@preventive/triage 1.0.0-alpha.5 → 1.0.0-alpha.50

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.5",
+  "version": "1.0.0-alpha.50",
   "description": "Client & relay server for triaging of automated reports",
-  "license": "MIT",
+  "license": "MIT OR Apache-2.0",
   "author": {
     "name": "Nikita Skovoroda",
     "email": "chalkerx@gmail.com",
@@ -29,63 +29,344 @@
     "#client/sync-host.js": "./client/sync-host.js"
   },
   "exports": {
-    "./server": "./server/index.ts",
+    "./reap": "./api/reap.ts",
+    "./server": "./server.ts",
+    "./server-e2e": "./server-e2e/index.ts",
+    "./bundle-build-worker": "./server-managed/bundle-build-worker.js",
     "./strip-types-loader": "./strip-types-loader.js",
     "./package.json": "./package.json"
   },
   "bin": {
-    "triage-server": "server/cli.js"
+    "triage-server": "cli.js",
+    "triage-e2e-server": "server-e2e/cli.js",
+    "triage-managed-server": "server-managed/cli.js"
   },
   "files": [
-    "server/auth.ts",
-    "server/bus-receiver.ts",
-    "server/cli.js",
-    "server/config.ts",
-    "server/db-neon.ts",
-    "server/db-revision-sql.ts",
-    "server/db-stmt.ts",
-    "server/db.ts",
-    "server/http.ts",
-    "server/hub.ts",
-    "server/index.ts",
-    "server/lifecycle.ts",
-    "server/neon-driver.ts",
-    "server/npm-proxy.ts",
-    "server/objstore/blob-fs.ts",
-    "server/objstore/blob-vercel.ts",
-    "server/objstore/blob.ts",
-    "server/objstore/fs.ts",
-    "server/objstore/handlers.ts",
-    "server/objstore/init.ts",
-    "server/objstore/reaper.ts",
-    "server/objstore/rest.ts",
-    "server/objstore/sign.ts",
-    "server/objstore/store-neon.ts",
-    "server/objstore/store.ts",
-    "server/objstore/tokens.ts",
-    "server/origin.ts",
-    "server/peer.ts",
-    "server/pubsub.ts",
-    "server/sign.ts",
-    "server/sse-server.ts",
-    "server/sse-session.ts",
-    "server/static.ts",
-    "server/sync-handlers.ts",
-    "server/util.ts",
-    "server/validation.ts",
-    "server/ws-server.ts",
-    "server/config.example.json",
+    "LICENSE-APACHE",
+    "LICENSE-MIT",
+    "api/reap.ts",
+    "cli.js",
+    "server.ts",
+    "server-e2e/app.ts",
+    "server-e2e/auth.ts",
+    "server-e2e/bus-receiver.ts",
+    "server-e2e/cli.js",
+    "server-e2e/config.ts",
+    "server-e2e/db-neon.ts",
+    "server-e2e/db-revision-sql.ts",
+    "server-e2e/db-stmt.ts",
+    "server-e2e/db.ts",
+    "server-e2e/http.ts",
+    "server-e2e/hub.ts",
+    "server-e2e/index.ts",
+    "server-e2e/lifecycle.ts",
+    "server-e2e/neon-driver.ts",
+    "server-e2e/npm-proxy.ts",
+    "server-e2e/objstore/blob-fs.ts",
+    "server-e2e/objstore/blob-vercel.ts",
+    "server-e2e/objstore/blob.ts",
+    "server-e2e/objstore/fetch-mint-guard.ts",
+    "server-e2e/objstore/fs.ts",
+    "server-e2e/objstore/handlers.ts",
+    "server-e2e/objstore/init.ts",
+    "server-e2e/objstore/reaper.ts",
+    "server-e2e/objstore/rest-deny.ts",
+    "server-e2e/objstore/rest-mint.ts",
+    "server-e2e/objstore/rest.ts",
+    "server-e2e/objstore/sign.ts",
+    "server-e2e/objstore/store-neon.ts",
+    "server-e2e/objstore/store.ts",
+    "server-e2e/objstore/tokens.ts",
+    "server-e2e/peer.ts",
+    "server-e2e/pubsub.ts",
+    "server-e2e/sign.ts",
+    "server-e2e/sse-server.ts",
+    "server-e2e/sse-session.ts",
+    "server-e2e/static.ts",
+    "server-e2e/sync-handlers.ts",
+    "server-e2e/util.ts",
+    "server-e2e/validation.ts",
