@preventive/triage 1.0.0-alpha.44 → 1.0.0-alpha.46

package/risk/actions/uses.js

@@ -0,0 +1,76 @@
+// What a `uses:` names, as GitHub reads it (`owner/repo[/path]@ref`, `./path`,
+// `$/path`, `docker://image`), and an image a job runs in.
+
+const GITHUB_OWNERS = new Set(['actions', 'github'])
+
+const OWNER = /^[\da-z](?:[\da-z]|-(?=[\da-z])){0,38}$/iu
+const NAME = /^(?!\.{1,2}$)[\w.-]{1,100}$/u
+const SHA = /^[\da-f]{40}$/u
+const SHORT_SHA = /^[\da-f]{7,39}$/u
+// A version a comment beside a pin names, as Dependabot, Renovate, pinact
+// and ratchet write one (`# v4.1.1`, `# tag=v4.1.1`, `# ratchet:x@v4`).
+const VERSION_COMMENT = /^#\s*(?:tag\s*[=:]\s*|pin@|ratchet:[^\s@]+@)?(v?\d+(?:\.\d+){0,3}(?:[-+][\w.-]+)?)(?![\w.])/iu
+
+// `sha`, `short-sha`, `ref` (a tag or a branch), or `expression`, which GitHub refuses.
+function pinOf(ref) {
+  if (/\$\{\{/u.test(ref)) return 'expression'
+  if (SHA.test(ref)) return 'sha'
+  return SHORT_SHA.test(ref) ? 'short-sha' : 'ref'
+}
+
+// An image's name, tag and digest (`[host[:port]/]path[:tag][@digest]`), null
+// for none; null where it isn't one.
+export function readImage(text) {
+  if (typeof text !== 'string' || text === '' || /\$\{\{|\s/u.test(text)) return null
+  const at = text.indexOf('@')
+  const digest = at === -1 ? null : text.slice(at + 1)
+  const named = at === -1 ? text : text.slice(0, at)
+  const colon = named.lastIndexOf(':')
+  const tagged = colon > named.lastIndexOf('/')
+  if (digest !== null && !/^sha256:[\da-f]{64}$/u.test(digest)) return null
+  return { image: tagged ? named.slice(0, colon) : named, tag: tagged ? named.slice(colon + 1) : null, digest }
+}
+
+const commentVersion = comment => typeof comment === 'string' ? VERSION_COMMENT.exec(comment.trim())?.[1] ?? null : null
+
+export const isWorkflowPath = path => /^\.github\/workflows\/[^/]+\.ya?ml$/u.test(path)
+
+// `{ kind, uses, … }`: `action`, or `workflow` at a job's level (`job`), with
+// its `repo`, `path`, `ref`, `pin` and `comment`'s version; `local`, `self`
+// at the commit running, `job` a reusable workflow's, at the calling
+// workflow's commit; `docker`; or `invalid`, which GitHub won't run.
+export function readUses(text, { job = false, comment = null } = {}) {
+  const uses = typeof text === 'string' ? text.trim() : ''
+  if (uses.startsWith('./') || uses.startsWith('$/')) {
+    return { kind: 'local', uses, path: uses.slice(2).replace(/\/+$/u, ''), ...uses.startsWith('$/') ? { self: true } : {}, ...job ? { job: true } : {} }
+  }
+  if (uses.startsWith('docker://')) {
+    const image = job ? null : readImage(uses.slice('docker://'.length))
+    return image ? { kind: 'docker', uses, ...image } : { kind: 'invalid', uses }
+  }
+  const at = uses.indexOf('@')
+  const [owner = '', name = '', ...path] = (at === -1 ? uses : uses.slice(0, at)).split('/')
+  const ref = at === -1 ? '' : uses.slice(at + 1)
+  if (!OWNER.test(owner) || !NAME.test(name) || ref === '' || path.some(part => !NAME.test(part)) || (job && !isWorkflowPath(path.join('/')))) {
+    return { kind: 'invalid', uses }
+  }
+  return { kind: job ? 'workflow' : 'action', uses, repo: `${owner}/${name}`, path: path.join('/'), ref, pin: pinOf(ref), comment: commentVersion(comment) }
+}
+
+// The key a reference is resolved once by, a commit's with its comment's version.
+export const usesKey = ({ repo, path, ref, pin, comment }) => `${repo.toLowerCase()}${path ? `/${path}` : ''}@${ref}${pin === 'sha' && comment ? ` # ${comment}` : ''}`
+
+// A reference from its key, a reusable workflow's by its path's.
+export function usesOfKey(key) {
+  const m = typeof key === 'string' ? /^([^@\s]+@\S+)(?: # (\S+))?$/u.exec(key) : null
+  const job = Boolean(m && /^[^/]+\/[^/]+\/\.github\/workflows\/[^/@]+\.ya?ml@/u.test(m[1]))
+  const read = m ? readUses(m[1], { job, comment: m[2] ? `# ${m[2]}` : null }) : null
+  return read && (read.kind === 'action' || read.kind === 'workflow') && usesKey(read) === key ? read : null
+}
+
+// GitHub's own, the workflow's owner's, or another's.
+export function ownerKind(repo, owner) {
+  const of = repo.split('/')[0].toLowerCase()
+  if (GITHUB_OWNERS.has(of)) return 'github'
+  return typeof owner === 'string' && of === owner.toLowerCase() ? 'own' : 'third-party'
+}

