOW_UNENCRYPTED_AND_ENCRYPTED'),
+            assigned('require_ssl', 'false'),
+            assigned('https_traffic_only_enabled', 'false'),
+            assigned('enable_https_traffic_only', 'false'),
+            assigned('non_ssl_port_enabled', 'true'),
+            assigned('enable_non_ssl_port', 'true'),
+        ],
+        rule: 'no-unencrypted-transport',
+        reason: 'the service explicitly accepts unencrypted connections - remove the argument or set its ' +
+            'encrypted-only value; every client the harness governs speaks TLS',
+    },
+];
+// A quoted assignment, whatever it names. WHICH names hold a credential is decided below rather than
+// inside the pattern: one alternation covering every spelling was unreadable and past the complexity
+// the lint budget allows, and it is the name's segments that carry the meaning anyway.
+const QUOTED_ASSIGNMENT = /^[ \t]*(?<name>\w+)[ \t]*=[ \t]*"(?<value>[^"]*)"/;
+// Read by the last `_`-segment of the name, the way the credential guard in `source-security.ts` reads
+// an identifier. `key` alone is excluded: an S3 object's `key` is a path, and reading it as a
+// credential would report every upload in the tree - so only a QUALIFIED key counts.
+const CREDENTIAL_WORDS = new Set([
+    'password',
+    'passphrase',
+    'secret',
+    'token',
+    'credential',
+    'credentials',
+]);
+const QUALIFIED_KEYS = new Set([
+    'api',
+    'access',
+    'secret',
+    'private',
+    'encryption',
+]);
+// A secret's CONTENT argument is named the other way round: `secret_string`, `secret_data` and
+// `secret_binary` are what a secret-store version holds, so the first segment carries the meaning and
+// the last says what shape the content takes. `secret_id` and `secret_arn` name a secret rather than
+// hold one, and stay outside.
+const SECRET_CONTENT = new Set(['string', 'data', 'binary', 'value']);
+const PENULTIMATE = -2;
+const isCredentialName = (name) => {
+    const segments = name.toLowerCase().split('_');
+    const first = segments.at(0) ?? '';
+    const last = segments.at(-1) ?? '';
+    if (last === 'key') {
+        return QUALIFIED_KEYS.has(segments.at(PENULTIMATE) ?? '');
+    }
+    return CREDENTIAL_WORDS.has(last) || (first === 'secret' && SECRET_CONTENT.has(last));
+};
+// What a placeholder looks like once punctuation and case stop mattering. An angle-bracketed value is
+// the other conventional spelling, and it needs no vocabulary.
+const PLACEHOLDER_VALUES = new Set([
+    'REPLACEME',
+    'CHANGEME',
+    'TODO',
+    'FIXME',
+    'XXX',
+    'PLACEHOLDER',
+    'TBD',
+    'YOURVALUEHERE',
+]);
+const isPlaceholder = (value) => {
+    if (value.startsWith('<') && value.endsWith('>')) {
+        return true;
+    }
+    return PLACEHOLDER_VALUES.has(value.toUpperCase().replaceAll(/[^A-Z0-9]/g, ''));
+};
+// An analyzer's own inline skip. Without this the curated checks are advisory: one comment turns the
+// flagship check off and the run still passes. gitleaks cannot see a placeholder either - it carries no
+// entropy - which is why the value rule above is here rather than left to the secret scan.
+const ANALYZER_SUPPRESSION = /#[ \t]*(?<analyzer>checkov:skip=|tfsec:ignore:|trivy:ignore:)/;
+const flagViolations = (code) => code.split('\n').flatMap((line, index) => FLAG_RULES.filter((flag) => flag.patterns.some((pattern) => pattern.test(line))).map((flag) => ({
+    line: index + FIRST_LINE,
+    rule: flag.rule,
+    reason: flag.reason,
+})));
+// The attribute a line leaves as a placeholder, or nothing. Separated from the walk below so each reads
+// as the one question it asks.
+const placeholderNameIn = (line) => {
+    const found = QUOTED_ASSIGNMENT.exec(line);
+    if (found === null) {
+        return undefined;
+    }
+    const name = found.groups?.['name'] ?? '';
+    const value = found.groups?.['value'] ?? '';
+    return isCredentialName(name) && isPlaceholder(value) ? name : undefined;
+};
+const placeholderViolations = (code) => code.split('\n').flatMap((line, index) => {
+    const name = placeholderNameIn(line);
+    return name === undefined
+        ? []
+        : [
+            {
+                line: index + FIRST_LINE,
+                rule: 'no-placeholder-secret',
+                reason: `${name} is set to a placeholder, so whatever it guards is guarded by a value written ` +
+                    'into the repository - supply it from a secret store, and let the configuration name ' +
+                    'the reference rather than the value',
+            },
+        ];
+});
+// Read from the RAW text, unlike every rule above: a comment is this rule's subject rather than
+// something to see past.