+    "server-e2e/ws-server.ts",
+    "server-e2e/config.example.json",
+    "server-managed/activity.ts",
+    "server-managed/agent-merges.ts",
+    "server-managed/release-commits.ts",
+    "server-managed/app-agents.ts",
+    "server-managed/avatar-store.ts",
+    "server-managed/blob-store.ts",
+    "server-managed/brotli.ts",
+    "server-managed/bundle-advisories.ts",
+    "server-managed/bundle-advisory-inventory.ts",
+    "server-managed/bundle-cache.ts",
+    "server-managed/bundle-build.ts",
+    "server-managed/bundle-build-leases.ts",
+    "server-managed/bundle-build-worker.js",
+    "server-managed/bundle-build-diagnostics.js",
+    "server-managed/bundle-build-diagnostics.d.ts",
+    "server-managed/bundle-catalog.ts",
+    "server-managed/bundle-commits.ts",
+    "server-managed/bundle-store.ts",
+    "server-managed/bundle-summary-cache.ts",
+    "server-managed/bundle.ts",
+    "server-managed/cache-storage.ts",
+    "server-managed/cli.js",
+    "server-managed/combined.ts",
+    "server-managed/commit-coauthors.ts",
+    "server-managed/comparison.ts",
+    "server-managed/comments.ts",
+    "server-managed/config.ts",
+    "server-managed/content-access.ts",
+    "server-managed/crypto.ts",
+    "server-managed/db-methods.ts",
+    "server-managed/db-neon.ts",
+    "server-managed/db-schema.ts",
+    "server-managed/db-table-names.ts",
+    "server-managed/db.ts",
+    "server-managed/dependabot-access.ts",
+    "server-managed/dependabot-alerts.ts",
+    "server-managed/dependency-review-comments.ts",
+    "server-managed/dependency-reviews.ts",
+    "server-managed/github-accounts.ts",
+    "server-managed/github-actions.ts",
+    "server-managed/github-app.ts",
+    "server-managed/github-errors.ts",
+    "server-managed/github-graphql.ts",
+    "server-managed/github-metadata.ts",
+    "server-managed/github-issue-oauth.ts",
+    "server-managed/github-issues.ts",
+    "server-managed/github-issue-links.ts",
+    "server-managed/github-link-oauth.ts",
+    "server-managed/github-links.ts",
+    "server-managed/github-users.ts",
+    "server-managed/github-oauth.ts",
+    "server-managed/github-pulls.ts",
+    "server-managed/github-requests.ts",
+    "server-managed/http-response.ts",
+    "server-managed/http.ts",
+    "server-managed/link-reports.ts",
+    "server-managed/locked-packages.ts",
+    "server-managed/lru.ts",
+    "server-managed/import-triage.ts",
+    "server-managed/managed-issues.ts",
+    "server-managed/management.ts",
+    "server-managed/management-catalog.ts",
+    "server-managed/object-storage.ts",
+    "server-managed/object-storage-disk.ts",
+    "server-managed/object-storage-vercel.ts",
+    "server-managed/index.ts",
+    "server-managed/npm-insights.ts",
+    "server-managed/npm-risk.ts",
+    "server-managed/npm-provenance.ts",
+    "server-managed/kept.ts",
+    "server-managed/kept-briefly.ts",
+    "server-managed/npm-kept.ts",
+    "server-managed/npm-loads.ts",
+    "server-managed/npm-delta.ts",
+    "server-managed/npm-delta-worker.js",
+    "server-managed/lockfile-scope.ts",
+    "server-managed/npm-manifest.ts",
+    "server-managed/npm-packages.ts",
+    "server-managed/package-entry-points.ts",
+    "server-managed/pretty-print.ts",
+    "server-managed/pull-reviews.ts",
+    "server-managed/rename-diff.ts",
+    "server-managed/rename-diff-worker.js",
+    "server-managed/public-workspace.ts",
+    "server-managed/pull-dependencies.ts",
