@secureci/cli 0.0.0-stage → 0.1.0

package/dist/config.js

@@ -0,0 +1,190 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONFIG_KEYS = exports.DEFAULT_CONFIG = void 0;
+exports.getConfigFilePath = getConfigFilePath;
+exports.loadConfig = loadConfig;
+exports.saveConfig = saveConfig;
+exports.getDefaultContainerRuntime = getDefaultContainerRuntime;
+exports.isValidConfigKey = isValidConfigKey;
+exports.getConfigValue = getConfigValue;
+exports.setConfigValue = setConfigValue;
+exports.unsetConfigValue = unsetConfigValue;
+exports.parseConfigValue = parseConfigValue;
+exports.resolveNetworkDisabled = resolveNetworkDisabled;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const YAML = __importStar(require("yaml"));
+/** Built-in defaults, used when a key is absent from the config file. */
+exports.DEFAULT_CONFIG = {
+    'container-runtime': 'docker'
+};
+const CONTAINER_RUNTIME_VALUES = [
+    'auto',
+    'docker',
+    'podman',
+    'containerd',
+    'host'
+];
+function getHomeDir() {
+    return process.env.HOME || process.env.USERPROFILE || '/tmp';
+}
+function getConfigDir() {
+    return path.join(getHomeDir(), '.secureci');
+}
+function getConfigFilePath() {
+    return path.join(getConfigDir(), 'config.yml');
+}
+/** Load the global config file, returning `{}` if absent or unreadable. */
+function loadConfig() {
+    const configFile = getConfigFilePath();
+    if (!fs.existsSync(configFile))
+        return {};
+    try {
+        const raw = fs.readFileSync(configFile, 'utf-8');
+        const parsed = YAML.parse(raw);
+        return parsed && typeof parsed === 'object' ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+/** Persist the given config object to the global config file. */
+function saveConfig(config) {
+    const configDir = getConfigDir();
+    if (!fs.existsSync(configDir)) {
+        fs.mkdirSync(configDir, { recursive: true });
+    }
+    fs.writeFileSync(getConfigFilePath(), YAML.stringify(config));
+}
+/** Resolve the effective value for `container-runtime`: config, else built-in default. */
+function getDefaultContainerRuntime(config = loadConfig()) {
+    const value = config['container-runtime'];
+    if (value === undefined)
+        return exports.DEFAULT_CONFIG['container-runtime'];
+    if (!CONTAINER_RUNTIME_VALUES.includes(value)) {
+        const hint = String(value) === 'none' ? ' ("none" was renamed to "host")' : '';
+        throw new Error(`Invalid container-runtime "${value}" in ${getConfigFilePath()}${hint}. Must be one of: ${CONTAINER_RUNTIME_VALUES.join(', ')}`);
+    }
+    return value;
+}
+exports.CONFIG_KEYS = [
+    'container-runtime',
+    'container-image',
+    'container-timeout',
+    'container-memory',
+    'allow-network'
+];
+/** `runner-images.<label>`: one entry of the runs-on -> image mapping. */
+const RUNNER_IMAGE_KEY = /^runner-images\.(.+)$/;
+/** A plain key, or `runner-images.<label>`. */
+function isValidConfigKey(key) {
+    return (exports.CONFIG_KEYS.includes(key) ||
+        RUNNER_IMAGE_KEY.test(key));
+}
+/** Read a key (see isValidConfigKey) from a config object. */
+function getConfigValue(config, key) {
+    const label = key.match(RUNNER_IMAGE_KEY)?.[1];
+    if (label !== undefined)
+        return config['runner-images']?.[label];
+    return config[key];
+}
+/** Parse `rawValue` for `key` and set it on `config`. Throws if invalid. */
+function setConfigValue(config, key, rawValue) {
+    const label = key.match(RUNNER_IMAGE_KEY)?.[1];
+    if (label !== undefined) {
+        config['runner-images'] = { ...config['runner-images'], [label]: rawValue };
+        return rawValue;
+    }
+    const value = parseConfigValue(key, rawValue);
+    config[key] = value;
+    return value;
+}
+/** Remove `key` from `config`, dropping an emptied runner-images map. */
+function unsetConfigValue(config, key) {
+    const label = key.match(RUNNER_IMAGE_KEY)?.[1];
+    if (label === undefined) {
+        delete config[key];
+        return;
+    }
+    const images = { ...config['runner-images'] };
+    delete images[label];
+    if (Object.keys(images).length > 0)
+        config['runner-images'] = images;
+    else
+        delete config['runner-images'];
+}
+/**
+ * Parse and validate a raw CLI string value for the given config key,
+ * returning the typed value to store. Throws on invalid input.
+ */
+function parseConfigValue(key, rawValue) {
+    switch (key) {
+        case 'container-runtime':
+            if (!CONTAINER_RUNTIME_VALUES.includes(rawValue)) {
+                throw new Error(`Invalid value "${rawValue}" for container-runtime. Must be one of: ${CONTAINER_RUNTIME_VALUES.join(', ')}`);
+            }
+            return rawValue;
+        case 'container-timeout': {
+            const num = Number(rawValue);
+            if (!Number.isFinite(num) || num < 0) {
+                throw new Error(`Invalid value "${rawValue}" for container-timeout. Must be a non-negative number.`);
+            }
+            return num;
+        }
+        case 'allow-network':
+            if (rawValue !== 'true' && rawValue !== 'false') {
+                throw new Error(`Invalid value "${rawValue}" for allow-network. Must be "true" or "false".`);
+            }
+            return rawValue === 'true';
+        case 'container-image':
+        case 'container-memory':
+            return rawValue;
+    }
+}
+/**
+ * Whether container networking should be disabled. Networking is on by
+ * default (matching GitHub-hosted runners); `--no-network` turns it off and
+ * wins over everything, then `--allow-network`, then `allow-network` in the
+ * config file.
+ */
+function resolveNetworkDisabled(flags, config = loadConfig()) {
+    if (flags.network === false)
+        return true;
+    if (flags.allowNetwork === true)
+        return false;
+    return config['allow-network'] === false;
+}
+//# sourceMappingURL=config.js.map

