@preventive/triage 1.0.0-alpha.5 → 1.0.0-alpha.50

package/risk/actions/resolve.js

@@ -0,0 +1,219 @@
+// A reference resolved on GitHub (`source`, index.d.ts ActionsSource): its
+// repository, its ref's commit and its own code's findings (README.md).
+import { YamlError } from '@preventive/lockfile/yaml.js'
+import { readWorkflow } from './workflow.js'
+import { workflowFindings, workflowUses } from './findings.js'
+import { imageFinding, scriptFindings } from './scripts/grade.js'
+import { isWorkflowPath, ownerKind, readImage, readUses, usesKey } from './uses.js'
+
+// An action's tags as versions: a release's (`v4.2.1`), and a major (`v4`) or
+// minor one (`v4.2`) moved to its line's latest. `[major, minor, patch]`,
+// null for a part a tag hasn't; null for no version.
+export function tagVersion(tag) {
+  const m = typeof tag === 'string' ? /^v?(\d{1,9})(?:\.(\d{1,9}))?(?:\.(\d{1,9}))?$/u.exec(tag) : null
+  return m && [Number(m[1]), m[2] === undefined ? null : Number(m[2]), m[3] === undefined ? null : Number(m[3])]
+}
+
+const isRelease = version => version !== null && version[2] !== null
+
+const byVersion = (a, b) => (b[0] - a[0]) || ((b[1] ?? -1) - (a[1] ?? -1)) || ((b[2] ?? -1) - (a[2] ?? -1))
+
+// Whether a release is of a major or minor tag's line: `v4`'s `4.x.y`.
+const ofLine = (version, other) => isRelease(other) && other[0] === version[0] && (version[1] === null || other[1] === version[1])
+
+// The versions of `tags` (`{ tag, oid }` each), the highest first.
+const versionsOf = tags => tags.flatMap(({ tag, oid }) => { const version = tagVersion(tag); return version ? [{ tag, oid, version }] : [] })
+  .toSorted((a, b) => byVersion(a.version, b.version))
+
+// The latest release's tag of `tags`, else the highest version's; null where
+// none is one.
+export function latestOf(tags) {
+  const versions = versionsOf(tags)
+  return (versions.find(({ version }) => isRelease(version)) ?? versions[0])?.tag ?? null
+}
+
+// The highest release of each major line, the latest line first: where a
+// commit is most likely in a release's history.
+export function newestOfLines(tags) {
+  const seen = new Set()
+  return versionsOf(tags).filter(({ version }) => isRelease(version) && !seen.has(version[0]) && seen.add(version[0]))
+}
+
+// An instruction's lines, its continuations (`\` at a line's end) joined,
+// and each heredoc's (`<<EOF`) through its delimiter, as BuildKit reads one.
+function instructions(text) {
+  const lines = text.split('\n').map(line => line.replace(/\r$/u, ''))
+  const found = []
+  for (let at = 0; at < lines.length; at++) {
+    const start = at
+    while (lines[at].endsWith('\\') && at + 1 < lines.length) at++
+    for (const { 2: quoted, 3: bare } of lines.slice(start, at + 1).join('\n').matchAll(/(?<!<)<<-?\s*(?:(["'])(.+?)\1|([^\s"'<>|&;()]+))/gu)) {
+      do at++
+      while (at < lines.length - 1 && lines[at].trim() !== (quoted ?? bare))
+    }
+    found.push({ start, lines: lines.slice(start, Math.min(at, lines.length - 1) + 1) })
+    at = Math.min(at, lines.length - 1)
+  }
+  return found
+}
+
+// A `RUN`'s command, its exec form (`RUN ["sh", "-c", "…"]`) as words.
+function runCommand(text) {
+  if (!text.trimStart().startsWith('[')) return text
+  try {
+    const words = JSON.parse(text)
+    return Array.isArray(words) ? words.map(word => /[\s'"]/u.test(String(word)) ? `'${String(word).replaceAll("'", "'\\''")}'` : String(word)).join(' ') : text
+  } catch { return text }
+}
+
+// A Docker action's Dockerfile: each `FROM` by a tag, a build argument's
+// yellow, and each `RUN` read as a script's (scripts/grade.js).
+export function dockerfileFindings(text) {
+  const findings = [], script = [], stages = new Set()
+  for (const { start, lines } of instructions(text)) {
+    const first = /^\s*(FROM|RUN)\s+(.*)$/iu.exec(lines[0])
+    // A RUN's options (`--mount=…`, `--network=…`) aren't its command.
+    if (first?.[1].toUpperCase() === 'RUN') { script.push(runCommand(first[2].replace(/^(?:--[a-z-]+(?:=\S*)?\s+)*/iu, '')), ...lines.slice(1)); continue }
+    script.push(...lines.map(() => ''))
+    if (!first) continue
+    const words = lines.join(' ').replaceAll('\\', ' ').trim().split(/\s+/u).slice(1).filter(word => !word.startsWith('--'))
+    const [image, as, stage] = words
+    const built = image && stages.has(image.toLowerCase())
+    if (as?.toLowerCase() === 'as' && stage) stages.add(stage.toLowerCase())
+    if (!image || image === 'scratch' || built) continue
+    const read = readImage(image)
+    if (image.includes('$')) findings.push({ id: 'unpinned-image', severity: 'moderate', image, line: start + 1 })
+    else if (!read?.digest) findings.push({ ...imageFinding(image, read), line: start + 1 })
+  }
+  const run = { script: script.join('\n'), line: 1, start: 1 }
+  findings.push(...scriptFindings(run, { locked: () => false, installed: () => false, external: true, triggers: [] }))
+  return findings.toSorted((a, b) => a.line - b.line)
+}
+
+// How many major lines' releases a commit is looked for in.