+const suppressionViolations = (source) => source.split('\n').flatMap((line, index) => {
+    const analyzer = ANALYZER_SUPPRESSION.exec(line)?.groups?.['analyzer'];
+    return analyzer === undefined
+        ? []
+        : [
+            {
+                line: index + FIRST_LINE,
+                rule: 'no-analyzer-suppression',
+                reason: `"${analyzer}" turns off a check this harness enabled, from inside the file the check ` +
+                    'judges - repair what the analyzer found, because a gate a project can switch off is ' +
+                    'not a gate',
+            },
+        ];
+});
+// The rule resource is read from its header to the next line that closes or opens a top-level block.
+// Formatted HCL closes a resource at column 0; unformatted HCL over-reads at worst the blank lines
+// before the next block, never the next block's attributes.
+const INGRESS_RULE_HEADER = /^[ \t]*resource[ \t]+"aws_vpc_security_group_ingress_rule"/;
+const BLOCK_BOUNDARY = /^(?:\}|(?:resource|data|module|variable|output|locals|provider|terraform)\b)/;
+const ANY_ADDRESS = /^[ \t]*cidr_ipv[46][ \t]*=[ \t]*"(?:0\.0\.0\.0\/0|::\/0)"/;
+const EVERY_PROTOCOL = /^[ \t]*ip_protocol[ \t]*=[ \t]*"?-1"?/;
+const PORT_EDGE = /^[ \t]*(?<edge>from_port|to_port)[ \t]*=[ \t]*(?<port>\d+)/;
+const SSH_PORT = 22;
+const RDP_PORT = 3389;
+const LAST_PORT = 65_535;
+const ingressRulesIn = (lines) => lines.flatMap((line, index) => {
+    if (!INGRESS_RULE_HEADER.test(line)) {
+        return [];
+    }
+    const rest = lines.slice(index + 1);
+    const end = rest.findIndex((candidate) => BLOCK_BOUNDARY.test(candidate));
+    return [{ line: index + FIRST_LINE, body: end === -1 ? rest : rest.slice(0, end) }];
+});
+const portRangeOf = (body) => {
+    const edges = new Map(body.flatMap((line) => {
+        const found = PORT_EDGE.exec(line);
+        return found === null
+            ? []
+            : [[found.groups?.['edge'] ?? '', Number(found.groups?.['port'] ?? '')]];
+    }));
+    const from = edges.get('from_port');
+    const to = edges.get('to_port');
+    return from === undefined || to === undefined ? undefined : { from, to };
+};
+const coversPort = (range, port) => range.from <= port && port <= range.to;
+// What a port range exposes when its source is every address, or nothing when its ports are ones a
+// public site legitimately opens.
+const exposureOfRange = (range) => {
+    if (range.from === 0 && range.to === LAST_PORT) {
+        return 'every port';
+    }
+    if (coversPort(range, SSH_PORT)) {
+        return 'SSH';
+    }
+    return coversPort(range, RDP_PORT) ? 'RDP' : undefined;
+};
+const exposureOf = (body) => {
+    if (!body.some((line) => ANY_ADDRESS.test(line))) {
+        return undefined;
+    }
+    if (body.some((line) => EVERY_PROTOCOL.test(line))) {
+        return 'every port';
+    }
+    const range = portRangeOf(body);
+    return range === undefined ? undefined : exposureOfRange(range);
+};
+const openIngressViolations = (code) => ingressRulesIn(code.split('\n')).flatMap((rule) => {
+    const exposure = exposureOf(rule.body);
+    return exposure === undefined
+        ? []
+        : [
+            {
+                line: rule.line,
+                rule: 'no-open-ingress',
+                reason: `an ingress rule admits ${exposure} from the whole internet - name the security ` +
+                    'group or address range that needs it as the source',
+            },
+        ];
+});
+/**
+ * Report every infrastructure defect a text reader can decide.
+ * @param source the file's text, as tracked.
+ * @returns one violation per defect, ordered by the line it sits on.
+ */
+export const findTerraformViolations = (source) => {
+    // `stripComments` covers the `//` and `/* */` forms HCL shares with the languages it was written
+    // for. It does NOT read `#`, which is HCL's own spelling - what keeps `# force_destroy = true` out
+    // of the value rules is that each pattern is anchored at the attribute, so a leading `#` cannot
+    // match. The suppression rule reads the raw text instead, because the comment is its subject.