package/risk/actions/workflow.js

@@ -0,0 +1,110 @@
+// A workflow, or an action's metadata, read for what it runs: its events, its
+// jobs' steps (`uses`, `run`) and images, each on its line from 1.
+import { YamlError, parseYaml } from '@preventive/lockfile/yaml.js'
+import { readImage, readUses } from './uses.js'
+
+const isMap = value => value !== null && typeof value === 'object' && !Array.isArray(value)
+const stringOf = value => typeof value === 'string' ? value : null
+
+// The line, from 1, `key` of a mapping or an entry of a sequence is on.
+function lineOf(file, container, key, fallback) {
+  const at = container !== null && typeof container === 'object' ? file.positions.get(container) : undefined
+  const line = at instanceof Map ? at.get(key) : at?.[key]
+  return line === undefined ? fallback : line + 1
+}
+
+// A step's or a job's `uses`, on its line, with the comment that line ends with.
+function usesOf(file, owner, fallback, job = false) {
+  if (typeof owner.uses !== 'string') return null
+  const line = lineOf(file, owner, 'uses', fallback)
+  return { ...readUses(owner.uses, { job, comment: /(?:^|[ \t])(#.*)$/u.exec(file.lines[line - 1] ?? '')?.[1] ?? null }), line }
+}
+
+function triggersOf(on) {
+  if (typeof on === 'string') return [on]
+  if (Array.isArray(on)) return on.filter(event => typeof event === 'string')
+  return isMap(on) ? Object.keys(on) : []
+}
+
+// The line a `|` block scalar's text starts on, after its key's; else null.
+const LITERAL_HEADER = /:[ \t]+(?:&\S+[ \t]+)?\|[1-9+-]{0,2}[ \t]*(?:#.*)?$/u
+const literalStart = (file, line) => line !== null && LITERAL_HEADER.test(file.lines[line - 1] ?? '') ? line + 1 : null
+
+// A `run:` step's script, and its directory, else `directory` (defaults.run);
+// `production` where its `env`, else the job's or the workflow's (`env`),
+// sets NODE_ENV so, as an install then leaves devDependencies out.
+const envOf = (owner, outer = {}) => ({ ...outer, ...isMap(owner?.env) ? owner.env : {} })
+function runOf(file, step, directory, env) {
+  const script = stringOf(step.run)
+  if (script === null) return null
+  const line = lineOf(file, step, 'run', null)
+  return { script, line, start: literalStart(file, line), workingDirectory: stringOf(step['working-directory']) ?? directory,
+    production: envOf(step, env).NODE_ENV === 'production' }
+}
+
+// A step's or a job's `with`, and the line each input is on.
+function inputsOf(file, owner, line) {
+  const inputs = isMap(owner.with) ? owner.with : null
+  return { with: inputs, withLines: inputs ? Object.fromEntries(Object.keys(inputs).map(key => [key, lineOf(file, inputs, key, line)])) : {} }
+}
+
+function stepsOf(file, steps, directory, env = {}) {
+  if (!Array.isArray(steps)) return []
+  return steps.flatMap((step, index) => {
+    if (!isMap(step)) return []
+    const line = lineOf(file, steps, index, null)
+    return [{ line, uses: usesOf(file, step, line), run: runOf(file, step, directory, env), ...inputsOf(file, step, line) }]
+  })
+}
+
+// The directory a workflow's or a job's `defaults.run` names, else `outer`.
+const directoryOf = (owner, outer) => stringOf(isMap(owner?.defaults) && isMap(owner.defaults.run) ? owner.defaults.run['working-directory'] : null) ?? outer
+
+// The images a job runs in: its container's and its services'.
+function imagesOf(file, job) {
+  const images = []
+  const container = isMap(job.container) ? job.container.image : job.container
+  if (typeof container === 'string') images.push({ text: container, line: lineOf(file, isMap(job.container) ? job.container : job, isMap(job.container) ? 'image' : 'container', null) })
+  if (isMap(job.services)) {
+    for (const service of Object.values(job.services)) {
+      if (isMap(service) && typeof service.image === 'string') images.push({ text: service.image, line: lineOf(file, service, 'image', null) })
+    }
+  }
+  return images.map(image => ({ ...image, read: readImage(image.text) }))
+}
+
+function jobsOf(file, doc) {
+  if (!isMap(doc.jobs)) throw new YamlError('a workflow has no jobs')
+  const directory = directoryOf(doc, null)
+  return Object.values(doc.jobs).filter(isMap).map(job => ({ uses: usesOf(file, job, null, true), secrets: job.secrets ?? null, ...inputsOf(file, job, null),
+    steps: stepsOf(file, job.steps, directoryOf(job, directory), envOf(job, envOf(doc))), images: imagesOf(file, job) }))
+}
+
+// An action's `runs`: its runtime, a composite one's steps as a job, and a
+// Docker one's image or Dockerfile.
+function runsOf(file, doc) {
+  const runs = isMap(doc.runs) ? doc.runs : null
+  if (!runs || typeof runs.using !== 'string') throw new YamlError('an action has no runs.using')
+  const using = runs.using.toLowerCase()
+  const usingLine = lineOf(file, runs, 'using', null)
+  const image = using === 'docker' ? stringOf(runs.image) : null
+  const imageLine = lineOf(file, runs, 'image', usingLine)
+  const docker = image?.startsWith('docker://') ? { text: image.slice('docker://'.length), line: imageLine, read: readImage(image.slice('docker://'.length)) } : null
+  const steps = using === 'composite' ? stepsOf(file, runs.steps, null) : []
+  return { using, usingLine, dockerfile: image && !docker ? { path: image.replace(/^\.\//u, ''), line: imageLine } : null, jobs: [{ uses: null, steps, images: docker ? [docker] : [] }] }
+}
+
+// A workflow (`kind` 'workflow') or an action's metadata ('action') read, or
+// the YamlError of one GitHub can't run.
+export function readWorkflow(kind, text) {
+  try {
+    const file = { lines: text.split('\n'), positions: new WeakMap() }
+    const doc = parseYaml(text, { workflow: true, lines: file.positions })
+    if (!isMap(doc)) throw new YamlError(`${kind === 'action' ? 'an action' : 'a workflow'} is not a mapping`)
+    if (kind === 'action') return { triggers: [], ...runsOf(file, doc) }
+    return { triggers: triggersOf(doc.on), using: null, usingLine: null, dockerfile: null, jobs: jobsOf(file, doc) }
+  } catch (error) {
+    if (error instanceof YamlError) return error
+    throw error
+  }
+}