+const MAX_LINES = 10
+
+async function repositoryOf(uses, source, owner) {
+  const info = await source.repo(uses.repo)
+  if (!info) return { info: null, findings: [{ id: 'repo-missing', severity: ownerKind(uses.repo, owner) === 'own' ? 'moderate' : 'critical' }] }
+  const findings = []
+  if (info.fullName.toLowerCase() !== uses.repo.toLowerCase()) findings.push({ id: 'repo-moved', severity: 'high', to: info.fullName })
+  if (info.fork) findings.push({ id: 'repo-fork', severity: 'low', parent: info.fork })
+  if (info.archived) findings.push({ id: 'repo-archived', severity: 'low' })
+  return { info, findings }
+}
+
+// Where `sha` is in the history (`default`, `release`, `branch`), `none`,
+// `unknown` where not all could be looked in, or `missing`: each branch and
+// release looked in once, from its commit.
+async function reachable(source, info, sha, tags) {
+  const name = info.fullName, releases = newestOfLines(tags ?? []).slice(0, MAX_LINES)
+  if (releases.some(({ oid }) => oid === sha)) return 'release'
+  const head = await source.branch(name, info.defaultBranch)
+  const onDefault = await source.contains(name, head ?? info.defaultBranch, sha)
+  if (onDefault === null) return 'missing'
+  if (onDefault) return 'default'
+  const looked = new Set([head])
+  const contains = oid => !looked.has(oid) && looked.add(oid) && source.contains(name, oid, sha)
+  for (const { oid } of releases) if (await contains(oid)) return 'release'
+  const { branches, complete } = await source.branches(name)
+  for (const { oid } of branches) if (oid === sha || await contains(oid)) return 'branch'
+  return complete && tags !== null ? 'none' : 'unknown'
+}
+
+const tagsOn = (tags, commit) => tags?.filter(({ oid }) => oid === commit).map(({ tag }) => tag) ?? []
+
+function tagFindings(ref, commit, tags) {
+  const version = tagVersion(ref)
+  if (!version) return [{ id: 'not-version', severity: 'moderate' }]
+  if (!tags) return []
+  const findings = []
+  const releases = versionsOf(tags).filter(other => ofLine(version, other.version))
+  if (version[2] === null && releases.length > 0 && !releases.some(({ oid }) => oid === commit)) findings.push({ id: 'tag-off-release', severity: 'high', release: releases[0].tag })
+  const latest = latestOf(tags)
+  if (latest && tagVersion(latest)[0] > version[0]) findings.push({ id: 'outdated', severity: 'low', latest })
+  return findings
+}
+
+// A ref not a commit, resolved as GitHub resolves it, a tag before a branch.
+async function refOf(uses, info, source, tags) {
+  const name = info.fullName
+  const [tagged, branched] = await Promise.all([tags ? tags.find(({ tag }) => tag === uses.ref)?.oid ?? null : source.tag(name, uses.ref), source.branch(name, uses.ref)])
+  if (!tagged && !branched) return { commit: null, at: null, findings: [{ id: 'ref-missing', severity: 'moderate' }] }
+  if (!tagged) return { commit: branched, at: 'branch', findings: [{ id: 'branch-ref', severity: 'high' }] }
+  const findings = branched ? [{ id: 'ambiguous-ref', severity: 'high', branch: branched }] : []
+  findings.push(...tagFindings(uses.ref, tagged, tags))
+  const where = await reachable(source, info, tagged, tags)
+  if (where === 'none') findings.push({ id: 'tag-off-branch', severity: 'low' })
+  return { commit: tagged, at: 'tag', findings }
+}
+
+// Whether a version a comment names is a tag on the commit, or one's line.
+function commentHolds(comment, named) {
+  const version = tagVersion(comment)
+  return named.some(tag => tag === comment || tag.replace(/^v/u, '') === comment.replace(/^v/u, '') || (version && version[2] === null && ofLine(version, tagVersion(tag))))
+}
+
+// A commit, looked for in the history where no tag names it, held to its comment.
+async function pinnedOf(uses, info, source, tags) {
+  const commit = uses.ref
+  let named = tagsOn(tags, commit)
+  if (!tags && uses.comment && await source.tag(info.fullName, uses.comment) === commit) named = [uses.comment]
+  const findings = []
+  if (named.length === 0) {
+    const where = await reachable(source, info, commit, tags)
+    if (where === 'missing') findings.push({ id: 'commit-missing', severity: 'high' })
+    else if (where === 'none') findings.push({ id: 'imposter-commit', severity: 'critical' })
+    else if (where === 'unknown') findings.push({ id: 'unverified-commit', severity: 'high' })
+    else if (tags) findings.push({ id: 'untagged-commit', severity: 'moderate', on: where })
+  }
+  if (uses.comment && !commentHolds(uses.comment, named)) findings.push({ id: 'comment-mismatch', severity: 'high', comment: uses.comment, tags: named })
+  return { commit, at: 'sha', findings }
+}
+
+// A `$/path` (the repository's own at the commit running) as a reference.
+const selfRef = (uses, info, commit) => readUses(`${info.fullName}/${uses.path}@${commit}`, { job: isWorkflowPath(uses.path) })
+
+// What a reference runs at `commit` (action.yml, a reusable workflow, a
+// Dockerfile): its findings, each with its file, and the references it makes.