+    "server-managed/pull-dependency-reviews.ts",
+    "server-managed/pull-comment-reviews.ts",
+    "server-managed/commit-lockfiles.ts",
+    "server-managed/queue.ts",
+    "server-managed/repo-path.ts",
+    "server-managed/report-migration.ts",
+    "server-managed/report-query.ts",
+    "server-managed/report-response.ts",
+    "server-managed/report-store.ts",
+    "server-managed/report-sources.ts",
+    "server-managed/revisions.ts",
+    "server-managed/repository-browser.ts",
+    "server-managed/repository-changes.ts",
+    "server-managed/repository-code.ts",
+    "server-managed/repository-dependency-reviews.ts",
+    "server-managed/request-timing.ts",
+    "server-managed/reviewed-dependencies.ts",
+    "server-managed/repository-agents.ts",
+    "server-managed/repository-history.ts",
+    "server-managed/repository-squashes.ts",
+    "server-managed/repository-issues.ts",
+    "server-managed/repository-pulse.ts",
+    "server-managed/repository-pulls.ts",
+    "server-managed/repository-aliases.ts",
+    "server-managed/repository-discovery.ts",
+    "server-managed/repository-policy.ts",
+    "server-managed/repository-actions.ts",
+    "server-managed/repository-risk.ts",
+    "server-managed/repository-risk-assess.ts",
+    "server-managed/repository-risk-audit.ts",
+    "server-managed/repository-risk-read.ts",
+    "server-managed/scan-downloads.ts",
+    "server-managed/session.ts",
+    "server-managed/slugs.ts",
+    "server-managed/solidity-entry-points.ts",
+    "server-managed/sql-postgres.ts",
+    "server-managed/sql.ts",
+    "server-managed/static.ts",
+    "server-managed/storage.ts",
+    "server-managed/storage-command.ts",
+    "server-managed/storage-db.ts",
+    "server-managed/storage-encryption.ts",
+    "server-managed/storage-maintenance.ts",
+    "server-managed/storage-payload.ts",
+    "server-managed/storage-stores.ts",
+    "server-managed/team-catalog.ts",
+    "server-managed/team-feed.ts",
+    "server-managed/team-npm-scopes.ts",
+    "server-managed/team-app.ts",
+    "server-managed/team-reports.ts",
+    "server-managed/triage-response.ts",
+    "server-managed/type-only.ts",
+    "server-managed/type-only-worker.js",
+    "server-managed/uploads.ts",
+    "server-managed/view-as.ts",
+    "server-managed/upstream-cache.ts",
+    "server-managed/workspace-shares.ts",
+    "server-common/database-config.ts",
+    "server-common/initialize.ts",
+    "server-common/reap.ts",
+    "server-common/npm-advisories.ts",
+    "server-common/origin.ts",
+    "server-common/standalone.ts",
+    "server-common/storage-log.ts",
+    "server-common/storage-crypto.ts",
+    "server-common/vercel-blob.ts",
+    "server-common/scan-config.ts",
+    "common/bundle-commit.d.ts",
+    "common/bundle-commit.js",
+    "common/bundle-compare-diff.js",
+    "common/bundle-compare-versions.js",
+    "common/bundle-comparison.d.ts",
+    "common/bundle-comparison.js",
+    "common/bundle-compare-diff.d.ts",
+    "common/bundle-compare-inputs.d.ts",
+    "common/bundle-compare-inputs.js",
+    "common/bundle-metadata.d.ts",
+    "common/bundle-pkg-of.d.ts",
+    "common/bundle-pkg-of.js",
+    "common/bundle-metadata.js",
+    "common/bundle-reasons.d.ts",
+    "common/bundle-reasons.js",
+    "common/bundle-sources.d.ts",
+    "common/bundle-sources.js",
+    "common/bundle-source-links.d.ts",
+    "common/bundle-source-links.js",
+    "common/bundle-sourcemap.d.ts",
+    "common/bundle-sourcemap.js",