package/risk/files/hosts.js

@@ -82,9 +82,9 @@ function githubNamed(url) {
 
 // The hosts a script's strings name, each with the line it is first named on,
 // in the order named, NPM_MAX_HOSTS at most; null for none, or for a file
-// that is no script.
-export function npmHosts(path, text) {
-  if (!npmIsScript(path, text) || !(text.includes('://') || text.includes(':\\/\\/'))) return null
+// that is no script, by its name or as node runs it (`script`, npmIsScript).
+export function npmHosts(path, text, script = false) {
+  if (!npmIsScript(path, text, script) || !(text.includes('://') || text.includes(':\\/\\/'))) return null
   const hosts = new Map(), line = lineOf(text)
   for (const { 1: token, index } of text.matchAll(JS_STRING_OR_COMMENT)) {
     if (hosts.size >= NPM_MAX_HOSTS) break
@@ -172,9 +172,9 @@ const SAYS_ANY = new RegExp([...EXFILTRATION.values()].map(({ pattern }) => patt
 
 // The services a file names, each with the lines it is named on, the first
 // NPM_MAX_FOUND, in EXFILTRATION's order; null for none, or for prose or a
-// source map.
-export function npmExfiltration(path, text) {
-  if (typeof text !== 'string' || NPM_PROSE.test(path) || SOURCE_MAP.test(path) || !SAYS_ANY.test(text)) return null
+// source map by its name that node doesn't run as a script (`script`).
+export function npmExfiltration(path, text, script = false) {
+  if (typeof text !== 'string' || (!script && (NPM_PROSE.test(path) || SOURCE_MAP.test(path))) || !SAYS_ANY.test(text)) return null
   const found = new Map(), line = lineOf(text)
   for (const [service, { pattern }] of EXFILTRATION) {
     const lines = new Set()

package/risk/files/readability.js

@@ -45,30 +45,34 @@ export function npmObfuscation(text) {
 
 // A code file this large is mostly a bundle, worth a look where a version
 // adds it: JavaScript or TypeScript, not a declaration file, which holds no
-// code that runs.
+// code that runs, or any file node runs as a script (`script`, npm/files.js
+// npmLoadedScripts).
 export const NPM_LARGE_CODE = 256 * 1024
 const CODE = /\.(?:[cm]?[jt]s|[jt]sx)$/iu
 const DECLARATION = /\.d\.[cm]?ts$/iu
-export const npmLargeCode = (path, bytes) => typeof bytes === 'number' && bytes >= NPM_LARGE_CODE && CODE.test(path) && !DECLARATION.test(path)
+export const npmLargeCode = (path, bytes, script = false) => typeof bytes === 'number' && bytes >= NPM_LARGE_CODE && (script || (CODE.test(path) && !DECLARATION.test(path)))
 
 // A code file that isn't text (npmFileReadability's `binary`: not UTF-8, or
-// holding a NUL), by its path and how it reads, a declaration file too: no
-// one can read it in review, yet what reads it by its byte order mark can
+// holding a NUL), by its path and how it reads, a declaration file too, or
+// any file node runs as a script (`script`, npm/files.js npmLoadedScripts):
+// no one can read it in review, yet what reads it by its byte order mark can
 // run it, or type with it, as UTF-16 (a browser's classic script, Windows
-// Script Host, TypeScript).
-export const npmBinaryCode = (path, readability) => readability?.category === 'binary' && CODE.test(path)
+// Script Host, TypeScript), and node runs it decoded as UTF-8 whatever it
+// holds past its code (`//` and a byte no UTF-8 has).
+export const npmBinaryCode = (path, readability, script = false) => readability?.category === 'binary' && (script || CODE.test(path))
 
 // A file with a line over UNREADABLE_LINE characters, by how it reads
 // (`now`, npmFileReadability's), `path` its path: an inline source map's line
 // counts for none, and prose and source maps, whose long lines the Long lines
-// tag passes over, never are, nor is a file that isn't text. Then one that
-// had no line over SHORT_LINES characters (`was`) and now has one over
-// UNREADABLE_LINE, by how it reads on each side.
+// tag passes over, never are, but where node runs it as a script (`script`),
+// nor is a file that isn't text. Then one that had no line over SHORT_LINES
+// characters (`was`) and now has one over UNREADABLE_LINE, by how it reads on
+// each side.
 const SHORT_LINES = 200
 const UNREADABLE_LINE = 2000
-export const npmUnreadable = (path, now) => Boolean(now) && now.category !== 'binary' && !NPM_PROSE.test(path) && !SOURCE_MAP.test(path)
+export const npmUnreadable = (path, now, script = false) => Boolean(now) && now.category !== 'binary' && (script || (!NPM_PROSE.test(path) && !SOURCE_MAP.test(path)))
   && now.longest > UNREADABLE_LINE
-export const npmBecameUnreadable = (path, was, now) => Boolean(was) && was.category !== 'binary' && was.longest <= SHORT_LINES && npmUnreadable(path, now)
+export const npmBecameUnreadable = (path, was, now, script = false) => Boolean(was) && was.category !== 'binary' && was.longest <= SHORT_LINES && npmUnreadable(path, now, script)
 