+async function codeOf(uses, info, commit, source) {
+  const dir = uses.path ? `${uses.path}/` : '', name = info.fullName
+  const candidates = uses.kind === 'workflow' ? [uses.path] : [`${dir}action.yml`, `${dir}action.yaml`]
+  let file = null, text = null
+  for (const path of candidates) {
+    text = await source.file(name, path, commit)
+    if (text !== null) { file = path; break }
+  }
+  if (text === null) return { findings: [{ id: 'action-missing', severity: 'moderate' }], uses: [] }
+  const read = readWorkflow(uses.kind === 'workflow' ? 'workflow' : 'action', text)
+  if (read instanceof YamlError) return { findings: [{ id: 'unreadable', severity: 'moderate', file, detail: read.message }], uses: [] }
+  const findings = workflowFindings(read, { owner: name.split('/')[0], external: true }).map(finding => ({ ...finding, file }))
+  const dockerfile = read.dockerfile && `${dir}${read.dockerfile.path}`
+  const docker = dockerfile && !dockerfile.split('/').includes('..') ? await source.file(name, dockerfile, commit) : null
+  if (docker !== null) findings.push(...dockerfileFindings(docker).map(finding => ({ ...finding, file: dockerfile })))
+  const nested = workflowUses(read).map(each => each.kind === 'local' ? (each.self || each.job) && selfRef(each, info, commit) : each)
+  return { findings, uses: nested.filter(each => each?.kind === 'action' || each?.kind === 'workflow').map(usesKey) }
+}
+
+// A reference resolved (index.d.ts ResolvedAction); `owner`, whose workflow names it.
+export async function resolveAction(uses, source, { owner = null } = {}) {
+  const at = { key: usesKey(uses), kind: uses.kind, repo: uses.repo, path: uses.path, ref: uses.ref }
+  const { info, findings } = await repositoryOf(uses, source, owner)
+  if (!info) return { ...at, repository: null, commit: null, at: null, tags: [], findings, uses: [] }
+  const tags = await source.tags(info.fullName)
+  const ref = uses.pin === 'sha' ? await pinnedOf(uses, info, source, tags) : await refOf(uses, info, source, tags)
+  const code = ref.commit && !ref.findings.some(({ id }) => id === 'commit-missing') ? await codeOf(uses, info, ref.commit, source) : null
+  return { ...at, repository: { fullName: info.fullName, private: Boolean(info.private) }, commit: ref.commit, at: ref.at, tags: tagsOn(tags, ref.commit),
+    findings: [...findings, ...ref.findings, ...code?.findings ?? []], uses: code?.uses ?? [] }
+}
+
+// `source` with its answers kept, by what was asked, while held: a scan's.
+export function keptSource(source) {
+  const kept = new Map()
+  const keep = method => (...args) => {
+    const key = `${method}\0${JSON.stringify(args)}`
+    if (!kept.has(key)) kept.set(key, source[method](...args).catch(error => { kept.delete(key); throw error }))
+    return kept.get(key)
+  }
+  return Object.fromEntries(['repo', 'tags', 'tag', 'branch', 'branches', 'contains', 'file'].map(method => [method, keep(method)]))
+}

package/risk/actions/scripts/commands.js

@@ -0,0 +1,182 @@
+// What a `run:` script fetches and runs past what a lockfile or a digest pins,
+// command by command (shell.js), each with its line in the script from 0.
+import { NPM_INSTALLS, fetched, npmToolFinds, optionsOf, projectOf, valuesOf } from './packages.js'
+import { pathFrom, scriptCommands, scriptLines } from './shell.js'
+import { SHELLS as SHELL_NAMES } from '../../files/runs-code.js'
+import { readImage } from '../uses.js'
+
+// A program's file name, lowercase, past its directory and a Windows extension.
+const programOf = word => (word ?? '').split(/[/\\]/u).at(-1).toLowerCase().replace(/\.(?:cmd|exe|bat|ps1)$|@[\w.-]*$/u, '')
+
+const SHELLS = new RegExp(String.raw`^(?:${SHELL_NAMES}|python[\d.]*|node|perl|ruby|php|iex|invoke-expression)$`, 'u')
+const FETCHERS = /^(?:curl|wget|irm|iwr|invoke-restmethod|invoke-webrequest)$/u
+// A script fetched and run on one line: `<(curl …)`, `-c "$(curl …)"`, `iex (irm …)`.
+const FETCHED_AND_RUN = [
+  /\b(?:(?:ba|z|da|k)?sh|source|\.)\s+(?:-\S+\s+)*<\(\s*(?:curl|wget)\b/iu,
+  /\b(?:(?:ba|z|da|k)?sh|python[\d.]*|node|perl|ruby)\s+(?:-\S+\s+)*-c\s+["']?\$\(\s*(?:curl|wget)\b/iu,
+  /\b(?:iex|invoke-expression)\b[^|;]*\b(?:irm|iwr|invoke-restmethod|invoke-webrequest|downloadstring)\b/iu,
+]
+
+// The file curl or wget saves to (`-o f`, `-of`, `--output f`, curl's `-O`,
+// wget's by its URL), or PowerShell's (`-OutFile f`); else null.
+function savedTo(program, argv) {
+  for (let at = 1; at < argv.length; at++) {
+    const outFile = /^-outfile(?::(.+))?$/iu.exec(argv[at]), word = argv[at]
+    if (outFile && !/^(?:curl|wget)$/u.test(program)) return outFile[1] ?? argv[at + 1] ?? null
+    const attached = { curl: /^-[a-zA-Z]*o(.+)$/u, wget: /^-[a-zA-Z]*O(.+)$/u }[program]?.exec(word)
+    if (attached) return attached[1] === '-' ? null : attached[1]
+    if (program === 'curl' && (/^-[a-zA-Z]*o$/u.test(word) || word === '--output')) return argv[at + 1] ?? null
+    if (program === 'wget' && (/^-[a-zA-Z]*O$/u.test(word) || word === '--output-document')) return argv[at + 1] === '-' ? null : argv[at + 1] ?? null
+    const joined = /^(?:--output|--output-document)=(.+)$/u.exec(word)
+    if (joined) return joined[1]
+  }
+  const url = program === 'wget' || (program === 'curl' && argv.some(word => /^-[a-zA-Z]*O[a-zA-Z]*$/u.test(word) || word === '--remote-name')) ? argv.find(word => /^https?:\/\//u.test(word)) : null
+  return url ? URL.parse(url)?.pathname.split('/').at(-1) || null : null
+}
+
+// A path from the current directory, its `./` (PowerShell's `.\`, its `\`
+// read as an escape) taken off.