+    "common/bundle-stats.js",
+    "common/bundle-tabs.js",
+    "common/code-language.js",
+    "common/default-scan-models.ts",
+    "common/dependency-reviews.js",
+    "common/dependency-reviews.d.ts",
+    "common/finding-id.js",
+    "common/finding-duplicates.js",
+    "common/finding-filters.js",
+    "common/github-pr.ts",
+    "common/github-issue-labels.js",
+    "common/github-issue-labels.d.ts",
+    "common/gzip.js",
+    "common/pretty-print.d.ts",
+    "common/pretty-print.js",
+    "common/line-diff.d.ts",
+    "common/line-diff.js",
+    "common/linked-workspace-groups.js",
+    "common/managed/agent-tasks.ts",
+    "common/managed/comments.ts",
+    "common/managed/finding-detail.d.ts",
+    "common/managed/finding-detail.js",
+    "common/managed/github-agents.ts",
+    "common/managed/github-logins.ts",
+    "common/managed/npm-packages.d.ts",
+    "common/managed/npm-packages.js",
+    "common/managed/permissions.ts",
+    "common/managed/report-content.ts",
+    "common/managed/repository-alias.ts",
+    "common/managed/report-filter.ts",
+    "common/managed/roles.ts",
+    "common/managed/routes.d.ts",
+    "common/managed/routes.js",
+    "common/managed/scan-models.ts",
+    "common/managed/team-app.js",
+    "common/managed/team-app.d.ts",
+    "common/managed/triage.ts",
+    "common/managed/upload-seal.ts",
     "common/save-error-reason.ts",
+    "common/revalidation-conflicts.js",
+    "common/revalidation-input-groups.js",
+    "common/server-info.ts",
+    "common/scan-server.ts",
+    "common/security-links.d.ts",
+    "common/security-links.js",
     "common/utf8.d.ts",
     "common/utf8.js",
+    "common/workspace-app.js",
+    "common/workspace-groups.js",
+    "risk/index.js",
+    "risk/index.d.ts",
+    "risk/files/characters.js",
+    "risk/files/hosts.js",
+    "risk/files/readability.js",
+    "risk/files/runs-code.js",
+    "risk/files/script.js",
+    "risk/files/stamps.js",
+    "risk/npm/assess.js",
+    "risk/npm/combined.js",
+    "risk/npm/compare.js",
+    "risk/npm/dependencies.js",
+    "risk/npm/diff.js",
+    "risk/npm/held.js",
+    "risk/npm/files.js",
+    "risk/npm/downloads.js",
+    "risk/npm/install-scripts.js",
+    "risk/npm/malware.js",
+    "risk/npm/manifest.js",
+    "risk/npm/new-dependency.js",
+    "risk/npm/old-version.js",
+    "risk/npm/registry.js",
+    "risk/npm/release.js",
+    "risk/npm/score.js",
+    "risk/npm/specs.js",
+    "risk/npm/tarball.js",
+    "risk/actions/findings.js",
+    "risk/actions/resolve.js",
+    "risk/actions/uses.js",
+    "risk/actions/workflow.js",
+    "risk/actions/scripts/commands.js",
+    "risk/actions/scripts/grade.js",
+    "risk/actions/scripts/packages.js",
+    "risk/actions/scripts/shell.js",
+    "client/dependency-paths.d.ts",
+    "client/dependency-paths.js",
+    "client/finding-link.js",
+    "client/linked-findings.d.ts",
+    "client/linked-findings.js",
+    "out/activity.js",
     "out/brotli-fallback.js",
+    "out/chunk-*.js",
+    "out/client-managed.js",
+    "out/client-managed-import.js",
     "out/client-sync.js",
+    "out/compare.js",
+    "out/dialogs.js",
     "out/graph.js",
+    "out/github-issue-authorized.html",
+    "out/github-issue-authorized.js",
     "out/icon-maskable.svg",
     "out/icon.svg",
     "out/index.html",
     "out/manifest.webmanifest",
     "out/prism.js",
+    "out/scan.js",
+    "out/stasis.svg",
     "out/terminal.js",
     "out/view.css",
     "out/view.html",