 // How a file reads, as its `category`, the first that holds (READABILITY):
 // binary (no text), map (a source map), long (code with some lines
@@ -85,8 +89,9 @@ export const npmBecameUnreadable = (path, was, now) => Boolean(was) && was.categ
 // short ones (strings and comments aside, see MINIFIED_AVERAGE; 0 otherwise),
 // how long its inline map is (`inlineMap`, 0 for none), and its obfuscator
 // fingerprint (`obfuscation`, npmObfuscation's; null for none, and for prose
-// or a source map).
-export function npmFileReadability(path, text) {
+// or a source map). One node runs as a script whatever its name (`script`,
+// script.js npmIsScript) is read as code: no prose nor source map.
+export function npmFileReadability(path, text, script = false) {
   const encoding = npmTextEncoding(text)
   if (encoding.kind === 'binary') return { ...encoding, category: 'binary', longest: 0, longLines: 0, average: 0, inlineMap: 0, obfuscation: null }
   let inlineMap = 0, longChars = 0, longLines = 0, longest = 0
@@ -106,14 +111,15 @@ export function npmFileReadability(path, text) {
   }
   // A source map holds the names and sources of the code it maps, and prose
   // its examples: neither runs.
-  const obfuscation = NPM_PROSE.test(path) || SOURCE_MAP.test(path) ? null : npmObfuscation(text)
+  const map = !script && SOURCE_MAP.test(path), prose = !script && NPM_PROSE.test(path)
+  const obfuscation = prose || map ? null : npmObfuscation(text)
   const read = { ...encoding, longest, longLines, average: 0, inlineMap, obfuscation }
-  if (SOURCE_MAP.test(path)) return { ...read, category: 'map' }
-  if (NPM_PROSE.test(path)) return { ...read, category: inlineMap > 0 ? 'inline-map' : encoding.kind }
+  if (map) return { ...read, category: 'map' }
+  if (prose) return { ...read, category: inlineMap > 0 ? 'inline-map' : encoding.kind }
   if (longLines === 0) {
     // None of its lines longer than MINIFIED_AVERAGE, none of its code's can
     // average more: told without reading its code.
-    const language = minifiable(path)
+    const language = minifiable(path, script)
     const average = language !== null && longest > MINIFIED_AVERAGE ? minifiedAverage(text, language) : 0
     return { ...read, average, category: inlineMap > 0 ? 'inline-map' : average > 0 ? 'minified' : encoding.kind }
   }

package/risk/files/runs-code.js

@@ -69,7 +69,7 @@ const ENV_WHOLE = String.raw`(?=JSON|Object|URLSearchParams)(?<![\p{ID_Continue}
 // BusyBox's `ash`, `| powershell`); after a pipe, by its path or env's too (`| /bin/sh`,
 // `| /usr/bin/env bash`), env's options, their values, and settings before
 // it on its line (`env -S`, `env -u NAME`, `env MODE=x`).
-const SHELLS = String.raw`(?:(?:ba|z|da|k|mk|c|tc|fi|a)?sh|pwsh|powershell)`
+export const SHELLS = String.raw`(?:(?:ba|z|da|k|mk|c|tc|fi|a)?sh|pwsh|powershell)`
 const SHELL_PATH = String.raw`(?:(?:\/[\w.-]{1,40}){0,8}\/)?(?:env(?:[^\S\n]+(?:-[\w-]{1,20}(?:=\S{0,100}|[^\S\n]+(?!-)[^\s=]{1,100})?|\w{1,40}=\S{0,100})){0,6}[^\S\n]+)?`
 const SHELL_OR_PLACE = String.raw`curl|wget|\|\s*(?:sudo|${SHELL_PATH}${SHELLS})|powershell|pwsh|rundll32|osascript|mshta|certutil|bitsadmin|\/dev\/(?:tcp|udp)|iex|invoke-expression`
   + String.raw`|\$profile|profile\.ps1|config\.fish|conf\.d|bashrc|zshrc|zshenv|zlogin|bash_profile|bash_login|zprofile|\.profile|Launch(?:Agents|Daemons)|systemd|systemctl|\.claude|\.vscode|trufflehog|metadata\.google\.internal|["'\x60\/\\]gh(?:\.exe)?["'\x60]`
@@ -118,16 +118,27 @@ const ABSENT_ENDS = String.raw`\s{0,4}(?:(?:\)\s{0,4}){1,4}(?![\s)]{0,8}(?:[.[(]
 const TOKEN_NAME = String.raw`(?=NPM|GITHUB)(?<![\p{ID_Continue}$])(?<!\b(?:const|let|var)\s{1,4})`
   + String.raw`(?:(?<!(?:!|\bdelete\s)[\s(]{0,4}(?:[\p{ID_Continue}$]{1,64}\s{0,4}\??\.\s{0,4}){0,4})|(?!${TOKEN_VAR}${ABSENT_ENDS}))`
   + String.raw`${TOKEN_VAR}(?![\p{ID_Continue}$])(?!${TYPED})(?:(?!${SET})|(?<=[{,]\s{0,64}${TOKEN_VAR}))`
+// eval as a key, not read: a property's name or a member typed, coming
+// first or after another (`{ eval: x }`, WebAuthn's `extensions: { prf: {
+// eval: { first } } }`, `const { eval: run } = vm`, `{ a: 1, eval: 2 }`, `a;
+// eval: T`); not where anything else comes before it, as a ternary's choice
+// does, whole or last of its branch (`c ? eval : f`, `c ? x && eval : f`),
+// nor a worker told to run its string as code (`new Worker(code, { eval:
+// true })`, minified `{eval:!0}`), nor eval destructured from the global
+// object (`const { eval: run } = globalThis`, `({ a, eval: run } = window)`).
+const KEYED = String.raw`(?<=[{,;]${GAP}eval)\s*:(?!${GAP}(?:true|!0)(?![\p{ID_Continue}$]))`
+  + String.raw`(?![^{};]{0,200}\}${GAP}=${GAP}(?:${GLOBAL})(?![\p{ID_Continue}$]))`
 // A script's strings, regular expressions and comments, as script.js
 // tells them, each taking its own text, and its code in none of them: eval,
 // not a property TypeScript types as optional (`eval?: T`, JavaScript's `?:`
-// none of its own), and Function called, but to find the global object;
+// none of its own) nor a key (KEYED), and Function called, but to find the
+// global object;
 // Module's _compile, called
 // (`module._compile(source, filename)`) or hooked (`Module.prototype._compile
 // = …`), not named in a type (`typeof Module.prototype._compile`); a token's
 // name, its value read; the environment read out whole; and a PUT request's
 // call (`axios.put(…)`).
-const READS = new RegExp(String.raw`${JS_STRING_OR_COMMENT.source}|(?<eval>${named('eval')}(?![\p{ID_Continue}$])(?!\s*\?:))|(?<function>${named('Function')}${FUNCTION_CALLED}${GLOBAL_FOUND})`
+const READS = new RegExp(String.raw`${JS_STRING_OR_COMMENT.source}|(?<eval>${named('eval')}(?![\p{ID_Continue}$])(?!\s*\?:)(?!${KEYED}))|(?<function>${named('Function')}${FUNCTION_CALLED}${GLOBAL_FOUND})`
   + String.raw`|(?<compile>\.${GAP}_compile(?:${FUNCTION_CALLED}|${GAP}=(?![=>])))|(?<tokens>${TOKEN_NAME})|(?<env>${ENV_WHOLE})|(?<put>\.${GAP}put${GAP}\()`, 'gmu')
 // What a string holds that a kind is: a credential file's path, npm's, SSH's
 // or AWS's (`~/.npmrc`, `.ssh/id_rsa`, `.aws/credentials`, not `x.npmrc` or
@@ -400,12 +411,13 @@ export const RUNS_CODE = new Map([
 