+const local = path => path.replace(/^\.\/?/u, '')
+
+// Whether a command runs `file`, as a program or a shell's script.
+function runsFile({ argv }, file) {
+  if (local(argv[0]) === local(file) || argv[0] === file) return true
+  return (SHELLS.test(programOf(argv[0])) || argv[0] === 'source' || argv[0] === '.') && argv.slice(1).some(word => local(word) === local(file))
+}
+
+const pythonPackage = text => {
+  if (/^(?:git\+|https?:|file:|\.{0,2}\/)/iu.test(text)) return { name: text, spec: null, exact: /@[\da-f]{40}(?:#|$)/u.test(text), registry: false }
+  const m = /^([\w.-]+)(?:\[[^\]]*\])?\s*(.*)$/u.exec(text)
+  return m && { name: m[1], spec: m[2] || null, exact: /^===?\s*[\w.!+-]+$/u.test(m[2]), registry: true }
+}
+
+// The packages pip installs by name, not a requirements file's or a path.
+const PIP_VALUED = /^(?:-r|--requirement|-c|--constraint|-e|--editable|-i|--index-url|--extra-index-url|-t|--target|--prefix|--root|-f|--find-links)$/u
+const pip = (tool, argv, from) => optionsOf(argv, from, PIP_VALUED).operands.filter(word => !/^\.{1,2}(?:\/|$)/u.test(word))
+  .flatMap(text => fetched(tool, pythonPackage(text), { ecosystem: 'pypi' }))
+// A package named `name@version`, as Go's, crates' and Deno's are.
+const atVersion = (text, exact) => {
+  const at = text.lastIndexOf('@')
+  const spec = at > 0 ? text.slice(at + 1) : null
+  return { name: at > 0 ? text.slice(0, at) : text, spec, exact: spec !== null && exact(spec), registry: true }
+}
+
+function python(program, argv) {
+  if (program === 'pip' || /^pip\d/u.test(program)) return argv[1] === 'install' ? pip(program, argv, 2) : []
+  if (/^python[\d.]*$/u.test(program) && argv[1] === '-m' && /^pip\d?$/u.test(argv[2] ?? '') && argv[3] === 'install') return pip(`${program} -m pip`, argv, 4)
+  if (program === 'uv' && argv[1] === 'pip' && argv[2] === 'install') return pip('uv pip', argv, 3)
+  if (program === 'uvx' || (program === 'uv' && argv[1] === 'tool' && /^(?:run|install)$/u.test(argv[2] ?? ''))) {
+    const options = optionsOf(argv, program === 'uvx' ? 1 : 3, /^--(?:from|python|with)$/u), [spec] = [...valuesOf(options, '--from'), ...options.operands]
+    return fetched(program === 'uvx' ? 'uvx' : `uv tool ${argv[2]}`, spec && pythonPackage(spec), { ecosystem: 'pypi' })
+  }
+  if (program === 'pipx' && /^(?:run|install)$/u.test(argv[1] ?? '')) {
+    const options = optionsOf(argv, 2, /^--(?:spec|python)$/u), [spec] = [...valuesOf(options, '--spec'), ...options.operands]
+    return fetched(`pipx ${argv[1]}`, spec && pythonPackage(spec), { ecosystem: 'pypi' })
+  }
+  return []
+}
+
+
+const EXACT_SEMVER = text => /^=?\d+\.\d+\.\d+(?:[-+][\w.-]+)?$/u.test(text)
+
+// `go install x@v y@v`, `go run x@v`, a version held to Go's checksum database.
+function go(argv) {
+  const { operands } = optionsOf(argv, 2, /^-(?:o|modfile|tags|ldflags|gcflags|C|exec)$/u)
+  return (argv[1] === 'run' ? operands.slice(0, 1) : operands).filter(target => target.includes('@'))
+    .flatMap(target => fetched(`go ${argv[1]}`, atVersion(target, spec => /^v\d+\.\d+\.\d+/u.test(spec)), { ecosystem: 'go' }))
+}
+
+// `cargo install`: each crate by its version, or a repository by its commit;
+// `locked` with `--locked`.
+function cargo(argv) {
+  if (argv.includes('--path')) return []
+  const options = optionsOf(argv, 2, /^--(?:version|git|branch|rev|tag|root|features|registry|index|bin|example|target|profile|jobs)$|^-[jF]$/u)
+  const [git = null] = valuesOf(options, '--git'), [version = null] = valuesOf(options, '--version'), [ref = null] = valuesOf(options, '--rev', '--tag', '--branch')
+  const specs = git ? [{ name: git, spec: ref, exact: /^[\da-f]{40}$/u.test(valuesOf(options, '--rev')[0] ?? ''), registry: false }] : options.operands.map(crate => atVersion(crate, EXACT_SEMVER))
+  return specs.flatMap(spec => fetched(`cargo ${argv[1]}`, { ...spec, spec: spec.spec ?? version, exact: spec.exact || (!git && EXACT_SEMVER(version ?? '')), locked: argv.includes('--locked') }, { ecosystem: 'crates' }))
+}
+
+// `gem install x [-v 1.2.3]`.
+function gem(argv) {
+  const options = optionsOf(argv, 2, /^(?:-v|--version|-i|--install-dir|-s|--source|-n|--bindir)$/u), [version = null] = valuesOf(options, '-v', '--version')
+  return options.operands.flatMap(name => fetched('gem install', { name, spec: version, exact: /^=?\s*\d+(?:\.\d+)+$/u.test(version ?? ''), registry: true }, { ecosystem: 'rubygems' }))
+}
+
+// `deno run|install|x` of a URL or a registry's package.