package/dist/index.js

@@ -0,0 +1,23 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./types"), exports);
+__exportStar(require("./parser/workflow-parser"), exports);
+__exportStar(require("./parser/validator"), exports);
+__exportStar(require("./runner/dry-run"), exports);
+__exportStar(require("./runner/executor"), exports);
+__exportStar(require("./utils/logger"), exports);
+//# sourceMappingURL=index.js.map

package/dist/init.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderInitWorkflow = renderInitWorkflow;
+/**
+ * Render a ready-to-commit `.github/workflows/secureci.yml` that runs SecureCI
+ * on every pull request via the published `secure-ci/cli` action.
+ *
+ * The output is deterministic for a given set of options, so it can be
+ * regenerated and diffed. With uploads on (the default) the workflow asks for
+ * `security-events: write` and lets the action upload SARIF; with uploads off
+ * it keeps `contents: read` only and passes `upload-sarif: false`.
+ */
+function renderInitWorkflow(options) {
+    const upload = options.upload !== false;
+    const contract = options.contract?.trim();
+    const lines = [
+        '# Validate GitHub Actions workflows with SecureCI on every pull request.',
+        '# Generated by `secureci init`; edit freely.',
+        'name: SecureCI',
+        '',
+        'on:',
+        '  - pull_request',
+        '',
+        'permissions:',
+        '  contents: read'
+    ];
+    if (upload)
+        lines.push('  security-events: write');
+    lines.push('', 'jobs:', '  secureci:', '    runs-on: ubuntu-latest', '    steps:', '      - uses: actions/checkout@v4', '      - uses: secure-ci/cli@v1');
+    const withLines = [];
+    if (contract)
+        withLines.push(`          contract: ${yamlScalar(contract)}`);
+    if (!upload)
+        withLines.push('          upload-sarif: false');
+    if (withLines.length > 0) {
+        lines.push('        with:', ...withLines);
+    }
+    lines.push('');
+    return lines.join('\n');
+}
+/** Quote a scalar only when YAML would otherwise misread it. */
+function yamlScalar(value) {
+    return /^[A-Za-z0-9._/@-]+$/.test(value) ? value : JSON.stringify(value);
+}
+//# sourceMappingURL=init.js.map