 // The kinds a file's code holds, each with the lines it is on, of the first
 // NPM_MAX_FOUND places it does each, in RUNS_CODE's order; null for none, or
-// for a file that is no script. A shell script's, read whole, are its shell
+// for a file that is no script, by its name or as node runs it (`nodeRuns`,
+// npmIsScript's `script`). A shell script's, read whole, are its shell
 // commands and the places it names; one with a shell's hashbang is one
 // whatever its extension, and read as JavaScript too where it is that, as
 // a launcher (`#!/bin/sh` then `exec node "$0"`) is both.
-export function npmRunsCode(path, text) {
-  const script = npmIsScript(path, text)
+export function npmRunsCode(path, text, nodeRuns = false) {
+  const script = npmIsScript(path, text, nodeRuns)
   const shell = typeof text === 'string' && (SHELL_SCRIPT.test(path) || SHELL_HASHBANG.test(text))
   if (!script && !shell) return null
   const found = new Map()

package/risk/files/script.js

@@ -50,7 +50,9 @@ const CSS = {
 // JavaScript's strings and regular expressions (the first group) and its
 // comments, for a reader that sets them aside (runs-code.js, hosts.js).
 export const JS_STRING_OR_COMMENT = JS.stringOrComment
-export const minifiable = path => /\.[cm]?js$/iu.test(path) ? JS : /\.css$/iu.test(path) ? CSS : null
+// A stylesheet's by its name, else JavaScript's for a script by its name, or
+// for any other where node runs it as one (`script`).
+export const minifiable = (path, script = false) => /\.css$/iu.test(path) ? CSS : script || /\.[cm]?js$/iu.test(path) ? JS : null
 // How much of a text is read for how its lines are minified: their average
 // is told by as much of them, and a text of millions of lines is read no
 // further.
@@ -81,8 +83,10 @@ export function minifiedAverage(whole, { stringOrComment, droppable, needed }) {
 // as an ES module (in a `"type": "module"` package).
 const SCRIPT = /\.[cm]?[jt]sx?$/iu
 const NODE_HASHBANG = /^\uFEFF?#!.*\bnode\b/u
-// Whether a file (its path and text) is a script, as SCRIPT and NODE_HASHBANG tell.
-export const npmIsScript = (path, text) => typeof text === 'string' && (SCRIPT.test(path) || NODE_HASHBANG.test(text))
+// Whether a file (its path and text) is a script, as SCRIPT and NODE_HASHBANG
+// tell, or as node runs it whatever its name (`script`, npm/files.js
+// npmLoadedScripts).
+export const npmIsScript = (path, text, script = false) => typeof text === 'string' && (script || SCRIPT.test(path) || NODE_HASHBANG.test(text))
 // How many places a file is told doing a thing, the first ones, at most
 // (runs-code.js, hosts.js): a file doing it on millions of lines is told by
 // its first, and what it holds of them kept to a bound however many there