+function deno(argv) {
+  const target = argv.slice(2).find(word => /^(?:https?:\/\/|npm:|jsr:)/u.test(word))
+  if (!target) return []
+  return fetched(`deno ${argv[1]}`, /^(?:npm|jsr):/u.test(target) ? atVersion(target.replace(/^(?:npm|jsr):/u, ''), EXACT_SEMVER)
+    : { name: target, spec: null, exact: /@v?\d+\.\d+\.\d+/u.test(target), registry: false }, { ecosystem: 'deno' })
+}
+
+function others(program, argv) {
+  if (program === 'go' && /^(?:install|run)$/u.test(argv[1] ?? '')) return go(argv)
+  if (program === 'cargo' && /^(?:install|binstall)$/u.test(argv[1] ?? '')) return cargo(argv)
+  if (program === 'gem' && argv[1] === 'install') return gem(argv)
+  return program === 'deno' && /^(?:run|install|x|compile)$/u.test(argv[1] ?? '') ? deno(argv) : []
+}
+
+// What a command fetches or runs unpinned, but a script fetched and run.
+function commandFinds(command) {
+  const { argv } = command
+  const program = programOf(argv[0])
+  if (/^(?:docker|podman)$/u.test(program) && /^(?:run|pull|create)$/u.test(argv[1] ?? '')) {
+    const image = argv.slice(2).find((word, at, words) => !word.startsWith('-') && !/^(?:-[evpwulhm]|--(?:env|volume|publish|workdir|user|label|hostname|memory|name|network|entrypoint|platform|mount|env-file|cpus|add-host|cap-add|device|dns|gpus|ipc|pid|restart|runtime|pull|security-opt|shm-size|tmpfs|ulimit|volumes-from|log-driver))$/u.test(words[at - 1] ?? ''))
+    return image ? [{ kind: 'image', text: image, read: readImage(image) }] : []
+  }
+  if (program === 'git' && argv[1] === 'clone') return [{ kind: 'clone', url: argv.slice(2).find(word => /^(?:https?:|git@|git:|ssh:)/u.test(word)) ?? null }]
+  return [...npmToolFinds(program, argv), ...python(program, argv), ...others(program, argv)]
+}
+
+const INSTALLS = { npm: new RegExp(`^(?:ci|clean-install|ic|install-clean|${NPM_INSTALLS})$`, 'u'), pnpm: /^(?:i|install|add)$/u, bun: /^(?:i|install|add)$/u }
+// An install's options that leave the project's node_modules as they are.
+const NOT_LOCAL = /^(?:-g|--location=global|--(?:global|package-lock-only|lockfile-only|dry-run)(?:=true)?)$/u
+
+// A script's installs of a project's packages: each one's `order`, the
+// directory it installs into, by its `cd`s and the one it names (`into`, a
+// path from the step's, '' for it), and whether it leaves devDependencies out
+// (`prod`), by an option or NODE_ENV production (the step's `production`).
+export function installsOf(script, production = false) {
+  const found = []
+  let exported = production
+  for (const { argv, dir, env, order } of scriptCommands(script)) {
+    const program = programOf(argv[0])
+    if (program === 'export') for (const word of argv) if (word.startsWith('NODE_ENV=')) exported = word === 'NODE_ENV=production'
+    const options = optionsOf(argv, 1), [command] = options.operands
+    if (argv.some(word => NOT_LOCAL.test(word)) || !(program === 'yarn' ? command === undefined || command === 'install' : INSTALLS[program]?.test(command ?? ''))) continue
+    // npm installs what `--include` names whatever leaves it out.
+    const prod = !valuesOf(options, '--include').includes('dev') && (valuesOf(options, '--omit').includes('dev') || /^prod(?:uction)?$/u.test(valuesOf(options, '--only')[0] ?? '')
+      || argv.some(word => /^--prod(?:uction)?$/u.test(word)) || (env.NODE_ENV ?? (exported ? 'production' : '')) === 'production')
+    const project = projectOf(argv)
+    found.push({ order, into: project === null ? dir : pathFrom(dir, project), prod })
+  }
+  return found
+}
+
+// A script's line, as a finding names what it runs, cut short.
+const excerpt = text => { const trimmed = text.trim().replaceAll(/\s+/gu, ' '); return trimmed.length > 120 ? `${trimmed.slice(0, 119)}…` : trimmed }
+
+// Everything a script fetches and runs past a pin, in its order.
+export function scriptFinds(script) {
+  const found = []
+  const lines = new Map(scriptLines(script).map(({ text, line }) => [line, text]))
+  for (const [line, text] of lines) {
+    if (FETCHED_AND_RUN.some(pattern => pattern.test(text))) found.push({ kind: 'remote-script', line, command: excerpt(text) })
+  }
+  const saved = new Map()
+  for (const command of scriptCommands(script)) {
+    const program = programOf(command.argv[0])
+    if (FETCHERS.test(program) && command.pipedTo.some(each => SHELLS.test(programOf(each.argv[0])))) found.push({ kind: 'remote-script', line: command.line, command: excerpt(lines.get(command.line) ?? '') })
+    const file = FETCHERS.test(program) ? savedTo(program, command.argv) ?? command.out : null
+    if (file) saved.set(file, command.line)
+    for (const [name, at] of saved) {
+      if (FETCHERS.test(program) || !runsFile(command, name)) continue
+      found.push({ kind: 'remote-script', line: command.line, command: excerpt(lines.get(at) ?? '') })
+      saved.delete(name)
+    }
+    for (const each of commandFinds(command)) found.push({ ...each, line: command.line, order: command.order, dir: command.dir })
+  }
+  const told = new Set()
+  return found.filter(({ order: _order, ...each }) => { const key = JSON.stringify(each); return !told.has(key) && told.add(key) }).toSorted((a, b) => a.line - b.line)
+}

package/risk/actions/scripts/grade.js

@@ -0,0 +1,113 @@
+// What a `run:` script fetches and runs (commands.js), graded (README.md).