+    const code = stripComments(source);
+    return [
+        ...flagViolations(code),
+        ...placeholderViolations(code),
+        ...openIngressViolations(code),
+        ...suppressionViolations(source),
+    ].toSorted((left, right) => left.line - right.line);
+};
+//# sourceMappingURL=terraform-policy.js.map

package/dist/terraform-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terraform-policy.js","sourceRoot":"","sources":["../src/terraform-policy.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,qGAAqG;AACrG,+FAA+F;AAC/F,kGAAkG;AAClG,mGAAmG;AACnG,+FAA+F;AAC/F,EAAE;AACF,uGAAuG;AACvG,uGAAuG;AACvG,oGAAoG;AACpG,kGAAkG;AAClG,qGAAqG;AACrG,wGAAwG;AACxG,uFAAuF;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAShD,MAAM,UAAU,GAAW,CAAC,CAAA;AAE5B,kGAAkG;AAClG,4EAA4E;AAC5E,MAAM,QAAQ,GAAG,CAAC,SAAiB,EAAE,KAAa,EAAU,EAAE,CAC5D,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,UAAU,SAAS,kBAAkB,KAAK,eAAe,CAAC,CAAA;AAEjF,iGAAiG;AACjG,uBAAuB;AACvB,MAAM,sBAAsB,GAAW,sCAAsC,CAAA;AAS7E,oGAAoG;AACpG,qGAAqG;AACrG,qGAAqG;AACrG,sFAAsF;AACtF,mGAAmG;AACnG,gGAAgG;AAChG,iGAAiG;AACjG,mGAAmG;AACnG,6BAA6B;AAC7B,MAAM,UAAU,GAAwB;IACtC;QACE,QAAQ,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,EAAE,kBAAkB;QACxB,MAAM,EACJ,4FAA4F;YAC5F,2FAA2F;YAC3F,qDAAqD;KACxD;IACD;QACE,QAAQ,EAAE,CAAC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,EAAE,2BAA2B;QACjC,MAAM,EACJ,4FAA4F;YAC5F,+FAA+F;YAC/F,qCAAqC;KACxC;IACD;QACE,QAAQ,EAAE;YACR,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;YAC/B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;YAChC,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;YACzC,IAAI,MAAM,CACR,MAAM,CAAC,GAAG,CAAA,+CAA+C,sBAAsB,GAAG,CACnF;SACF;QACD,IAAI,EAAE,8BAA8B;QACpC,MAAM,EACJ,6FAA6F;YAC7F,mEAAmE;KACtE;IACD;QACE,QAAQ,EAAE;YACR,QAAQ,CAAC,UAAU,EAAE,iCAAiC,CAAC;YACvD,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;YAChC,QAAQ,CAAC,4BAA4B,EAAE,OAAO,CAAC;YAC/C,QAAQ,CAAC,2BAA2B,EAAE,OAAO,CAAC;YAC9C,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;YACxC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;SACxC;QACD,IAAI,EAAE,0BAA0B;QAChC,MAAM,EACJ,0FAA0F;YAC1F,mEAAmE;KACtE;CACF,CAAA;AAED,qGAAqG;AACrG,qGAAqG;AACrG,uFAAuF;AACvF,MAAM,iBAAiB,GAAW,mDAAmD,CAAA;AAErF,uGAAuG;AACvG,8FAA8F;AAC9F,qFAAqF;AACrF,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IACpD,UAAU;IACV,YAAY;IACZ,QAAQ;IACR,OAAO;IACP,YAAY;IACZ,aAAa;CACd,CAAC,CAAA;AAEF,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,YAAY;CACb,CAAC,CAAA;AAEF,+FAA+F;AAC/F,sGAAsG;AACtG,qGAAqG;AACrG,8BAA8B;AAC9B,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAA;AAE1F,MAAM,WAAW,GAAW,CAAC,CAAC,CAAA;AAE9B,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAW,EAAE;IACjD,MAAM,QAAQ,GAAsB,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjE,MAAM,KAAK,GAAW,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC1C,MAAM,IAAI,GAAW,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC1C,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,OAAO,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAA;IAC3D,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;AACvF,CAAC,CAAA;AAED,sGAAsG;AACtG,+DAA+D;AAC/D,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IACtD,WAAW;IACX,UAAU;IACV,MAAM;IACN,OAAO;IACP,KAAK;IACL,aAAa;IACb,KAAK;IACL,eAAe;CAChB,CAAC,CAAA;AAEF,MAAM,aAAa,GAAG,CAAC,KAAa,EAAW,EAAE;IAC/C,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAA;AACjF,CAAC,CAAA;AAED,qGAAqG;AACrG,wGAAwG;AACxG,2FAA2F;AAC3F,MAAM,oBAAoB,GAAW,+DAA+D,CAAA;AAEpG,MAAM,cAAc,GAAG,CAAC,IAAY,EAAiC,EAAE,CACrE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAY,EAAE,KAAa,EAAiC,EAAE,CACtF,UAAU,CAAC,MAAM,CAAC,CAAC,IAAc,EAAW,EAAE,CAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACrE,CAAC,GAAG,CACH,CAAC,IAAc,EAAsB,EAAE,CAAC,CAAC;IACvC,IAAI,EAAE,KAAK,GAAG,UAAU;IACxB,IAAI,EAAE,IAAI,CAAC,IAAI;IACf,MAAM,EAAE,IAAI,CAAC,MAAM;CACpB,CAAC,CACH,CACF,CAAA;AAEH,wGAAwG;AACxG,+BAA+B;AAC/B,