package/risk/files/stamps.js

@@ -22,12 +22,12 @@ const severityOf = mark => mark === 'warn' ? 'high' : 'notice'
 // obfuscator's fingerprint, a warning's; and its control characters, long
 // lines and category, by their marks, but for what reads as most files do
 // (UTF-8, ASCII) and a source map.
-function npmStampsOf({ path, bytes, readability, runsCode, exfiltration }) {
+function npmStampsOf({ path, bytes, readability, runsCode, exfiltration, script }) {
   const category = npmTaggedCategory(readability)
   const listed = category !== 'ascii' && category !== 'map' && READABILITY.get(category).mark
   return [...npmRunsCodeFlags(runsCode),
     ...npmHostTags(exfiltration).map(([tag, services]) => ({ name: tag, severity: npmHostSeverity(tag, services) })),
-    ...npmLargeCode(path, bytes) ? [{ name: 'Large', severity: 'notice' }] : [],
+    ...npmLargeCode(path, bytes, script) ? [{ name: 'Large', severity: 'notice' }] : [],
     ...readability.obfuscation ? [{ name: 'Obfuscated', severity: 'high' }] : [],
     ...npmReadabilityLabels(readability).filter(label => label === 'controls' || label === 'long')
       .map(label => ({ name: READABILITY.get(label).tag, severity: severityOf(npmLabelMark(readability, label)) })),
@@ -38,9 +38,10 @@ function npmStampsOf({ path, bytes, readability, runsCode, exfiltration }) {
 // isn't, and its size in `bytes`): how it reads (npmFileReadability), what
 // its code does beyond itself (npmRunsCode), the services it names under the
 // hosts' tags (npmExfiltration) and the hosts its code names (npmHosts), and its
-// `stamps` (npmStampsOf).
-export function npmFileRisk(path, text, bytes) {
-  const readability = npmFileReadability(path, text)
-  const exfiltration = npmExfiltration(path, text), runsCode = npmRunsCode(path, text)
-  return { readability, runsCode, exfiltration, hosts: npmHosts(path, text), stamps: npmStampsOf({ path, bytes, readability, runsCode, exfiltration }) }
+// `stamps` (npmStampsOf); read as a script where node runs it as one whatever
+// its name (`script`, npm/files.js npmLoadedScripts).
+export function npmFileRisk(path, text, bytes, script = false) {
+  const readability = npmFileReadability(path, text, script)
+  const exfiltration = npmExfiltration(path, text, script), runsCode = npmRunsCode(path, text, script)
+  return { readability, runsCode, exfiltration, hosts: npmHosts(path, text, script), stamps: npmStampsOf({ path, bytes, readability, runsCode, exfiltration, script }) }
 }

package/risk/index.d.ts

@@ -179,4 +179,74 @@ export function npmReadyDownload(name: string, options: { cache: CacheStore; sig
 // malware.
 export function npmMalwareAdvisory(advisory: { id?: string | undefined; aliases?: readonly string[] | undefined; cwe?: readonly string[] | undefined; title?: string | undefined }): boolean
 
-export function npmFileRisk(path: string, text: string | null, bytes?: number): unknown
+export function npmFileRisk(path: string, text: string | null, bytes?: number, script?: boolean): unknown
+
+// GitHub Actions (actions/), a workflow GitHub can't run thrown as
+// @preventive/lockfile's YamlError. A finding of a workflow's, its `line` from 1; of a reference's own code,
+// with the `file` it is in.
+export interface ActionsFinding extends Finding {
+  line?: number | null
+  file?: string
+}
+
+// What a `uses:` names: an action's or a reusable workflow's, by its `key`,
+// or the repository's own.
+export type ActionUses = { kind: 'action' | 'workflow'; uses: string; repo: string; path: string; ref: string; pin: 'sha' | 'short-sha' | 'ref' | 'expression'; comment: string | null; key?: string; line?: number | null }
+export type Uses = ActionUses | { kind: 'local'; uses: string; path: string; self?: true; job?: true; line?: number | null }
+
+export interface ScanOptions {
+  // Whose repository it is, as an unpinned `uses:` of its owner's is yellow.
+  owner?: string | null
+  // Its lockfiles' paths, the packages each locks, as npx runs those, by
+  // name and by `name@version`, and those only devDependencies need.
+  lockfiles?: { path: string; names: ReadonlySet<string>; dev?: ReadonlySet<string> }[]
+  // Its own actions' metadata by their directories, and its workflows by
+  // their paths: for where its actions install its packages, else each
+  // counts as installing them anywhere; and for the inputs its actions and
+  // reusable workflows write into their scripts, else each of a reusable
+  // workflow's counts as one.
+  actions?: ReadonlyMap<string, string> | null
+}
+
+export type WorkflowScan = { uses: Uses[]; findings: ActionsFinding[] } | { error: 'workflow-unreadable'; detail: string }
+
+export function scanWorkflow(kind: 'workflow' | 'action', text: string, options?: ScanOptions): WorkflowScan
+// The actions of the repository's own a workflow or an action uses, by
+// their directories, and a Docker action's Dockerfile, from its own.
+export function ownFilesOf(kind: 'workflow' | 'action', text: string): { actions: string[]; dockerfile: string | null }
+// A Dockerfile's findings, each on its line.
+export function dockerfileFindings(text: string): ActionsFinding[]
+// A reference by its key, as a scan names it; null for none.
+export function usesOfKey(key: string): ActionUses | null
+
+// GitHub as the asker can read it; null for none.
+export interface ActionsSource {
+  // Its name now, where it moved, and the repository it forks.
+  repo(name: string): Promise<{ fullName: string; defaultBranch: string; fork?: string | null; archived?: boolean; private?: boolean } | null>
+  // Every tag's commit; null where it has too many to list.
+  tags(name: string): Promise<{ tag: string; oid: string }[] | null>
+  tag(name: string, tag: string): Promise<string | null>
+  branch(name: string, branch: string): Promise<string | null>
+  // Its branches, and whether those are all.
+  branches(name: string): Promise<{ branches: { branch: string; oid: string }[]; complete: boolean }>
+  // Whether `sha` is `base` or in its history; null for no such commit. Of two
+  // commits, it holds for good.
+  contains(name: string, base: string, sha: string): Promise<boolean | null>
+  file(name: string, path: string, commit: string): Promise<string | null>
+}
+
+// A reference resolved: its repository as GitHub has it now, its ref's
+// commit, what the ref is, the tags on the commit, and the keys of the
+// references its code makes; null for none.
+export interface ResolvedAction extends Pick<ActionUses, 'kind' | 'repo' | 'path' | 'ref'> {
+  key: string
+  repository: { fullName: string; private: boolean } | null
+  commit: string | null
+  at: 'sha' | 'tag' | 'branch' | null
+  tags: string[]
+  findings: ActionsFinding[]
+  uses: string[]
+}
+
+export function resolveAction(uses: ActionUses, source: ActionsSource, options?: { owner?: string | null }): Promise<ResolvedAction>
+export function keptSource(source: ActionsSource): ActionsSource