+import { HOST_TAGS, npmExfiltration, npmHostTags } from '../../files/hosts.js'
+import { lineOf } from '../../files/script.js'
+import { installsOf, scriptFinds } from './commands.js'
+
+// The events a workflow runs on with its secrets for anyone's pull request.
+const PRIVILEGED_TRIGGERS = new Set(['pull_request_target', 'workflow_run', 'issue_comment', 'issues', 'discussion', 'discussion_comment',
+  'pull_request_review', 'pull_request_review_comment', 'fork', 'watch'])
+
+// The expressions anyone can write: a title, a body, a branch's name, a
+// commit's message, a fork's description.
+const INDEX = String.raw`(?:\s*\[[^\]]*\]|\.\*)`
+const AUTHOR = String.raw`(?:author|committer)\.(?:email|name)`
+const UNTRUSTED = new RegExp(String.raw`\bgithub\s*\.\s*(?:head_ref|event\s*\.\s*(?:`
+  + [String.raw`issue\.(?:title|body)`,
+    String.raw`pull_request\.(?:title|body|head\.(?:ref|label|repo\.(?:default_branch|description|homepage)))`,
+    String.raw`(?:comment|review|review_comment)\.body`,
+    String.raw`pages${INDEX}\.page_name`,
+    String.raw`commits${INDEX}\.(?:message|${AUTHOR})`,
+    String.raw`head_commit\.(?:message|${AUTHOR})`,
+    String.raw`workflow_run\.(?:head_branch|display_title|head_commit\.(?:message|${AUTHOR})|head_repository\.(?:description|homepage|default_branch)|pull_requests${INDEX}\.head\.ref)`,
+    String.raw`discussion\.(?:title|body)`].join('|')
+  + String.raw`))(?![\w-])`, 'gu')
+
+// An expression with its index syntax's properties (`github['event']`) as
+// dereferences, as GitHub reads either.
+export const dotted = text => text.replaceAll(/\[\s*'([\w-]+)'\s*\]/gu, '.$1')
+
+// Each expression anyone can write in a script's `text`, a finding with
+// the `index` its `${{` is at: red where the workflow runs with its secrets
+// for anyone (`triggers`), else orange.
+export function scriptInjections(text, triggers) {
+  if (typeof text !== 'string' || !text.includes('${{')) return []
+  const severity = triggers.some(event => PRIVILEGED_TRIGGERS.has(event)) ? 'critical' : 'high'
+  return [...text.matchAll(/\$\{\{([\s\S]*?)\}\}/gu)].flatMap(({ 1: inner, index }) =>
+    [...dotted(inner).matchAll(UNTRUSTED)].map(({ 0: expression }) => ({ id: 'script-injection', severity, expression: expression.replaceAll(/\s+/gu, ''), index })))
+}
+
+// A ref or a repository naming a pull request's own code, as
+// `actions/checkout` checks it out: its head's commit or branch (a
+// `workflow_run`'s pull requests' too), or the fork's repository, whose
+// default branch it is then.
+const PULL_HEAD = new RegExp(String.raw`\bgithub\.(?:head_ref|event\.(?:number|pull_request\.(?:number|merge_commit_sha|head\.(?:sha|ref|repo\.(?:full_name|owner\.login)))|workflow_run\.(?:head_sha|head_branch|head_commit\.id|pull_requests\[[^\]]*\]\.head\.(?:sha|ref)|head_repository\.(?:full_name|owner\.login))))\b`
+  .replaceAll('\\.', String.raw`\s*\.\s*`) + String.raw`|refs\/pull\/`, 'u')
+export const namesPullHead = text => typeof text === 'string' && PULL_HEAD.test(dotted(text))
+
+// Programs whose package is named otherwise: `npx tsc` runs typescript's.
+const KNOWN_BINS = new Map([['tsc', 'typescript'], ['tsserver', 'typescript'], ['ng', '@angular/cli'], ['nest', '@nestjs/cli'],
+  ['changeset', '@changesets/cli'], ['biome', '@biomejs/biome'], ['svelte-kit', '@sveltejs/kit'], ['api-extractor', '@microsoft/api-extractor'],
+  ['commitlint', '@commitlint/cli'], ['attw', '@arethetypeswrong/cli'], ['ncu', 'npm-check-updates'], ['vue-cli-service', '@vue/cli-service'],
+  ['firebase', 'firebase-tools'], ['netlify', 'netlify-cli'], ['cdk', 'aws-cdk'], ['sls', 'serverless'], ['playwright', '@playwright/test'],
+  ['eas', 'eas-cli'], ['expo', 'expo'], ['vsce', '@vscode/vsce'], ['wdio', '@wdio/cli'], ['lhci', '@lhci/cli'], ['tsx', 'tsx'], ['webpack', 'webpack-cli']])
+const PACKAGING = new Set(['pip', 'setuptools', 'wheel'])
+
+// Whether `locked` (a Set) has what npx runs by `name`, or the package giving it.
+export const lockedName = (locked, name) => locked.has(name) || (KNOWN_BINS.has(name) && locked.has(KNOWN_BINS.get(name)))
+
+// How severe fetching a package is; null for none.
+function packageSeverity(found, { locked, installed, external }) {
+  const runsOwn = found.ecosystem === 'npm' && found.localFirst && found.registry && (found.spec === null || found.exact)
+  if (runsOwn && (external ? installed : locked && installed)) return null
+  if (found.ecosystem === 'go' && found.exact) return null
+  if (found.ecosystem === 'crates' && found.exact && found.locked) return null
+  if (found.ecosystem === 'pypi' && PACKAGING.has(found.name.toLowerCase())) return 'notice'
+  // A version a variable names may be one, set elsewhere in the workflow.
+  return found.exact || found.spec?.includes('$') ? 'moderate' : 'high'
+}
+
+// The findings of one find of a script, `locked` what a lockfile says of it.