@@ -94,40 +375,59 @@
   ],
   "scripts": {
     "lint": "node --run lint:js && node --run lint:css && node --run lint:ts",
-    "lint:js": "oxlint -c .oxlintrc.json --ignore-pattern=ui/logs.js ./tests/ ./common/ ./server/ ./client/ ./ui/",
+    "lint:js": "oxlint -c .oxlintrc.json --ignore-pattern=ui/logs.js ./cli.js ./server.ts ./tests/ ./common/ ./server-common/ ./server-e2e/ ./server-managed/ ./client/ ./ui/ ./risk/ ./api/",
     "lint:css": "stylelint 'ui/**/*.css'",
     "lint:ts": "tsc --noEmit",
     "prepack": "node --run build",
     "build": "node build.js build",
     "serve": "node build.js serve",
-    "server": "node server/index.ts",
-    "test": "node --js-base-64 --experimental-test-module-mocks --test ./tests/*.test.js"
+    "server": "node --run server-e2e --",
+    "server-e2e": "node server-e2e/index.ts",
+    "server-managed": "node server-managed/index.ts",
+    "server-managed-test": "node server-managed/test-server.ts",
+    "test": "node --js-base-64 --require=./tests/_resource-loader.js --experimental-test-module-mocks --test-timeout=120000 --test-concurrency=$(node -p 'Math.ceil(os.availableParallelism() * 1.5)') --test ./tests/*.test.js"
   },
   "devDependencies": {
-    "@electric-sql/pglite": "^0.4.5",
-    "@exodus/stasis": "^1.0.0-alpha.1",
-    "@noble/ciphers": "^2.2.0",
-    "@preventive/terminal": "^1.3.0",
+    "@electric-sql/pglite": "^0.5.8",
+    "@noble/ciphers": "^2.4.0",
+    "@preventive/terminal": "2.0.0-beta.3",
     "@rray/frontend": "^1.0.0",
-    "@stylistic/stylelint-plugin": "^5.1.0",
-    "@types/node": "^25.6.2",
-    "@types/ws": "^8.18.1",
+    "@stylistic/stylelint-plugin": "^5.3.1",
+    "@types/node": "^26.6.4",
+    "@types/ws": "^8.18.2",
+    "@vercel/functions": "^3.9.11",
     "brotli": "^1.3.3",
-    "esbuild": "^0.27.4",
-    "lit": "^3.3.2",
+    "esbuild": "^0.28.2",
+    "lit": "^3.3.3",
     "minify-html-literals": "^1.3.5",
-    "oxlint": "^1.63.0",
+    "oxlint": "^1.87.0",
     "prismjs": "^1.30.0",
-    "stylelint": "^17.11.0",
+    "stylelint": "^17.16.0",
     "stylelint-config-recommended": "^18.0.0",
-    "typescript": "^6.0.3"
+    "typescript": "^7.0.2"
   },
   "dependencies": {
-    "ws": "^8.20.1"
+    "@exodus/stasis": "1.0.0-beta.11",
+    "@exodus/stasis-core": "1.0.0-beta.11",
+    "@preventive/archive": "^1.2.0",
+    "@preventive/compare": "^1.2.11",
+    "@preventive/diff": "^1.1.0",
+    "@preventive/lockfile": "^1.2.0",
+    "@preventive/publishers": "^1.1.0",
+    "@preventive/report": "^1.0.0",
+    "@preventive/sourcemap": "1.0.0-alpha.1",
+    "@preventive/upstream": "^1.3.0",
+    "css-tree": "^3.2.1",
+    "oxc-minify": "^0.152.0",
+    "oxc-parser": "^0.152.0",
+    "oxfmt": "^0.72.0",
+    "semver": "^7.8.5",
+    "ws": "^8.22.0"
   },
   "peerDependencies": {
     "@neondatabase/serverless": "^1.0.2",
-    "@vercel/blob": "^2.3.3"
+    "@vercel/blob": "^2.3.3",
+    "@vercel/functions": "^3.9.11"
   },
   "peerDependenciesMeta": {
     "@neondatabase/serverless": {
@@ -135,6 +435,9 @@
     },
     "@vercel/blob": {
       "optional": true
+    },
+    "@vercel/functions": {
+      "optional": true
     }
   },
   "packageManager": "pnpm@10.33.4+sha512.1c67b3b359b2d408119ba1ed289f34b8fc3c6873412bec6fd264fbdc82489e510fcbecb9ce9d22dae7f3b76269d8441046014bdca53b9979cd7a561ad631b800"

package/risk/actions/findings.js

@@ -0,0 +1,161 @@
+// What a workflow, or an action's metadata, calls for by its own text (README.md).