package/dist/inventory.js

@@ -0,0 +1,212 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectReferences = collectReferences;
+exports.buildInventory = buildInventory;
+exports.diffLock = diffLock;
+exports.lockEntries = lockEntries;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const workflow_parser_1 = require("./parser/workflow-parser");
+const repository_1 = require("./utils/repository");
+const FULL_SHA = /^[0-9a-f]{40}$/i;
+const MAX_DEPTH = 10;
+function classify(uses, kind) {
+    const base = { uses, kind, pinned: false, path: '' };
+    if (uses.startsWith('docker://')) {
+        return { ...base, kind: 'docker' };
+    }
+    if (uses.startsWith('./') || uses.startsWith('../')) {
+        return { ...base, kind: 'local' };
+    }
+    const at = uses.lastIndexOf('@');
+    const ref = at === -1 ? undefined : uses.slice(at + 1);
+    const name = at === -1 ? uses : uses.slice(0, at);
+    const parts = name.split('/');
+    return {
+        ...base,
+        kind,
+        owner: parts[0],
+        repo: parts[1],
+        subpath: parts.length > 2 ? parts.slice(2).join('/') : undefined,
+        ref,
+        pinned: !!ref && FULL_SHA.test(ref)
+    };
+}
+/**
+ * Every `uses:` reference in a workflow, recursing into local composite
+ * actions (`./path`) and local reusable workflows (`jobs.<id>.uses: ./x.yml`)
+ * so wrapped references are still listed. Remote references are listed but
+ * not followed. Order is the walk order; each carries its call path.
+ */
+function collectReferences(parsed) {
+    const root = (0, repository_1.repositoryRoot)(parsed.path);
+    const refs = [];
+    const resolveLocal = (uses, names) => {
+        const target = path.resolve(root, uses);
+        for (const candidate of [
+            target,
+            ...names.map((n) => path.join(target, n))
+        ]) {
+            if (fs.existsSync(candidate) && fs.statSync(candidate).isFile()) {
+                return candidate;
+            }
+        }
+        return null;
+    };
+    const isLocal = (u) => u.startsWith('./') || u.startsWith('../');
+    const addStep = (step, at, stack) => {
+        if (!step.uses)
+            return;
+        const ref = classify(step.uses, 'action');
+        refs.push({ ...ref, path: at });
+        if (!isLocal(step.uses))
+            return;
+        const file = resolveLocal(step.uses, ['action.yml', 'action.yaml']);
+        if (!file || stack.includes(file) || stack.length >= MAX_DEPTH)
+            return;
+        let parsedAction;
+        try {
+            parsedAction = (0, workflow_parser_1.parseFile)(file);
+        }
+        catch {
+            return;
+        }
+        if (parsedAction.type === 'action' &&
+            parsedAction.file.runs.using === 'composite') {
+            (parsedAction.file.runs.steps ?? []).forEach((s, i) => addStep(s, `${at} > ${step.uses} > steps[${i}]`, [...stack, file]));
+        }
+    };
+    const addWorkflow = (workflow, at, stack) => {
+        for (const [jobId, job] of Object.entries(workflow.jobs ?? {})) {
+            const jobPath = `${at}jobs.${jobId}`;
+            if (job.uses) {
+                const ref = classify(job.uses, 'reusable-workflow');
+                refs.push({ ...ref, path: jobPath });
+                if (!isLocal(job.uses))
+                    continue;
+                const file = resolveLocal(job.uses, []);
+                if (!file || stack.includes(file) || stack.length >= MAX_DEPTH)
+                    continue;
+                try {
+                    const called = (0, workflow_parser_1.parseFile)(file);
+                    if (called.type === 'workflow') {
+                        addWorkflow(called.file, `${jobPath} > ${job.uses} > `, [
+                            ...stack,
+                            file
+                        ]);
+                    }
+                }
+                catch {
+                    // Unparseable reusable workflow: skip.
+                }
+                continue;
+            }
+            (job.steps ?? []).forEach((step, i) => addStep(step, `${jobPath}.steps[${i}]`, stack));
+        }
+    };
+    addWorkflow(parsed.file, '', [path.resolve(parsed.path)]);
+    return refs;
+}
+/**
+ * The inventory of a workflow: every reference, plus the distinct remote
+ * actions resolved to commit SHAs (an already-pinned ref resolves to
+ * itself; otherwise `resolveSha` is consulted).
+ */
+async function buildInventory(parsed, resolveSha) {
+    const references = collectReferences(parsed);
+    const remote = references.filter((r) => r.kind === 'action' || r.kind === 'reusable-workflow');
+    const byUses = new Map();
+    for (const ref of remote) {
+        if (!ref.owner || !ref.repo)
+            continue;
+        let action = byUses.get(ref.uses);
+        if (!action) {
+            action = {
+                uses: ref.uses,
+                owner: ref.owner,
+                repo: ref.repo,
+                subpath: ref.subpath,
+                ref: ref.ref,
+                pinned: ref.pinned,
+                resolvedSha: ref.ref && FULL_SHA.test(ref.ref) ? ref.ref.toLowerCase() : undefined,
+                paths: []
+            };
+            byUses.set(ref.uses, action);
+        }
+        action.paths.push(ref.path);
+    }
+    if (resolveSha) {
+        for (const action of byUses.values()) {
+            if (!action.resolvedSha) {
+                action.resolvedSha = await resolveSha(action.uses);
+            }
+        }
+    }
+    return {
+        workflow: parsed.path,
+        actions: [...byUses.values()],
+        references
+    };
+}
+/** Compare current `uses -> sha` against a lockfile's recorded commits. */
+function diffLock(current, lock) {
+    const drifted = [];
+    const added = [];
+    for (const [uses, sha] of Object.entries(current)) {
+        const known = lock.actions[uses];
+        if (known === undefined)
+            added.push(uses);
+        else if (known !== sha)
+            drifted.push({ uses, from: known, to: sha });
+    }
+    const removed = Object.keys(lock.actions).filter((uses) => !(uses in current));
+    return {
+        changed: drifted.length > 0 || added.length > 0 || removed.length > 0,
+        drifted,
+        added: added.sort(),
+        removed: removed.sort()
+    };
+}
+/** The `uses -> resolvedSha` map an inventory contributes to a lockfile. */
+function lockEntries(inv) {
+    const entries = {};
+    for (const action of inv.actions) {
+        if (action.resolvedSha)
+            entries[action.uses] = action.resolvedSha;
+    }
+    return entries;
+}
+//# sourceMappingURL=inventory.js.map