package/risk/index.js

@@ -1,7 +1,11 @@
-// What calls for a look at a package version, for a reviewer: risk's
-// heuristics, apart from any view of them. See README.md.
+// What calls for a look at a package version, or a repository's GitHub
+// Actions, for a reviewer: risk's heuristics, apart from any view of them.
+// See README.md.
 export { assessNpm } from './npm/assess.js'
 export { npmMalwareAdvisory } from './npm/malware.js'
 export { DEFAULT_MINIMUM_RELEASE_AGE } from './npm/release.js'
 export { NpmRiskError, npmReadyDownload, npmReadyDownloads } from './npm/registry.js'
 export { SEVERITIES, npmFileRisk } from './files/stamps.js'
+export { ownFilesOf, scanWorkflow } from './actions/findings.js'
+export { dockerfileFindings, keptSource, resolveAction } from './actions/resolve.js'
+export { usesOfKey } from './actions/uses.js'

package/risk/npm/assess.js

@@ -19,7 +19,7 @@ import { npmRiskScore } from './score.js'
 // Which reading of a version an assessment kept (`risk/npm/assessments`) is:
 // one more whenever a heuristic changes what it finds, so one kept by an
 // older reading is read anew.
-const RISK_VERSION = 17
+const RISK_VERSION = 18
 
 // How long an assessment kept may be as JSON, and what risk reads of either
 // version's files: a package past it, whose files name thousands of hosts or

package/risk/npm/compare.js

@@ -8,10 +8,11 @@
 // files the open version adds, and `changed`, those it changes, each `{ path,
 // renamedFrom?, modified? }`, by its path in the open version.
 import { bundleFileSizes, bundleFilesAsMap } from '../../common/bundle-sources.js'
-import { npmVersionFileRisk, npmVersionHosts } from './files.js'
+import { npmLoadedScripts, npmVersionFileRisk, npmVersionHosts } from './files.js'
 import { npmHostFinding } from './held.js'
 import { HOST_TAGS, npmHostSeverity, npmHostsTagged } from '../files/hosts.js'
 import { npmBecameUnreadable, npmBinaryCode, npmLargeCode, npmUnreadable } from '../files/readability.js'
+import { npmIsScript } from '../files/script.js'
 import { SEVERITIES } from '../files/stamps.js'
 import { CREDENTIAL_TAGS, npmFoundAdded, npmRunsCodeFlags, npmRunsCodeTagged, npmRunsCodeWithout } from '../files/runs-code.js'
 import { npmDependencySpecs } from './dependencies.js'
@@ -19,6 +20,21 @@ import { npmFilesDiff } from './diff.js'
 import { npmInstallScripts } from './install-scripts.js'
 import { npmInstallScriptsChange, npmProvenanceLost, npmPublisherChange } from './release.js'
 