+import { YamlError } from '@preventive/lockfile/yaml.js'
+import { readWorkflow } from './workflow.js'
+import { installsOf } from './scripts/commands.js'
+import { dotted, imageFinding, lockedName, namesPullHead, scriptFindings, scriptInjections, within } from './scripts/grade.js'
+import { ownerKind, usesKey } from './uses.js'
+import { resolved } from '../npm/files.js'
+
+// What a `uses:` calls for by its pin, a reference's with its `key`.
+function usesFinding(uses, owner) {
+  if (uses.kind === 'invalid') return { id: 'invalid-uses', severity: 'low', uses: uses.uses }
+  if (uses.kind === 'docker') return uses.digest ? null : imageFinding(uses.uses, uses)
+  if ((uses.kind !== 'action' && uses.kind !== 'workflow') || uses.pin === 'sha') return null
+  const at = { uses: uses.uses, key: usesKey(uses) }
+  return uses.pin === 'short-sha' ? { id: 'short-sha', severity: 'high', ...at } : { id: 'unpinned', severity: ownerKind(uses.repo, owner) === 'third-party' ? 'high' : 'moderate', ...at, ref: uses.ref }
+}
+
+// An action that installs a project's npm packages, by its name: npm's,
+// Yarn's, pnpm's or Bun's install of dependencies (`bahmutov/npm-install`),
+// not another tool's (`cachix/install-nix-action`).
+const INSTALLER = /(?:npm|yarn|pnpm|bun|node[-_]?modules)[-_]?(?:ci|install)|install[-_]?(?:npm|yarn|pnpm|bun|node[-_]?modules|dep(?:endencie)?s|packages)/iu
+
+// Where a step installs a project's packages, each `{ at, prod }`: a
+// script's install's directory or the one it names, and whether it leaves
+// devDependencies out; an action of its own's, by its metadata (ScanOptions
+// `actions`), anywhere (null) where none is told; and anywhere for an action
+// that installs them (cypress-io/github-action's unless `install: false`,
+// pnpm/action-setup's with `run_install`).
+const ANYWHERE = [{ at: null, prod: false }]
+function installs(step, actions, seen = new Set()) {
+  if (step.uses?.kind === 'local') return actions ? ownInstalls(actions, step.uses.path, seen) : ANYWHERE
+  const repo = step.uses?.repo?.toLowerCase()
+  if (repo && (INSTALLER.test(repo) || (repo === 'cypress-io/github-action' && String(step.with?.install) !== 'false'))) return ANYWHERE
+  if (repo === 'pnpm/action-setup' && /^(?:true|\[|\{|-)/u.test(String(step.with?.run_install ?? '').trim())) return ANYWHERE
+  return step.run ? installsOf(step.run.script, step.run.production).map(({ into, prod }) => ({ at: directoryOf(step.run.workingDirectory, into), prod })) : []
+}
+
+// Where the repository's own action at `dir` installs, by its steps, each
+// action of its own once.
+function ownInstalls(actions, dir, seen) {
+  const read = actions.has(dir) && !seen.has(dir) && seen.add(dir) ? readWorkflow('action', actions.get(dir)) : null
+  return read && !(read instanceof YamlError) ? read.jobs.flatMap(job => job.steps.flatMap(step => installs(step, actions, seen))) : []
+}
+
+// A step's directory, and a path from it (`into`), from the repository's
+// root, '' for it; as written where an expression or a variable names it, or
+// it is out of the repository, so that it is within the same alone.