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAsB,EAAE;IAC7D,MAAM,KAAK,GAA2B,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAClE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,IAAI,GAAW,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;IACjD,MAAM,KAAK,GAAW,KAAK,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;IACnD,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AAC1E,CAAC,CAAA;AAED,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAiC,EAAE,CAC5E,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAY,EAAE,KAAa,EAAiC,EAAE;IACtF,MAAM,IAAI,GAAuB,iBAAiB,CAAC,IAAI,CAAC,CAAA;IACxD,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,GAAG,UAAU;gBACxB,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EACJ,GAAG,IAAI,gFAAgF;oBACvF,sFAAsF;oBACtF,qCAAqC;aACxC;SACF,CAAA;AACP,CAAC,CAAC,CAAA;AAEJ,gGAAgG;AAChG,yBAAyB;AACzB,MAAM,qBAAqB,GAAG,CAAC,MAAc,EAAiC,EAAE,CAC9E,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAY,EAAE,KAAa,EAAiC,EAAE;IACxF,MAAM,QAAQ,GAAuB,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,CAAA;IAC1F,OAAO,QAAQ,KAAK,SAAS;QAC3B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,GAAG,UAAU;gBACxB,IAAI,EAAE,yBAAyB;gBAC/B,MAAM,EACJ,IAAI,QAAQ,2EAA2E;oBACvF,sFAAsF;oBACtF,YAAY;aACf;SACF,CAAA;AACP,CAAC,CAAC,CAAA;AAEJ,qGAAqG;AACrG,mGAAmG;AACnG,4DAA4D;AAC5D,MAAM,mBAAmB,GAAW,4DAA4D,CAAA;AAChG,MAAM,cAAc,GAClB,8EAA8E,CAAA;AAChF,MAAM,WAAW,GAAW,2DAA2D,CAAA;AACvF,MAAM,cAAc,GAAW,uCAAuC,CAAA;AACtE,MAAM,SAAS,GAAW,4DAA4D,CAAA;AAEtF,MAAM,QAAQ,GAAW,EAAE,CAAA;AAC3B,MAAM,QAAQ,GAAW,IAAI,CAAA;AAC7B,MAAM,SAAS,GAAW,MAAM,CAAA;AAYhC,MAAM,cAAc,GAAG,CAAC,KAAwB,EAA0B,EAAE,CAC1E,KAAK,CAAC,OAAO,CAAC,CAAC,IAAY,EAAE,KAAa,EAA0B,EAAE;IACpE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,IAAI,GAAsB,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IACtD,MAAM,GAAG,GAAW,IAAI,CAAC,SAAS,CAAC,CAAC,SAAiB,EAAW,EAAE,CAChE,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAC/B,CAAA;IACD,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,UAAU,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;AACrF,CAAC,CAAC,CAAA;AAEJ,MAAM,WAAW,GAAG,CAAC,IAAuB,EAAyB,EAAE;IACrE,MAAM,KAAK,GAAgC,IAAI,GAAG,CAChD,IAAI,CAAC,OAAO,CAAC,CAAC,IAAY,EAA0C,EAAE;QACpE,MAAM,KAAK,GAA2B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC1D,OAAO,KAAK,KAAK,IAAI;YACnB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC5E,CAAC,CAAC,CACH,CAAA;IACD,MAAM,IAAI,GAAuB,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACvD,MAAM,EAAE,GAAuB,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACnD,OAAO,IAAI,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;AAC1E,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,KAAgB,EAAE,IAAY,EAAW,EAAE,CAC7D,KAAK,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC,EAAE,CAAA;AAExC,mGAAmG;AACnG,kCAAkC;AAClC,MAAM,eAAe,GAAG,CAAC,KAAgB,EAAsB,EAAE;IAC/D,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QAC/C,OAAO,YAAY,CAAA;IACrB,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACxD,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,IAAuB,EAAsB,EAAE;IACjE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAClE,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,YAAY,CAAA;IACrB,CAAC;IACD,MAAM,KAAK,GAA0B,WAAW,CAAC,IAAI,CAAC,CAAA;IACtD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC,CAAA;AAED,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAiC,EAAE,CAC5E,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAiB,EAAiC,EAAE;IAC5F,MAAM,QAAQ,GAAuB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1D,OAAO,QAAQ,KAAK,SAAS;QAC3B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EACJ,0BAA0B,QAAQ,+CAA+C;oBACjF,oDAAoD;aACvD;SACF,CAAA;AACP,CAAC,CAAC,CAAA;AAEJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAAiC,EAAE;IACvF,iGAAiG;IACjG,mGAAmG;IACnG,gGAAgG;IAChG,8FAA8F;IAC9F,MAAM,IAAI,GAAW,aAAa,CAAC,MAAM,CAAC,CAAA;IAC1C,OAAO;QACL,GAAG,cAAc,CAAC,IAAI,CAAC;QACvB,GAAG,qBAAqB,CAAC,IAAI,CAAC;QAC9B,GAAG,qBAAqB,CAAC,IAAI,CAAC;QAC9B,GAAG,qBAAqB,CAAC,MAAM,CAAC;KACjC,CAAC,QAAQ,CACR,CAAC,IAAwB,EAAE,KAAyB,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CACxF,CAAA;AACH,CAAC,CAAA"}