+function graded(found, context, locked) {
+  if (found.kind === 'package') {
+    const { tool, name, spec, localFirst } = found, installed = context.installed
+    const severity = packageSeverity(found, { locked, installed, external: context.external })
+    return severity ? [{ id: 'fetched-package', severity, tool, name, spec, ...localFirst ? { localFirst, locked, installed } : {} }] : []
+  }
+  if (found.kind === 'unlocked-install') return [{ id: 'unlocked-install', severity: /^(?:yarn|bun)\b/u.test(found.tool) ? 'low' : 'moderate', tool: found.tool }]
+  if (found.kind === 'remote-script') return [{ id: 'remote-script', severity: 'high', command: found.command }]
+  if (found.kind === 'image') return found.read?.digest ? [] : [imageFinding(found.text, found.read)]
+  return found.kind === 'clone' ? [{ id: 'clone', severity: 'low', url: found.url }] : []
+}
+
+// An image run by a tag: orange with none or `latest`, else yellow.
+export const imageFinding = (text, read) => ({ id: 'unpinned-image', severity: !read || read.tag === null || read.tag === 'latest' ? 'high' : 'moderate', image: text })
+
+// The file's line a script's line is on: a `|` block scalar's own, else `run:`'s.
+const fileLine = (run, line) => run.start === null ? run.line : run.start + line
+
+// Whether `dir` is `directory` or above it, as node finds a package there;
+// null for anywhere.
+export const within = (dir, directory) => dir === null || dir === '' || directory === dir || directory.startsWith(`${dir}/`)
+
+// Every finding of a `run` script (workflow.js runOf); `context`'s
+// `locked(name, dir)` whether a lockfile there locks it (`dev` where
+// devDependencies alone need it), `installed(dev, dir)` whether an install
+// ran before that installs such a package there, `dir` a path from the
+// step's directory, as a `cd` moves to.
+export function scriptFindings(run, context) {
+  const findings = []
+  // An install earlier in the script counts as one in a step before.
+  const installs = installsOf(run.script, run.production)
+  for (const found of scriptFinds(run.script)) {
+    const dir = found.dir ?? ''
+    const locked = found.kind === 'package' && found.ecosystem === 'npm' && found.localFirst && context.locked(found.exact ? `${found.name}@${found.spec.replace(/^[v=]/u, '')}` : found.name, dir)
+    const before = context.installed(locked === 'dev', dir) || installs.some(({ order, into, prod }) => order < found.order && within(into, dir) && !(prod && locked === 'dev'))
+    for (const finding of graded(found, { ...context, installed: before }, Boolean(locked))) findings.push({ ...finding, line: fileLine(run, found.line) })
+  }
+  for (const [tag, services] of npmHostTags(npmExfiltration('run.sh', run.script, true))) {
+    findings.push({ id: 'hosts', severity: HOST_TAGS.get(tag), tag, services: [...services.keys()], line: fileLine(run, Math.min(...[...services.values()].flat()) - 1) })
+  }
+  const line = lineOf(run.script)
+  for (const { index, ...finding } of scriptInjections(run.script, context.triggers)) findings.push({ ...finding, line: fileLine(run, line(index) - 1) })
+  return findings
+}

package/risk/actions/scripts/packages.js

@@ -0,0 +1,123 @@
+// What a command of npm's tools fetches and runs past what a lockfile locks
+// (commands.js), npx's and its kin's the project's own where installed
+// (`localFirst`), and an install that resolves anew (`unlocked`).
+import { isExactVersion } from '@preventive/upstream/semver.js'
+
+// A package spec's name and spec, `exact` for a version, `registry: false` for
+// a URL, a path, git or a GitHub shorthand.
+export function npmSpec(text) {
+  if (/^(?:\.{0,2}\/|~|[a-z][\w+.-]*:|[\w.-]+\/[\w.-]+(?:#.*)?$)/iu.test(text) && !/^@[\w.-]+\//u.test(text)) {
+    return { name: text, spec: null, exact: false, registry: false }
+  }
+  const at = text.indexOf('@', text.startsWith('@') ? 1 : 0)
+  const name = at === -1 ? text : text.slice(0, at)
+  const spec = at === -1 ? null : text.slice(at + 1)
+  if (!/^(?:@[\w.-]+\/)?[\w.-]+$/u.test(name)) return null
+  return { name, spec, exact: spec !== null && isExactVersion(spec.replace(/^[v=]/u, '')), registry: true }
+}
+
+// A package a tool fetches, as a script's find; none for none.
+export const fetched = (tool, spec, { ecosystem = 'npm', localFirst = false, ...more } = {}) => spec ? [{ kind: 'package', tool, ecosystem, localFirst, ...more, ...spec }] : []
+
+// What `npm create x` runs: `create-x`, `@s/create` for `@s`, `@s/create-x`.
+function createPackage(text) {
+  const scoped = /^(@[\w.-]+)(?:@(.+))?$/u.exec(text)
+  if (scoped) return npmSpec(`${scoped[1]}/create${scoped[2] ? `@${scoped[2]}` : ''}`)
+  const spec = npmSpec(text)
+  if (!spec?.registry) return spec
+  const [scope, name] = spec.name.startsWith('@') ? spec.name.split('/') : [null, spec.name]
+  const named = scope ? (name ? `${scope}/create-${name}` : `${scope}/create`) : `create-${name}`
+  return { ...spec, name: named }
+}
+
+// Options of npm's tools that take a value.
+const VALUED = /^(?:-[pcwC]|--(?:package|call|cache|userconfig|registry|workspace|prefix|filter|dir|global-dir|store-dir|loglevel|cwd|spec|location|include|omit|only))$/u
+const GLOBAL = /^(?:-g|--global|--location=global)$/u
+
+// A command's words past `from`: those not options (`operands`), all past
+// `--` too, and each option's values (`values`), of `--x=v`, and `--x v` for
+// one `valued` names.