+function directoryOf(workingDirectory, into = null) {
+  const path = into?.startsWith('/') ? into : [workingDirectory, into].filter(Boolean).join('/')
+  return /\$|^\//u.test(path) ? path : resolved([], path)?.join('/') ?? path
+}
+
+// Whether the nearest lockfiles at or above `directory`, its project's, lock
+// what npx runs by `name`: `dev` where only devDependencies need it in each
+// that does.
+const lockDir = path => path.includes('/') ? path.slice(0, path.lastIndexOf('/')) : ''
+function lockedIn(lockfiles, directory, name) {
+  const above = lockfiles.filter(({ path }) => within(lockDir(path), directory))
+  const nearest = Math.max(...above.map(({ path }) => lockDir(path).length))
+  const locking = above.filter(({ path, names }) => lockDir(path).length === nearest && lockedName(names, name))
+  return locking.length > 0 && (locking.every(({ dev }) => dev && lockedName(dev, name)) ? 'dev' : true)
+}
+
+// The inputs a text names (`${{ inputs.title }}`).
+const inputsIn = text => typeof text === 'string' ? [...dotted(text).matchAll(/\$\{\{[^}]*?\binputs\s*\.\s*([\w-]+)/gu)].map(match => match[1]) : []
+
+// The inputs a step's action, or a job's reusable workflow, writes into a
+// script: github-script's `script`; those one of the repository's own
+// (ScanOptions `actions`) names in its `run:`s or its jobs' images, or hands
+// to such an input of a step's or a job's; and each of another reusable
+// workflow's, or one whose text isn't told, as it may.
+function scriptInputs(step, actions, seen = new Set()) {
+  if (step.uses?.repo?.toLowerCase() === 'actions/github-script') return ['script']
+  if (step.uses?.kind === 'workflow' || (step.uses?.job && !actions?.has(step.uses.path))) return Object.keys(step.with ?? {})
+  const path = step.uses?.kind === 'local' && actions?.has(step.uses.path) && !seen.has(step.uses.path) ? step.uses.path : null
+  const read = path === null ? null : readWorkflow(step.uses.job ? 'workflow' : 'action', actions.get(path))
+  if (!read || read instanceof YamlError) return []
+  const inner = new Set(seen).add(path)
+  const handed = each => scriptInputs(each, actions, inner).flatMap(input => inputsIn(each.with?.[input]))
+  return [...new Set(read.jobs.flatMap(job => [...job.uses ? handed(job) : [], ...job.images.flatMap(image => inputsIn(image.text)),
+    ...job.steps.flatMap(each => [...inputsIn(each.run?.script), ...handed(each)])]))]
+}
+
+// Injections through the inputs an action writes into its scripts, and a
+// fork's code or artifacts taken where the workflow runs with its secrets.
+function stepFindings(step, triggers, actions) {
+  const repo = step.uses?.repo?.toLowerCase()
+  const found = scriptInputs(step, actions).flatMap(input => scriptInjections(step.with?.[input], triggers).map(({ index: _index, ...finding }) => ({ ...finding, line: step.withLines[input] })))
+  const forks = ['pull_request_target', 'workflow_run', 'issue_comment'].some(event => triggers.includes(event))
+  if (forks && repo === 'actions/checkout' && (namesPullHead(step.with?.ref) || namesPullHead(step.with?.repository))) {
+    found.push({ id: 'pwn-request', severity: 'critical', ref: String(step.with.ref ?? step.with.repository), line: step.withLines.ref ?? step.withLines.repository ?? step.line })
+  }
+  if (forks && step.run && /\bgh\s+pr\s+checkout\b/u.test(step.run.script)) found.push({ id: 'pwn-request', severity: 'critical', ref: 'gh pr checkout', line: step.run.line })
+  if (triggers.includes('workflow_run') && ((repo === 'actions/download-artifact' && (step.with?.['run-id'] !== undefined || step.with?.['github-token'] !== undefined))
+    || repo === 'dawidd6/action-download-artifact' || /\bgh\s+run\s+download\b/u.test(step.run?.script ?? ''))) found.push({ id: 'untrusted-artifact', severity: 'high', line: step.uses?.line ?? step.run.line })
+  return found
+}
+
+// A job's findings, each script graded by the installs before it and its lockfiles.