package/dist/parser/pipeline-contract-parser.js

@@ -0,0 +1,131 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parsePipelineContract = parsePipelineContract;
+const fs = __importStar(require("fs"));
+const YAML = __importStar(require("yaml"));
+/**
+ * Parse a pipeline contract file (`secureci validate --contract <file>`).
+ *
+ * Shape:
+ * ```yaml
+ * ordering: relative   # or "strict" (default: relative)
+ * required:
+ *   - uses: org/security-scan
+ *     min-version: v1.2.0
+ *   - uses: org/deploy
+ * forbidden:
+ *   - uses: org/legacy-deploy
+ * ```
+ */
+function parsePipelineContract(filePath) {
+    if (!fs.existsSync(filePath)) {
+        throw new Error(`Contract file not found: ${filePath}`);
+    }
+    const content = fs.readFileSync(filePath, 'utf-8');
+    let parsed;
+    try {
+        parsed = YAML.parse(content);
+    }
+    catch (error) {
+        throw new Error(`Failed to parse contract file: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+    if (parsed === null || parsed === undefined) {
+        return {};
+    }
+    if (typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('Contract file must be a YAML mapping with optional "ordering", "required", and "forbidden" sections');
+    }
+    const spec = parsed;
+    if (spec.ordering !== undefined &&
+        spec.ordering !== 'relative' &&
+        spec.ordering !== 'strict') {
+        throw new Error(`Contract "ordering" must be "relative" or "strict", got "${String(spec.ordering)}"`);
+    }
+    const result = {};
+    if (spec.ordering)
+        result.ordering = spec.ordering;
+    if (spec.required !== undefined) {
+        result.required = parseEntryList(spec.required, 'required');
+    }
+    if (spec.forbidden !== undefined) {
+        result.forbidden = parseEntryList(spec.forbidden, 'forbidden');
+    }
+    if (spec.pins !== undefined) {
+        if (typeof spec.pins !== 'object' || spec.pins === null) {
+            throw new Error('Contract "pins" must be a mapping');
+        }
+        const pins = spec.pins;
+        result.pins = {};
+        if (pins.required !== undefined) {
+            result.pins.required = pins.required === true;
+        }
+        if (pins.allow !== undefined) {
+            result.pins.allow = parseStringList(pins.allow, 'pins.allow');
+        }
+    }
+    if (spec['allowed-owners'] !== undefined) {
+        result.allowedOwners = parseStringList(spec['allowed-owners'], 'allowed-owners');
+    }
+    return result;
+}
+function parseStringList(value, section) {
+    if (!Array.isArray(value) || value.some((v) => typeof v !== 'string')) {
+        throw new Error(`Contract "${section}" must be a list of strings`);
+    }
+    return value;
+}
+function parseEntryList(value, section) {
+    if (!Array.isArray(value)) {
+        throw new Error(`Contract "${section}" must be a list of entries`);
+    }
+    return value.map((entry, idx) => {
+        if (typeof entry !== 'object' ||
+            entry === null ||
+            typeof entry.uses !== 'string') {
+            throw new Error(`Contract "${section}[${idx}]" must be a mapping with a string "uses" field`);
+        }
+        const e = entry;
+        const parsedEntry = { uses: e.uses };
+        if (e['min-version'] !== undefined) {
+            parsedEntry['min-version'] = String(e['min-version']);
+        }
+        if (e.version !== undefined) {
+            parsedEntry.version = String(e.version);
+        }
+        return parsedEntry;
+    });
+}
+//# sourceMappingURL=pipeline-contract-parser.js.map