+export function optionsOf(argv, from, valued = VALUED) {
+  const operands = [], values = new Map()
+  for (let at = from; at < argv.length; at++) {
+    const [, name, joined] = /^(--[\w-]+)=(.*)$/u.exec(argv[at]) ?? [], word = argv[at]
+    if (word === '--') return { operands: [...operands, ...argv.slice(at + 1)], values }
+    if (name || valued.test(word)) values.set(name ?? word, [...values.get(name ?? word) ?? [], joined ?? argv[++at] ?? ''])
+    else if (!word.startsWith('-')) operands.push(word)
+  }
+  return { operands, values }
+}
+const positional = (argv, from) => optionsOf(argv, from).operands
+// The values of `names`' options, in their order.
+export const valuesOf = ({ values }, ...names) => names.flatMap(name => values.get(name) ?? [])
+
+// What an exec (npx, `npm exec`, bunx, dlx) fetches: its `--package`s, else
+// its command's; none with `--no`, `--offline`, or a command line (`-c`).
+function execPackages(tool, argv, from, localFirst) {
+  if (argv.some(word => /^(?:--no|--no-install|--offline)$/u.test(word))) return []
+  const named = valuesOf(optionsOf(argv, 1), '-p', '--package').filter(Boolean)
+  if (named.length === 0 && argv.some(word => word === '-c' || word === '--call')) return []
+  return (named.length > 0 ? named : positional(argv, from).slice(0, 1)).flatMap(text => fetched(tool, npmSpec(text), { localFirst }))
+}
+
+// The directory an install names for its project (`--prefix`, `-C`, `--dir`,
+// `--cwd`); null for the one it runs in, `.` too.
+export function projectOf(argv) {
+  const [dir = null] = valuesOf(optionsOf(argv, 1), '-C', '--prefix', '--dir', '--cwd')
+  return dir === null || /^\.\/?$/u.test(dir) ? null : dir
+}
+
+const installs = (tool, words) => words.flatMap(text => fetched(tool, npmSpec(text)))
+// npm's install command and its aliases (commands.js installsOf).
+export const NPM_INSTALLS = 'i|in|ins|inst|insta|instal|install|isnt|isnta|isntal|isntall|add|it|install-test'
+const created = (tool, text) => text ? fetched(tool, createPackage(text)) : []
+const unlocked = tool => [{ kind: 'unlocked-install', tool }]
+const isInstalled = word => /^(?:\.{1,2}(?:\/|$)|file:|link:|workspace:)/u.test(word)
+
+function npm(argv) {
+  const [command = '', ...rest] = positional(argv, 1)
+  if (command === 'exec' || command === 'x') return execPackages(`npm ${command}`, argv, argv.indexOf(command) + 1, true)
+  if (/^(?:create|init|innit)$/u.test(command)) return created(`npm ${command}`, rest[0])
+  if (new RegExp(`^(?:${NPM_INSTALLS})$`, 'u').test(command)) {
+    const named = rest.filter(word => !isInstalled(word))
+    if (argv.some(word => GLOBAL.test(word))) return installs(`npm ${command} -g`, named)
+    return named.length > 0 ? installs(`npm ${command}`, named) : unlocked(`npm ${command}`)
+  }
+  return /^(?:update|up|upgrade|udpate)$/u.test(command) ? unlocked(`npm ${command}`) : []
+}
+
+// pnpm's and bun's, by the word each runs a package with (`exec`), what an
+// install resolving anew is told by (`anew`, null for none), and its updates.
+const pnpmLike = (program, exec, localFirst, anew, updates) => argv => {
+  const [command = '', ...rest] = positional(argv, 1)
+  if (command === exec) return execPackages(`${program} ${exec}`, argv, argv.indexOf(exec) + 1, localFirst)
+  if (command === 'create') return created(`${program} create`, rest[0])
+  const global = argv.some(word => GLOBAL.test(word)), installing = command === 'install' || command === 'i'
+  if (command === 'add' || (installing && rest.length > 0)) return installs(`${program} ${command}${global ? ' -g' : ''}`, rest.filter(word => !isInstalled(word)))
+  if (installing && anew(argv) !== null) return unlocked(`${program} ${command}${anew(argv)}`)
+  return updates.test(command) ? unlocked(`${program} ${command}`) : []
+}
+const pnpm = pnpmLike('pnpm', 'dlx', false, argv => argv.includes('--no-frozen-lockfile') ? ' --no-frozen-lockfile' : null, /^(?:update|up|upgrade)$/u)
+const bun = pnpmLike('bun', 'x', true, argv => argv.some(word => word === '--frozen-lockfile' || word === '--ci') ? null : '', /^update$/u)
+
+function yarn(argv) {
+  const [command = '', ...rest] = positional(argv, 1)
+  if (command === 'dlx') return execPackages('yarn dlx', argv, argv.indexOf('dlx') + 1, false)
+  if (command === 'create') return created('yarn create', rest[0])
+  if (command === 'global' && rest[0] === 'add') return installs('yarn global add', rest.slice(1))
+  if (command === 'add') return installs('yarn add', rest.filter(word => !isInstalled(word)))
+  const frozen = argv.some(word => /^--(?:frozen-lockfile|immutable)$/u.test(word))
+  if ((command === '' || command === 'install') && !frozen) return unlocked(command ? 'yarn install' : 'yarn')
+  return /^(?:upgrade|up)$/u.test(command) ? unlocked(`yarn ${command}`) : []
+}
+
+// The tools that run a package (whether one installed first), and the rest.
+const EXECS = new Map([['npx', true], ['bunx', true], ['pnpx', false]])
+const TOOLS = new Map([['npm', npm], ['pnpm', pnpm], ['yarn', yarn], ['bun', bun]])
+
+// What a command of npm's tools fetches, by its program's name: packages and
+// installs resolving anew.
+export function npmToolFinds(program, argv) {
+  if (EXECS.has(program)) return execPackages(program, argv, 1, EXECS.get(program))
+  return TOOLS.get(program)?.(argv) ?? []
+}