package/dist/terraform-providers.d.ts

@@ -0,0 +1,28 @@
+/** One line that names a provider: a resource, a data source, or a provider block. */
+export interface ProviderDeclaration {
+    readonly line: number;
+    readonly provider: string;
+    /** What the line declares, as a finding names it: the resource type, or `provider "name"`. */
+    readonly subject: string;
+    readonly kind: 'resource' | 'data' | 'provider';
+}
+/**
+ * Every line of a source that names a provider.
+ * @param source the file's text, as tracked.
+ * @returns the declarations, ordered by the line they sit on.
+ */
+export declare const providerDeclarationsIn: (source: string) => readonly ProviderDeclaration[];
+/**
+ * The providers a set of declarations names.
+ * @param declarations declarations from one or many sources.
+ * @returns each provider once, ordered so a report reads the same on every machine.
+ */
+export declare const providersOf: (declarations: readonly ProviderDeclaration[]) => readonly string[];
+/**
+ * How many resources and data sources the declarations carry - what an analyzer has to judge. A
+ * provider block configures a provider and declares nothing it could check.
+ * @param declarations declarations from one or many sources.
+ * @returns the count of resource and data declarations.
+ */
+export declare const resourceCountOf: (declarations: readonly ProviderDeclaration[]) => number;
+//# sourceMappingURL=terraform-providers.d.ts.map

package/dist/terraform-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terraform-providers.d.ts","sourceRoot":"","sources":["../src/terraform-providers.ts"],"names":[],"mappings":"AAUA,sFAAsF;AACtF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,8FAA8F;IAC9F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,UAAU,CAAA;CAChD;AA6CD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GAAI,QAAQ,MAAM,KAAG,SAAS,mBAAmB,EAKnF,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,WAAW,GAAI,cAAc,SAAS,mBAAmB,EAAE,KAAG,SAAS,MAAM,EAKV,CAAA;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,cAAc,SAAS,mBAAmB,EAAE,KAAG,MAGrE,CAAA"}

package/dist/terraform-providers.js

@@ -0,0 +1,68 @@
+// Which providers an OpenTofu or Terraform source declares, read from block headers alone.
+//
+// The resource type is the key, because it is what the analyzer's own catalogue binds a check to:
+// `aws_iam_role` belongs to `aws` whatever local name a `required_providers` block gives the provider.
+// That block is deliberately not read. Modules inherit it from their caller, so it sits in a minority
+// of files; its `source = "..."` line cannot be told from a module's without block parsing; and a
+// provider declared there with no resource in the tree leaves the analyzer nothing to judge anyway.
+// Nothing here parses HCL structure - this stays a line reader, like the policy beside it.
+import { lineOf, stripComments } from './source-text.js';
+// Anchored at the start of a line so HCL's own `#` comment, which `stripComments` does not read, cannot
+// match; a `//` or `/* */` comment is blanked before the scan (see terraform-policy.ts).
+const RESOURCE_HEADER = /^[ \t]*(?<kind>resource|data)[ \t]+"(?<type>[a-z][a-z0-9_]*)"/gm;
+const PROVIDER_HEADER = /^[ \t]*provider[ \t]+"(?<name>[a-z][a-z0-9-]*)"/gm;
+// A provider whose resources carry another provider's prefix. `google-beta` declares `google_*`
+// resources, so its block names the provider the resource types already name.
+const PROVIDER_ALIASES = new Map([['google-beta', 'google']]);
+const providerOfType = (type) => {
+    const separator = type.indexOf('_');
+    return separator === -1 ? type : type.slice(0, separator);
+};
+// A matched header always carries its groups; the fallback satisfies the type checker, not a case.