+// The files the open version (`other`) runs as scripts that the one compared
+// with (`base`) held, changed or not, but didn't run, by their names
+// (script.js npmIsScript, a `.js` renamed `.txt`) or as code loaded them
+// (npm/files.js npmLoadedScripts), as its code now loads them, each a row as npmFilesDiff's
+// `changed` holds one, its own where it has one: what node runs of them is
+// new, as a changed file's is.
+function npmWokenFiles(base, other, files) {
+  const added = new Set(files.onlyOther.map(row => row.path)), rows = new Map(files.changed.map(row => [row.path, row]))
+  const before = bundleFilesAsMap(base), loadedBefore = npmLoadedScripts(base)
+  // A file that isn't text by its name alone (`payload.js`).
+  const ran = path => loadedBefore.has(path) || (before.has(path) && npmIsScript(path, typeof before.get(path) === 'string' ? before.get(path) : ''))
+  return [...npmLoadedScripts(other)].filter(path => !added.has(path)).map(path => rows.get(path) ?? { path })
+    .filter(row => !ran(row.renamedFrom ?? row.path))
+}
+
 // What the open version does to its files that calls for a look, as red
 // findings: code that runs beyond itself (runs-code.js), new to a file it
 // adds or changes, the kinds with their lines (`runs-code`), those reaching
@@ -26,7 +42,8 @@ import { npmInstallScriptsChange, npmProvenanceLost, npmPublisherChange } from '
 // one of the hosts' tags new to a file it adds or changes (hosts.js
 // npmExfiltration), a finding a tag a level higher than its own
 // (npmHostSeverity: `exfiltration` and `remote` red, `ip-lookup` orange); a
-// code file of 256 KiB or more it adds (npmLargeCode, `large-code`); a file
+// code file of 256 KiB or more it adds, one node runs as a script whatever
+// its name too (npmLargeCode, `large-code`); a file
 // it changes that had no line over 200 characters and now has one over 2,000
 // (npmBecameUnreadable, `now-unreadable`); a file it adds or changes with
 // an obfuscator's fingerprint where the one compared with had none
@@ -39,13 +56,17 @@ import { npmInstallScriptsChange, npmProvenanceLost, npmPublisherChange } from '
 // where its source map was rebuilt with it (`rebuilt`, rebuiltWithMap), as a
 // build minifies a file and writes its map together, and in a `major`
 // release (npmMajorRelease): `now-unreadable` orange where every such file is
-// either, else red.
+// either, else red. A file it held, changed or not, that node now runs as a
+// script (npmWokenFiles) counts as one it changes, large code where it is
+// one, and unreadable now where it wasn't as no script, whatever its lines
+// were.
 function npmFileFindings(base, other, files, major) {
   const added = new Set(files.onlyOther)
   const after = row => npmVersionFileRisk(other, row.path)
   const before = row => added.has(row) ? null : npmVersionFileRisk(base, row.renamedFrom ?? row.path)
   const changed = files.changed.filter(row => row.renamedFrom == null || row.modified)
-  const touched = [...files.onlyOther, ...changed]
+  const woken = npmWokenFiles(base, other, files)
+  const touched = [...new Set([...files.onlyOther, ...changed, ...woken])]
   const sizes = bundleFileSizes(other)
   // The files that hold what they didn't before, each with that.
   const gained = key => touched.map(row => ({ path: row.path, added: npmFoundAdded(after(row)[key], before(row)?.[key] ?? null) })).filter(row => row.added)
@@ -61,13 +82,16 @@ function npmFileFindings(base, other, files, major) {
       const rows = exfiltration.map(row => ({ path: row.path, added: npmHostsTagged(row.added, tag) })).filter(row => row.added)
       return { id: npmHostFinding(tag), severity: rows.length > 0 ? npmHostSeverity(tag, rows[0].added, null) : HOST_TAGS.get(tag), files: rows }
     }),
-    { id: 'large-code', severity: 'critical', files: files.onlyOther.filter(row => npmLargeCode(row.path, sizes.get(row.path))).map(row => ({ path: row.path, bytes: sizes.get(row.path) })) },
-    { id: 'now-unreadable', ...unreadableFinding(major, changed.filter(row => npmBecameUnreadable(row.path, before(row)?.readability, after(row).readability))
+    { id: 'large-code', severity: 'critical', files: [...files.onlyOther, ...woken].filter(row => npmLargeCode(row.path, sizes.get(row.path), npmLoadedScripts(other).has(row.path)))
+      .map(row => ({ path: row.path, bytes: sizes.get(row.path) })) },
+    { id: 'now-unreadable', ...unreadableFinding(major, [...new Set([...changed.filter(row => npmBecameUnreadable(row.path, before(row)?.readability, after(row).readability, npmLoadedScripts(other).has(row.path))),
+      ...woken.filter(row => npmUnreadable(row.path, after(row).readability, true) && !npmUnreadable(row.renamedFrom ?? row.path, before(row).readability))])]
       .map(row => ({ path: row.path, was: before(row).readability.longest, now: after(row).readability.longest,
         ...rebuiltWithMap(base, other, row.path, row.renamedFrom ?? row.path) ? { rebuilt: true } : {} }))) },
     { id: 'obfuscated', severity: 'critical', files: touched.filter(row => after(row).readability.obfuscation && !before(row)?.readability.obfuscation)
       .map(row => ({ path: row.path, obfuscation: after(row).readability.obfuscation })) },
-    { id: 'binary-code', severity: 'critical', files: touched.filter(row => npmBinaryCode(row.path, after(row).readability) && !npmBinaryCode(row.renamedFrom ?? row.path, before(row)?.readability))
+    { id: 'binary-code', severity: 'critical', files: touched.filter(row => npmBinaryCode(row.path, after(row).readability, npmLoadedScripts(other).has(row.path))
+      && !npmBinaryCode(row.renamedFrom ?? row.path, before(row)?.readability, npmLoadedScripts(base).has(row.renamedFrom ?? row.path)))
       .map(row => ({ path: row.path, bytes: sizes.get(row.path) })) },
     { id: 'kept-runs-code', severity: 'high', files: ofKinds(kept, 'found', npmRunsCodeWithout) },
     { id: 'kept-credentials', severity: 'high', files: ofKinds(kept, 'found', npmRunsCodeTagged) },
@@ -149,7 +173,7 @@ const unreadableFinding = (major, files) => ({ severity: major || files.every(ro
 // adds or changes hold all it names anew.
 function npmNewHosts(base, other, files) {
   const found = new Map(), known = npmVersionHosts(base)
-  for (const { path } of [...files.onlyOther, ...files.changed]) {
+  for (const path of new Set([...files.onlyOther, ...files.changed, ...npmWokenFiles(base, other, files)].map(row => row.path))) {
     for (const [host, line] of npmVersionFileRisk(other, path).hosts ?? []) {
       if (known.has(host) || ALLOWED_HOSTS.has(host)) continue
       const place = { path, line }
@@ -179,8 +203,8 @@ export function npmBaseFilesTell(other, manifest) {
   const sizes = bundleFileSizes(other)
   return [...bundleFilesAsMap(other).keys()].some(path => {
     const { runsCode, exfiltration, readability, hosts } = npmVersionFileRisk(other, path)
-    return Boolean(runsCode || exfiltration || readability.obfuscation) || npmUnreadable(path, readability) || npmLargeCode(path, sizes.get(path))
-      || npmBinaryCode(path, readability)
+    return Boolean(runsCode || exfiltration || readability.obfuscation) || npmUnreadable(path, readability, npmLoadedScripts(other).has(path)) || npmLargeCode(path, sizes.get(path), npmLoadedScripts(other).has(path))
+      || npmBinaryCode(path, readability, npmLoadedScripts(other).has(path))
       || [...hosts?.keys() ?? []].some(host => !ALLOWED_HOSTS.has(host))
   })
 }