+function jobFindings(job, triggers, { owner, lockfiles, external, actions }) {
+  const found = []
+  if (job.uses) {
+    const finding = usesFinding(job.uses, owner)
+    if (finding) found.push({ ...finding, line: job.uses.line })
+    if (job.secrets === 'inherit' && job.uses.repo && ownerKind(job.uses.repo, owner) === 'third-party') found.push({ id: 'secrets-inherited', severity: 'high', uses: job.uses.uses, key: usesKey(job.uses), line: job.uses.line })
+    // An input a reusable workflow writes into its scripts.
+    for (const input of scriptInputs(job, actions)) for (const { index: _index, ...injected } of scriptInjections(job.with?.[input], triggers)) found.push({ ...injected, line: job.withLines[input] })
+  }
+  for (const image of job.images) {
+    if (!image.read?.digest && !image.text.includes('${{')) found.push({ ...imageFinding(image.text, image.read), line: image.line })
+    for (const { index: _index, ...injected } of scriptInjections(image.text, triggers)) found.push({ ...injected, line: image.line })
+  }
+  const installed = []
+  for (const step of job.steps) {
+    const finding = step.uses && usesFinding(step.uses, owner)
+    if (finding) found.push({ ...finding, line: step.uses.line })
+    if (step.run) {
+      const directory = dir => directoryOf(step.run.workingDirectory, dir)
+      const locked = (name, dir) => !external && lockedIn(lockfiles, directory(dir), name)
+      const before = (dev, dir) => installed.some(({ at, prod }) => within(at, directory(dir)) && !(prod && dev))
+      found.push(...scriptFindings(step.run, { locked, installed: before, external, triggers }))
+    }
+    found.push(...stepFindings(step, triggers, actions))
+    installed.push(...installs(step, actions))
+  }
+  return found
+}
+
+// Every finding of a workflow read (readWorkflow), in its lines' order, by
+// index.d.ts ScanOptions.
+export function workflowFindings(read, { owner = null, lockfiles = [], external = false, actions = null } = {}) {
+  const found = read.jobs.flatMap(job => jobFindings(job, read.triggers, { owner, lockfiles, external, actions }))
+  if (/^node(?:12|16)$/u.test(read.using ?? '')) found.push({ id: 'deprecated-runtime', severity: 'low', using: read.using, line: read.usingLine })
+  return found.toSorted((a, b) => (a.line ?? 0) - (b.line ?? 0))
+}
+
+// The references a workflow read makes: of GitHub's, each with its `key`, and
+// of its own (`local`).
+export function workflowUses(read) {
+  return read.jobs.flatMap(job => [job.uses, ...job.steps.map(step => step.uses)]).flatMap(uses => {
+    if (uses?.kind === 'local') return [uses]
+    return uses?.kind === 'action' || uses?.kind === 'workflow' ? [{ ...uses, key: usesKey(uses) }] : []
+  })
+}
+
+// The actions of the repository's own a workflow or an action uses, by
+// their directories, and a Docker action's Dockerfile; none for one GitHub
+// can't run.
+export function ownFilesOf(kind, text) {
+  const read = readWorkflow(kind, text)
+  if (read instanceof YamlError) return { actions: [], dockerfile: null }
+  return { actions: workflowUses(read).flatMap(uses => uses.kind === 'local' && !uses.job ? [uses.path] : []), dockerfile: read.dockerfile?.path ?? null }
+}
+
+// A workflow's or an action's metadata's (`kind`) references and findings;
+// why not (`workflow-unreadable`) for one GitHub can't run.
+export function scanWorkflow(kind, text, options = {}) {
+  const read = readWorkflow(kind, text)
+  if (read instanceof YamlError) return { error: 'workflow-unreadable', detail: read.message.slice(0, 500) }
+  return { uses: workflowUses(read), findings: workflowFindings(read, options) }
+}