+const groupOf = (found, group) => found[group] ?? '';
+const KIND_GROUP = 1;
+const TYPE_GROUP = 2;
+const NAME_GROUP = 1;
+const resourceDeclarations = (code) => [...code.matchAll(RESOURCE_HEADER)].map((found) => {
+    const type = groupOf(found, TYPE_GROUP);
+    return {
+        line: lineOf(code, found.index),
+        provider: providerOfType(type),
+        subject: type,
+        kind: groupOf(found, KIND_GROUP) === 'data' ? 'data' : 'resource',
+    };
+});
+const providerBlocks = (code) => [...code.matchAll(PROVIDER_HEADER)].map((found) => {
+    const name = groupOf(found, NAME_GROUP);
+    return {
+        line: lineOf(code, found.index),
+        provider: PROVIDER_ALIASES.get(name) ?? name,
+        subject: `provider "${name}"`,
+        kind: 'provider',
+    };
+});
+/**
+ * Every line of a source that names a provider.
+ * @param source the file's text, as tracked.
+ * @returns the declarations, ordered by the line they sit on.
+ */
+export const providerDeclarationsIn = (source) => {
+    const code = stripComments(source);
+    return [...resourceDeclarations(code), ...providerBlocks(code)].toSorted((left, right) => left.line - right.line);
+};
+/**
+ * The providers a set of declarations names.
+ * @param declarations declarations from one or many sources.
+ * @returns each provider once, ordered so a report reads the same on every machine.
+ */
+export const providersOf = (declarations) => [
+    ...new Set(declarations.map((declaration) => declaration.provider)),
+].toSorted((left, right) => left.localeCompare(right));
+/**
+ * How many resources and data sources the declarations carry - what an analyzer has to judge. A
+ * provider block configures a provider and declares nothing it could check.
+ * @param declarations declarations from one or many sources.
+ * @returns the count of resource and data declarations.
+ */
+export const resourceCountOf = (declarations) => declarations.filter((declaration) => declaration.kind !== 'provider').length;
+//# sourceMappingURL=terraform-providers.js.map

package/dist/terraform-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terraform-providers.js","sourceRoot":"","sources":["../src/terraform-providers.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,EAAE;AACF,kGAAkG;AAClG,uGAAuG;AACvG,sGAAsG;AACtG,kGAAkG;AAClG,oGAAoG;AACpG,2FAA2F;AAC3F,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAWxD,wGAAwG;AACxG,yFAAyF;AACzF,MAAM,eAAe,GAAW,iEAAiE,CAAA;AACjG,MAAM,eAAe,GAAW,mDAAmD,CAAA;AAEnF,gGAAgG;AAChG,8EAA8E;AAC9E,MAAM,gBAAgB,GAAgC,IAAI,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;AAE1F,MAAM,cAAc,GAAG,CAAC,IAAY,EAAU,EAAE;IAC9C,MAAM,SAAS,GAAW,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC3C,OAAO,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;AAC3D,CAAC,CAAA;AAED,mGAAmG;AACnG,MAAM,OAAO,GAAG,CAAC,KAAsB,EAAE,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;AAErF,MAAM,UAAU,GAAW,CAAC,CAAA;AAC5B,MAAM,UAAU,GAAW,CAAC,CAAA;AAC5B,MAAM,UAAU,GAAW,CAAC,CAAA;AAE5B,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAkC,EAAE,CAC5E,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAsB,EAAuB,EAAE;IACtF,MAAM,IAAI,GAAW,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC/C,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC;QAC/B,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC;QAC9B,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU;KAClE,CAAA;AACH,CAAC,CAAC,CAAA;AAEJ,MAAM,cAAc,GAAG,CAAC,IAAY,EAAkC,EAAE,CACtE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAsB,EAAuB,EAAE;IACtF,MAAM,IAAI,GAAW,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC/C,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC;QAC/B,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI;QAC5C,OAAO,EAAE,aAAa,IAAI,GAAG;QAC7B,IAAI,EAAE,UAAU;KACjB,CAAA;AACH,CAAC,CAAC,CAAA;AAEJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,MAAc,EAAkC,EAAE;IACvF,MAAM,IAAI,GAAW,aAAa,CAAC,MAAM,CAAC,CAAA;IAC1C,OAAO,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CACtE,CAAC,IAAyB,EAAE,KAA0B,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAC1F,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,YAA4C,EAAqB,EAAE,CAC7F;IACE,GAAG,IAAI,GAAG,CACR,YAAY,CAAC,GAAG,CAAC,CAAC,WAAgC,EAAU,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CACrF;CACF,CAAC,QAAQ,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,YAA4C,EAAU,EAAE,CACtF,YAAY,CAAC,MAAM,CACjB,CAAC,WAAgC,EAAW,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,UAAU,CAC/E,CAAC,MAAM,CAAA"}

package/dist/toolchain-pins.d.ts

@@ -1,5 +1,5 @@
 /** An analyzer ploaness runs in a container rather than installing from the registry. */
-export type ContainerTool = 'gitleaks' | 'hadolint' | 'actionlint' | 'shellcheck';
+export type ContainerTool = 'gitleaks' | 'hadolint' | 'actionlint' | 'shellcheck' | 'checkov';
 /** The exact image each containerised analyzer runs, by digest. */
 export declare const CONTAINER_IMAGES: Readonly<Record<ContainerTool, string>>;
 /** Matches a reference that names image bytes AND the release they are, and only such a reference. */

package/dist/toolchain-pins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"toolchain-pins.d.ts","sourceRoot":"","sources":["../src/toolchain-pins.ts"],"names":[],"mappings":"AAGA,yFAAyF;AACzF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,YAAY,CAAA;AAEjF,mEAAmE;AACnE,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAWpE,CAAA;AAED,sGAAsG;AACtG,eAAO,MAAM,aAAa,EAAE,MACsC,CAAA;AAElE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAG,SAAS,MAAM,EAOxF,CAAA;AAOL;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,aAAa,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAG3E,CAAA;AAOD;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,gBAAgB,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAG/E,CAAA;AAMD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,GACpC,WAAW,MAAM,GAAG,SAAS,EAC7B,UAAU,MAAM,GAAG,SAAS,KAC3B,SAAS,MAAM,EAajB,CAAA"}
+{"version":3,"file":"toolchain-pins.d.ts","sourceRoot":"","sources":["../src/toolchain-pins.ts"],"names":[],"mappings":"AAGA,yFAAyF;AACzF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,YAAY,GAAG,SAAS,CAAA;AAE7F,mEAAmE;AACnE,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAmBpE,CAAA;AAED,sGAAsG;AACtG,eAAO,MAAM,aAAa,EAAE,MACsC,CAAA;AAElE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAG,SAAS,MAAM,EAOxF,CAAA;AAOL;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,aAAa,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAG3E,CAAA;AAOD;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,gBAAgB,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAG/E,CAAA;AAMD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,GACpC,WAAW,MAAM,GAAG,SAAS,EAC7B,UAAU,MAAM,GAAG,SAAS,KAC3B,SAAS,MAAM,EAajB,CAAA"}

package/dist/toolchain-pins.js

@@ -5,9 +5,16 @@ export const CONTAINER_IMAGES = {
     gitleaks: 'zricethezav/gitleaks:v8.30.1@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f',
     hadolint: 'hadolint/hadolint:v2.15.1@sha256:32dac94127fd60b7b7e3fbfc65e1383b9b5e25c9bfd7b8536de7a539fe68a12d',
     actionlint: 'rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667',
-    // The standard makes a check a repository implements itself into its source code, and the ploaness
-    // verification command is a shell script that no analyzer read.
+    // A project's operational scripts are code it runs against its own database and its own deployments,
+    // and the standard makes a check a repository implements itself into its source code. The `shell`
+    // gate reads both: a consumer's scripts, and the ones this verification command is written in.
     shellcheck: 'koalaman/shellcheck:v0.11.0@sha256:61862eba1fcf09a484ebcc6feea46f1782532571a34ed51fedf90dd25f925a8d',
+    // The infrastructure gate enables named checks rather than a category, and a `--check` id that does
+    // not exist matches nothing and raises no error. The digest is what makes that audit durable: the
+    // catalogue cannot change underneath it, so the enabled ids stay the ones somebody confirmed with
+    // `--list`. The provider standings beside the catalogue rest on the same listing: which providers
+    // the image has no check for at all. Re-confirm both whenever this pin moves.
+    checkov: 'bridgecrew/checkov:3.3.17@sha256:41c4701c6a56d8952e5aba7a420f871c8b70b57da94eb4f142dcdf7295bb0be3',
 };
 /** Matches a reference that names image bytes AND the release they are, and only such a reference. */
 export const DIGEST_PINNED = /^[a-z0-9][a-z0-9._/-]*:[A-Za-z0-9][\w.-]*@sha256:[0-9a-f]{64}$/;

package/dist/toolchain-pins.js.map

@@ -1 +1 @@
-{"version":3,"file":"toolchain-pins.js","sourceRoot":"","sources":["../src/toolchain-pins.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,wEAAwE;AAKxE,mEAAmE;AACnE,MAAM,CAAC,MAAM,gBAAgB,GAA4C;IACvE,QAAQ,EACN,sGAAsG;IACxG,QAAQ,EACN,mGAAmG;IACrG,UAAU,EACR,iGAAiG;IACnG,mGAAmG;IACnG,gEAAgE;IAChE,UAAU,EACR,qGAAqG;CACxG,CAAA;AAED,sGAAsG;AACtG,MAAM,CAAC,MAAM,aAAa,GACxB,gEAAgE,CAAA;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAwC,EAAqB,EAAE,CAChG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;KACnB,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,CAA4B,EAAW,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;KAC7F,GAAG,CACF,CAAC,CAAC,IAAI,EAAE,SAAS,CAA4B,EAAU,EAAE,CACvD,GAAG,IAAI,UAAU,SAAS,yDAAyD;IACnF,wCAAwC,CAC3C,CAAA;AAEL,0FAA0F;AAC1F,wGAAwG;AACxG,sGAAsG;AACtG,MAAM,aAAa,GAAW,OAAO,CAAA;AAErC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,WAA+B,EAAsB,EAAE;IACtF,MAAM,KAAK,GAA2B,aAAa,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;IAC3E,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AACtD,CAAC,CAAA;AAED,oGAAoG;AACpG,iGAAiG;AACjG,0DAA0D;AAC1D,MAAM,cAAc,GAAW,4BAA4B,CAAA;AAE3D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,cAAkC,EAAsB,EAAE;IAC1F,MAAM,KAAK,GAA2B,cAAc,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAA;IAC/E,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC,CAAA;AAED,qGAAqG;AACrG,oGAAoG;AACpG,MAAM,eAAe,GAAW,qBAAqB,CAAA;AAErD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,SAA6B,EAC7B,QAA4B,EACT,EAAE;IACrB,MAAM,KAAK,GAA2B,eAAe,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAuB,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;IAC9C,gGAAgG;IAChG,oGAAoG;IACpG,8FAA8F;IAC9F,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5E,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO;QACL,QAAQ,OAAO,mDAAmD,QAAQ,IAAI;YAC5E,0FAA0F;KAC7F,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"toolchain-pins.js","sourceRoot":"","sources":["../src/toolchain-pins.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,wEAAwE;AAKxE,mEAAmE;AACnE,MAAM,CAAC,MAAM,gBAAgB,GAA4C;IACvE,QAAQ,EACN,sGAAsG;IACxG,QAAQ,EACN,mGAAmG;IACrG,UAAU,EACR,iGAAiG;IACnG,qGAAqG;IACrG,kGAAkG;IAClG,+FAA+F;IAC/F,UAAU,EACR,qGAAqG;IACvG,oGAAoG;IACpG,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,8EAA8E;IAC9E,OAAO,EACL,mGAAmG;CACtG,CAAA;AAED,sGAAsG;AACtG,MAAM,CAAC,MAAM,aAAa,GACxB,gEAAgE,CAAA;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAwC,EAAqB,EAAE,CAChG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;KACnB,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,CAA4B,EAAW,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;KAC7F,GAAG,CACF,CAAC,CAAC,IAAI,EAAE,SAAS,CAA4B,EAAU,EAAE,CACvD,GAAG,IAAI,UAAU,SAAS,yDAAyD;IACnF,wCAAwC,CAC3C,CAAA;AAEL,0FAA0F;AAC1F,wGAAwG;AACxG,sGAAsG;AACtG,MAAM,aAAa,GAAW,OAAO,CAAA;AAErC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,WAA+B,EAAsB,EAAE;IACtF,MAAM,KAAK,GAA2B,aAAa,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;IAC3E,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AACtD,CAAC,CAAA;AAED,oGAAoG;AACpG,iGAAiG;AACjG,0DAA0D;AAC1D,MAAM,cAAc,GAAW,4BAA4B,CAAA;AAE3D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,cAAkC,EAAsB,EAAE;IAC1F,MAAM,KAAK,GAA2B,cAAc,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAA;IAC/E,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC,CAAA;AAED,qGAAqG;AACrG,oGAAoG;AACpG,MAAM,eAAe,GAAW,qBAAqB,CAAA;AAErD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,SAA6B,EAC7B,QAA4B,EACT,EAAE;IACrB,MAAM,KAAK,GAA2B,eAAe,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAuB,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;IAC9C,gGAAgG;IAChG,oGAAoG;IACpG,8FAA8F;IAC9F,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5E,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO;QACL,QAAQ,OAAO,mDAAmD,QAAQ,IAAI;YAC5E,0FAA0F;KAC7F,CAAA;AACH,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ploaness/governance",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "description": "Pure, unit-tested governance rules for ploaness. No filesystem, process, or network access.",
   "license": "MIT",
   "author": "Herman Ciechanowiec <herman@ciechanowiec.eu>",